On 03/22/2011 03:35 PM, Alexandre Bergel wrote:
I am not saying that this is feasible with the current VM. But I am doubtful that the bytecode verification can only be done in the VM. If something get wrong, why not to raise a primitiveFailed, as 1/0 will do?
I have the impression that you give a particular status to the bytecodes. I have the feeling that we should not. I can realize a division, and time to time it get wrong (/0). But the VM does not crash. So, why if I evaluate the wrong bytecodes, the VM should crash? You could have the necessary guards in the VM. But the full algorithm for verification could be in the VM. I am not expert on this and I may perfectly be wrong.
Most of virtual machine maker will say that a good debugger and profiler can only be done in the VM. Do you agree with this?
Cheers, Alexandre Well, there is 1 alternative. Check at runtime if what the bytecode wants to do is safe. And that's what you basically suggest. This imposes a high runtime overhead however and that by itself makes that an unwanted approach.
The same is true for debuggers and profilers. Depending on what your task at hand is, you don't want this to interfere with the speed of the system. In other cases however you are just fine with knowing where you spend most of your time based on your model. These are 2 different things. And I do agree very strongly that it's most often more interesting to have the high-level view. If you want the bytecode to run safely but -also- as fast as possible, I don't see a way around precomputing if it is valid. This is how VMs optimize things all the time; that's exactly why register-based bytecodes are faster than stack-based bytecodes. You avoid doing at runtime what you know at compilation time. Obviously it gives the same effect in both cases, but you avoid an overhead with the increased risk of doing things wrongly. However, your solution of having a VM that safely executes bytecodes doesn't bring the verification to the image! It keeps it in the VM, just in a different location. Now every execution of a bytecode needs to perform the check, while beforehand you only would do it once for the whole method. Even worse! My approach would allow you to write the verification in Smalltalk code; it's just Smalltalk code running in a privileged sector of the VM. Your code will be pure C code. And why would you need Smalltalk-level verification anyway if your bytecodes already do the checks anyway? This seems duplicate work with no gain. (it basically would just check that your compiler is surely not broken :)) cheers, Toon
On 22 Mar 2011, at 09:24, Toon Verwaest wrote:
Construct me any scenario just based on the image, and I can show you how I can avoid it and segfault your system anyway.
Construct me any piece of code that can segfault my approach. I doubt that you'll find any.
I can't really say more, since I don't know what you are unconvinced about :)
cheers, Toon
On 03/22/2011 03:19 PM, Alexandre Bergel wrote:
Hi Toon,
Thanks for having taken the time to reply. I understand your and Eliot's email but I am left unconvinced.
Alexandre
On 22 Mar 2011, at 09:02, Toon Verwaest wrote:
The problem is exactly what you had at hand. Your bytecode WAS valid, but it was used in combination with an incompatible class layout. So validation here wouldn't solve anything. You always need to validate in a closed world to ensure you don't accidentally break everything. Whenever you change something, you need to ensure that you revalidate the relevant parts. In this case you could for example just have validated that your new class is a valid subclass of its superclass; which it was not.
To make the system more secure obviously you would have to check those things, but if you add part of the API that circumvents these checks, like you were doing by calling "Class new" rather than using the ClassBuilder which does do the checks, everything breaks. The only authority that can actually ensure that you don't circumvent these checks is the VM.
Obviously you can make sure already in your image that you have enough checks everywhere. You just don't have a crashproof mechanism that will chain your users down avoiding that they shoot themselves in the foot with segfaults. If you put it inside of the VM you -can- provide such a mechanism, because you don't execute anything unless you know it's safe. And as I said, this piece of code could be a piece of prevalidated Smalltalk code that's immutable from the rest of the image.
cheers, Toon
On 03/22/2011 02:37 PM, Alexandre Bergel wrote:
But why we could not have a byecode validator at the image level that first make sure that byte code are in sync with the format of the objects. Why this has to be done in the vm. I agree with Stef. It is not obvious for me why it has to be done at the VM.
Alexandre