... of sharedpages(p)(sg), for some p and sg.
Proof. Similar to the previous proof. ✷
Proposition 134. IsLockedPage iff lpno? is a locked page; that is, iff lpno?
is an element of lockedpages.
Proof. ...
OnPageRequest =
2 38 5 Using Messages in the Swapping Kernel
The procedures comprising the system- call library all send and receive
messages. Therefore, the rest of the proof must be in...
... MA,
1 989 .
36. Wirth N. and Gutknecht, J., The Oberon System, Software Practice and Expe-
rience, Vol. 19, No. 9, 1 989 .
37. Zhou, D. and Black, Paul E., Formal Specification of Operating Systems ... future.
7.2 Review
The formal models of three operating systems have been presented. All three
kernels are intended for use on uni-processor systems. They are also examples
of...
... N
pgallocstart =0
The value of 0 is completely arbitrary, as is now explained.
Some systems map a virtual copy of the operating system onto the vir-
tual address space of each user space (and some ... determine a number of
properties of CCS and CSP processes, including observational equivalence and
bisimilarity. The propositions concerning equivalence of the various versions...
... descendant of the ancestor of the process just blocked.
Proof. This requires the proof of the following lemma.
Lemma 16. For any process, p, BlockProcessChildren implies that there are
no children of ... closure of the childof relation; the complete set of descendants of
a given process are represented by childof
+
(|{p?}|) for any process identifier
p?. In BlockProcessChildren,...
... message contains the identifier of the sending process. It
also contains two natural numbers (elements of N). They denote the size of
the data area and the size of the stack area that are, respectively, ... prove some fairly general properties of the
message-passing system.
Proposition 112. The message-passing mechanism is synchronous.
Proof. By the predicates of SendMessage and...
... most significant aspect of this chapter’s model is that it acts
as an existence proof. It is possible to define a formal model of an operating
system kernel and to prove some of its properties. In ... cannot be used. Indeed, it is of a complexity not far from that of the
tiny kernels used for embedded and some real-time systems. The µC/OS [ 18]
is a good example of such a k...
... to determine all the children of a parent process.
4 .8 General Results
This final section contains the proof of a number of propositions that deal
with properties of the kernel.
The propositions ... an idea of
some of the other things that might need to be handled during termination).
If a process is on disk when it is terminated (say, because of system ter-
mination or becau...
... •
parentof (p
1
, p?))
RemoveProcessFromParent
∆(parentof )
parent?, child?:APREF
parentof
= parentof \{(parent?, child?)}
ParentOfProcess
p?:APREF
parent!:APREF
(∃ p
1
: APREF •
parentof (p
1
, ... priority of process,
p. If p is an element of q, then MakeUnready[p/pid?] implies that p is not
an element of q
.
Proof. There are two cases to consider:
Case 1. Process p is the head o...
... performed, the inclusion of IdleProcRef and the ex-
clusion of NullProcRef are of some importance. They determine the range of
possible values for the domains of the components of process descriptors. ... the idle process, of
course.
Proof. The components of the process description, pstate, pkind, pstack,
pregs, etc., all have identical domains by the first part of the invari...
... a real help—I have used formal
models as a way of trying out new software ideas since the late 1 980 s).
Of course, I hope that people from formal methods and operating systems,
as well as computer ... relatively broad.
Formal Models of Operating System Kernels
x Contents
3.6 Current Process and Prioritised Ready Queue 77
3.7 MessagesandSemaphoreTables 81
3 .8 Proce...