41 ms·

Sure and this list likely worked well in the NASA/JBL context. The point being is it needlessly specific as a generic advice. At the risk of stating the obviou

Sure and this list likely worked well in the NASA/JBL context. The point being is it needlessly specific as a generic advice. At the risk of stating the obvious, a "goto exit" pattern is the defacto standard for function cleanup in Linux kernel, which may not be flying every space probe, but it's still pretty damn ultra-reliable piece of software.

yitchelle 10y ago
An ultra reliable software comes down to knowing its behaviour fully in its released form. If the code has 100s of gotos and their paths are mapped out and its ramifications of the paths are clearly understood for all scenarios, then it is still reliable as its full behaviour is understood and is safe.
4ad 10y ago
Talk about missing the point and the whole context around mission-critical software. > a "goto exit" pattern is the defacto standard for function cleanup in Linux kernel There are many ways to do error cleanup that do not involve goto, and there are many bad ways to use goto. A static analyser can't decide if you do "good goto" or "bad goto", but it's easy to ban goto outright and avoid all the "bad gotos". You pay the price in terms of programmer work (he has to do something different), but you gain better static analysis and eliminate a full class of bugs. This tradeoff makes sense for JPL and other people who do mission-critical of life-critical software. It might not make sense for the Linux kernel or most C software. Mission-critical is not the place where you want to rely on programmers to do their work correctly (goto fail anyone?). You rely on specific methodology, standards, and static analysis.
- OskarS 10y ago
  The Linux kernel is not mission critical? Many of those mission critical systems probably run off of a Linux kernel, you know. I think the point is that while it is potentially a good rule for mission critical code, it is not essential. There are other ways as well.
  - 4ad 10y ago
    No, they don't. The Linux kernel is not a RTOS. Most JPL projects use VxWorks.
  - pjmlp 10y ago
    No it isn't. Operating systems like INTEGRITY RTOS are. http://www.ghs.com/products/rtos/integrity.html http://www.ghs.com/products/rtos/integrity.html Which is why GNU/Linux gets packed into his own little sandbox running on top of INTEGRITY.
    - kristoffer 10y ago
      Well, SpaceX claims to be running their flight software on Linux so it is critical to their missions at least :)
      - 4ad 10y ago
        SpaceX uses VxWorks for their hard real-time requirements: http://blogs.windriver.com/vxworks/2010/12/vxworks-helping-commercial-spaceflight-become-a-reality.html http://blogs.windriver.com/vxworks/2010/12/vxworks-helping-c... They use Linux for non-hard-real-time stuff. Their microcontrollers also do not use Linux. Coincidentally, Tesla uses QNX.
        kristoffer 10y ago
        Yes for their microcontrollers they use VxWorks. But Linux is still used for the flight software (i.e. mission control).
        4ad 10y ago
        VxWorks does not run on microcontrollers.
        kristoffer 10y ago
        Don't know your definition of microcontroller but VxWorks runs on e.g. Cortex-M3/4, MIPS, 68K, SH, SparcV8, PowerPC thus including some devices I could microcontrollers. But there is no clear cut definition of microcontroller, microprocessor, SoC, whatnot.
- nanolith 10y ago
  > A static analyser can't decide if you do "good goto" or "bad goto", but it's easy to ban goto outright and avoid all the "bad gotos". That depends on the goto statement. A good static analyzer can certainly recognize a "goto exit" pattern. There is very little difference in a function graph between an if/then/else clause and a goto statement. In fact, most static analyzers perform a first pass that is pretty similar to a compiler so that it can build a function graph for performing data analysis along each of the potential branches. One this pass is performed, it doesn't matter if you used an if/then/else, a for/while/do-while, a switch statement, or a complex sequence of break or continue statements. A graph is a graph. The more succinct question is, "What constitutes a 'good' goto statement?" From the perspective of a static analyzer, it would be applying the exact same analysis as it would for any other branch in the function graph. If it detects a memory leak, a use-after-free, or a use of data which isn't always initialized, it makes little difference whether this is because of a bad goto statement or a sloppy set of conditionals. Either the graph shows a problem, or it does not.
pjmlp 10y ago
> but it's still pretty damn ultra-reliable piece of software. Are you sure? http://arstechnica.com/security/2016/09/linux-kernel-security-needs-fixing/ http://arstechnica.com/security/2016/09/linux-kernel-securit... http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...
naasking 10y ago
> [Linux is] still pretty damn ultra-reliable piece of software. It's really not. I don't think you have a good sense of how reliable the systems in this space really are. Firmwares and other ultra-reliable systems typically use microkernels, and there are billions of units of verified L4 microkernels out there. Linux can't even dream of approaching this level of reliability.
- unethical_ban 10y ago
  If I wanted to learn more about open source, reliable microkernels, where would you point me?
  - naasking 10y ago
    seL4 is the big one: https://sel4.systems/ https://sel4.systems/ Here's a general reference of open source microkernel operating systems: http://www.microkernel.info/ http://www.microkernel.info/ Here's a general reference for open source real time operating systems: http://www.osrtos.com/ http://www.osrtos.com/
    - JoachimSchipper 10y ago
      seL4 is really sexy, but I don't think it's anywhere near the most-used one?
      - nickpsecurity 10y ago
        OKL4 if we're going with the phone example. They stopped open-sourcing it by version 4.0 but someone should be able to dig up OKL4 3.0 somewhere.

yitchelle 10y ago

An ultra reliable software comes down to knowing its behaviour fully in its released form. If the code has 100s of gotos and their paths are mapped out and its ramifications of the paths are clearly understood for all scenarios, then it is still reliable as its full behaviour is understood and is safe.

