8/9/2019 Hydra Multiproccesor Kernel

1/9

Operating C. WeissmanSystems Editor

H Y D R A : T h e K ernelof a M ultiprocessorOperating SystemW. Wulf, E. Cohen, W. Corwin, A. Jones,R. Levin, C. Pierson, and F. PollackCarnegie-Mellon Universi ty

This pape r desc ribes the des ign p h i losophy o f HYDRA- - t h e k e r n e l o f an o p e r at i n g s y s t e m f o r C . m m p , t h e

C a r n e g i e - M e l l o n M u l t i - M i n i - P r o c e s s o r. T h i s p h i l o so p h yis real ized through the int roduct iot~ of a general izedno t ion o f " re source , " bo th phys ica l and v i r tua l , ca l l edan "ob jec t . " Me chan i s ms a re p resen ted fo r dea l ing wi thob jec t s , i nc lud ing the c rea t ion o f new types , spec i f i ca tionof new opera t ions app l i cab le to a g iven type , sha r ing ,and p ro tec t ion o f any r e fe rence to a g iven ob jec t aga ins timproper app l i ca t ion o f any o f the ope ra t ions de f inedwi th r e spec t to tha t t ype o f ob jec t . The mechan i smsprov ide a cohe ren t bas i s fo r ex tens io n o f the sys t em intwo d i r ec t ions : t he in t roduc t ion o f new fac i l i t ie s , andthe c rea t ion o f h igh ly secure sys t ems .

K e y W o r d s a n d P h r a s e s : o p e r a t in g s y s t e m , k e r n e l,

nuc leus , p ro tec t ion , s ecur i tyC R C a t e g o r i e s : 4 . 3 , 6 . 2

Copyright 1974, Association for Computing Machinery, Inc.General permission to republish, but not for profit, all or partof this material is granted provided that ACM's copyright noticeis given and that reference is made to the publication, to its dateof issue, and to the fact that reprinting privileges were grantedby permission of the Association for Computing Machinery.

This work was supported by the Advanced Research ProjectsAgency of the Office of the Secretary of Defense (F44620-70-C-0107) and is monitored by the Air Force Office of Scientific ResearchAuthors' address: Department of Computer Science, Carnegie-Mellon University, Schenley Park, Pittsburgh, PA 15213.

337

In t roduc t ion

The HYDRA system is the "ker nel " base for a collectionof operating systems designed to exploit and explorethe potential inherent in a multiprocessor computersystem. Since the field of parallel processing in general,and multiprocessing in particular, is not current art,the design of HYDRA has a dual goal imp osed upon it:(1) to provide, as any operating system must, an en-vironment for effective utilization of the hardwareresources, and (2) to facilitate the cons truc tion of suchenvironments. In the latter case the goal is to provide arecta-environment which can serve as the host forexploration of the space of user-visible operating en-vironments.

The p articul ar hardw are on which HYDRA has beenimplemented is C.mmp, a multiprocessor constructedat Carnegie-Mellon University. Although the details ofthe design of C.mmp are not essential to an understand-ing of the material which follows, the following briefdescription has been included to help set the context(a more detailed description may be found in [9]).C.mmp permits the connection of 16 processors to 32million bytes of shared primary memory through across-bar switch. The processors are any o f the variousmodels of PDP-11 minicomputer s. E ach proces sor isactually an independent computer system with a smallamount of private memory, secondary memories, I/Odevices, etc. Processors may interrupt each other atany of four priority levels; a central clock serves forunique-name generation (see below) and also broadcastsa central time base to all process6rs. Relocation hard-ware on each processor's bus provides mapping ofvirtual addresses on that bus to physical addresses inshared primary memory.

D e s i g n P h i l o s o p h y

The design p hilos ophy of HYDRA evolved from boththe environment in which the system was to functionand a set of principles held by its designers. The centralgoals of the system together with the attitudes expressedbelow suggest that, at the heart of the system, oneshould build a collection of facilities of "universalapplicability" and "absolute reliability"- -a set ofmechanisms from which an arbitrary set of operatingsystem facilities and policies can be conveniently,

flexibly, efficiently, and reliably constructed. Moreover,lest the flexibility be constrained at any instant, itshould be possible for an arbi trar y num ber of systemscreated from these facilities to co-exist simultaneously.The collection of such basic facilities has been calledthe k e r n e l or nuc leus [1] of an operating system. Themore specific considerations are listed below.1 . M u l t i p r o c e s so r e n v i r o n m e n t .Although multiproces-sors have been discussed for well over a decade and a

1 Manufactured by Digital Equipment Corpormion.

Communications June 1974of Volume 17the ACM Number 6

8/9/2019 Hydra Multiproccesor Kernel

2/9

f e w h a v e b e e n b u i l t , b o t h t h e p o t e n t i a l s a n d p r o b l e m so f t h e s e s y s t e m s a r e d i m l y p e r c e i v ed . T h e d e s ig n o fhYDRA was con s t ra in ed to be suff ic ien t ly cons erva t iv et o i n s u re it s c o n s t r u c t i o n a n d u t i l it y i n a r e a s o n a b l et i m e f r a m e , y e t f l e xi b le e n o u g h t o p e r m i t e x p e r i m e n t a le x p l o r a t i o n w i t h i n t h e d e s i g n s p a c e b o u n d e d b y i t sh a r d w a r e c a p a b i l i t i e s .2. Separation o f mechanism a nd policy.A m o n g t h em a j o r c a u s e s o f o u r i n a b i l it y t o e x p e r i m e n t w i th , a n dadapt , ex is t ing opera t ing sys tems i s the i r fa i lu re top r o p e r l y s e p a r a t e m e c h a n i s m s f r o m p o l i c i e s . ( H a n s e n[ 1] h a s p r e s e n t e d c o g e n t a rg u m e n t s f o r t h is s e p a r a t i o n . )S u c h s e p a r a t i o n c o n t r i b u t e s t o t h e f l e xi b il i ty o f th es y s t e m , f o r i t l ea v e s t h e c o m p l e x d e c i s i o n s i n t h e h a n d so f t h e p e r s o n w h o s h o u l d m a k e t h e m - - t h e h i g he r -l e v els y s t e m d e s i g n e r.3. Integration o f the design with implementation me th-odology. I t h a s b e e n o b s e r v e d t h a t t h e s t r u c t u r e o f e x -t a n t o p e r a t i n g s y s t e m s b e a r s a r e m a r k a b l e r e s e m b l a n c et o t h a t o f t h e o rg a n i z a t i o n w h i c h c r e a t e d t h e m . T h i sobs erva t ion i s one of a se t which asser t s the (prac t ica l )i m p o s s i b i l i t y o f s e p a r a t i n g t h e d e s i g n f r o m t h e m e t h -o d o l o g y t o b e u s ed in i m p l e m e n t i n g - t h e d e s i g n . T h ea u t h o r s ' p r e d i s p o s i t io n f o r i m p l e m e n t a t i o n m e t h o d o l -o g y is a h y b r i d o f s tr u c t u r e d p r o g r a m m i n g a s a d v o c a t e db y D i j k s t r a a n d o t h e r s [ 2] a n d t h e m o d u l a r i z a t i o np h i l o s o p h y o f P a r n a s [ 8] .4. Rejectio n of strict hierarchical layering.T h e n o t i o no f a s t r ic t h i e r a r c h i c a l ly l a y e r e d s y s t e m h a s b e c o m ep o p u l a r s i n c e f i r s t d e s c r i b e d b y D i j k s t r a f o r t h e T H Esys tem [3] . Whi le we be l ieve tha t the sys tem as v iewedb y a n y s i n g l e u s e r s h o u l d b e h i e r a r c h i c a l l y s t r u c t u r e d ,w e r e j e c t t h e n o t i o n a s a g l o b a l d e s i g n c r i t e r i o n . Web e l ie v e t h a t i f t h e e n t i r e s y s t e m i s s o s t r u c t u r e d , t h edes ign wi l l severe ly l imi t the f lex ib i l i ty ava i lab le to the

h i g h - l e v e l u s e r a n d w i l l s t r a n g l e e x p e r i m e n t a t i o n ; i np a r t i c u l a r, t h e r e i s n o r e a s o n t o b e l i e v e t h a t t h e s a m eh i e r a r c h i c a l r e l a t i o n s h o u l d e x i s t f o r c o n t r o l a s f o rr e s o u r c e a l l o c a t i o n , o r a s f o r p r o t e c t i o n , e t c .5. Protection. F l e x i b i l i t y a n d p r o t e c t i o n a r e c l o s e l yr e l a t e d , b u t n o t i n v e r s e l y p r o p o r t i o n a l . We b e l i e v e t h a tp r o t e c t i o n i s n o t m e r e l y a r e s t r i c t i v e d e v i c e i m p o s e d b y" t h e s y s t e m " t o i n s u r e t h e i n t e g ri t y o f u s e r o p e r a t i o n s ,b u t is a k e y t o o l i n t h e p r o p e r d e s i g n o f o p e r a t i n g s y s -tems . I t i s essen t ia l fo r p ro tec t ion to ex is t in a un i formm a n n e r t h r o u g h t h e s y s t em , a n d n o t t o b e a p p l i ed o n l yto spec i f ic en t i ti es (e .g . f l ies ) . The idea of capabi l i t i es( in t h e s e n se o f D e n n i s [ 5] ) is m o s t i m p o r t a n t i n t h e

laVORA des ign; the kerne l p rovid es a p ro te c t io n fac i l i tyf o r a l l e n t i t i e s i n t h e s y s t e m . T h i s p r o t e c t i o n i n c l u d e sn o t o n l y t h e t r a d i t i o n a l r e a d , w r i te , e x e c u t e c a p a b il i t ie s ,b u t a r b i t r a r y p r o t e c t i o n c o n d i ti o n s w h o s e m e a n i n g i sd e t e r m i n e d b y h i g h e r- l e v e l s o f t w a r e .6. Reliability.T h e e x i s t en c e o f m u l t i p l e c o p i e s o f m o s tc r i ti c a l h a r d w a r e r e s o u r c e s i n C . m m p s u g g e s ts t h ep o s s i b i li t y o f h i g h l y r e li a b l e o p e r a t i o n . O u r d e s i r e is t op r o v i d e c o m m e n s u r a t e r e l i a b i l i t y i n t h e s o f t w a r e . R e -l i a b i l i t y n o t o n l y r e q u i r e s t h a t t h e s y s t e m b e c o r r e c t ,

338

b u t t h a t i t b e a b l e t o d e t e c t a n d r e c o v e r f r o m e r r o r s t h a td o e x i s t - - a s t h e r e s u l t o f h a r d w a r e m a l f u n c t i o n , f o re x a m p l e .

