Lecture Notes in Computer Science

L.. Lecture Notes in Computer Science Edited by G. Goos and J. Hartmanis 60 M. J. Flynn, J. N. Gray, A. K. Jones, K. Lagally H. Opderbeck, G. J. Popek, B. Randell J. H. Saltzer, H. R. Wiehle Operating Systems An Advanced Course Edited by R. Bayer, R. M. Graham, and G. Seegm~iller Prof. Dr. J. Stoer hu~lut for Angewandte Mathematik und Statisfik 87 WOrzburg, Am Hubland Springer-Verlag Berlin Heidelberg New York 1978

Editorial Board P. Brinch Hansen J. Stoer N. Wirth D. Gries C. Moler G. Seegmeller Editors Prof. Dr. R. Bayer Institut far Informatik der TU M0nchen Arcisstra6e 21 D-8000 MLinchen 2 Prof. Dr. R. M. Graham Computer and Information Science Graduate Research Center University of Massachusetts Amherst, Mass. 01002/USA Prof. Dr. G. SeegmLiller Institut flir Informatik der Universit~it und Leibnitz-Rechenzentrum der Bayrischen Akademie der Wissenschaften BarerstraBe 21 D-8000 MLinchen 2 AMS Subject Classifications (1970): 68-02 CR Subject Classifications (1974): ISBN 3-540-08?55-9 Springer-Verlag Berlin Heidelberg New York ISBN 0-38?-08?55-9 Springer-Verlag New York Heidelberg Berlin This work i s subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically those of translation, reprinting, re-use of illustrations, broadcasting, reproduction by photocopying machine or similar means, and storage in data banks. Under 54 of the German Copyright Law where copies are made for other than private use, a fee is payable to the publisher, the amount of the fee to be determined by agreement with the publisher. by Springer-Verlag Berlin Heidelberg 1978 Printed in Germany Printing and binding: Beltz Offsetdruck, Hemsbach/Bergstr. 2145/3140-543210

PREFACE The Advanced Course on Operating Systems was held at the Technical University in Munich from July 28 to August 5, 1977, and was repeated from March 29 to April 6, 1978. The course was organized by the Institute for Informatics of the Technical University Munich and the Leibniz Computing Center of the Bavarian Academy of Sciences, in co-operation with the European Communities, sponsored by the Ministry for Research and Technology of the Federal Republic of Germany.

Contents CHAPTER i.: INTRODUCTION R. Bayer R. M. Graham J. H. Saltzer G. SeegmUller INTRODUCTION CHAPTER 2.: MODELS A, K. Jones THE OBJECT MODEL: A CONCEPTUAL TOOL FOR STRUCTURING SOFTWARE 1. The Object Model 2. The Object Model Applied to Operating Systems 3. Mechanics of Supporting Type Modules 4. Observation 5. 8 11 15 16 16 M. J. Flynn COMPUTER ORGANIZATION AND ARCHITECTURE 1. Machine Mapping and Well Mapped Machines 2. Name Space - Memory Space 3. Traditional Machine Language Problems and Some Fundamental C~ncepts 4. Towards Ideal Program Representations 5. Parallel Processor Forms of Computing Systems 17 19 37 52 56 81 97 CHAPTER 3.: ISSUES AND RESULTS IN THE DESIGN OF OPERATING SYSTEMS J. H. Saltzer NAMING AND BINDING OF OBJECTS A. Introduction To Names in Computer Systems 2. A Model for the Use of Names 3. Problems in the Use of Names 4. Some Examples of Existir~ Namin~ Systems 5. The Need for Names with Different Properties 6. Plan of Study B. An Architecture for Addressing Shared Objects T. User-Dependent Bindings and Multiple Naming Contexts 2. Larger Contexts and Context Switching 99 102 102 104 110 114 120 123 124 129 136

