Operating Systems Exam 5
What is a logic bomb?
A logic bomb is a program that initiates a security incident under certain circumstances. One classic example is a program that checks for a user's employment status, and if the user has been terminated, does something harmful.
What is the relationship between a disk sector and logical block?
A logical block is made up of some number of sectors, perhaps 8 or 16 sectors. Sectors are the smallest "item" generally written to the disk, but the OS works with larger pieces of data - the logical blocks.
UNIX uses a complicated "Combined Scheme" for file allocation, which supports multilevel indexed blocks. Why not simply use one large index block?
A separate index block may suffice for medium-sized files, but wastes space for small files, and may still be insufficient for large files. The multi-level index method is efficient and expandable from small files to very large files.
In terms of security, what is the difference between a threat and an attack?
A threat is a potential security violation; an attack is an actual violation (an attempt to breach security).
What is the relationship between a "sector", "track" and "cylinder"?
A track is a ring, composted of small storage units called sectors. A cylinder is tracks in the same location on different platter/surfaces — in effect, a cylinder of tracks.
What change(s) need to be made to the page table to support demand paging, and why?
A valid-invalid bit must be added to distinguish between pages that are in memory (valid) and pages that are not in memory (invalid). A modified / dirty bit should also be added to distinguish between pages that have been modified versus those that have not.
The stack / buffer overflow is a classic program threat. How can an input value "overflow" the buffer that it is being written into?
A value is read that is bigger than the buffer, so when it is loaded into memory it goes past the end of the buffer.
What is the distinction between a partition and a volume?
A volume is a partition that contains a file system.
In terms of security threats, what is a trap door?
A command or password, such as a debug command, that enables additional features of a program, some of which could circumvent normal security procedures.
What are the advantages and disadvantages of linked allocation over contiguous allocation of disk space?
Advantages: Since any free space can be used, there is no need for complex allocation algorithms such as first-fit or best-fit. Further, linked allocation does not suffer from external fragmentation like contiguous allocation. Disadvantages: If the file is spread out across the disk, access is less efficient. Following the links adds overhead. If a link gets damaged, the entire rest of the file is lost.
Which File Control Blocks are stored on the disk, and where on the disk are they stored?
All File Control Blocks are stored on disk; they are stored in a table (called the "i-list" in UNIX terms) near the beginning of the volume.
A page fault is a type of exception. What is an exception?
An exception is similar to an interrupt, but instead of being generated by a hardware device, it is caused by a failure in the execution of an instruction.
An important component of demand paging is a good page replacement policy. How difficult is it to implement Least Recently Used (LRU) replacement? Explain.
Fully implementing LRU would require storing a clock value (timestamp) for each memory access and likely maintaining some sort of sorted list. Just storing the time stamp would double the time required for every memory access, and then the sorting would take yet more time. Overall, this would be far too much overhead for a simple memory access.
In terms of demand paging, what is meant by temporal locality?
If a page is needed now, it will probably be needed again soon. For example, a set of instructions may be executing in a loop, or the data may need to be accessed repeatedly for a period of time.
What are the disadvantages of Linked Allocation for storing a file?
If only one block in the middle of the file needs to be read, all the blocks before it must be read to get to that middle block. Also, if a block gets damaged, the rest of the file is lost. Finally, it can potentially require many seeks to find the blocks if they are not stored contiguously.
What happens on a reference to the page table if the bit is invalid?
If the entry is invalid, the page is not in memory, so a page fault must occur to bring the page into memory and update the page table before the page can be accessed.
What happens on a reference to the page table if the bit is valid?
If the entry is valid, the page is in memory, and the page table entry contains the frame number, so use that frame number to generate the physical address.
Would it be a good idea for SSTF to consider rotational delay as well? Explain your answer.
If the goal is to service the request that can be reached in the shortest amount of time, then rotational delay should be considered as well, since it is roughly as time-consuming as seek time. However, rotational delay is harder to estimate, and would add to the overhead of the algorithm, which is why it is not considered in practice.
One way to avoid thrashing is to monitor the page fault frequency and adjust the number of frame allocated to a process occasionally. How does this work?
If the page fault frequency goes above a threshold, another page is allocated to the process. If the page fault frequency goes below a threshold, a page is removed from the process.
How can thrashing be avoided by monitoring the page-fault frequency of a process?
If the process is page faulting too much, its entire working set is not in memory, so give it an additional frame.
Describe the C-SCAN disk head scheduling, and draw a diagram to illustrate your explanation.
In C-SCAN, the disk head starts at one end of the disk and moves toward the other end, servicing requests as it moves. Once it reaches the other end, it returns to the beginning and starts over, but it does not service requests as it returns to the beginning.
What is RAID 0 (Striping) and why is it useful?
