Fall 2000: CS 771/871 Operating Systems

[ Home | Class Roster | Syllabus | Status | Glossary | Search | Course Notes]

Amoeba Distributed Operating System

System Architecture

Microkernel

  1. Manages processes and threads (with synchronization)
  2. Low-level memory management (Segments)
  3. Communications (RPC and group)
  4. Low-level I/O (But using client/server model)

Client Server Model

.
 Capabilities

CREATE-OBJECT RPC to Object server returns capability

Object Protection

QUESTION: How safe is this?
How do we know it is owner trying to restrict the capability?
Can another process make up a capability with owner rights?
Can rights be increased?
Can an impostor steal the owner's capability?
Can a process with a restricted capability, increase the rights?
Is XOR reversible?
Give an example of a one way function.

Standard Operations on Objects

 

Call Description
Age Perform Garbage Collection Cycle
Copy Duplicate and return capability to new object
Destroy Destroy and reclaim storage
Getparams Get parameters
Info Get ASCII string describing
Restrict Produce restricted capability to this object
Setparams Set server parameters
Status Get status from server
Touch Pretend object was just used (garbage collection)

NOTES:

Process Management

/*
** Process descriptor.
** This is followed by pd_nseg segment descriptors (segment_d),
** reachable through PD_SD(p)[i], for 0 <= i < p->pd_nseg.
** The index in the segment array is also the segment identifier.
** Following the segments are pd_nthread variable-lenght thread descriptors.
** Sample code to walk through the threads:
**	thread_d *t = PD_TD(p);
**	for (i = 0; i < p->pd_nthread; ++i, t = TD_NEXT(t))
**		<here *t points to thread number i>;
*/
typedef struct {
	char		pd_magic[ARCHSIZE];	/* Architecture */
	capability	pd_self;	/* Process capability (if running) */
	capability	pd_owner;	/* Default checkpoint recipient */
	uint16		pd_nseg;	/* Number of segments */
	uint16		pd_nthread;	/* Number of threads */
} process_d;

Thread Management

Memory Management

Communications in Amoeba

Address is a 48 bit randomly chosen number by thread
this is the first field of a capability.

RPC, point to point, request/block/reply

  1. get_request(&header, buffer, bytes)
    (server listens to port), header Contains the PORT (6 bytes)
  2. put_reply (&header, buffer, bytes)
    server sends reply to send
  3. trans (&header1, buffer1, bytes1, &header2, buffer2, bytes2)
    send message from client to server

To prevent impersonating a server, ports are assigned in pairs

These are related by a one-way function.

put-port = F(get-port)

Since get_request uses get-port, an impostor cannot issue one in place of a server.

Group Communications

Closed groups, but anyone can send RPC message to any member for group broadcast.

Reliable Broadcast: Initiation

  1. User process traps to kernel, passing message
  2. kernels blocks user process
  3. kernel sends point-to-point message to SEQUENCER
    1. kernel message contains unique number to detect duplicates
    2. also contains number of last broadcast message received by kernel
      (piggybacked acknowledgment)
    3. starts timer
  4. Sequencer allocates next message number and broadcasts message
  5. 1H[ seeing broadcast, sending kernel
    1. stops timer
    2. unblocks user process

Failures Modes:

Reliable Broadcast: Sequencer

Reliable Broadcast:Receiving Kernel

Reliable Broadcast: History Buffer

COMPLEXITY of GROUP COMMUNICATIONS: slightly more than 2, increasing slightly with N

Fault Tolerant Group Communications

Fault tolerance of history buffer is achieved when setting up group by specifying how many machines maintain a copy ("k" fault tolerance).

To sync "k" copies:

Measurements on 68030 CPUs 10Mbps ethernet, 800 reliable transmission per second.

FLIP (Fast Local Internet Protocol)

Why another protocol at the network layer?

Each Process has a unique randomly chosen 64 bit FLIP address
this address migrates with process

For security, consists of public and private parts

Public-address = DES(private-address)

Use private address as a key to DES encode bit 0.

Servers listen on private addresses, but clients send on public ones.
(analogous to put/get ports but at lower level).

 

FLIP Functions

FLIP Routing Table

 

FLIP
Address

Network
address

Hop
count

Trusted
bit

Age

         
         
         

Locating Put-Ports in Amoeba

Let's look at how client A communicates to server B.

NOTE: for redundancy, there may be several processes listening to a put_port
if several respond to a broadcast, RPC layer chooses one.

Separating FLIP from put_ports:

Amoeba's File System

Amoebas allows arbitrary file servers to coexist.
Standard file systems consists of

  1. BULLET server: handles file storage
  2. Directory server: maps names to capabilities
  3. Replication server: copies files

BULLET server

Implementation of BULLET Server

Garbage Collection

Directory Server

Maps ASCII names to capabilities using directory tables
Can implement different flavors of directory management
Typically, a UNIX like directory service

Every user has his on root, so system looks like a forest from the users point of view.

Directory Server Calls

Implementation of Directory Server

Replication Server

Run Server

Boot Server

Other Servers

Copyright chris wild 2000.
For problems or questions regarding this web contact [Dr. Wild].
Last updated: 01 Nov 2000 .