[cap-talk] Domain change (IPC?) overhead

[Jonathan S. Shapiro]

On Tue, 2008-03-25 at 11:50 -0400, Jonathan S. Shapiro wrote:
> On Tue, 2008-03-25 at 07:52 -0700, Mark Miller wrote:
> > On Tue, Mar 25, 2008 at 6:30 AM, Jonathan S. Shapiro <shap at eros-os.com> wrote:
> > >  I think you are tacitly assuming that domain calls will be normal
> > >  procedure calls. No sensible design would do this.
> > 
> > Unless I misunderstand your meaning, Gedanken, W7, E, Emily, Joe-E,
> > Caja all do this.
> 
> Yes. And I stand by my assertion. The domain interdependencies resulting
> from these systems do not scale up successfully.

Hmm. I didn't intend to preclude the possibility of domain boundaries
that might exist at multiple granularities. A single domain boundary
need not provide all forms of isolation. For example, it may be
acceptable for one domain boundary crossing to share a space accounting
realm, but not for another. Similarly, it may be acceptable for two
protection domains to share a GC domain with each other while a third
does not.

The domain scale that I am discussing is the one that conceptually
replaces processes. At that boundary crossing, sharing and storage
isolation become important issues. None of the systems that you identify
above address this issue. IIRC, E chose not to address storage isolation
explicitly.


shap