Standard Linux was not designed for long-running, unattended, mission-critical deployments. As Linux has become increasingly prevalent in carrier and enterprise infrastructure, this limitation has become a significant engineering challenge. The bugs that emerge in high-availability Linux environments are characteristically difficult to encounter in development and staging: they often require thousands of hours of continuous operation to reproduce, and are extraordinarily difficult to diagnose — meaning they typically surface only after deployment in production.
OpenClovis has invested over $40 million and many engineer-years identifying, solving, and hardening against these failure modes. The following are representative examples of the class of problems that SAFplus handles transparently on behalf of every application built on top of it.
Process Management
The standard Linux semaphore facility (sem_xxx system calls) is not resilient in the face of process failures. If a process terminates while holding a semaphore, that semaphore remains permanently locked — indefinitely blocking every other process that attempts to acquire it. The same failure mode applies when pthread mutexes are used in shared memory.
This issue extends to widely used third-party libraries: the industry-standard Boost C++ interprocess library bases its semaphore implementation on these same Linux primitives, making it inherently unsafe in high-availability environments where process failures must be tolerated gracefully.
SAFplus applications rarely need to interact directly with interprocess semaphores, because coordination is handled through SAFplus’s own availability, event, checkpoint, and messaging abstractions. Internally, SAFplus semaphores are automatically released upon process failure, and shared memory access is carefully managed to preserve data integrity and consistency even when a process terminates mid-update. |