Principles of Computer System Design

Citation

Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann.

Chapter Summary

The book grew out of notes for MIT's course 6.033, Computer System Engineering, written over some forty years. It is published in two parts. Part I (Chapters 1–6) is the printed Morgan Kaufmann book; Part II (Chapters 7–11) is distributed by the authors and MIT OpenCourseWare as an open educational resource. A recurring theme is enforcing modularity: Part I introduces methods that stop accidental errors in one module from spreading to others, and Part II introduces stronger forms of modularity against component failures and malicious attacks. Named design principles, such as the end-to-end argument, are highlighted where they are used and collected in a list at the front.

Chapter 1: Systems

The opening chapter treats complexity as the central problem of systems. It looks at common problems of systems in many fields, systems, components, interfaces and environments, and complexity itself (1.1), the sources of complexity, namely cascading and interacting requirements and maintaining high utilization (1.2), and ways of coping: modularity, abstraction, layering and hierarchy, with names making connections (1.3). It then explains why computer systems are the same but different, with no nearby bounds on composition and unprecedented technology change (1.4), and returns to coping through iteration and simplicity (1.5).

Chapter 2: Elements of Computer System Organization

Chapter 2 identifies three fundamental abstractions, memory, interpreters and communication links (2.1), and then develops a model of naming in computer systems: default and explicit context references, path names and recursive name resolution, searching through layered contexts, comparing names and name discovery (2.2). Section 2.3 organises systems with names and layers, using the bus as a hardware layer and the file abstraction as a software layer. The case study (2.5) takes the UNIX file system apart layer by layer, from the block layer to the symbolic link layer.

Chapter 3: The Design of Naming Schemes

This chapter turns the naming model into design considerations: modular sharing, metadata and name overloading, addresses as names that locate objects, generating unique names, user-friendly names and the relative lifetimes of names, values and bindings. A case study covers the Uniform Resource Locator, and "war stories" collect real pathologies in the use of names, from name collisions to running out of telephone numbers.

Chapter 4: Enforcing Modularity with Clients and Services

Moving from soft to enforced modularity, Chapter 4 describes client/service organization, multiple clients and services, trusted intermediaries and remote procedure call, including how RPCs differ from ordinary procedure calls. The two case studies are the Internet Domain Name System (name resolution, hierarchical name management, trustworthiness of responses) and the Network File System (the remote procedure calls it defines, extending the UNIX file system to support it, and coherence).

Chapter 5: Enforcing Modularity with Virtualization

Chapter 5 shows how the same client/service idea is enforced inside one computer by virtualization. It covers virtual links using SEND and RECEIVE with a bounded buffer, including race conditions, locks, before-or-after actions and deadlock; enforcing modularity in memory with domains, kernel and user mode and gates; virtualizing memory with page maps and the translation look-aside buffer, with segments as an advanced topic; virtualizing processors using threads and their sequence-coordination primitives; and the evolution of enforced modularity in the Intel x86. It closes with virtual machines.

Chapter 6: Performance

The last chapter of Part I treats designing for performance: metrics (capacity, utilization, latency, throughput), a systems approach to bottlenecks, concurrency, queuing and overload, batching, dallying and speculation. It then covers multilevel memories, including locality of reference, working sets and page-removal policies, and scheduling resources and policies, with the disk arm as a case study.

Chapters 7–8: The Network; Fault Tolerance (Part II)

Chapter 7, The Network as a System and as a System Component, covers the properties of networks, layers (link, network and end-to-end), congestion control, and a case study mapping the Internet to Ethernet. Chapter 8, Fault Tolerance: Reliable Systems from Unreliable Components, covers faults and failures, measures of reliability, tolerating active faults, applying redundancy to software and data, and a fault-tolerance model for CMOS RAM.

Chapters 9–11: Atomicity; Consistency; Information Security (Part II)

Chapter 9 distinguishes all-or-nothing from before-or-after atomicity and treats each in concept and in practice, followed by atomicity across layers and sites. Chapter 10, Consistency, covers constraints, cache coherence, durable storage with geographically separated replicas, and reconciliation. Chapter 11, Information Security, covers authenticating principals and messages, confidentiality, security protocols, authorization, a case study of TLS, and war stories of breaches.

