[lkml]   [1998]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Virtual Machines, JVM in kernel, hot-swapped kernel
In message <>, Alan Cox writes:
| > Actually, at one point I thought about a JVM (or other bytecode interpreter,
| > e.g. iconx) in the kernel for the purpose of loadable packet filters. For
| The BPF filters in 2.1.x and in BSD are very much byte code. BPF isnt turing
| complete and doesnt do a lot, but it is also quite possible to convert it to
| native code. Right now we dont do that but the hooks exist in the kernel

Not sure I want native code; I prefer that it be sandboxed, even at the
price of speed. (Just what we need, a virus vector in the kernel...
although I suppose that modules already give us one such.)

What I was thinking of is something like the packet filtering used by
CheckPoint FireWall-1 (not available for Linux AFAIK); this involves a
kernel module which implements arbitrarily complex (limited by memory
assigned for bytecode and table storage) stateful packet filters. It runs
bytecode. (For those who've seen FW-1, the things you can do with their GUI
filter editor are a subset of its full capability; you have to write
low-level INSPECT code to use its full power. INSPECT is *not* a simple
language to work with, though, which is why I was thinking of more normal
languages such as Java or Icon.)

BPF doesn't appear to be capable of supporting all of the capabilities of
this kind of filter, even ignoring the "stateful" part.

brandon s. allbery [os/2][linux][solaris][japh]
system administrator [WAY too many hats]
electrical and computer engineering KF8NH
carnegie mellon university

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:44    [W:0.065 / U:8.508 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site