Re: Reliability of RPC services

[Jonathan S. Shapiro]

On Sun, 2006-04-23 at 20:53 +0200, Marcus Brinkmann wrote:
> There must be a better argument than "it was enough for KeyKOS".  We
> don't know KeyKOS very well (and I suspect that our collective
> knowledge about AS/400 is also slim), so it would be nice if you could
> explain what the actual problems where that the resume capability
> behaviour solved, and what convinced you that omitting it was a
> mistake in EROS.

Concerning AS/400: the fact that there was an overwhelmingly successful
system that ran in hundreds of thousands of installations acceptably is
strong evidence that whatever they did deserves consideration.

Concerning EROS v. KeyKOS: Omitting this feature was a mistake because
watchdogs were rejected in the context of EROS, and in the absence of
watchdogs there could not be recovery.

I am coming to the reluctant view that (a) watchdogs are needed (b) they
should not be directly supported by the kernel, and (c) they are
sufficient to allow application recovery in all of the cases we are
considering.

shap