lkml.org 
[lkml]   [1998]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Virtual Machines, JVM in kernel, hot-swapped kernel
Date
From
In message <m0zCNTx-000aPKC@the-village.bc.nu>, Alan Cox writes:
+-----
| > Actually, at one point I thought about a JVM (or other bytecode interpreter,
| > e.g. iconx) in the kernel for the purpose of loadable packet filters. For
| The BPF filters in 2.1.x and in BSD are very much byte code. BPF isnt turing
| complete and doesnt do a lot, but it is also quite possible to convert it to
| native code. Right now we dont do that but the hooks exist in the kernel
+--->8

Not sure I want native code; I prefer that it be sandboxed, even at the
price of speed. (Just what we need, a virus vector in the kernel...
although I suppose that modules already give us one such.)

What I was thinking of is something like the packet filtering used by
CheckPoint FireWall-1 (not available for Linux AFAIK); this involves a
kernel module which implements arbitrarily complex (limited by memory
assigned for bytecode and table storage) stateful packet filters. It runs
bytecode. (For those who've seen FW-1, the things you can do with their GUI
filter editor are a subset of its full capability; you have to write
low-level INSPECT code to use its full power. INSPECT is *not* a simple
language to work with, though, which is why I was thinking of more normal
languages such as Java or Icon.)

BPF doesn't appear to be capable of supporting all of the capabilities of
this kind of filter, even ignoring the "stateful" part.

--
brandon s. allbery [os/2][linux][solaris][japh] allbery@kf8nh.apk.net
system administrator [WAY too many hats] allbery@ece.cmu.edu
electrical and computer engineering KF8NH
carnegie mellon university



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:44    [from the cache]
©2003-2011 Jasper Spaans