From owner-freebsd-arch@FreeBSD.ORG  Fri Jun  9 13:24:48 2006
Return-Path: <owner-freebsd-arch@FreeBSD.ORG>
X-Original-To: freebsd-arch@freebsd.org
Delivered-To: freebsd-arch@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 20C0516A41A;
	Fri,  9 Jun 2006 13:24:48 +0000 (UTC)
	(envelope-from julian@elischer.org)
Received: from a50.ironport.com (a50.ironport.com [63.251.108.112])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 774D743D8F;
	Fri,  9 Jun 2006 13:24:38 +0000 (GMT)
	(envelope-from julian@elischer.org)
Received: from unknown (HELO [192.168.3.4]) ([10.251.60.61])
	by a50.ironport.com with ESMTP; 09 Jun 2006 06:24:36 -0700
Message-ID: <44897693.5050306@elischer.org>
Date: Fri, 09 Jun 2006 21:24:35 +0800
From: Julian Elischer <julian@elischer.org>
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US;
	rv:1.7.13) Gecko/20060414
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Alex Lyashkov <shadow@psoft.net>
References: <1149610678.4074.42.camel@berloga.shadowland>	
	<448633F2.7030902@elischer.org>
	<20060607095824.W53690@fledge.watson.org>	
	<200606070819.04301.jhb@freebsd.org>
	<4486E41B.4000003@elischer.org>	
	<1149692184.3224.208.camel@berloga.shadowland>	
	<4486EBBD.3090404@elischer.org>	
	<1149757290.3222.44.camel@berloga.shadowland>
	<1149786697.3222.91.camel@berloga.shadowland>
In-Reply-To: <1149786697.3222.91.camel@berloga.shadowland>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Robert Watson <rwatson@freebsd.org>, freebsd-arch@freebsd.org
Subject: Re: jail extensions
X-BeenThere: freebsd-arch@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussion related to FreeBSD architecture <freebsd-arch.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-arch>,
	<mailto:freebsd-arch-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-arch>
List-Post: <mailto:freebsd-arch@freebsd.org>
List-Help: <mailto:freebsd-arch-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-arch>,
	<mailto:freebsd-arch-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 09 Jun 2006 13:24:48 -0000

Alex Lyashkov wrote:

>>2) at MOD_LOAD case run loop for each prisons and init private data for
>>this module at all contexts. At this way module always 'exist' at all
>>contexts.
>>and disable module compiling (loading) when module don`t marked jail
>>safe.
>>    
>>
>example for this way.
>http://cvs.freevps.com/index.cgi/kernel/include/linux/freevps/s_context_xfrm.h?rev=1.3
>http://cvs.freevps.com/index.cgi/kernel/net/ipv4/ah4.c?rev=1.3
>ah4_init/ah4_fini functions.
>  
>

this is the bit that is obvious.

The hard bit is the non obvious difficulty of changing all existing 
modules in such away that
they can be compiled both in the new way, and in a way that they are 
still compiled to the old way.

You need to put all the currently global variables into a structure that 
can be instantiated
for each jail, but in order to make this continue to work in the 
existing system, they still need to
be compiled as a global when the normal buold is made.

for this reason Marco and I were looking at various macros that can be 
defined to
allow the variables to be compiled both ways.

For example :


int xx;
static int yy;
struct a {
  int aa;
  int bb;
} cc;

might become:

VM_GLOBAL_START(modname)
   int xx;
   VMG_STATIC int yy;
   struct a {
     int aa;
     int bb;
   } cc;
 VM_GLOBAL_STOP(modname)


You would access these as:
 VM_GLOBAL(modname, yy) = 2
 foobar( VM_GLOBAL_STRUCT(cc, modname)->bb);

or similar.