D e f i n i n g a k e r n e l w i t h a ll t h e a t t r i b u t e s g i v e n a b o v eis d i ff icu l t , and perhaps imprac t ica l a t the cur ren t s ta teo f t h e a r t. I t i s , n e v er t h e l es s , t h e a p p r o a c h t a k e n i n t h eH YD RA s y s t e m . A l t h o u g h w e m a k e n o c l a i m e i t h e r t h a tthe se t o f fac i l i t ies p ro vid ed b y the HYDRA kerne l i sm i n i m a l ( t h e m o s t p r i m i t i v e " a d e q u a t e " s e t ) o r t h a t i t i sm a x i m a l l y d e s i r a b l e , w e d o b e l i e v e t h e s e t p r o v i d e sp r i m i t i v e s w h i c h a r e b o t h n e c e s s a r y a n d a d e q u a t e f o rt h e c o n s t r u c t i o n o f a l a rge a n d i h t e r e s t i n g c l a ss o fo p e r a t i n g e n v i r o n m e n t s . I t i s o u r v i e w t h a t t h e s e t o ff u n c t i o n s p r o v i d e d b y H Y D R A w i ll e n a b l e t h e u s e r o fC . m m p t o c r e a t e h i s o w n o p e r a t i n g e n v i r o n m e n t w i t h -o u t b e i n g c o n f i n e d t o p r e d e t e r m i n e d c o m m a n d a n d f i les y s t e m s , e x e c u t i o n s c e n a r i o s , r e s o u r c e a l l o c a t i o n p o l i c i e s ,e tc .

G i v e n t h e g e n e r a l d e c is i o n to a d o p t t h e " k e r n e ls y s t e m " a p p r o a c h , t h e q u e s t i o n r e m a i n s a s t o w h a tb e l o n g s in a k e rn e l an d , p e r h a p s m o r e i m p o r t a n t , w h a td o e s n o t . N o n s p e c i f i c a n s w e r s t o th i s q u e s t i o n a r e i m -p l i c i t i n t h e a t t i t u d e s e n u m e r a t e d e a r l i e r ; e . g . a s e t o fm e c h a n i s m s m a y b e a p p r o p r i a t e i n a k e r n e l, b u t p o l i cyd e c i s i o n s c e rt a i n l y a re n o t . F o r o t h e r, m o r e s p e c i f ic ,a n s w e r s w e m u s t s t e p o u t s i d e t h e s e a t t i t u d e s a l o n e a n dc o n s i d e r t h e n a t u r e o f t h e e n t i ty t o b e b u i l t u s i n g t h efac i l i t i es o f a kerne l .

I f a k e r n e l i s t o p r o v i d e f a c i l i t i e s f o r b u i l d i n g a no p e r a t i n g s y s t e m a n d w e w i s h t o k n o w w h a t t h e s efac i l i t i es should be , then i t i s re levant to ask what ano p e r a t i n g s y s t e m / s o rdoes. Tw o v i e w s a r e c o m m o n l yh e l d : ( I ) a n o p e r a t i n g s y s t e m d e f i n e s a n " a b s t r a c tm a c h i n e " b y p r o v i d i n g f a c i li t ie s , o r r e s o u r c e s , w h i c h a r em o r e c o n v e n i e n t t h a n t h o s e p r o v i d e d b y t h e " b a r e "

h a r d w a r e ; a n d ( 2 ) a n o p e r a t i n g s y s t e m a l l o c a t e s ( h a r d -w a r e ) r e s o u r c e s i n s u c h a w a y a s t o m o s t e f f e c t i v e l yu t i li z e t h e m . O f c o u r s e t h e s e v i ew s a r e , r e s p e c t i v e l y,t h e b i r d ' s - e y e a n d w o r m ' s e y e v i ew s o f w h a t i s a s i ng l ee n t i t y w i t h m u l t i p l e g o a l s . N e v e r t h e l e s s , t h e i m p o r t a n to b s e r v a t i o n f o r o u r p u r p o s e s i s t h e e m p h a s i s p l a c e d ,i n b o t h v i e w s , o n t h e c e n t r a l r o l e o fresources--bothp h y s i c a l a n d a b s t r a c t .

T h e m e c h a n i s m s p r o v i d e d b y t h e H Y D RA k e r n e l a r ea ll i n t e n d e d t o s u p p o r t t h e a b s t r a c te d n o t i o n o f ar e s o u r c e ( i n c a r n a t i o n s o f a r e s o u r c e a r e c a ll e dobjects).T h e s e m e c h a n i s m s p r o v i d e f o r th e c r e a t i o n a n d r e p r e s e n -t a t i o n o f n e w types o f r e s o u r c e s , a s w e l l as o p e r a t i o n s

d e f i n e d o n t h e m , p r o t e c t e d a c c e s s to i n s t a n c e s o f o n e o rm o r e r e s o u r c e s w i t h i n c o n t r o l l e d e x e c u t i o n d o m a i n s ,a n d c o n t r o l l e d pa s s in g o f b o t h c o n t r o l a n d r e s o u r c e sb e t w e e n e x e c u t i o n d o m a i n s . T h e k e y a s p ec t s o f t h e s ef a c il i ti e s a re t h e g e n e r a l i z e d n o t i o n o f r e s o u r c e , t h ed e f i n it i o n o f a n e x e c u t io n d o m a i n , a n d t h e p r o t e c t i o nm e c h a n i s m w h i c h a l l o w s o r p r e v e n t s a c ce s s t o r e s o u r c e sw i t h i n a d o m a i n . T h e r e m a i n d e r o f t hi s p a p e r f o c u s e s o nt h e s e i s su e s , t h u s d e e m p h a s i z i n g s e v e r a l o f t h e o t h e ri ssues ra i sed ear l ie r.

Comm unications June 1974of Volume 17the ACM Number 6

8/9/2019 Hydra Multiproccesor Kernel

3/9

O v e r vi ew o f th e H Y D R A E n v ir o nm e n t

B e f o r e p r o c e e d i n g t o a d e t a i l e d d e s c r i p t i o n o f t h em e c h a n i s m s , i t w il l b e c o n v e n i e n t t o p r e s e n t a s o m e w h a ti n c o m p l e t e a n d s i m p l i s ti c v i ew o f t h e e x e c u t i o n e n -v i r o n m e n t c r e a t e d b y t h e H Y DR A k e r n e l . T h e m a t e r i a lp r e s e n t e d i n t h i s s e c t i o n w i l l b e e l a b o r a t e d f u r t h e r i nt h e f o l l o w i n g s e c t i o n s ; h o w e v e r, t h e o v e r v i e w w i l l a t -t e m p t t o p r o v i d e t h e c o n t e x t n e c e s s a r y t o u n d e r s t a n dt h e m o r e d e t a i l e d i n f o r m a t i o n .

I n o r d e r t o u n d e r s t a n d t h e e x ec u t i on e n v i r o n m e n tw h i c h t h e k e r n e l p r o v i d e s , o n e m u s t c l e a r l y u n d e r s t a n dt h e i n t e r r e l a t i o n s h i p s o f t h r e e o b j e c t t y p e s :procedure,LNS, a n d process.T h e s e p r i m i t i v e o b j e c t s a r e p r o v i d e db y t h e k e r n e l s p e c if i ca l ly f o r t h e p u r p o s e o f c r e a t i n ga n d m a n i p u l a ti n g a n e x e c u t i o n e n v ir o n m e n t .

T h e p r o c e d u r e o b j e c t i s s i m p l y a n a b s t r a c t i o n o f t h ei n t u i t iv e n o t i o n o f p r o c e d u r e o r s u b r o u t i n e ; z t h a t i s, ap r o c e d u r e ha s so m e " c o d e " a n d s o m e " d a t a " a s s o -c i a t e d w i t h i t , i t m a y a c c e p t p a r a m e t e r s , a n d i t m a y r e -t u r n v a l u es . H Y D RA p r o c e d u r e s g o b e y o n d t h i s s i m p l emodel by inc luding pro tec t ion fac i l i t i es , as we sha l l sees h o r t l y. T h e a c t o f c r e a t i n g a p r o c e d u r e o b j e c t i s

a n a l o g o u s t o th e t a s k o f w r i t i n g a n A l g o l p r o c e d u r e ;o n e p r o d u c e s a b o d y o f co d e , a s s o c i a te s t h e c o d e w i t h an a m e , d e c l a r e s t h e d a t a w h i c h t h e c o d e r e q u i r e s , a n ds p e ci f ie s t h e n a t u r e o f t h e p a r a m e t e r s a n d r e t u r n v a l u e sw h i c h a r e i n v o l v e d . I n m o r e a b s t r a c t t e r m s , o n e c r e a t e sa s e q u e n c e o f i n s t r u c t i o n s a n d d e s c r i b e s t h e e n v i r o n m e n tin w hich th ey wi l l u l t im ate ly e xecute ; in HYDRA th isa b s t r a c t i o n i s m a d e p r e c is e . L e t u s c o n s i d e r t h e e n v i r o n -m e n t d e s c r i p t i o n f i r s t .

