Re: [MiNT] Kernel modules idea

[Frank Naumann <fnaumann@boerde.de>]

Hello!

> At this moment if module uses a kernel function in a wrong way (like kfree on 
> a memory that never been kmalloced) we shoot the messenger, ie. kernel, we 
> have kernel fatal error.
>
> The idea is so modules should have a special verion of each function that atm 
> harms kernel, so the would not. At the beggining, module should  register() 
> to get a module id (mid). Then is should use this mid when calling every 
> kernel function (as a first parameter). Then if module misbehaves we can 
> shoot the module not the kernel, as kernel can track all resource allocation 
> made by module (resurce = memory, fd, trap, etc.).

That's the wrong direction and idea. As kernel modules run in kernel mode 
they are part of the complete kernel. It really don't matter if 
subroutines of the kernel are loaded as module or linked directly to the 
main kernel. Ther borderline to unsafe code is the user space boundary 
(e.g. code that operate in user mode and not kernel mode).

It will be totally useless to spent any time into such things as:

1) a buggy kernel module can crash the kernel in the same way
   as any other buggy kernel routine anyway

2) tracking resource usage will be a never ending story at this level
   you will for sure oversee tons of dependency thus introducing(!) lot of
   new bugs instead removing bugs

3) such fatal bugs you are able to detect are fixed in a short time
   (bugs you can detect are maybe wrong API usage or such simple things)

In summary, if you spent the needed work on this into fixing bugs instead 
we have a bug free kernel in the next time. If you try to implement this 
you will for sure introduce a lot more of new bugs instead detecting and 
removing existing bugs.

Per definition a kernel module is the same trusted code as the main kernel 
code itself (as I said it's directly part of the kernel). You can't 
difference in kernel mode.

Or as question, if you don't trust kernel code, what code do you trust 
them?

You can for sure go into the microkernel architecture. The idea behind is 
is to reduce the kernel code to a minimum and to put most things into user 
space server applications. The main drawback of this design is the needed 
communication overhead between the user space server applications.


Regards,
Frank

--
ATARI FALCON 060 // MILAN 060
-----------------------------------------
e-Mail: fnaumann@freemint.de