Key Concepts

Chapters 1–3: Systems, Names and Layers

• Modularity, abstraction, layering, hierarchy: the four techniques the book presents for coping with complexity.
• Naming model: names, contexts and name resolution as a general mechanism.
• Three fundamental abstractions: memory, interpreters and communication links.

Chapters 4–6: Enforced Modularity and Performance

• Client/service organization: modules that interact only through messages, so errors do not propagate.
• Virtualization: threads, virtual memory and bounded buffers as the means of enforcing modularity within a computer.
• Bottlenecks and scheduling: the performance themes of Chapter 6.

Chapters 7–11: Networks, Reliability, Atomicity, Consistency and Security

• End-to-end argument: listed in the book's design principles as "The application knows best."
• All-or-nothing and before-or-after atomicity: the two properties of transactions.
• Least privilege and complete mediation: security principles listed in the front matter.

Critical Analysis

Strengths

• A principles-first design. The publisher presents it as the first textbook to take a principles-based approach to computer system design, using abstractions common to operating systems, networks, databases and distributed systems. Design principles are named, boldfaced where defined and flagged where used, and collected in a list.
• Cross-cutting case studies. The case studies are chosen to reuse the same ideas across areas: the UNIX file system, URLs, DNS, NFS, the x86, disk-arm scheduling, TLS and others, with pseudocode fragments for concrete examples.
• Reviewer's view. Joe Pasquale of UC San Diego, quoted by the publisher, calls it a unique, ambitious and important book about computer system design principles rather than the usual mechanics of how things work, and notes that no book he knows makes so many of these principles explicit.
• Free supporting material. Part II, the problem sets, the glossary and the index are free from MIT OpenCourseWare, together with course materials from 6.033.
• Exercises with a history. Exercises and problem sets are drawn from decades of examinations, and each is tagged with year, exam and problem number.

Limitations

• The printed book is only half the text. The print edition contains Chapters 1–6; fault tolerance, atomicity, consistency, networks and security are in the online Part II. A reader who buys the print book should plan to use the online chapters.
• Not a mechanism-level operating-systems text. It teaches principles through selected case studies; it is not a full tour of operating-system mechanisms and does not replace a standard operating-systems textbook.
• Case studies date from 2009. The examples (NFS, the Intel x86, TLS, the DNS) reflect the state of those systems at publication; the principles are stated generally, but details need checking against current practice.
• Part II is a separate version. The free chapters are labelled Version 5.0 (June 2009), with errata updated as late as February 2022, and are licensed for non-commercial use.

Where It Fits in the Course

This is a systems-design book, not a first operating-systems course. Operating System Concepts and Modern Operating Systems are the conventional textbooks that cover processes, memory, file systems and I/O in order, with case studies of real systems; Operating Systems: Three Easy Pieces is a free, narrative treatment of virtualization, concurrency and persistence; and How Linux Works is a practical guide to a real system. Saltzer and Kaashoek's Chapters 2, 4 and 5 overlap with that material, but the aim is to extract the design ideas (naming, layering, enforced modularity) and carry them into networks, fault tolerance and security.

It is best read after, or alongside, one of those textbooks, by readers who want the design vocabulary behind the mechanisms.

How to Use This Book

The book is meant for junior and senior undergraduates in operating systems, distributed systems, or computer systems design courses, and for professional system designers. The publisher lists the same audience.

A practical plan:

• Core: Chapter 1 for the vocabulary of complexity; Chapters 2–3 for naming; Chapters 4–5 for enforced modularity.
• Next: Chapter 6 for performance, then Part II chapters according to interest: 7 for networks, 8–10 for reliability and transactions, 11 for security.
• Advanced topics: sections labelled advanced (for example segments in 5.4.5 and reasoning about authentication in 11.7) can be left for a second reading.
• Reference material: keep the list of design principles and the glossary at hand; use the exercises and problem sets to test understanding.