Re: Architecture of Backing Store Descriptors
Jonathan Shapiro (shap@viper.cis.upenn.edu)
Sun, 27 Nov 94 13:13:18 -0500
The standard way of passing resources was to pass a space bank and a meter.
The space bank provided trusted pages and nodes. (Since there could be
many space banks in a system, the a program could trust some and not
trust others. Some banks might provide replicated pages while others
did not. Or pages on unsecure devices etc.)
Note, however, that if a server somehow contrived to let itself run on
the user-provided meter, and the meter ran out, you were basically
hosed. There isn't an obvious way for the server to protect itself
that I can see.