A p r o c e d u r e o b j ec t c o n t a i n s a l is t o f r e f e r e n c e s t oo t h e r o b j e c t s w h i c h m u s t b e a c c e s s e d d u r i n g t h e e x e c u -t ion of the pro ced ure ' s code . T his i s , in fac t , a li s t o fcapabi l i t i es [7] and , therefore , def ines no t on ly whicho b j e c t s t h e p r o c e d u r e m a y r e f e r e n c e , b u t a l s o w h a t a c -t i o n s i t m a y p e r f o r m o n t h o s e o b j e c t s . T h e c a p a b i l i t i e sw h i c h a p r o c e d u r e r e q u i r e s m a y b e d i v i d e d i n t o t w og r o u p s : t h o s e w h i c h a r e c a l le r i n d e p e n d e n t a n d t h o s ew h i c h a r e c a l l e r d e p e n d e n t . T h e s e g r o u p s n a t u r a l l yc o r r e s p o n d t o t h o s e o b j e c t s w h i c h t h e p r o c e d u r e a l w a y saccesses (a t l eas t po ten t ia l ly ) and those ob jec t s whicha r e c o n s i d e r e d p a r a m e t e r s . O b v i o u s l y, t h e f o r m e r o fthese group s can b e prec ise ly spec i f ied a t the t ime th ep r o c e d u r e i s c r e a t e d , w h i l e t h e l a t t e r c a n o n l y b ec h a r a c t e r i z e d s i n c e t h e a c t u a l o b j e c t s p a s s e d a s p a r a m -e t e r s a r e u n k n o w n u n t i l e x e c u t i o n t i m e . T h u s , t h e e n -v i r o n m e n t d e f i n e d b y a p r o c e d u r e o b j e c t c o n t a i n s s o m e" h o l e s " o r " p a r a m e t e r p o s i t i o n s " w h i c h a r e o n ly p ar -t ia l ly spec i f ied a t c rea t ion t ime . These ho les a re f i l l edi n f o r e a c h e x e c u t i o n o f t h e p r o c e d u r e , u s i n g c a p a b i li t ie s

2 It sh ould be noted however, that the cost of entering aHYDRA procedure is considerably greater than, say, a Fortransubroutine. We do not expect that simple subroutines, such as SIN,would use the HYD RA mechanism until better hardware is pro-vided. The reader should visualize a procedure as replacing rela-tively large code units an d/o r at points where protection environ-ments m ust change.

provided by the ca l le r. We wi l l re turn to a d i scuss ion t h e m e c h a n i s m b y w h i c h a p r o c e d u r e c h a r a c t e r i z e s ip a r a m e t e r s , b u t f i r s t w e m u s t e x a m i n e t h e L N S .

A procedurei s a s ta t ic en t i ty ; an LNS ( loca l nams p a c e ) i s t h e r e c o r d o f t h e e x e c u t i o n e n v i r o n m e n t o fp r o c e d u r e w h e n t h a t p r o c e d u r e i s i n v o k e d ( c a l l e dT h e r e i s a u n i q u e L NS f o r e a c h i n v o c a t i o n , w h i c h d ia p p e a r s a f t e r t h e p r o c e d u r e t e r m i n a t e s . T h e L NS f o rp a r t i c u l a r i n v o c a t i o n i s t h e r e s u lt o f c o m b i n i n g t hc a l l e r - i n d e p e n d e n t c a p a b i l i t i e s ( l i s t e d i n t h e p r o c e d u

o b j e c t ) w i t h c a l l e r - d e p e n d e n t a c t u a l p a r a m e t e r s ( o nc h a r a c t e r i z e d i n t h e p r o c e d u r e o b j e c t ) t o f o r m a s i n gl i s t o f capabi l i t ies . Th e LNS def ines the to ta l i ty o f caa b i l i t i e s a v a i l a b l e t o a p r o c e d u r e d u r i n g t h e e x e c u t i or e s u l t i n g f r o m a p a r t i c u l a r i n v o c a t i o n . N o t e t h a t t hL N S, w h i l e h e a v il y d e p e n d e n t u p o n t h e c o r r e s p o n d i np r o c e d u r e f o r i t s i n i t i a l i z a t i o n , i s a w h o l l y i n d e p e n d eo b j e c t t h e r e a f t e r, a n d a l t e r a t i o n s o f t h e LN S d o n oa ff e ct t h e p r o c e d u r e o b j e c t ; t h i s i m p l ie s , a m o n g o t ht h i n gs , t h a t p r o c e d u r e s a r e r e e n t r a n t a n d p o t e n t i a l l y rcurs ive .

U p t o t h i s p o i n t t h e t e r m " c a p a b i l i t y " h a s b e e n u s ei n a s o m e w h a t l o o s e a n d i n t u i t i v e s e n s e ; s u b s e q u e n t

i t wi l l be used in a technica l sense . Acapability c o n -s i s ts o f a re fe rence to an ob jec t toge th er wi th a co l let i o n o f " a c c e s s r i g h t s " t o t h a t o b j e c t . P o s s e s s i o n o fc a p a b i l i t y i s t a k e n a s p r i m a f a c ie e v i d e n c e t h a t t hp o s s e s s o r m a y a c c e s s t h e o b j e c t i n t h e w a y s , a n d only t h e w a y s , d e s c r i b e d b y t h e c a p a b i l i t y. C a p a b i l i t i et h e m s e l v e s a re m a n i p u l a t e d o n l y b y t h e k e rn e l ; h e ni t is i m p o s s i b l e t o " f o rg e " a c a p a b i l i t y.

A p r o c e d u r e o b j e c t m a y c o n t a i ntemplatesin addi -t i o n t o t h e u s u a l c o l l e c t i o n o f c a l l e r - i n d e p e n d e n t c a pabil i t ies . Templates c h a r a c t e r i z e t h e a c t u a l p a r a m e t e r se x p e c t e d b y th e p r o c e d u r e . W h e n t h e p r o c e d u r e ca l led , the s lo t s in the LNS which co r res pon d to p arameter t empla tes in the procedure ob jec t a re f i l l ed wi t" n o r m a l " c a p ab i li t ie s d e r i v e d f r o m t h e a c t u a l p a r a me t e r s s u p p l i e d b y t h e c a l l e r. T h i s " d e r i v a t i o n " i s , if a c t , t h e h e a r t o f t h e p r o t e c t i o n - c h e c k i n g m e c h a n i s ma n d t h e t e m p l a t e d e f i n e s t h e c h e c k i n g t o b e p e r f o r m e dIf the ca l le r ' s r igh ts a re adeq uate , a capab i l i ty i s cons t ruc t ed in the (new ) LNS which re fe rences the ob jep a s s e d b y t h e c a l le r a n d w h i c h c o n t a i n s r i g h t s f o r m eby merg ing the ca l le r ' s r igh ts wi th the r igh ts spec i f iei n t h e t e m p l a t e . T h i s i m p l i e s t h a t a c a l l e e m a y h a vg r e a t e r f r e e d o m t o o p e r a t e o n a n o b j e c t t h a n t h e c a l l ew h o p a s s e d i t as a p a r a m e t e r, b u t t h e c a ll e r c a n i n nw a y o b t a i n t h a t f r e e d o m f o r h i m s e l f . We s h a l l s e e t h at h i s p o t e n t i a l e x p a n s i o n o f r ig h t s a c r o s s e n v i r o n m e ndom ains i s a key fac to r in ach iev ing the f lex ib i l i ty goao f t h e k e r n e l a n d i n a l l o w i n g u s t o r e j e c t e n f o r c eh i e r a r c h i c a l s t r u c t u r e s w i t h o u t i n t r o d u c i n g c h a o s .

B e f o r e p r o c e e d in g , le t u s r e v i e w t h e m a j o r a c t i o n s t h e C A L L m e c h a n i s m . A n e x e c u t i n g b o d y o f c o d e f i rno t i f ies the kerne l tha t i t wishes to ca l l a p rocedurT h e k e r n e l e x a m i n e s t h e a c t u a l p a r a m e t e r c a p a b i l i t i es u p p l i e d b y t h e c a l l e r a n d d e t e r m i n e s w h e t h e r a l l p r o

339 Comm unications June 1974of Volume 17the ACM Number 6

8/9/2019 Hydra Multiproccesor Kernel

4/9

t e c t i o n r e q u i r e m e n t s a r e m e t . I f s o, th e k e r n e l c r e a te s an e w L NS w h i c h d e f in e s t h e n e w e n v i r o n m e n t ; t h e c a l l e r ' sLNS i s sup erce ded by th i s new LNS for the du ra t io n o ft h e c al l e d p r o c e d u r e ' s e x e c u t i o n . T h e b o d y o f c o d ea s s o c i a t e d w i t h t h e c a l le e r e c e iv e s c o n t r o l f r o m t h ek e r n e l a n d b e g i n s e x e c u t i n g . W h e n i t c o m p l e t e s i t sfunc t ion , i t wi l l r e tu rn con t ro l to i t s ca l l e r by way ofthe ke rne l . Th e kerne l wi ll de le te the ca l l ee ' s LNS andr e s t o r e t h a t o f t h e c a l le r , t h u s r e t u r n i n g t o t h e p r e v i o u se n v i r o n m e n t .

U p t o th i s p o i n t , n o t h i n g w e h a v e d e s c r i b e d s u g g e s t sa n y e x p l o i t a t i o n o f th e p a r a l l e l p r o c e s s i n g c a p a b i l i t ie so f C . m m p . T h e a c t io n s i n v o l v e d in c a l li n g a n d r e t u r n i n gf r o m p r o c e d u r e s a r e s t r i c t l y s e q u e n t i a l i n n a t u r e , b e i n gi n e s s e n c e f o r m a l i z a t i o n s o f t r a d i t i o n a l s u b r o u t i n e b e -h a v i o r. We c o m e n o w t o t h e u n it o f a s y n c h r o n o u sp r o c e s s i n g i n H Y D R A - - t h eprocess. A process in thet e c h n i c a l s e n s e d e f i n e d b y H Y D RA c o r r e s p o n d s c l o s e l yt o o n e ' s i n tu i t i v e n o t i o n o f a p r o c e s s . Vi e w e d f r o m t h eou ts ide , i t i s the smal les t en t i ty which can be inde-p e n d e n t l y s c h e d u l e d f o r e x e c u t io n . Vi e w e d f r o m t h ei n s id e , i t c o n s t i t u t e s a p r e c i s e r e c o r d o f th e c h a n g e s o fe n v i r o n m e n t i n d u c e d b y a s e q u e n c e o f c a ll s . I n o t h e rwo rds , a p roces s i s a s t ack o f LNS 'S which repre sen t s thec u m u l a t i v e s t a t e o f a si n g le s e q u e n t i a l t a s k . H Y D RAi m p l e m e n t s i n t e r p r o c e s s c o m m u n i c a t i o n a n d s y n c h r o -n i z a t i o n b y p r o v i d i n g e l e m e n t a r y m e s s a g e b u f f e r i n gp r i m i t i v e s a n d D i j k s t r a - s t y l e s e m a p h o r e o p e r a t i o n s .T h e s e f a c i l i t i e s h a v e b e e n t r e a t e d i n [ 4 ] a n d e l s e w h e r eand wi l l no t be d i scussed here .

