Re: The idea of an own L4

[Jonathan S. Shapiro]

On Sun, 2005-10-09 at 15:17 +0200, ness wrote:
> The idea of an own L4 came up in irc several times. This is one thing we 
> should really think about, IMHO. I did so (well, not very much for now):
> 
> _why?_
> - the dresden/karlsruhe guys don't really care about what we need/assume
>    is needed
> - the dresden/karlsruhe guys don't give us access to development sources
>    and we dunno when an upcoming L4 will be released (we even don't know
>    whether this would solve our problems)

Ness:

I think it is possible that you are getting two issues confused. The
first is a legitemate problem communicating with Dresden. The second is
the conclusion that forking is the right solution to this. It may be
that the right answer is to consider working with a group that
communicates more effectively.

Microkernels are incredibly hard to do well. It takes 15-20 years to
learn how to architect a really good kernel interface, and at least a
decade to learn how to implement one.

In the microkernel world, this learning process has been fiercely
Darwinian. When I started working on microkernels in 1990, there were
perhaps 20 active research microkernels, and perhaps 10 industrial ones.
Today, only two research efforts remain, and only one significant
industrial microkernel (the rest have gone to Linux). The two research
efforts are converging rapidly. You need to remember that *all* of the
leaders in this space were exceptionally talented architects. There is a
*reason* that this elimination has occurred.

I think that all of us who do this would like to see more people with
this expertise, so if you think that you have new ideas to bring to
bear, we will certainly welcome you.

But please, please: do not underestimate the difficulty of what you are
proposing. Yes, you could fork L4sec (or Coyotos, or EROS) and go your
own way. The overwhelmingly likely outcome is that you will end up with
a weaker architecture that is lower performance, and your resulting
system will be very vulnerable.

Do what you must, but take the time to give this one some thought. My
personal opinion is that it would be wiser to find a way to build a
closer relationship with Dresden, or to work with a group that is on a
shorter timetable to delivery than L4sec.

Finally, you need to consider that "some of what we need/assume is
needed" is actually wrong, and that the Dresden people may know this.

I predict that we will learn a lot about this as the discussion of
capability-based design proceeds. I certainly do not know all that there
is to know about system design, but I have at least had 15 years in this
space to learn about it. What I know is yours for the asking. Take what
works, leave the rest.


shap