In RAID 0, data is split ("striped") across both drive, with part of the data written to one drive while the other part is written to the other drive. Since both parts are written simultaneously, RAID 0 provides improved performance.
What is RAID 1 (Mirroring) and why is it useful?
In RAID 1, data on one drive is completely copied (mirrored) onto the drive. It provides fault tolerance - if one drive fails, the data can be restored from the other drive.
How does the SCAN disk head scheduling algorithm differ from the C-SCAN algorithm?
In SCAN, the disk head moves in one direction as it services requests, then moves in the other direction as it services requests. In C-SCAN, the disk head movers in one direction as it services requests, then it goes all the way back to the beginning, then moves again in the original direction as it services requests. In other words, SCAN services requests when moving in both directions, while C-SCAN only services requests when moving in a single direction.
Describe the SCAN disk head scheduling , and draw a diagram to illustrate your explanation.
In SCAN, the disk head starts at one end of the disk and moves toward the other end, servicing requests as it moves. Once it reaches the far end, it reverses direction, servicing requests as it moves in that direction.
What is the relationship between a directory and the File Control Block representing that directory?
In general, a File Control Block contains pointers to the data blocks storing the file's contents and contains accounting information such as the file's owner and creation time. The directory contains a list of file names for the files in that directory along with pointers to each file's File Control Block, but is itself pointed to by a File Control Block that represents the directory.
What is the distinction between paging (as discussed in Chapter 8) and demand paging (as discussed in Chapter 9)?
In paging, the entire process must be in main (physical) memory to run, and when the process is swapped out, the entire process must be swapped out. In demand paging, individual pages (the working set) are loaded into memory as needed, and those pages are paged out to swap space when necessary.
Define the RAID concepts of striping (RAID 0) and mirroring (RAID 1).
In striping, each piece of data is distributed over multiple drives to improve disk access time. In mirroring, each piece of data is duplicated in its entirety on another drive to provide redundancy in the case a drive fails.
Can the LRU algorithm be implemented directly using timestamps? Explain.
It could be implemented that way, but checking the clock and storing a timestamp for every memory reference would be a huge amount of overhead — more than doubling the time for the memory reference — so in practice such a technique would not be used.
The First-Come First-Served (FCFS) disk scheduling is easy to implement, but not very good in terms of performance. Explain.
It does not consider seek time, so it could seek widely back and forth across the disk, especially if one set of accesses are on the inner tracks and another set of accesses are on the outer tracks.
The internet worm used three separate methods to install a grappling hook program on target systems. What is a grappling hook program and what did it do?
It is a small program that connects to another system and downloads the full worm program.
What is a macro virus and how is it propagated?
It is a virus embedded in a macro, such as a Visual Basic Macro. It usually propagates via email.
What page/frame does the Optimal algorithm replace?
It replaces the page that will not be used for the longest period of time — the one that will be referenced the farthest in the future.
Why is it difficult to implement the Optimal page replacement algorithm?
It requires knowledge of the future, which we do not have.
What information is stored in a Directory?
The Directory is a table of file names and pointers to the File Control Block / inode that represents the file.
Explain how UNIX's indexed allocation scheme efficiently supports both small and large files.
The File Control Block (the inode, using UNIX terms) directly points to about 10 (the number has varied over time) disk blocks, meaning no additional index blocks are needed for small files. For larger files, single, double, and triple indirect blocks are used, each containing 128 pointers, so that large files can also be supported in a manner that efficiently scales up as the size of the file increases.
During the process of translating a virtual address to a physical address, how does the Memory Management Unit know whether or not a page is in physical memory?
The Page Table contains a valid / invalid bit for each entry. If the bit is valid, the page is in physical memory; if the bit is invalid the page is not in physical memory.
Why does the Least-Recently-Used page replacement algorithm generally work well?
The Principle of Locality of Reference says that data that was used recently will likely be needed again soon, lending credence to the idea that data last used long ago will likely not be needed again anytime soon, while data last used recently will likely be needed again very soon.
Why is the Least-Recently-Used page replacement algorithm generally considered a good approximation of the Optimal page replacement algorithm?
The Principle of Locality of Reference says that data that was used recently will likely be needed again soon, lending credence to the idea that data last used long ago will likely not be needed again anytime soon, while data last used recently will likely be needed again very soon.
Each platter surface in a hard drive is formatted with a number of tracks, each of which contains a number of sectors. How does the read/write head reach a particular track and sector?
The arm moves the head over the desired track, and then the head waits for that sector to rotate under the head.
What is the role of the valid-invalid bit in the page table? What happens if the bit if "valid"? What happens if it is "invalid"?
The bit specifies whether or not the page is in memory. If the bit is "valid", the page is in memory, and is in the frame referenced by the page table. If the bit is "invalid", the page is not in memory, so a page fault occurs and the page must be brought into memory.
Summarize what happens when a page fault occurs. (Ignore the possible need for page replacement in your answer.)