T h e P r o t e c t io n M e c h a n i s m

T h e p r o t e c t i o n m e c h a n i s m i s a t t h e h e a r t o f t h e

H Y DR A d e s i g n . I n d e s c r i b i n g t h e m e c h a n i s m i t i s i m -p o r t a n t a t t h e o u t s e t t o d i s t i n g u i s h b e t w e e nprotectiona n d security a n d t o d e t e r m i n e w h a t i s t o b e p r o t e c t e da n d a g a i n s t w h a t .

I n o u r v i e w, p r o t e c t i o n i s a m e c h a n i s m ; s e c u r i t y i s ap o l i c y. A s y s t e m u t i l i z i n g s u c h a m e c h a n i s m m a y b em o r e o r l e s s s e c u r e d e p e n d i n g u p o n p o l i c i e s g o v e r n i n gt h e u s e o f t h e m e c h a n i s m ( f o r e x a m p l e , p a s s w o r d sa n d t h e l i ke a r e p o l i c y is s u e s) a n d u p o n t h e r e l i a b il i tyo f t h e p r o g r a m s w h i c h m a n i p u l a t e t h e p r o t e c te d e n -t it ie s . T h u s t h e d e s i g n g o a l o f t h e H Y D R A p r o t e c t i o nm e c h a n i s m i s t o p r o v i d e a s e t o f c o n c e p t s a n d f a c i l it i eso n w h i c h a h i g h l y s e c u r e s y s t e m m a y b e b u i l t , b u tnott o i n h e r e n t l y p r o v i d e t h a t s e c u r i t y. A p a r t i c u l a r c o n -s e q u e n c e o f t h i s p h i l o s o p h y h a s b e e n t o d i s c a r d t h en o t i o n o f " o w n e r s h i p . " W h i l e o w n e r s h i p i s a u se f u l,p e r h a p s e v e n a n i m p o r t a n t , c o n c e p t f o r c e rt a i n " s e c u r -i t y " s t r a t e g i e s , t o i n c l u d e t h e c o n c e p t a t t h e m o s t p r i m -i t iv e le v e l s w o u l d b e t o e x c l u d e t h e c o n s t r u c t i o n o f c er -t a i n o t h e r c l a s s e s o f t r u l y s e c u r e s y s t e m s .

O u r r e j e c t i o n o f h i e r a r c h i c a l s y s t e m s t r u c t u r e s , a n de s p e c i a l l y o n e s w h i c h e m p l o y a s i n g l e h i e r a r c h i c a l r e l a -t ion fo r a l l a spec t s o f sys te m in te rac t ion , i s a l so , in

p a r t , a c o n s e q u e n c e o f t h e d i st i n c t io n b e t w e e n p r o t e c t i o na n d s e c u r it y. A f a i l u r e t o d i s t in g u i s h t h e s e is s u e s c o u p l e dw i t h a s t r i ct h i e r a r c h i c a l s t r u c t u r e l e a d s i n e v i t a b l y t o as u c c e s s io n o f i n c r e a s i n g l y p r iv i l e g e d s y s t e m c o m p o n e n t s ,a n d u l t i m a t e l y t o a " m o s t p r i v i l e g e d " o n e , w h i c h g a i nthe i r p r iv i l ege exc lus ive ly by v i r tue o f the i r po s i t ion int h e h i e r a r c h y. Te c h n o l o g i s t s l i k e h i e r a r c h i c a l s t r u c -t u r e s - t h e y a r e e l e g a n t; b u t ex p e r i en c e f r o m t h e r e a lw o r l d s h o w s t h e y a r e n o t v i a b l e s e c u r i t y s t r u c t u r e s . T h ep r o b l e m , t h e n , w h i c h H Y D R A a t t e m p t s t o f a c e s q u a r e l y,

i s t o m a i n t a i n o r d e r in a n o n h i e r a r c h i c a l e n v i r o n m e n t .T h e o b v i o u s c a n d i d a t e f o r ( t h e u n it o f ) p r o t e c t i o n

is the object s i n ce t h is i s t h e a b s t r a c t e d n o t i o n o f a na r b i t r a r y r e s o u r c e . S i m i l a r l y, t h e H Y D R Aprocedure isc o n s i d e r e d t o b e t h e a b s t r a c t io n o f a n o p e r a t i o n . T h u sH YD RA p r o v i d e s a p r o t e c t i o n m e c h a n i s m f o r t h e a p p l i c a -t i o n o f o p e r a t i o n s (procedures) t o i n s t a n c e s o f r e s o u r c e s(objects). All o f the fam i l i a r secur i ty fo r f il e s (e .g . r ead ,w r i t e , d e l e t e ) , m e m o r y ( e . g . r e a d , w r i t e , e x e c u t e ) , e t c . ,c a n b e c o n v e n i e n t l y m o d e l e d i n t h i s w a y. I n a d d i t i o n al a rg e a d d i t i o n a l c l a s s o f s e c u r e s y s t e m s c a n b e b u i l t .

E v e r y t h i n g o f i n t e r e st i n t h e H Y D R A v i e w i s th e a b -s t r a c t e d n o t i o n o f a r e s o u r c e , c a l l e d a nobject, o r ar e f e r e n c e t o a n o b j e c t , c a l l e d acapabili ty. E a c h o b j e c th a s a unique name, a type part,a n d a representation( c o n s i s t i n g o f a capabili ty part , a n d a data part).

T h e u n i q u e n a m e o f a n o b j e c t d i s ti n g u is h e s t h eo b j e c t n o t o n l y f r o m a l l o t h e r e x t a n t o b j e c t s , b u t f r o ma l l o b j e c t s w h i c h h a v e e x i s t e d o r w i l l e x i s t . K n o w l e d g eo f t h e u n i q u e n a m e o f a n o b j e c t d o e snot g r a n t a c c e s st o t h e o b j e c t s i n c e o b j e c t s m a y o n l y b e r e f e r e n c e dt h r o u g h c a p a b i li t ie s ( w h i c h a r e n o t m a n i p u l a b l e e x c e p tb y t h e k e r n e l ) .

T h e t y p e p a r t o f a n o b j e c t s e r v e s t o i d e n t i f y t h eo b j e c t w i t h t h a t c l a s s o f o b j e c t s w h o s e t y p e p a r t s h a v ea n i d e n t i c a l v a l u e . T h e t y p e p a r t c o n t a i n s , i n f a c t , t h eu n i q u e n a m e o f a d is t i n g u i s h e d o b j e c t w h i c h s e r v e s a st h e r e p r e s e n t a t i v e o f s u c h a c la s s . ( B y c o n v e n t i o n t h et y p e o f t h e se r e p r e s e n t a t i v e s i s t h e n a m e o f a s p e c i a ld i s t i n g u i s h e d o b j e c t w h o s e n a m e i s T Y P E a n d w h i c hnam es i t se l f in i ts type f i e ld . ) S ince the re i s a po ten t ia l lyi n fi n it e s u p p l y o f u n i q u e n a m e s , t h e r e i s a p o t e n t i a l l yi n fi n it e n u m b e r o f o b j e c t t y p e s a s w e ll . A n e w c l a s s o fo b j e c t s m a y b e c r e a t e d s i m p l y b y c r e a t i n g a s i n g l e o b -j e c t t o s e r v e a s i t s d i s t i n g u i s h e d r e p r e s e n t a t i v e .

O b j e c t s b e c o m e i n a c c e s s i b l e o n l y w h e n t h e r e a r e n or e f e r e n c e s t o t h e m . I t i s p o s s i b l e t o g e n e r a t e s e l f -r e f e r e n t i a l s t r u c t u r e s ; a n d a l t h o u g h a g e n e r a l g a r b a g e -

c o l l e c t io n d e l e t i o n m e c h a n i s m i s r e q u i r e d , t h e s e s t r u c -t u r e s a r e r a r e . H e n c e a r e f e r e n c e c o u n t i s m a i n t a i n e di n e a c h o b j e c t , a n d o b j e c t s a r e d e l e t e d a w h e n t h i s c o u n tb e c o m e s z e r o .

T h e r e p r e s e n t a t i o n p o r t i o n o f a n o b j e c t c o n t a i n sw h a t e v e r i n f o r m a t i o n i s r e l e v a n t t o t h e r e p r e s e n t a t i o no f t h e r e s o u r c e w h i c h t h e o b j e c t d e n o t e s . T h i s i n f o r m a -t i o n m a y b e o f t w o t y p e s : d a t a ( w h i c h is n o r m a l l y u n -

a The deletion mechanism is not essential to an understandingof HY DR A, therefore this function o f the kernel will not be dis-cussed further.