VI 3. Binding on Demand, and Binding from Higher-Level Contexts C, Higher-Level Naming Contexts, or File Systems ~. Direct-Access and Copy Organizations 2. Multiple Catalogs and Naming Networks 3. The Dynamics of Naming Networks 4. Binding Reference Names to Path Names 5. Context Initialization D. Implementation Considerations 7. Lost Objects 2. Catalogs as Repositories 3, Indirect Catalog Entries 4, Search Rules E. Research Directions Appendix A: Case Study of Naming in Multics 1. The Addressing Architecture of Multics 2. The Multics File System 3. Context Initialization in Multics 4. on Naming in Multics 145 151 151 157 165 168 175 178 178 182 183 185 186 190 193 193 200 202 208 G. J. Popek C. S. Kline ISSUES IN KERNEL DESIGN 1. 2, 2, 1, 2,2. 2.3. 2.4. 3. 3.1. 3.2. 3.2.1. 3.2,2. 3.2.3. 4. 4.1. 4.2. 5. 5.1. 5.2. 5.3. 6. 6.1. 6.2. 6.3. 7. Introduction Effects of Design Constraints on Kernel Architecture Security Policy System Functions Hard~Jare Effects Performance Principles of Kernel Design Overall System Architecture Resource Pools Type Integrity Resource Management Naming More on Overall System Architecture Trusted Processes Levels of Kernels Internal Kernel Architecture Hardware Selection Parallelism Abstract Type Structures Confinement Importance Storage and Timing Channels Timing Independent Scheduling Channels Conclusion 209 210 211 212 212 213 215 216 216 216 217 218 218 219 219 220 221 222 222 222 223 223 224 225 226 226 A. K. Jones PROTECTION MECHANISMS AND THE ENFORCEMENT OF SECURITY POLICIES 1. Introduction 2. Security Policies 3. Protection Mechanisms 4. Enforcing a Policy of Isolation 5. Enforcing Access Control Policies 5.1. Implementation of Access Control Protection Mechanisms 228 229 230 233 233 236 240

Vll 5.2, 5.3. 5.3.1. 5.3.2. 6. 7. Authority Lists Capability Based Implementation Extended Object Types Status Enforcing Information Control Policies 241 242 244 248 248 250 K. Lagally SYNCHRONIZATION IN A LAYERED SYSTEM 252 1. 2. 2.1. 2.2. 2.3, 3, 3.1. 3.2. 3.3. 3.4. 3.5. 4. 4.1. 4.1.1. 4.1.2. 4.1.3. 4.1.4. 4,1.5, 4.2. 5. 6. Introduction General Concepts Synchronization Processes and Messages Process Hierarchy Implementation Tools Semaphores Conditional Critical Regions Monitors Path Expressions Object Managers Examples Readers and Writers Semaphores Conditional Critical Regions Monitors Path Expressions Object Managers The Five Dining Philosophers Conclusion 253 253 253 255 257 258 258 259 260 261 262 263 263 264 268 269 270 271 275 277 278 B. Randell RELIABLE COMPUTING SYSTEMS 282 I. 2. 2,1. 2.2. 3. 3.1. 3.2. 3.3. 3.4. 4. 4.1. 4.2. 4.3. 4.4. 4 5. 4.6. 5. 5.1. 5.1.1. 5.2. 5.2.1. 5.2.2. 5.3. 5.4. 5.5. 5.5.1. Introduction Basic Concepts Systems and Their Failures Errors and Faults Reliability Issues Requirements Types of Fault Fault Intolerance and Fault Tolerance Design Fault Tolerance System Structure Static Structure Dynamic Structure Atomic Actions Forms of Atomic Action Levels of Abstraction Faults and Structuring Fault Tolerance Technique~ Protective Redundancy Triple ModularRedundancy Error Detection Types of Check Interface Checking Fault Treatment Damage Assessment Error Recovery Backward Error Recovery 283 286 286 287 290 290 291 293 294 296 296 298 299 302 303 306 308 308 309 311 312 313 314 317 318 318

Vitl 5.5.2. 5.5.3. 6, 7. 8. Forward Error Recovery 325 Multi-Level Error Recovery 328 Summary and Conclusions 332 Acknowledgements 334 335 Appendix 1: Bell Laboratories ESS No. 1A Processor 340 A1.1 System Description 340 AI.2 Reliability Strategies 342 A1.3 Reliability Evaluation 348 Appendix 2: HIVE 350 A2.1 System Description 350 A2.2 Reliability Strategies 352 Appendix 3: The JPL-STAR Computer 355 A3.1 System Description 355 A3.2 Reliability Strategies 356 A3.3 Reliability Evaluation 359 Appendix 4: The Newcastle Reliability Project 362 A4.1 The EML System 362 A4.2 System Description 364 A4.3 Reliability Strategies 364 A4.4 Reliability Evaluation 366 A4.5 The Recoverable Filing System 366 A4.6 Resource Contention System 367 Appendix 5: The Plessey System 250 Computer 368 A5.1 System Description 368 A5.2 Reliability Strategies 369 A5.3 Reliability Evaluation 371 Appendix 6: Pluribus 374 A6.1 System Description 374 A6.2 Reliability Strategies 376 A6.3 Reliability Evaluation 378 Appendix 7: PRIME 381 A7.1 System Description 381 A7.2 Reliability Strategies 383 A7.3 Reliability Evaluation 385 Appendix 8: The SIFT Computer 387 A8.1 System Description 387 A8.2 Reliability Strategies 388 J. N. Gray NOTES ON DATA BASE OPERATING SYSTEMS 393 Acknowledgements 394 I. Introduction 395 i.i. A Sample System 395 1.2. Relationship to Operating System 396 1,3. General Structure of Data Management Systems 397 1.4. 398 2. Dictionary 400 2.1. What it is 400 2,2. 401 3. Data Management 402 3. I. Records and Fields 402 3.2. Sets 402 3.3. Cursors 404 3.3, 2. Operations on Cursors 404 3.3, 3. Cursor Positioning 405 3.4. Various Data Models 406 3.4.1. Relational Data Model 406 3~ 4.2. Hierarchical Data Model 407 3.4.3. Network Data Model 408 3, 4.4. Comparison of Data Models 409

