Differences Between Coyotos and EROS — A Quick Summary†
Version 0.3, revised 2 April 2006
Jonathan Shapiro, Ph.D.
Systems Research Laboratory
Dept. of Computer Science
Johns Hopkins University
May 12, 2005
Coyotos is a (mostly) evolutionary step from the EROS
kernel. This document briefly summarizes the major ar-
chitectural differences between EROS and Coyotos, and
gives the rationale for each change. It looks both at the
changes that have been definitely decided, and also at
some questions in the Coyotos architecture that still re-
Coyotos, the successor to EROS , has three main ob-
• Correct some known deficiencies relative to the
EROS architecture that impede performance or in-
4/2/2006 Update: When this document was first
written, the design and evaluation of solutions was
a research issue. That work is still underway, but
the resulting design is now stable modulo minor
tweaks that may become motivated during develop-
ment. The kernel specification can now be found on-
line at the website.
• Explore the use of software verification techniques
to achieve higher confidence in the correctness and
security of the kernel and the key system components
(a topic for another document). This is a research
• Re-examine whether persistence was a good idea.
4/2/2006 Update: The answer is now clearly yes.
† Copyright c© 2005, Jonathan S. Shapiro.
We are sticking firmly with the idea of capability-based
systems. For the most part, the goal in Coyotos is refine-
ment rather than replacement of ideas.
The most important changes relative to the EROS archi-
tecture are conceptually minor and not particularly con-
troversial. A few are controversial, but possibly important
as Coyotos moves forward. One or two should definitely
be considered exploratory in nature. Overall, the basic
theory of operation for the Coyotos system is very similar
to the EROS theory of operation, and this should allow us
to preserve most of the design elements of EROS applica-