3 4 0 Com munications June 1974of Volume 17the ACM Number 6

8/9/2019 Hydra Multiproccesor Kernel

5/9

8/9/2019 Hydra Multiproccesor Kernel

6/9

. add i t iona l r igh ts a re presen t on ly in the ca l lee ' s LNS--t h e c a l l e r 's L NS i s u n c h a n g e d ) . A l s o , b y a p p r o p r i a t e u s eof the check- r igh ts an d ty pe f ie lds in a temp la te , thec r e a t o r o f a p r o c e d u r e c a n i m p l e m e n t r a t h e r g e n e r a lt y p e - d e p e n d e n t p r o t e c t i o n c h e c k i n g . ( T h i s f o l l o w s f r o mthe observa t ion tha t the check- r igh ts f ie ld i s no t in -t e r p r e t e d b y t h e k e r n e l ; t h e i n t e r p r e t a t i o n o f t h e a u x i l ia r yr igh ts i s up to the user. )

P a t h N a m e s a n d t h e W a l k R i g h t

We h a v e a v o i d e d e n u m e r a t i n g t h e s p e c if i c p r i m i t i v e spro vide d by HYDRA; th i s i s in ten t io na l s ince we a rem o r e c o n c e r n e d w i th p h i l o s o p h y t h a n w i t h i m p l e m e n t a -t i o n . H o w e v e r, a f e w p r i m i t i v e s m u s t b e d i s c u s s e d i no r d e r t o f a i r l y p r e s e n t t h e p h i l o s o p h y - - o n e i swalk.T h e walk pr im i t ive i s a one- leve l coerc ion w hich , g ivena c a p a b i l i t y a n d a n o n n e g a t i v e i n t e g e r, p r o d u c e s t h ecapabi l i ty which occupies the spec i f ied pos i t ion in thec a p a b i l i t y p a r t o f t h e o b j e c t n a m e d b y t h e p a r a m e t e rc a p a b i l i ty. T h e walk pr imi t ive , l ike a l l kerne l p r imi t ives ,i s a n a c c e s s r i g h t p r o t e c t e d b y t h e " k e r n e l r i g h t s " b i t sin a capabi l i ty.

B e c a u s e o f t h ewalk p r i m i ti v e , th e e n v i r o n m e n t o f ap r o c e d u r e d o e s n o t c o n s i s t o f t h e o b j e c t s n a m e d b ycapabi l i t i es in i t s LNS a lone . R athe r, i t is the c losure oft h e s e t o f o b je c t s r e a c h a b l e a l o n g a p a t h ( o r i g i n a t i n g i nt h e L N S ) s u c h t h a t e v e r y c a p a b i l i t y a l o n g t h e p a t h(except poss ib ly the las t ) g ran t thewalk r i g h t . R e c o g -n iz ing th i s , al l o f the kern e l p r imi t ives acc ept pa t hn a m e s a s p a r a m e t e r s a n d t h ewalk r i g h t i s c h e c k e d a te a c h s t e p a l o n g t h e p a t h . T h e u s e o f p a t h n a m e s a n dw a l k r i g h t s e f f e c t a s i g n i fi c a n t r e d u c t i o n i n t h e n u m b e r o fc a p a b i l i ti e s n e e d e d i n a n L NS . F a r m o r e i m p o r t a n t , h o w -

ever, i s tha t the walk r igh t (or ra the r the lack of i t) i su s e d t o p r e v e n t a c c es s t o t h e r e p r e s e n t a t i o n o f a n o b j e c t .T h e a m p l i f i c a t io nwalk r i g ht s is o n e o f th e m o s t c o m m o nw h e n e n t e r i n g a p r o c e d u r e w h i c h i m p l e m e n t s o p e r a t i o n so n a p a r t i c u l a r o b j e c t t y p e .

S y s t e m s a n d S u b s y s t e m s

T h e p r e v i o u s s e c t i o n s d e s c r i b e h o w t h e k e r n e l s u p -p o r t s t h e n o t i o n o f a n o b j e c t , o p e r a t i o n s o n o b j e c t s , a n dp r o t e c t i o n . I t i s n o w t i m e t o q u e s t i o n t o w h a t e x t e n tt h e s e m e c h a n i s m s p e r m i t a n d f a c i l it a t e t h e c o n s t r u c t i o n

o f o p e r a t i n g s y s t e m s ; p a r t o f t h e r e s p o n s e i s i m p l i c i ti n w h a t h a s a l r e a d y b e e n d e s c r i b e d , a n d p a r t i s n o t .

A n " o p e r a t i n g s y s t e m , " i n t h e se n s e o f a m o n o l i t h i cen t i ty which p rovid es var iou s fac i l i ti es to the user, i sn o t a n a p p r o p r i a t e i m a g e o f a u s er e n v i r o n m e n t i n th eH YD RA c o n t e x t . R a t h e r, a u s e r e n v i r o n m e n t c o n s i s t s o fa c o l l e c t i o n o f r e s o u r c e s ( o b j e c t s ) o f v a r i o u s t y p e s a n dp r o c e d u r e s w h i c h o p e r a t e o n t h em . T h e e n v i r o n m e n t i nw h i c h o n e u s e r o p e r a t e s m a y o r m a y n o t b e t h e s a m ea s t h a t f o r a n o t h e r u s e r, i t m a y b e t o t a l l y d i f f e r e n t , o r

342

m ay par t ia l ly over lap . I t i s en t i re ly poss ib le , fo r ex-a m p l e , t h a t a t s o m e p o i n t i n t h e e v o l u t i o n o f t h e H YD RAe n v i r o n m e n t s e v e r a l d i f f e r e n t " f i l e s y s t e m s " w i l l h a v eb e e n d e v i s ed . E a c h . s u c h " s y s t e m " w ill c o n s i s t o f ad i s t i n c t o b j e c t - t y p e t o d e n o t e t h e s t y l e o f fi le s u p p o r t e db y t h a t s y s t e m , a n d a c o l l e c ti o n o f o p e r a t i o n s ( p r o -cedures ) for dea l ing wi th tha t s ty le of fi le . Th e var io uss t y le s o f fi le s, f o r e x a m p l e , m a y c o r r e s p o n d t o d i f f e r e n ta c c es s m e t h o d s , d i f f e r en t q u e u e i n g s t r a te g i e s f o r d e a l i n gwi th d i sk , o r d i ffe ren t secur i ty po l ic ies . An ind iv idua lu s e r m a y u s e a n y o n e o f t h e s y s te m s , o r b e c a u s e t h ev a r i o u s s y s t e m s a r e o p t i m i z e d a l o n g d i s t i n c t d i m e n -s i o n s , h e m a y u s e m o r e t h a n o n e . S i m i l a r c o m m e n t s , o fc o u r s e , a p p l y t o e v e r y t y p e o f f a c i l i t y p r o v i d e d b y a no p e r a t i n g s y s t e m , e . g . c o m m a n d i n t e r p r e t e r s , s y n -c h r o n i z a t i o n m e c h a n i s m s , e t c .

T h e f l ex i b il i ty n e c e s s a ry t o o b t a i n t h i s f o r m o f e x -t e n s i o n r e s u l ts f r o m b o t h t h e r e p r e s e n t a t i o n o f o b j e c tsa s b o t h d a t a a n d c a p a b i l i t i e s , a n d f r o m t h e n a t u r e o ft h e p r o t e c t i o n m e c h a n i s m . L e t u s r e t u r n , f o r a m o m e n t ,t o t h e i s su e r a i s e d e a r l i er c o n c e r n i n g t h e u s e o f t h ec a p a b i l i t y - p a r t o f an o b j e c t in t h e r e p r e s e n t a t i o n o f n e wo b j e c t t y p es . F i r s t , a n i n s t a n c e o f a n o b j e c t m a y b ec r e a t e d b y i n v o k i n g a k e r n e l p r i m i t i v ecreate a n d p a s s i n gt o i t a c a p a b i l i ty r e f e r e n c i n g t h e r e p r e s e n t a t i v e o f t y p eof ob jec t one wishes to c rea te . In par t icu la r, then , in -v o k i n g create with a capabi l i ty re fe renc in g the d i s -t inguished objec t nam ed TYPE wi ll c rea te the represe n ta -t ive of a new type c lass . Sub sequ ent ca l l s oncreatepass ing capabi l i t i es re fe renc ing th i s new type represen-ta t ive wi l l c rea te ins tanc es o f the new c lass of ob jec t s .

S u p p o s e , f o r e x a m p l e , t h a t a t s o m e i n s t a n t a t l e a s tt h e t y p e s 4FILE, SEMAPHORE, and PROCEDURE exist . W ew i s h t o i n t r o d u c e t h e n o t i o n o f a g e n e r a l d i r e c t o r yo b j e c t , w h i c h d e f i n e s a m a p p i n g f r o m p r i n t n a m e s t o

capabi l i t i es . One idea i s to l i s t the pr in t names in thed a t a p a r t , a n d a s s o c i a t e e a c h s u c h n a m e w i t h a c a p a b i l i t yi n t h e c a p a b i l i t y p a r t . ( C l e a r l y, a m o r e s o p h i s t i c a t e ds t r u c t u r e c o u l d b e d e v i s e d . ) To s u p p o r t t h e m u t u a l e x -c l u s i o n n e e d e d t o p e r m i t s h a r e d a c c e s s t o d i r e c t o r i e s ,we als o inclu de a cap abi l i ty for a SEMAPHORE in theDIRECTORY'S c a p a b i l i t y p a r t . We m a y n o w c r e a t e P R O -C ED URE S w h i c h " u n d e r s t a n d " t h e r e p r e s e n t a t i o n j u s td e s c r i b e d a n d w h i c h p r o v i d e t y p ic a l d i r e c t o r y f u n c t i o n s .N o t i c e t h a t w e h a v e n o t r e s t r i c t e d t h e c a p a b i l i t i e s c o n -tain ed in a D1RECa'ORY to be of the s am e ty pe; i nde ed,the PROCEDURES which m ain ta in d i rec tor ies m ay spe-cifica lly all ow di rec to rie s of FLUES, or PROCEDURES, or of

a r b i t r a r i l y m i x e d t y p e s . I n f a c t , a d i r e c t o r y m a y c o n t a i nc a p a b i l i t i e s f o r o t h e r d i r e c t o r i e s , w h i c h s u g g e s t s t h ep o t e n t i a l f o r g e n e r a l p a t h n a m e s i n a d i r e c t o r y s t r u c t u r e ,a n d i n h e r e n t s e a r c h r u l e s . M a n y v a r i a t i o n s a r e p o s s i b l e ;th e i m p o r t a n t i d e a is t h a t t h e n a t u r e o f t h e d i r e c t o r y" s u b s y s t e m " i s c o m p l e t e l y u s e r - s p e c i f i e d .

