arch paper section on safety

[Frank Ch. Eigler]

Hi -


brad.chen wrote:

> Before I check this in I was hoping to get through
> one round of review.

Looks good overall, within the context of the ongoing debate
about portals and static checkers.

> [...]
> By default, kernel code cannot be invoked directly from a Systemtap 
> script.  

Not just by default: I am aware of no construct being contemplated for
supporting invocation of kernel code from script.  Perhaps an abuse of
the "embedded C" idea, or of the dpcc expression string could do it,
but both of these are hypothetical and nonessential to the system.

> The Systemtap runtime can use kernel subroutines, and these
> references are assumed to be safe.

It may be informative to enumerate here certain other aspects of
safety, in terms of operating probes within the tight constraints
of the kernel:

- avoiding excessive usage of kernel stack by using explicitly
  synthesized frames in heap/static memory for probe local variables
- strictly terminating, nonblocking body code in probes
- no assumption of user context, as far as possible
- as little as possible dynamic memory allocation during probe
  operation


- FChE
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/systemtap/attachments/20050408/53de657c/attachment.sig>