Reflections on an Operating System Design Butler W. Lampson and - - PowerPoint PPT Presentation

▶

Aug 19, 2023 352 likes •549 views

Introduction Kernel User Evaluation Reflections on an Operating System Design Butler W. Lampson and Howard E. Sturgis Presented by Neal H. Walfield Introduction Kernel User Evaluation Cal System General purpose OS 200 users

SLIDE 1

Introduction Kernel User Evaluation

Reflections on an Operating System Design Butler W. Lampson and Howard E. Sturgis

Presented by Neal H. Walfield

SLIDE 2

Introduction Kernel User Evaluation

Cal System

◮ General purpose OS

◮ 200 users

◮ Classes of Applications

◮ Editing ◮ “Typical Fortran batch jobs” ◮ Large batch jobs

◮ Legacy support

SLIDE 3

Introduction Kernel User Evaluation

Structure

◮ Capabilities ◮ Objects ◮ Domains ◮ Layers

◮ Abstract machine / New architecture / Virtual Machine ◮ Unprivileged ◮ No reliance on later layers

◮ Explicit accounting

SLIDE 4

Introduction Kernel User Evaluation

Isolation

◮ Domains

◮ Protection from others ◮ Confined

◮ Controlled breaching via messaging

SLIDE 5

Introduction Kernel User Evaluation

First Protection Layer

◮ Microkernel ◮ 8 objects ◮ No reliance on disk

SLIDE 6

Introduction Kernel User Evaluation

Kernel Objects

◮ Kernel files - Mach Memory Object ◮ Event channels - Inter-process signalling (fixed size queue) ◮ Allocation blocks - Memory and CPU quota ◮ C-lists ◮ Capabilities ◮ Labels - Names a domain ◮ Processes - Hierarchy of domains ◮ Operations - Authority to invoke a domain

SLIDE 7

Introduction Kernel User Evaluation

Capabilities

◮ Name objects ◮ Data: <type, rights, value> ◮ value: object pointer or word ◮ As object pointer: <unique name, index>

◮ Indexes Master Object Table (MOT) ◮ Name stored in MOT entry ◮ O(1) revoke ◮ O(1) relocation

SLIDE 8

Introduction Kernel User Evaluation

Processes

◮ Virtual machine ◮ Contain tree of domains ◮ Call stack - no reply capability

SLIDE 9

Introduction Kernel User Evaluation

Operations

◮ Realize user-objects ◮ Sealed closures

◮ Authority to transfer control to another domain

SLIDE 10

Introduction Kernel User Evaluation

Extensibility

◮ Invalid operations return abnormally ◮ Kernel chains to next level in operation ◮ Cost of abstraction is zero ◮ Not for overriding functionality

SLIDE 11

Introduction Kernel User Evaluation

Disk Files

◮ Extend kernel files to support paging ◮ Invocation only goes to disk file when kernel file returns

abnormally

SLIDE 12

Introduction Kernel User Evaluation

Directories

◮ Symbolic name to user capability ◮ Access control lists ◮ Directory is trusted by user?

SLIDE 13

Introduction Kernel User Evaluation

Accountability

◮ Reduction in sharing ◮ Difficult to attribute, e.g., automatic ◮ Lots of unnecessary paging

SLIDE 14

Introduction Kernel User Evaluation

Object Paging

◮ Kernel objects not paged:

◮ No reliance on disk (transparent paging) ◮ Data integrity1 (user pagers)

◮ Kernel resources are sparse

1User-level checkpointing through exportable kernel state: Tullmann, et

al., 1996

SLIDE 15

Introduction Kernel User Evaluation

Duplicity

◮ Process ≈ Domains ◮ Event Channels ≈ Operations ◮ Motivated by performance concerns ◮ Unnecessary

SLIDE 16

Introduction Kernel User Evaluation

Negative Results

◮ 2–3 iterations for new ideas to be implemented efficiently ◮ Don’t ignore design flaws ◮ An OS is more than a kernel

SLIDE 17

Introduction Kernel User Evaluation

Positive Results

◮ Layering

◮ Simplification ◮ Reliability

◮ Capabilities

◮ Consistent and uniform naming ◮ Consistent and uniform access control

◮ Devices as processes

SLIDE 18

Introduction Kernel User Evaluation

My Observations

◮ Little focus on security ◮ Access control does not rely on delegation ◮ System not persistent

SLIDE 19

Introduction Kernel User Evaluation

Questions

◮ Domain Labels: identify a service in any process? ◮ How do types work?