4ad 10y ago

Talk about missing the point and the whole context around mission-critical software. > a "goto exit" pattern is the defacto standard for function cleanup in Linux kernel There are many ways to do error cleanup that do not involve goto, and there are many bad ways to use goto. A static analyser can't decide if you do "good goto" or "bad goto", but it's easy to ban goto outright and avoid all the "bad gotos". You pay the price in terms of programmer work (he has to do something different), but you gain better static analysis and eliminate a full class of bugs. This tradeoff makes sense for JPL and other people who do mission-critical of life-critical software. It might not make sense for the Linux kernel or most C software. Mission-critical is not the place where you want to rely on programmers to do their work correctly (goto fail anyone?). You rely on specific methodology, standards, and static analysis.

OskarS 10y ago
The Linux kernel is not mission critical? Many of those mission critical systems probably run off of a Linux kernel, you know. I think the point is that while it is potentially a good rule for mission critical code, it is not essential. There are other ways as well.
- 4ad 10y ago
  No, they don't. The Linux kernel is not a RTOS. Most JPL projects use VxWorks.
- pjmlp 10y ago
  No it isn't. Operating systems like INTEGRITY RTOS are. http://www.ghs.com/products/rtos/integrity.html http://www.ghs.com/products/rtos/integrity.html Which is why GNU/Linux gets packed into his own little sandbox running on top of INTEGRITY.
  - kristoffer 10y ago
    Well, SpaceX claims to be running their flight software on Linux so it is critical to their missions at least :)
    - 4ad 10y ago
      SpaceX uses VxWorks for their hard real-time requirements: http://blogs.windriver.com/vxworks/2010/12/vxworks-helping-commercial-spaceflight-become-a-reality.html http://blogs.windriver.com/vxworks/2010/12/vxworks-helping-c... They use Linux for non-hard-real-time stuff. Their microcontrollers also do not use Linux. Coincidentally, Tesla uses QNX.
      - kristoffer 10y ago
        Yes for their microcontrollers they use VxWorks. But Linux is still used for the flight software (i.e. mission control).
        4ad 10y ago
        VxWorks does not run on microcontrollers.
        kristoffer 10y ago
        Don't know your definition of microcontroller but VxWorks runs on e.g. Cortex-M3/4, MIPS, 68K, SH, SparcV8, PowerPC thus including some devices I could microcontrollers. But there is no clear cut definition of microcontroller, microprocessor, SoC, whatnot.
nanolith 10y ago
> A static analyser can't decide if you do "good goto" or "bad goto", but it's easy to ban goto outright and avoid all the "bad gotos". That depends on the goto statement. A good static analyzer can certainly recognize a "goto exit" pattern. There is very little difference in a function graph between an if/then/else clause and a goto statement. In fact, most static analyzers perform a first pass that is pretty similar to a compiler so that it can build a function graph for performing data analysis along each of the potential branches. One this pass is performed, it doesn't matter if you used an if/then/else, a for/while/do-while, a switch statement, or a complex sequence of break or continue statements. A graph is a graph. The more succinct question is, "What constitutes a 'good' goto statement?" From the perspective of a static analyzer, it would be applying the exact same analysis as it would for any other branch in the function graph. If it detects a memory leak, a use-after-free, or a use of data which isn't always initialized, it makes little difference whether this is because of a bad goto statement or a sloppy set of conditionals. Either the graph shows a problem, or it does not.

pjmlp 10y ago

> but it's still pretty damn ultra-reliable piece of software. Are you sure? http://arstechnica.com/security/2016/09/linux-kernel-security-needs-fixing/ http://arstechnica.com/security/2016/09/linux-kernel-securit... http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...

naasking 10y ago

> [Linux is] still pretty damn ultra-reliable piece of software. It's really not. I don't think you have a good sense of how reliable the systems in this space really are. Firmwares and other ultra-reliable systems typically use microkernels, and there are billions of units of verified L4 microkernels out there. Linux can't even dream of approaching this level of reliability.

unethical_ban 10y ago
If I wanted to learn more about open source, reliable microkernels, where would you point me?
- naasking 10y ago
  seL4 is the big one: https://sel4.systems/ https://sel4.systems/ Here's a general reference of open source microkernel operating systems: http://www.microkernel.info/ http://www.microkernel.info/ Here's a general reference for open source real time operating systems: http://www.osrtos.com/ http://www.osrtos.com/
  - JoachimSchipper 10y ago
    seL4 is really sexy, but I don't think it's anywhere near the most-used one?
    - nickpsecurity 10y ago
      OKL4 if we're going with the phone example. They stopped open-sourcing it by version 4.0 but someone should be able to dig up OKL4 3.0 somewhere.