From df00904039873068c8fed609691cf9cbc9d3604a Mon Sep 17 00:00:00 2001 From: Sigilante <57601680+sigilante@users.noreply.github.com> Date: Thu, 9 May 2024 15:28:04 -0500 Subject: [PATCH 1/4] Create %jinx discussion. --- UIPS/UIP-012X.md | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 UIPS/UIP-012X.md diff --git a/UIPS/UIP-012X.md b/UIPS/UIP-012X.md new file mode 100644 index 0000000..fecc965 --- /dev/null +++ b/UIPS/UIP-012X.md @@ -0,0 +1,47 @@ +--- +title: Computation Timeout Hint +description: Introduce a `%jinx` hint to permit timeout of a computation which may not terminate. +author: ~lagrev-nocfep +status: Draft +type: Standards Track +category: Kernel +created: 2024-05-09 +--- + +## Abstract + +We propose adding a `%jinx` hint to terminate computations automatically from the runtime. + +``` +> ~> %jinx ~s5 (add 1 3) +4 + +> ~> %jinx ~s5 (add 1 3) +bail: timed out at s/5.001.000 +``` + +## Motivation + +As a personal server, an Urbit instance may be called upon to evaluate arbitrary code. Per the halting problem, aside from trivial infinite loops we cannot conclude how long an arbitrary expression will take to evaluate—or if it will never complete. In certain environements, it is impossible or inconvenient to interrupt the runtime process. (In particular, interfaces using `%eyre`/HTTP or `%lick` may not be able to send a `SIGINT` to break execution.) + +While the subject-oriented programming model provides some security, and userspace permissions will provide more, arbitrary code may result in intentional or inadvertent evaluation of long-running code or non-terminating code. + +## Specification + +The `%jinx` hint is a dynamic hint accepting a timeout value and an expression. If the expression does not complete within the span of the timeout value, then the runtime should interrupt the process with a `bail` and slog the elapsed time to the console. + +No changes need to be made to `/sys/hoon` or Arvo. Vere needs to be modified in `nock.c` to handle the hint along with a callback interrupt function somewhere (`manage.c`?). + +An implementation has been begun in `sigilante/jinx`. + +## Backwards Compatibility + +This is a new runtime hint. No backward compatibility issues found. + +## Security Considerations + +This should improve Urbit security for any instance in which arbitrary eval is allowed. + +## Copyright + +Copyright and related rights waived via [CC0](../LICENSE.md). From f37dcfb2d8ddb496d4ab1b551b060173bf82410d Mon Sep 17 00:00:00 2001 From: Sigilante <57601680+sigilante@users.noreply.github.com> Date: Fri, 10 May 2024 09:41:05 -0500 Subject: [PATCH 2/4] Revise hint call syntax. --- UIPS/UIP-012X.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/UIPS/UIP-012X.md b/UIPS/UIP-012X.md index fecc965..badd3ff 100644 --- a/UIPS/UIP-012X.md +++ b/UIPS/UIP-012X.md @@ -13,10 +13,10 @@ created: 2024-05-09 We propose adding a `%jinx` hint to terminate computations automatically from the runtime. ``` -> ~> %jinx ~s5 (add 1 3) +> ~> %jinx [~s5 (add 1 3)] 4 -> ~> %jinx ~s5 (add 1 3) +> ~> %jinx [~s5 (add 1 3)] bail: timed out at s/5.001.000 ``` @@ -30,7 +30,7 @@ While the subject-oriented programming model provides some security, and userspa The `%jinx` hint is a dynamic hint accepting a timeout value and an expression. If the expression does not complete within the span of the timeout value, then the runtime should interrupt the process with a `bail` and slog the elapsed time to the console. -No changes need to be made to `/sys/hoon` or Arvo. Vere needs to be modified in `nock.c` to handle the hint along with a callback interrupt function somewhere (`manage.c`?). +No changes need to be made to `/sys/hoon` or Arvo. Vere needs to be modified in `nock.c` to handle the hint. The currently unused timeout mechanism in `u3m_soft` will be reactivated with the head of the hint for the timeout and the tail of the hint for the product. An implementation has been begun in `sigilante/jinx`. From 22bad76c7eb56b98091289b1e4aa5af38129b655 Mon Sep 17 00:00:00 2001 From: Sigilante <57601680+sigilante@users.noreply.github.com> Date: Fri, 10 May 2024 09:46:09 -0500 Subject: [PATCH 3/4] Revise jet hint syntax again. --- UIPS/UIP-012X.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/UIPS/UIP-012X.md b/UIPS/UIP-012X.md index badd3ff..d708dc1 100644 --- a/UIPS/UIP-012X.md +++ b/UIPS/UIP-012X.md @@ -13,10 +13,10 @@ created: 2024-05-09 We propose adding a `%jinx` hint to terminate computations automatically from the runtime. ``` -> ~> %jinx [~s5 (add 1 3)] +> ~> %jinx.[~s5] (add 1 3) 4 -> ~> %jinx [~s5 (add 1 3)] +> ~> %jinx.[~s5] (infinite-loop) bail: timed out at s/5.001.000 ``` From b9c64e5972e186f1512de43c7af46309fd06b32b Mon Sep 17 00:00:00 2001 From: Sigilante <57601680+sigilante@users.noreply.github.com> Date: Fri, 17 May 2024 14:55:16 -0500 Subject: [PATCH 4/4] Update UIP-012X.md --- UIPS/UIP-012X.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/UIPS/UIP-012X.md b/UIPS/UIP-012X.md index d708dc1..f294248 100644 --- a/UIPS/UIP-012X.md +++ b/UIPS/UIP-012X.md @@ -17,7 +17,17 @@ We propose adding a `%jinx` hint to terminate computations automatically from th 4 > ~> %jinx.[~s5] (infinite-loop) -bail: timed out at s/5.001.000 +recover: dig: alrm +crud: %belt event failed +call: failed + +> ~> %jinx.[~s4] =|(i=@ |-(?:(=(10.000.000 i) i $(i +(i))))) +10.000.000 + +> ~> %jinx.[~s3| =|(i=@ |-(?:(=(10.000.000 i) i $(i +(i))))) +recover: dig: alrm +crud: %belt event failed +call: failed ``` ## Motivation @@ -28,11 +38,11 @@ While the subject-oriented programming model provides some security, and userspa ## Specification -The `%jinx` hint is a dynamic hint accepting a timeout value and an expression. If the expression does not complete within the span of the timeout value, then the runtime should interrupt the process with a `bail` and slog the elapsed time to the console. +The `%jinx` hint is a dynamic hint accepting a timeout value and an expression. If the expression does not complete within the span of the timeout value, then the runtime should interrupt the process with a `bail` and slog the elapsed time to the console. The timeout value is specified in Urbit fracto-seconds but converted in the runtime to Unix milliseconds. No changes need to be made to `/sys/hoon` or Arvo. Vere needs to be modified in `nock.c` to handle the hint. The currently unused timeout mechanism in `u3m_soft` will be reactivated with the head of the hint for the timeout and the tail of the hint for the product. -An implementation has been begun in `sigilante/jinx`. +An implementation has been begun in `sigilante/timeout`, PR [#648](https://github.com/urbit/vere/pull/648). ## Backwards Compatibility