IX 3.5, 3.5.1. 3.6. 3.7. 3.8. 3.9. 4. 4.1. 4.2. 4.3. 4.4. 4.5. 4.5. 4.6. 4.7. 4.8. 5. 5.1. 5.2. 5.3. 5.4. 5.5. 5.6, 5.7. 5.7.1. 5.7.2. 5.7.3. 5.7.4. 5.7.5. 5.7.6. 5.7.7. 5.7.8. 5.8. 5.8.1. 5.8.2. 5.8.3. 5.8.4. 5.8.5. 5.8.6. 5.8.7. 5.8.8. Views Views and Update Structure of Data Manager A Sample Data Base Design Comparison to File Access Method Data Con~m~nications Messages, Sessions, are Relationship to Network Manager Session Management ~'~eue8 Message Recovery Response Mode Processing Conversations Message Mapping Topics not Covered Transaction Management Transaction Scheduling Distributed Transaction Management The Data Management Systemas a Subsystem Exception Handling Other Components Within Transaction Management Lock Management Pros and Cons of Concurrency Concurrency Problems Model of Consistency and Lock Protocols Locking, Transaction Backup and System Recovery Lower Degrees of Consistency Lock Granularity Lock Management Pragmatics Recovery Management Model of Errors Overview of RecoVery Management Recovery Protocols Structure of Recovery Manager Log Management Examples of a Recovery Routine Historical Note on Recovery Management 409 411 411 412 414 414 415 415 417 417 418 418 419 419 420 420 421 424 425 427 428 429 429 430 430 431 431 437 438 438 446 458 459 459 460 462 472 478 80 480 481 Opderbeck COMMON CARRIER PROVIDED NETWORK INTERFACES 1. Introduction 2. Protocoll Characteristics 2.1. Connection Establishment and Clearing 2.2. Error Control 2.3. Flow Control 2.4. Multiplexing 2.5. Synchronization 2.6. Transparancy 3. Terminal Emulation Interface 4. Character Concentration Interface 5. X. 25 Interface 5.1. Introduction 5.2. Link Access Procedure 5.3. Packet Level Interface 482 483 485 485 485 486 487 488 489 490 493 495 495 496 498

6. Terminal Handling Through P~blic Networks 6.1. Introduction 6.2. PAD Parameters 6.3. PAD-User Interaction 6.4. PAD-Host Interaction 6.5. Network Virtual Terminal 502 502 502 504 505 506 507 G. J. Popek C. S. Kline DESIGN ISSUES FOR SECURE COMPUTER NETWORKS 1. Introduction 1.1. The Environment and its Threats 1.2. Operational Assumptions 2. Relevant Issues in Encryption 2.1. P~blic Key E~ryption 2.2. Algorithms Based on NP Completeness 2.3. Error Detection 2.4. Block vs Chain Ciphers 2.5. Applications of Encryption 2.6. Limitations of Encryption 3. Key Distribution 3.1. Public Key Based Distribution Algorithms 4. Levels of Integration 5. Encryption Protocols 5.1. Confinement 5.2. Authentication 6. Network Encryption Protocol Case Study: Process-Process Encryption 6.1. The Encryption Connection Protocol 6.2. Discussion 6.3. ARPANET Application 6.4. Efficiency Considerations 6.5. System Initialization Procedures 6,6. Symmetry 7. Conclusion 8. 517 518 519 520 520 522 522 523 524 524 526 529 531 533 534 535 536 538 539 542 543 543 544 545 545 546 CHAPTER 4: FUTURE OUTLOOK AND RESEARCH PROBLEMS H. R. Wiehle ON SYSTEM SPECIFICATION A. Introduction B. Definitions and Examples C. Sequentializing Units Do Specification of Units and Decomposable Systems E. Some Remarks on Relations between Systems 547 548 556 564 573 579 582 J. H. Saltzer RESEARCH PROBLEMS OF DECENTRALIZED SYSTEMS WITH LARGELY AUTONOMOUS NODES Coherence and the Object Model Other Problems in the Semantics of Coherence Heterogeneous and Homogeneous Systems Cor~ lusion 583 586 589 590 591 591