Re: Reliability of RPC services

[Marcus Brinkmann]

Hi,

You made strong arguments against "death notifications" for reply
capabilities.  Nevertheless you also said:

At Fri, 21 Apr 2006 20:16:40 -0400,
"Jonathan S. Shapiro" <address@hidden> wrote:
> In EROS, this behavior [resume capabilities] was dropped, and in my
> opinion that was a mistake.

[...]

> > 1) Is RPC robustness desirable/required, or is an alternative model
> >    feasible where machine-local RPC is as unreliable as IP/UDP network
> >    communication?
> 
> Yes, it is important.

I would like to know why you think omitting this behaviour was
dropped, and why you think that it is important to have at least that
behaviour.

There must be a better argument than "it was enough for KeyKOS".  We
don't know KeyKOS very well (and I suspect that our collective
knowledge about AS/400 is also slim), so it would be nice if you could
explain what the actual problems where that the resume capability
behaviour solved, and what convinced you that omitting it was a
mistake in EROS.

Right now I am confused, because it seems to me that most of the
arguments against "send-once" notifications apply equally well to
"send on destroy" notifications, and it also seems to me that if one
can build a system without "send-once" death notifications, one should
equally well be able to build a system without "send on destroy" death
notifications (ie EROS).  But apparently you think that is not the
case.

I also hope that a more elaborate explanation will help me to
understand better why stronger guarantees where not deemed required in
KeyKOS, and if the same reasons apply to the Hurd.

Thanks,
Marcus