Amoeba A Distributed Operating System for the 1990s Sape J Mullender and Guido van Rossum Centre for Mathematics and Computer Science Andrew S Tanenbaum Robbert van Renesse and Hans van Staveren Free University of Amsterdam n the nexi decdde computer prices will drop 50 low that IO 20 or perhaps IO0 powerful microprocessors per user will be feasible All this computing power will have to be organized in a simple efficient and fault tolerant system that is easy to use The basic problem with current networks of PCs and workstations is that they are not transparent that is users are aware of the other machines The user logs into one machine and uses that machine only until doing a remote login to another machine Few if any programs take advantage of multiple CPUs even when all are idle We envision a system for the 1990s that will appear to users as a single 1970s centralized time sharing system Users will not know which processors their jobs are using or even how many where their files are stored or how many replicated copies are maintained to provide high availability or how processes and machines are communicating All resources will be managed completely and automatically by a distributed operating system Few such systems have been designed T 1 44 The Amoeba distributed operating system appears to users as a centralized system but it has the speed fault tolerance security safeguards and flexibility required for the 1990s and even fewer have been implemented Fewer still are actually used by anyone yet An early distributed system was the Cambridge system Later systems were Locus Mach the V K e r n l and Chorus s Here we describe Amoeba a distributed 0018 9162 90 0500 0014501 000 1990 IEEE system developed at the Free University and the Centre for Mathematics and Computer Science in Amsterdam Amoeba combines high availability parallelism and scalability with simplicity and high performance Although distributed systems are necessarily more complicated than centralized systems and tend to be much slower we have worked hard to achieve extremely high performance Amoeba is already one of the fastest distributed systems on its class of hardware reported so far and future versions will be even faster With the current implementation a remote procedure call can be performed in 1 4 ms on Sun 3 50 class machines The file server can deliver data continuously at 677 Kbytes per second The Amoeba software is based on objects An object is a piece of data on which well defined operations can be performed by authorized users independent of the user s and object s locations Objects are managed by server processes and named using capabilities chosen randomly from a sparse name space COMPUTER A process is a segmented address space shared by one or more threads of control Processes can be created managed and debugged remotely Operations on objects are implemented using remote procedure calls Amoeba has a unique fast file system split into two parts The bullet service stores immutable files contiguously on the disk the directory service gives capabilities symbolic names and handles replication and atomicity eliminating the need for a separate transaction management system To bridge the gap with existing systems Amoeba has a Unix emulation facility consisting of a library of Unix system call routines that make calls to the various Amoeba server processes Most classical distributed systems literature describes work on parts of or aspects of distributed systems distributed file servers distributed name servers distributed transaction systems and so on Here we discuss the whole system covering most of the traditional operating system design issues including communication protection the file system and process management We explain not only what we did but also why we did it Processor pool m Workstations d d d 7 I Gateway Wide area network Local area network Specialized servers file database etc Figure 1 Four components of the Amoeba architecture 48 24 8 48 Service Port Object number Rights field Check field Bits Figure 2 The structure of a capability The service port identifies the service that manages the object The object number specifies the object for example which file The rights field determines which operations are permitted The check field provides cryptographic protection to keep users from tampering with the other fields Overview of Amoeba The Amoeba project6 has been under way for nearly 10 years and has seen numerous system redesigns and reimplementations as design flaws became glaringly apparent This article describes the Amoeba 4 0 system released in 1990 Hardware architecture As Figure 1 shows the Amoeba hardware consists of four components workstations pool processors specialized servers and gateways The workstations execute only processes that require intense user interaction for example window managers command interpreters editors and CAD CAM graphical front ends Most applications however do not interact much with the user and are run elsewhere Amoeba s processor pool provides most of the computing power Typically it consists of many single board computers each with several megabytes of private memory and a network interface The Free University for example has 48 such machines A pile of diskless terminalless workstations can also be used as a processor pool When a user has an application to run for example building a program consistMay 1990 ing of dozens of source files a number of processors can be allocated to run many compilations in parallel When the user is finished the processors are returned to the pool for other work Although the pool processors are all multiprogrammed the best performance is obtained by giving each process its own processor until the supply runs out The processor pool allows us to build a system in which the number of processors exceeds the number of users by an order of magnitude or more something quite impossible in the personal workstation model of the 1980s The software has been designed to treat the number of processors dynamically so processors can be added as the user population grows When a few processors crash some jobs may have to be restarted and the computing capacity is temporarily lowered but otherwise the system continues normally providing a degree of fault tolerance Specialized servers the third system component are machines for running dedicated processes with unusual resource demands For example it is best to run file servers on machines that