4 We have triedto use suggestivenam es for object and typenames in the examples. In practice, of course, the unique nam es ofobjects have no visible representation; they are 64-bit values.

Comm unications June 1974of Volume 17th e ACM Number 6

8/9/2019 Hydra Multiproccesor Kernel

7/9

A n E x a m p l e

I n t h i s s e c t i o n w e p r e s e n t a n e x a m p l e w h i c h d e m o n -s t ra t e s th e p o w e r o f th e p r o t e c t i o n m e c h a n i s m d e -s c r i b e d a b o v e t o a c c o m p l i s h i n a n a t u r a l w a y a k i n d o fp r o t e c t i o n w h i c h c a n b e a c h i e v e d i n e x i s t i n g s y s t e m s , i fa t a l l , on ly by ra the r a r t i f i c ia l dev ices . Whi le the spec i f i ce x a m p l e i s i t s e lf s o m e w h a t a r t if i ci a l, i t h a s v e r y r e a l i s t icc o u n t e r p a r t s .

C o n s i d e r t h e c a s e o f a re s e a r c h w o r k e r w h o , b e i n g ad i l i g e n t f e l lo w, w i s h e s t o k e e p h i m s e l f a b r e a s t o f th ere levan t l i t e ra tu re in h i s f i e ld . Also hav ing access to ac o m p u t e r , t h i s r e s e a r c h e r h a s w r i t t e n s o m e p r o g r a m st o m a i n t a i n a n a n n o t a t e d b i b l i o g r a p h y o n t h a t c o m -p u t e r. T h e p r o g r a m s p e r m i t h i m t o u p d a t e t h e b i b l i o g -r a p h y e i t h e r b y i n s e r t i n g n e w e n t r i e s o r c h a n g i n g e x i s t -i n g o n e s ; h e m a y a l s o p r i n t t h e b i b l i o g r a p h y i n t o t a l , o rs e l e ct i v e ly o n a n y o n e o f s e v e ra l c r i te r i a ; h e m a y a l s ow i s h to c o m p l e t e l y e r a s e a n e n t i r e b i b l i o g r a p h y o c c a -s i o n a l l y. I n a d d i t i o n , o u r h e r o h a s o rg a n i z e d b o t h t h ep r o g r a m s a n d t h e b i b l i o g r a p h y s t r u c t u r e t o b e v e r ye f f i c i e n t . I t ' s a n i c e s y s t e m o f p r o g r a m s , i n d e e d !

N o w, i n t h e f u l ln e s s o f ti m e , t h e r e s e a r c h e r d e c i d e st h a t i t w o u l d b e t o h is a d v a n t a g e t o a l l o w h i s co l l e a g u e s ,a n d p e r h a p s h i s s t u d e n t s , t o u s e h i s p r o g r a m s a n d h i sb i b l i o g r a p h i e s . I n a d d i t i o n t o c r e a t i n g t h e i r o w n i n -d e p e n d e n t b i b l i o g r a p h i e s , t h e c o l l e a g u e s m a y b e a b l et o a d d n e w e n t r i e s t o t h e r e s e a r c h e r ' s o w n o r t o a d da n n o t a t i o n s w h i c h ( m a y ) p r o v i d e t h e re s e a r c h e r w i tha d d i t i o n a l i n s ig h t s . H e is c o n c e r n e d , h o w e v e r, a b o u ts e v e r a l a s p e c t s o f t h e p r o t e c t i o n o f b o t h h i s p r o g r a m sa n d d a t a .1. N o o n e , e x c e p t h i m s e l f , s h o u l d b e a b l e t o e r a s e h i sb i b l i o g r a p h i e s .2 . H e w o r k e d h a r d o n h is s y s t e m o f p r o g r a m s , a n d h e

w o u l d n o t l i k e a n y o n e e l s e t o c o p y o r m o d i f y t h e m . I na n y c a s e h i s s u p e r v i s o r h a s i n f o r m e d h i m t h a t s i n c e t h ep r o g r a m s w e r e d e v e lo p e d o n t h e e m p l o y e r ' s t im e , t h ee m p l o y e r i s c o n s i d e r i n g s e l l i n g t h e m a s a p r o p r i e t a r yp a c k a g e .3 . S o m e o f th e r e f e r e n c e s c i t ed i n h is o w n b i b l i o g r a p h yw e r e w r i t te n b y h i s c o l l e a g u e s . H i s a n n o t a t i o n s a r e o c c a -s i o n a l l y c r y p t i c , a n d h e w o u l d p r e f e r t h a t t h e y w e r e n o tr e a d b y e v e r y o n e . H e w o u l d l i k e t o c h o o s e s e l e c t iv e l yw h o m a y r e a d t h e a n n o t a t i o n s .4 . T h e d a t a s t ru c t u r e s u s e d t o c o n t a i n t h e b i b l i o g r a p h yr e f e r e n c e s a r e h i g h l y o p t i m i z e d a n d " d e l i c a t e . " H ew o u l d l i k e t o in s u r e t h a t w h e n a n u p d a t e i s d o n e , t h e

d a t a s t r u c t u r e s a r e c o r r e c t l y m a n i p u l a t e d .5 . F r o m t i m e to t im e h e c h a n g e s t h e p r o g r a m s , e i t h e rt o c o r r e c t e r r o r s o r t o a d d n e w f e a t u r e s . F o r a p e r i o d o ft i m e a f t e r t h e c h a n g e s a r e m a d e , h e w o u l d l i k e t o a l l o wo n l y a s m a l l, s y m p a t h e t i c s u b s e t o f h i s ( g r o w i n g ) u s e rc o m m u n i t y t o u s e t h e n e w v e r s io n s o f hi s p r o g r a m s .6 . H e s u s p e c t s t h a t a f t e r h e h a s a l l o w e d o t h e r s t o u s eh i s p r o g r a m s a n d b u i l d t h e i r o w n b i b l i o g r a p h i e s t h e ywi l l sha re s om e of h is concerns , e .g . i t ems (1 ) , (3 ) , and( 5 ) , a b o v e . I n p a r t i c u l a r, t h e y w i l l n o t w a n thim t o b e

3 4 3

a b l e t o e r a s e o r e x a m i n e t h e i r b i b l i o g r a p h i e s , o r t of o r c e a n e w v e r si o n o f t h e p r o g r a m s u p o n t h e m .

S e v e r a l o f t h e c o n c e r n s o f o u r r e s e a r c h e r s c a n , o fc o u r s e, b e h a n d l e d b y m o s t " r e a s o n a b l e " p r o t e c t i o ns y s t e m s ; o t h e r s , h o w e v e r , c a n n o t . T h e m o s t s t r a i g h t -f o r w a r d i m p l e m e n t a t i o n o f t h e b i b l io g r a p h y w o u l d b e tos t o r e t h e b i b l i o g r a p h i c i n f o r m a t i o n i n a s i n g l e f i le ; 5t h e r e f o r e , l e t u s f r a m e t h e d i s c u s s i o n i n t h a t c o n t e x t .

S i n c e m o s t f i l e s y s t e m s o n l y p r o t e c t r e a d a c c e s s t oan en t i re f i l e , the re i s no way to enforce se lec t ive p r in t -i n g , i . e . t o d i s t i n g u i s h b e t w e e n t h e a c c e s s o r s w h om a y p r i n t t h e e n t i re f il e a n d t h o s e w h o m a y n o t p r i n tt h e a n n o t a t i o n s . S i m i l a r l y, u n d i f f e r e n t i a t e d r e a d a c c e s sm a y p e r m i t a n u n s c r u p u l o u s u s e r t o d u m p a n e n t i r eb i b l i o g r a p h y f il e, d e t e r m i n e i t s s t r u c t u r e , a n d t h u s c o m -p r o m i s e t h e p r o p r i e t a r y n a t u r e o f t h e p r o g r a m s .

U n d i f f e r e n t i a t e d w r i t e a c c e s s i m p l i e s a n a l o g o u sp r o b l e m s . C l e a r l y, th e o p e r a t i o n o f u p d a t i n g t h e f il ei m p l i e s w r i t i n g o n i t ; in f a c t it m a y c o n c e i v a b l y i m p l y am a s s i v e re o r g a n i z a t i o n in o r d e r t o m a i n t a i n t h e"op-t i m a l " d a t a s t r u c t u r e .

T h e c o n c e p t o f " o w n e r s h i p , " a n d i t s c o r o l l a r yp r i v il e g e s , p r e s e n t i n m a n y e x t a n t s y s t e m s m a y i m p l yt h a t t h e u s e r o f t h i s s y s t e m c a n n o t p r o t e c t h i m s e l f( u n l e s s h e t a k e s s p e c i a l , e x p l i c i t p r e c a u t i o n s ) f r o m e x -a m i n a t i o n o f hi s b ib l i o g r a p h i e s b y t h e a u t h o r o f th es y s t e m a n d / o r f r o m u n e x p e c t e d a l t e ra t i o n o f th e s y s-t e m . I n p a r t i c u l a r h e m a y n o t b e a b l e t o p r o t e c t h i m -s e l f f r o m a l t e r a t i o n i n w a y s w h i c h p e n e t r a t e t h e s e c u r i t yo f h i s b i b l i o g r a p h i e s .

N o w l e t u s c o n s i d e r t h e " n a t u r a l " i m p l e m e n t a t i o no f t h e b i b l i o g r a p h y s y s t e m i n H Y D RA a n d h o w t h i s i m -p l e m e n t a t i o n o v e r c o m e s t h e p r o b l e m s m e n t i o n e d a b o v e .

C l e a r l y a b i b l i o g r a p h y i s a n e w t y p e o f v i r t u a lr e s o u r c e . T h e r e f o r e , w e w o u l d c r e a t e a n e w o b j e c t t y p e ;

ca l l i t BIBLIO. In fac t , o f course , we w i l l w an t to u se ex i s t -i n g fi le m e c h a n i s m s t o r e p r e s e n t b i b l i o g r a p h i e s . I n a l ll i k e l i h o o d a n i n s t a n c e o f a b i b l i o g r a p h y o b j e c t w il l h a v ea n e m p t y d a t a p a r t a n d i t s c a p a b i l i t y p a r t w i l l m e r e l yc o n s i s t o f a s i n gl e c a p a b i l i t y w h i c h r e f e r e n c e sa nord inary f i l e ob jec t .

