... •
parentof (p
1
, p?))
RemoveProcessFromParent
∆(parentof )
parent?, child?:APREF
parentof
= parentof \{(parent?, child?)}
ParentOfProcess
p?:APREF
parent!:APREF
(∃ p
1
: APREF •
parentof (p
1
, ... =0,
it is an element of PREF but not of IPREF . ✷
Proposition 37 . ∀ p : APREF • p ∈ freeids ⇔ p ∈ known
procs.
Proof. This is a conjunct of the invariant. ✷
Proposition 38 . NewPId[p/p...
... end of P
than P.
3. If the new value of p
r
is the same as the old one, one of the two previous
conditions will hold.
Proof. By Proposition 21. The interesting case is case 3, whose proof follows
from ... most significant aspect of this chapter’s model is that it acts
as an existence proof. It is possible to define a formal model of an operating
system kernel and to prove so...
... N
pgallocstart =0
The value of 0 is completely arbitrary, as is now explained.
Some systems map a virtual copy of the operating system onto the vir-
tual address space of each user space (and some ... versions):
VM
3
= init.(ISR | PFH
3
| Q | PD
2
| DSK | STORE)
\{i, enq, deq, ok , done, get, init, s}
where:
PFH
3
= i.(enq.ok.0 | PFH
3
)
Proposition 167. VM
3
is observatio...
... incore(p?)(sg?)
✷
Proposition 133 . IsSharedPage iff lpno? is a shared page; that is, iff lpno?
is an element of sharedpages(p)(sg), for some p and sg.
Proof. Similar to the previous proof. ✷
Proposition 134 . IsLockedPage ...
OnPageRequest =
238 5 Using Messages in the Swapping Kernel
The procedures comprising the system- call library all send and receive
messages. Therefore, the rest...
... al.’s fascinating and elegant Oberon system
[35 , 36 ] is recommended).
With these points noted, it is possible to move on to the use of the message-
passing subsystem as defined above. The reader ... raiseRcvInterrupt[m!/msg!, ]
5.6 Kernel Interface 233
In order to provide these operations, a set of parameters must be defined
for each operation. In each case, the identifier of the new...
... to determine all the children of a parent process.
4.8 General Results
This final section contains the proof of a number of propositions that deal
with properties of the kernel.
The propositions ... an idea of
some of the other things that might need to be handled during termination).
If a process is on disk when it is terminated (say, because of system ter-
mination or because...
... descendant of the ancestor of the process just blocked.
Proof. This requires the proof of the following lemma.
Lemma 16. For any process, p, BlockProcessChildren implies that there are
no children of ... closure of the childof relation; the complete set of descendants of
a given process are represented by childof
+
(|{p?}|) for any process identifier
p?. In BlockProcessChildren,...
... performed, the inclusion of IdleProcRef and the ex-
clusion of NullProcRef are of some importance. They determine the range of
possible values for the domains of the components of process descriptors. ... interrupts
occur during the execution of a piece of code. They are used as a kind of low-
level mutual exclusion mechanism.
4 .3 Common Structures 101
Proof. By a previous...