On Sun, 2004-01-04 at 13:28, Hermann Härtig wrote:

David,

on behalf of the L4 team (at least the one in Dresden): Thanks for your kind words and the concern ;-) .

No need to worry about motivation.

I agree. Speaking from the EROS side, I am reluctant to divert *either* effort. If I thought that the L4 groups were likely to get diverted, I wouldn't have started the discussion.

In my view, there are three possible outcomes of this discussion. All of them are good outcomes. The L4 team(s) will have to decide which one:

1. No change to L4, but the discussions generate improved understanding on both sides. This would not yield tangible benefit in the short term, but it will impact both teams positively as they think about new problems.

2. L4 adopts some form of protected thread ID. Setting aside any desire to move EROS to L4, this is an utterly necessary change if L4 is to support secure systems. The EROS group has some experience with efficient mechanisms to accomplish this and if we can provide value, great. If not, this is also okay.

3. L4 will truly become what is claimed: a universal microkernel. By this, I mean that L4 will change enough to efficiently support capability-based systems. Today, it appears to me that it does not do so, and L4 cannot be considered a universal microkernel until it can.

This could take two forms: (1) changes in L4, or (2) education of me.

In the course of writing some of these exchanges, I have spent a great deal of time thinking about the real feasibility of producing a truly universal nucleus. Much of this has been extremely productive.

I am also a bit surprised at the volume and heat ...

This is a discussion that has engaged several brilliant people, all of whom are knowledgeable, and all of whom feel passionate about what they have done. Under the circumstances, a sense of passion in the discussion is inevitable and healthy.

In response to David:

David Denny wrote:

...

I have been wondering why "Eros" has invaded this list.

This user's pov: L4 is a solid product which works well. I want to experiment with OS building and L4 has a robust base structure, as well as a friendly community and all the tools I need to stick my own silly things on top of it. I support L4. [ I'd support Eros if it had been built to the same level, never mind whatever "angels on pinhead" theoretical issues might occasionally surface. However, from my assessment of the website and some googled papers, Eros is still (shall we say) alpha.]

I agree that L4 has achieved a certain maturity and that this is good. I also agree that EROS has not reached that maturity level yet. In part, this is because EROS has been trying to tackle a harder problem, and in part it is simply because we have a much smaller group of active people. The website is stale because we simply don't have the time to update it! And I agree that it would be very unfortunate for the stability of the current L4 design to stumble in any way.

However! The groups at Hopkins, Dresden, UNSW, and Karlsruhe are not primarily in the business of building development tools. Doing this is very important, but it is equally important that we continue to investigate and question the fundamentals. If we stop doing this, we cease to be researchers.

So: we all need a stable L4, but we also need to think about L5.

...

Please keep at it, Team, and don't allow yourselves to get tr*lled into distractions.

This conversation was started by invitation. You may not have noticed, but I have not spoken out on the L4 list in the last five years -- partly because I did not want to create controversy or distraction.

Soon, these discussions will be over, and both groups will go back to what we do best.

shap

Hermann Härtig wrote:

David,

on behalf of the L4 team (at least the one in Dresden): Thanks for your kind words and the concern ;-) .

No need to worry about motivation. On the contrary, we want to push the usage of L4 much further. After having had some nice publication successes in the real-time domain, we now seem to have a real chance to push the usage of L4 into the (high assurance ?) security area. For instance, Dresden's L4 team has a contract to build a prototype of a minimal VPN box in close contact with the German "Bundesamt für Sicherheit in der Informationstechnik" (see http://os.inf.tu-dresden.de/mikrosina/). But since a long time, we understand that the current interface has shortcomings, e.g., lacks means to control message passing.

I like to help where I can see an honest and forthright endeavour, and a piece of work that shines out. My zone at present is on the testing side of things; where I have the tools, inclination and time I do hope to be of use in that respect.

Sorry for interrupting the discussion :-(

DD