E v e n t h o u g h t h e r e p r e s e n t a t i o n o f a b i b l i o g r a p h y i sa f i l e , f i l e o p e r a t i o n s a r e n o t a p p l i c a b l e t o b i b l i o g r a p h yo b j e c t s ; t h e y a r e a p p l i c a b l e o n l y t o f i l e o b j e c t s ; w ec a nc r e a t e n e w o p e r a t i o n s ( p r o c e d u r e s ) , h o w e v e r, w h i c h a r ea p p l i c a b l e t o b i b l i o g r a p h y o b j e c t s , f o r e x a m p l e :

U ( ~ , p l , . . . , p , ) U p d a t eP(~ ,p l , . . . , pm) Pr in tP W O A ( ~ , p ~ ,. .. ,p m ) P r i n t Wi t h O u t A n n o t a t i o n sE ( ~ ) E r a s e

I n e a c h o f t h e s e, ~ m u s t b e a c a p a b i l i t y w h i c h r e f -e r e n c e s a b i b l i o g r a p h y o b j e c t a n d t h e p i ' s f u r t h e r s p e c i f yt h e n a t u r e o f t h e u p d a t e , p r i n t , e t c. , t o b e d o n e . ( N o t i c e

Some, but not all, of the problems raised can be solved bya nesoteric m ulti-file structure for the bibliography; how ever, sincethese solutions violate the "natu ralnes s" criterion, they w ill not bem e n t i o n e d .

C o m m u n i c a t i o n s J u n e 1 9 7 4of Volume 17the ACM Number 6

8/9/2019 Hydra Multiproccesor Kernel

8/9

t h a t e v e n t h o u g h P a n d P W O A a r e d is t in c t p ro c e d u r e s ,i n t h e s e n s e o f b e i n g d i s t i n ct o b j e c t s , t h e y n e e d n o tn e c e s s a r i l y h a v e d i s t i n c t c o d e b o d i e s ; t h a t i s , t h e c a p -a b i l it y p a r t o f e a c h o f t h e s e p r o c e d u r e o b j e c t s , t h e i rp r o t o t y p e L N S 'S , m a y r e f e r e n c e s o m e o r a l l o f t h e s a m epage objec ts . )

F o r s i m p l i c it y, l e t us a s s u m e t h a t e a c h o f th e p r o -c e d u r e s a b o v e i s u n i q u e l y a s s o c i a t e d w i t h a s i n g l e b i ti n t h e " a u x i l i a r y r i g h t s " f i el d o f a c a p a b i l i ty w h i c hr e f e r e n c e s a b i b l i o g r a p h y o b j e c t ; d e n o t e t h e s e b i ts b yt h e l o w e r c a s e v e r s io n o f t h e p r o c e d u r e n a m e , i . e . u ,p , e tc . T h u s i n o r d e r t o v a l i d l y e x e c u t e " C A L L U ( ~ ,. .. ) "i t i s f i r s t necessary tha t ~3 be a re fe ren ce to a b ib l io gra phyo b j e c t , a n d s e c o n d t h a t t h e" u " bit of ~ be set.

F i g u r e 1 i l l u s tr a t e s ( i n c o m p l e t e l y ) a s i t u a t i o n i n -v o l v i n g s e v e r a l " u s e r s " a n d s e v e r a l b i b l i o g r a p h i e s w h i c hm i g h t e x i s t a t s o m e i n s t a n t . R e c t a n g u l a r b o x e s d e n o t eo b j e c t s . D i r e c t e d a r r o w s i l l u s t r a t e c a p a b i l i t y r e f e r e n c e s ,a n d t h e l o w e r c a s e l e t t e r s a l o n g t h e s e a r r o w s s i g n i f ywhich of the auxi l ia ry r igh ts b i t s a re se t in these cap-abil i t ies .

T h e f o l l o w i n g k in d s o f i n f o r m a t i o n m a y b e g l e a n e db y i n s p e c t i o n o f F i g u r e 1 .1. U s e r # 1 m a y a c c e ss a ll o f t h e p r o c e d u r e s U , P,P W O A , a n d E . H e m a y a l so a c ce s s b i b l i o g r a p h y o b j e ct sB 1 a n d B 2 . H e m a y p e r f o r m a n y o f t he o p e r a t i o n sU , P, P W O A , a n d E o n B 1, b u t he m a y o n l y p e r f o r m Ua n d P W O A o n B 2.2 . U s e r # 2 m a y a l s o a cc e s s a l l o f t h e p r o c e d u r e s a n d ,i n a d d i t i o n , m a y a c c e s s t h r e e b i b l i o g r a p h y o b j e c t s :B 2 , B 3 , a n d B 4 . H e m a y o n l y p e r f o r m P W O A o n B 2 ,b u t m a y p e r f o r m U , P, o r E o n B 3 a n d B 4.3 . U s e r # 3 m a y o n l y a c c e ss th r e e o f t h e p r o c e d u r e s ; h ed o e s n o t h a v e a r e f e r e n c e t o E . H e m a y a c c es s t h r e eb i b l i o g r a p h y o b j e c t s - - B l , B 4 , a n d B 5 , a n d m a y, i n

p r i n c i p le , p e r f o r m U o r P o n B 4 , a n d U , P, o r E o nB 5 , a n d P o n B 1 . N o t i c e , h o w e v e r, t h a t t h e r i g h t , i np r i n c i p le , t o p e r f o r m E o n B 5 i s u se l es s t o h i m s i n c e h ed o e s n o t h a v e a r e f e r e n c e to c a p a b i l i t y E .

I t s h o u l d n o w b e c l e a r t h a t e a c h o f t h e p r o t e c t i o nc o n c e r n s e x p r e s s e d b y o u r f r i e n d t h e r e s e a r c h e r i s n e a t l yh a n d l e d b y t h i s s c h e m e . F o r e x a m p l e ,1 . S in c e th e o p e r a t i o n o f p r i n t i n g i s t h e p r o t e c t e d" r i g h t " i n th e s y s t e m r a t h e r t h a n t h e a c t o f r e a d i n g , i t i sp o s s i b l e t o d i s t i n g u i s h b e t w e e n p r i n t i n g t h e e n t i r eb i b l i o g r a p h y a n d p r i n t i n g it w i t h o u t a n n o t a t i o n s . M o r e -o v e r, s in c e th e c o n c e p t o f " r e a d " i s n o t d e f i n e d w i t hr e s p e c t t o b i b l i o g r a p h i e sat al l , i t is s i m p l y i m p o s s i b l e f o r

s o m e o n e t o e x a m i n e t h e r e p r e s e n t a t i o n o f a b i b l i o g -r a p h y o b j e c t a n d d e t e r m i n e i t s s t r u c t u r e ; t h e p r o p r i e t a r yn a t u r e o f t h e s y s t e m is t h e r e f o r e i n s u r e d .2 . S i m i l a r ly, s in c e t h e o p e r a t i o n o f u p d a t i n g a b i b l io g -r a p h y i s d is t i n c t f r o m t h a t o f w r i t i n g t h e f i le w h i c hr e p r e s e n t s i t, t h e i n t e r n a l i n t e g r i t y o f t h e d a t a s t r u c t u r ei s g u a r a n t e e d ( a t l e a s t i f t h e p r o c e d u r e U w o r k s c o r-rec t ly ) .

We w o u l d l i k e t o m a k e t w o m o r e p o i n t s w i t h r e s p e c tt o t h e e x a m p l e b e f o r e le a v i n g it . T h e c o n v e n t i o n a l

Fig, 1. B ibliography example.PROCEDURES USERS BIBLIOGRAPHIES

v i e w w i t h r e s p e c t t o s h a r i n g r e s o u r c e s i s t h a t t h e r e a r ep r e c i s e ly t w o c a s e s : ( 1 ) t h e s h a r e d r e s o u r c e i s p a s s e dt o a n o t h e r " u s e r " - - i n w h i c h ca s e t h e " r i g h t s " w h i c hm a y b e p a s s ed m u s t b e a s u b s e t o f t h o s e o f t h e p a s s e r ;o r ( 2 ) t h e s h a r e d r e s o u r c e i s o w n e d b y t h e " o p e r a t i n gs y s t e m " - - i n w h i c h ca s e t h e s e t o f " r i g h t s " e x p a n d sd r a s t i c a l l y w h e n a n o p e r a t i n g s y s t e m f u n c t i o n i s i n -

v o k e d . W e r e j e c t b o t h o f t h e s e c as e s as i n a d e q u a t e t oserve as the bas i s o f a t ru ly secure sys tem .O n s e v e r a l o c c a s i o n s w e h a v e r e f e r r e d t o o u r r e j e c -

t i o n o f " o w n e r s h i p " a s a d e s i g n c o n c e p t . C o n s i d e r t h ec o n s e q u e n c e s o f t h is s t a t e m e n t i n t h e c o n t e x t o f t h ee x a m p l e ; s p e c if i ca l ly, w h o " o w n s " o b j e c t B 1 ? We c a n n o tt e l l f r o m t h e s t a t i c p i c t u r e w h o o r i g i n a l l y c r e a t e d t h eo b j e c t : i n d e e d t h e c r e a t o r m a y n o t b e a b l e t o r e f e r e n c e ita n y l o n g e r. We d o k n o w t h a t u s e r # 1 h a s m o r e r i g h t s t oB 1 t h a n d o e s u s e r # 2 ; h o w e v e r, e v e n u s e r # 1 c a n o n l yi n v o k e B I B L I O - s p e c if i c o p e r a t i o n s o n B l - - h e c a n n o t ,f o r e x a m p l e , m a n i p u l a t e t h e r e p r e s e n t a t i o n o f B 1 .

