• Messages sorted by: [ date ][ thread ][ subject ][ author ] [ Next ]
• [ Previous ] Maybe in reply to: shapj@us.ibm.com

I am forwarding Mike Laskin's original note from his class for the benefit of those who may wish to see it pre-dissected :-)

Jonathan S. Shapiro
IBM T.J. Watson Research Center
Email: shapj@us.ibm.com
Phone: +1 914 784 7085 (Tieline: 863)
Fax: +1 914 784 7595

12:30 PM ---------------------------

"Jonathan S. Shapiro" <shap@eros.cis.upenn.edu> on 04/23/99 06:56:52 PM

To: Jonathan S Shapiro/Watson/IBM
cc:
Subject: "Mike Laskin": EROS Problems we discovered

Return-Path: laskin@pobox.com
Delivery-Date: Fri Apr 23 18:53:30 1999
Received: from halifax.syncomas.com (localhost [127.0.0.1])

     by snocrash.cis.upenn.edu (8.8.7/8.8.7) with ESMTP id SAA06721
     for <shap@localhost>; Fri, 23 Apr 1999 18:53:29 -0400
Received: from mail.earthlink.net
     by halifax.syncomas.com (fetchmail-4.4.4 POP3)
     for <shap/localhost> (single-drop); Fri, 23 Apr 1999 18:53:29 EDT
Received: from smtp2.Stanford.EDU (smtp2.Stanford.EDU [171.64.14.23])
     by toucan.prod.itd.earthlink.net (8.9.3/8.9.3) with ESMTP id IAA11197
     for <jsshapiro@earthlink.net>; Fri, 23 Apr 1999 08:48:53 -0700 (PDT)
Received: from vireo (vireo.Stanford.EDU [171.64.202.104])
     by smtp2.Stanford.EDU (8.9.3/8.9.3/L) with SMTP id IAA03500
     for <jsshapiro@earthlink.net>; Fri, 23 Apr 1999 08:48:53 -0700 (PDT)

charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0

Shap,

Here's a list of pros and cons that we thought EROS had as presented in the Technical report, "EROS: A capability system".

I am sure you are aware of most of these, and some might just plain be wrong. But this is what we got from spending a few hours discussing EROS and reading the programmer's reference, and the overview paper.

Pros:
Microkernel design
- - broken into chunks

• - compartmentalized and contained

Capabilities
- - Opaque to client

• - can expose architecture HAL securely
• - provides black box testing support
• - fine-granularity security model

Pass capabilities around easily
- - Keys kept over crashes

• - Easy transfer of rights

Checkpoints save entire system state
- - Reduces overhead of starting and stopping programs repeatedly (revocation
vs. domain processors)
- - All but eliminates need for normal named file system

• - Makes system completely restartable to last checkpoint (~5 minutes ago)
• - Allows efficient scheduling of disk writes (burstiness)
• - Efficient: can saturate disk bandwidth on most platforms

All services occur as atomic actions
- - Provides more reliability (actions have a clear commit point)

• - Opens door for easy and efficient multi-threaded programming Efficient Store
• - No indirection blocks Memory Allocation
• - Separate pages and nodes for user data and capabilities
• - To allocate memory, simply request from space bank Processes
• - Keeper opens the ability for better exception handling
• - Off-the-shelf processes (sorting routines, etc) on standby

Cons:
Different programming model
- - What happens when a buggy program crashes and is then restarted at a point
that lead to a crash?

No standard interface
- - Paper proposed but didn't provide one

Persistent process may complicate common bugs

Paper doesn't describe how common security problems are addressed.
- - Do checkpoints help in 24/7 uptime?

• - What should keepers be implemented do? Unclear solutions to address space violations...
• - Many common security problems are implementation problems
• --- Unclear how EROS checks buffer overruns...

Performance
- - Heavily process-oriented -- lots of context-switching

• - Each server process can handle only one request at a time (dispatcher is slow, no fork in system)
• --- No way to implement an internet server <-- I know this is false
• - Use of a software TLB and a software cache

No real performance metrics given in the paper, compared to other fault-tolerant OS.

100ms checkpoint time for what size system? How long for a large-size system? How's this different than other checkpoint systems out there?

I thought you might be interested to see these.

Take care,
Mike
laskin@pobox.com

[ Next ]
• [ Previous ] Maybe in reply to: shapj@us.ibm.com