Reflections on an operating system design

ABSTRACT

The main features of a general purpose multiaccess operating system developed for the CDC 6400 at Berkeley are presented, and its good and bad points are discussed as they appear in retrospect. Distinctive features of the design were the use of capabilities for protection, and the organization of the system into a sequence of layers, each building on the facilities provided by earlier ones and protecting itself from the malfunctions of later ones. There were serious problems in maintaining the protection between layers when levels were added to the memory hierarchy; these problems are discussed and a new solution is described.

REFERENCES

• 1: Daniel G. Bobrow , Jerry D. Burchfiel , Daniel L. Murphy , Raymond S. Tomlinson, TENEX, a paged time sharing system for the PDP - 10, Communications of the ACM, v.15 n.3, p.135-143, March 1972 [doi>10.1145/361268.361271]
• 2: Per Brinch Hansen, The nucleus of a multiprogramming system, Communications of the ACM, v.13 n.4, p.238-241, April 1970 [doi>10.1145/362258.362278]
• 3: Dahl, O-J., and Hoare, C.A.R. Hierarchical program structures. In Structured Programming, Academic Press, New York, 1972.
• 4: England, D.M. Capability concept, mechanisms and structure in system 250. Symp. on Protection in Operating Systems. IRIA, Rocquencourt 78150 Le Chesnay, France, Aug. 1974, pp. 68-82.
• 5: R. S. Fabry, Capability-based addressing, Communications of the ACM, v.17 n.7, p.403-412, July 1974 [doi>10.1145/361011.361070]
• 6: Gray, J., et al. The control structure of an operating system. IBM Research Rep. RC 3949, Watson Research Center, Yorktown Heights, N.Y., July 1972.
• 7: Lampson, B.W., et al. A user machine in a time-sharing system. Proc. IEEE 54, 12, (Dec. 1966), 1766-1774.
• 8: Lampson, B.W. Dynamic protection structures. AFIPS Conf. Proc., Vol. 35, 1969 FJCC, AFIPS Press, Montvale, N.J. 1969, pp. 27-28.
• 9: Lampson, B.W. On reliable and extendable operating systems. State of the Art Report, Vol. 1, Infotech Ltd., Maidenhead, Berkshire, England, 1971.
• 10: Butler W. Lampson , J. G. Mitchell , E. H. Satterthwhaite, On the transfer of control between contexts, Programming Symposium, Proceedings Colloque sur la Programmation, p.181-203, April 09-11, 1974
• 11: Meyer, R.A., and Seawright, L.H. A virtual machine time sharing system. IBM Systems J. 9, 3 (1970), 199-218.
• 12: James H. Morris, Jr., Protection in programming languages, Communications of the ACM, v.16 n.1, p.15-21, Jan. 1973 [doi>10.1145/361932.361937]
• 13: Michael D. Schroeder , Jerome H. Saltzer, A hardware architecture for implementing protection rings, Communications of the ACM, v.15 n.3, p.157-170, March 1972 [doi>10.1145/361268.361275]
• 14: Sturgis, H.E. A Post-mortem for a time-sharing system. Ph.D. Th., U. of California, Berkeley, and Rep. CSL 74-1, Xerox Research Center, Palo Alto, Calif., Jan. 1974.
• 15: W. Wulf , E. Cohen , W. Corwin , A. Jones , R. Levin , C. Pierson , F. Pollack, HYDRA: the kernel of a multiprocessor operating system, Communications of the ACM, v.17 n.6, p.337-345, June 1974 [doi>10.1145/355616.364017]
• 16: W. Wulf , R. Levin , C. Pierson, Overview of the Hydra Operating System development, ACM SIGOPS Operating Systems Review, v.9 n.5, p.122-131, November 1975

INDEX TERMS

Keywords:
capabilities, faults, layering domains, memory hierarchy, operating system, protection