N o r d o es th e B I B L I O s u b s ys t em " o w n " B 1. A s

d i s c u s s e d i n t h e p r e v i o u s s e c t i o n , t h e r i g h t s a c q u i r e d b ya p r o c e d u r e t o a c a p a b i l i t y p a s s e d t o i t a s a n a c t u a lp a r a m e t e r a r e o b t a i n e d f r o m t h e t e m p l a t e i n t h a t p r o -c e d u r e ' s p r o t o t y p e L N S . T h e s e r i g h t s m a y b e a s u b s e t ,s u p e r s e t , o r t o t a l l y d i s j o i n t f r o m t h o s e o f th e c a l l er.T h e p o i n t i s t h a t a p r o c e d u r e i s i n v e s t e d w i t h t h o s er i g h t s , a n d o n l y t h o s e r i g h t s , w h i c h i t n e e d s t o d o i t sj o b . N o t e t h a t th e p r o c e d u r e s c o m p r i s e d w i t h in t h eB I B L I O s y s t e m d o n o t h a v e a c c e s s t oa n y B I B L I O o b -j e c t s e x c e p t a s p a r a m e t e r s . ( B y w a y o f a n a l o g y, I a m

3 4 4 Comm unications June 1974of Volume 17the ACM Number 6

8/9/2019 Hydra Multiproccesor Kernel

9/9

n o t p e r m i t t e d t o r e p a i r m y t e le p h o n e . I a m p e r m i t t e d ,h o w e v e r , t o i n v o k e a n o p e r a t i o n , n a m e l y a t e l e p h o n er e p a i r m a n , t h a t c a n r e p a i r it . T h e r e p a i r m a ni n h e r e n t l yh a s t h e r i g h t t o r e p a ir t e l e p h o n e s ; h e d o e sno t , h o w e v e r ,h a v e a c c e s s t o m y p a r t i c u l a r t e l e p h o n e u n t il I g r a n th i m a c c e s s t o i t . )

C o n c l u s i o n

A n o p e r a t i n g s y s t em , e v e n t h e k e r n e l o f o n e , is al a r g e u n d e r t a k i n g w h i c h i n v o l v e s m a n y i n t e r r e l a te dd e c i s i o n s . I n d e e d w e b e li e v e t h a t t h e c o n s i s t e n c y a n dc l e a nl i n es s o f t h is i n t e r r e la t i o n a r e m o r e i m p o r t a n t t ot h e u l t i m a t e u t i l it y o f t h e s y s t e m t h a n a n y o f t h e i n -d i v i d u a l d e c i s i o n s . I t i s t h i s a s p e c t o f t h e H Y D R A d e s i g nt h a t w e f ee l is m o s t i m p o r t a n t .

A w o r d o r tw o c o n c e r n i n g t h e s t a t u s o f t h e s y s t e ma n d o u r e x p e r i e n c e w i t h it s e e m a p p r o p r i a t e . A t t h e t im eo f t h is w r i t i n g th e k e r n e l h a s b e e n o p e r a t i o n a l f o r a b o u tn i n e m o n t h s . T h e e x i s t e nc e o f a k e r n el , h o w e v e r , d o e sn o t m a k e a s y s t e m u s a b l e , n o r d o e s i t re l i ev e t h e i m -p l e m e n t e r s f r o m t h e r e s p o n s i b i l i ty o f d e v e l o p i n g a tl e a s t o n e v e r s i o n o f t h e s u b s y s t e m s , e . g . a f il e s y s t e m ,w h i c h u s e r s r e q u i r e . We a r e c u r r e n t l y d e v e l o p i n g t h e s es u b s y s t e m s . T h e e x t e n t o f o u r e x p e r i e n c e t o d a t e is th a tt h e f a c il i ti e s p r o v i d e d b y t h e k e r n e l d o i n d e e d s i g-n i f i ca n t l y s im p l i f y t h e c o n s t r u c t i o n o f t he s e s u b s y s t e m s .

A c k n o w l e d g m e n t s .I t i s d i f f i c u l t t o g i v e p r o p e r c r e d i tt o t h e s o u r c e s o f al l t h e i d e as p r e s e n t e d a b o v e . A l t h o u g hw e h a v e f el t f r ee to c h a n g e t e r m i n o l o g y, t h e w o r k s o fD e n n i s [ 5] , D i j k s t r a [ 4] , H a n s e n [ 1] , a n d e s p e c i a l l yL a m p s o n [ 7] a n d J o n e s [ 6] h a v e h a d s i g n i f i ca n t i m p a c t .T h e i d e as o f t h e s e i n d i v i d u a ls w i ll c le a r l y s h o w t h r o u g h

t o t h o s e w h o a r e f a m i l ia r w i t h t h e m . T h e r e m a i n i n gi d e a s a n d t h e c e m e n t w h i c h h o l d s t h e d e s i g n t o g e t h e re m e r g e d i n d is c u s s i o n b e t w e e n t h e a u t h o r s .

Received June 1973 ; revised December 1973

References1. Brinch-Hansen, P. The nucleus of a multiprogrammingsystem. Comm. AC M 13 ,4 (Apr. 1970), 238-241.2. Dahl, O.J., Dijkstra, E.W., and Hoare, C.A .R.StructuredProgramming, Academic Press, New York, 1972.3. Dijkstra, E.W. The structure of TH E multiprogrammingsystem. Comm. AC M 11 ,5 (May 1968), 341-346.4. Dijkstra, E.W., Coo peratin g sequential processes. InProgram-mingLanguages, F. Genuys, (Ed.), Academic Press, New York,1968, pp. 43-112.5. Dennis, J.B., and Van Horn, E.C. Program ming semantics formultiprogrammed computations.Comm. ACM 9 , 3(Mar. 1966), 143-155.6. Jones, A.K . Protection in prog ram min g systems. Ph.D. Th.Carnegie-Mellon U., 1973.7. Lamp son, B.W. Dynam ic Protection Structures, Proc. AFIPS1969 FJCC, Vol. 35, AI=IPS Press, Montvale, N.J. pp. 27-38.8. Parnas, D.L. On the criteria to be used in decomposing systemsinto modules. Comput. Sci. Dep. Rep., Carnegie-Mellon U., 1971.9. Wulf, W.A., and Bell, C. G. C. mm p- -a multi-mini-processor.Proc. AF IPS 1972, FJCC. Vol. 41, AFIP S Press, M ontvale, N.J.pp. 765-777.

I n f o r m a t i o n R e t ri e v al C . A . M o n t g o m e r ya n d L a n g u a g e P r o c e s si n g E d i t o r

A n Informat ion-

Theoretic A pproach toT ex t Searching inD irect A ccess SystemsIan J . Bar ton, Susan E. Creasey,M i c h a e l F. Ly n c h , a n d M i c h a e l J . S n e l lUn ivers i ty o f Sheff ie ld

U s i n g d i r e c t a c c e s s c o m p u t e r f i l e s o fb i b l i o g r a p h i ci n f o r m a t i o n , a n a t t e m p t i s m a d e t oo v e r c o m e o n e o f t h ep r o b l e m s o f t e n a s s o c i a t e d w i t h i n f o r m a t i o nr e t r i e v a l ,n a m e l y, t h e m a i n t e n a n c e a n d u s e o f l a rg e d i c t i o n a r i e s ,t h e g r e a t e r p a r t o f w h i c h i s us e d o n l y i n f r e q u e n t l y. An o v e l m e t h o d i s p r e s e n t e d , w h i c h m a p s t h eh y p e r b o l i cf r e q u e n c y d i s t r ib u t i o n o f t e x tc h a r a c t e r i s t i c s o n t o ar e c t a n g u l a r d i s t r i b u t io n . T h i s i s m o r e s u i t e dtoi m p l e m e n t a t i o n o n s t o r a g e d e v ic e s .

T h i s m e t h o d t r e a t s t e x t a s a s t r i n g o fc h a r a c t e r sr a t h e r t h a n w o r d s b o u n d e d b y s p a c e s , a n d c h o o s e s s u b s e tso f s t r i n g s s u c ht h a t t h e i r f r e q u e n c i e s o f o c c u r r e n c ea r em o r e e v e n t h a n t h o s e o f w o r d t y p e s .T h e m e m b e r s o f t h i ss u b s e t a r e t h e n u s e d a s i n d e x k e y s f o rr e t r i e v a l . T h er e c t a n g u l a r d i s t r i b u t i o n o fk e y f r e q u e n ci e s r e su l t s i n am u c h s i m p l if i e d fi le o rg a n i z a t i o n a n d p r o m i s e sc o n s i d e r a b l e c o s ta d v a n t a g e s .

K e y Wo r d s a n d P h r a s e s : t e x t s e a r c h i n g , i n f o r m a t i o nt h e o r y, f i l e o rg a n i z a t i o n , d i r e c t a c c e s s , i n f o r m a t i o nr e t r i e v a l , c h a r a c t e r s t r i n g , b i t v e c t o r

C R C a t e g o r i e s : 3 . 4 2 , 3 . 7 0 , 3 . 7 3 , 3 . 7 4 ,5 .6

I n t r o d u c t i o n

I n f o r m a t i o n d i s s e m i n a t i o n s e r v ic e s p r o v i d i n g c o m -p u t e r b a s e d s e a r c h e s o f b i b l i o g r a p h i c d a t a b a s e s h a v e

u n t i l r e c e n t l y d e p e n d e d l a rg e l y o n s e r ia l s e a r c h e s o f m a g -n e t i c t a p e f i l e s [ 1 , 2 ] . H o w e v e r, t h e n e e d t o p r o c e s s l a rg e

Copyright 1974, Association for Compu ting Machinery, Inc.General permission to republish, but not for profit, all or partof this material is granted provided that A CM 's copy right noticeis given and that reference is made to the publication, to its dateof issue, and to the fact th at reprinting privileges were grantedby permission o f the Association for Com puting Machinery.

This w ork was supported by the Office of Scientific and Techni-cal Info rma tion of the British Government. Au thor s' address: Post-gradu ate School of Librarianship and Infor ma tion Science, Univer-sity of Sheffield, Western B ank, Sheffield, SI 0 2TN , U.K .

345 Comm unications June 1974of Volume 17the ACM Number 6