Re: On hierarchy

[Jonathan S. Shapiro]

On Fri, 2005-10-21 at 20:23 +0200, Espen Skoglund wrote:
> [Jonathan S Shapiro]
> > 3. For any microkernel operation, the portion of the operation that
> >    performs semantically observable mutations to system state must
> >    be atomic.
> 
> I'll try to get back to providing some comment when I get the time.
> However, I'm really curious about how you view this atomicity
> requirement in the light of MP systems.  Do you require that all
> observable mutations to system state are synchronized across all CPUs?

Originally, our requirement for MPs is that there must, in hindsight,
exist some serialization of operations that would leave the system in
the same state. As long as two processors are executing non-conflicting
updates (in the usual transactional sense) there is no difficulty.

Or at least, this is what we thought originally. Then we realized that
there are places where this rule can safely be "bent" -- in particular
for string transfer, where a second thread on an SMP might observe the
progress of a partial transfer as it is occurring without violating any
important security properties.

Because of this case, I would now say that we still follow the original
rule, but we are prepared to "bend" it for performance after very
careful analysis and with a great deal of fear and concern.

shap