The exception handler for the page fault is called. That hander saves the process state, calls the Pager, restores the process state, and the process continues execution. The Pager finds a free frame, brings the page into memory, and updates the Page Table (including the valid bit).
The File Control Block contains most of the information about a file, but does not contain the file name. Where is the file name stored, and why is it not stored in the File Control Block?
The file name is stored in the directory. It is stored there because, with aliases / shortcuts, multiple directories could refer to the file, possibly using different names for it.
Explain the basic idea of multi-level indexing, with respect to file systems.
The inode has some number of pointers in the inode itself, which point directly to blocks storing the file. If the file is small, those inodes may be sufficient to point to the file. If the file is larger, the inode has another pointer to a block containing more pointers to blocks in the file. If the file is larger still, the inode has another pointer to a block containing pointers to blocks containing pointers to blocks in the file.
What potential problem does the SSTF algorithm have? Explain your answer.
The main problem is that the head can stay in one part of the disk indefinitely, leading to the starvation of requests far away from that part of the disk.
Why does the First-In-First-Out Page Replacement algorithm not work very well?
The main reason is that it does not consider whether a page is being actively used or not, only that it was brought in before the others. A secondary reason, called Belady's Anomaly, is that adding more page frames can sometimes cause more page faults.
How does the modified / dirty bit reduce the number of page transfers to swap space?
The modified / dirty bit is set when the page is modified, so only pages with the dirty bit set need to be written to swap space when the page is replaced. If the page does not have that bit set, it has not been modified, so there is no need to copy it to swap space.
The key idea behind virtual memory and demand paging is to only load pages as needed - on demand. Why is this an advantage?
The operating system does not waste time loading code / data pages that are not needed. With part of each processes in memory, more processes can be loaded and share the memory. Finally, this allows processes that are larger than physical memory to still run.
How can better programming prevent this overflow situation from occurring?
The programmer could check the size of the input, and not copy input values larger than the size of the buffer.
If the page considered for replacement has a reference bit of 0, the page is replaced. What happens if the page has a reference bit of 1?
The reference bit is set to 0, and the next page is considered. Essentially, the page gets a "second chance" and is replaced the next time it is scanned.
What is contained in the volume control block (also called the superblock)?
The total number of blocks in the partition, the block size, the number of free blocks, and pointers to the free blocks.
Thrashing occurs when the sum of all processes' memory needs is greater than physical memory. What is the "working set" of a process?
The working set is the set of pages that a process is actively working with, and which must be kept in main memory to avoid thrashing.
What is the "working set" of a process?
The working set is the set of pages that a process is actively working with, and which must be kept in main memory to avoid thrashing.
Describe the Reference Bit / Not-Recently-Used page replacement algorithm.
There is a "Reference Bit" associated with each page, which is initially 0. Each time the page is referenced, the bit is set to 1. When page replacement occurs, any page with a bit of 0 can be replaced. Eventually all the bits may be set to 1, so periodically all bits are reset to 0.
Consider the form of demand paging ("Option 3" on the slides) where the program is paged in from the file system, and only modified data pages are paged out to swap space. What happens to pages containing code or pages containing unmodified data when they are replaced?
They are removed and discarded. If they are needed later, they are paged in again from the file system or swap space.
What is thrashing and why is it bad?
Thrashing is the wasted activity due to frequent paging that occurs when the combined working sets of the active processes are too big to fit into memory. In this situation, a particular process's active pages get paged into memory, paged out before the next time they are used, and then must be paged back in again — a huge amount of time that could be better used running processes instead of running OS code to handle paging.
Which File Control Blocks are stored in memory, and where in memory are they stored?
File Control Blocks for open files are stored in the System-Wide Open File Table, which is part of the OS kernel.
The File Control Block (called an "inode" in UNIX terminology) represents the file, much as a Process Control Block represents a process. What information is stored in the File Control Block?
First, it includes accounting information such as file permissions, file dates (creation, access, write), file owner, file size. Second, it includes pointers to the file's data blocks on the disk.
What page/frame does the Least-Recently-Used (LRU) algorithm replace?
LRU replaces the page that has not been used for the longest period of time — the one that was used the farthest in the past
In what way(s) is a page fault similar to an interrupt?
Like an interrupt, a page fault can occur at unpredictable times as the program runs. Like an interrupt, a page fault transfers control to an OS service routine, which in the case of a page fault brings the requested page into memory and updates the page table. When that service routine finishes, control returns to the user program at the point it was interrupted and normal execution continues.
Consider the various disk head scheduling algorithms discussed in class. Briefly describe the LOOK algorithm.
Move the disk head from one side of the disk to the other, picking up requests as it goes along. Once it reaches the last request in a particular direction, it turns around and heads back the other way.
Consider the Second Chance page replacement algorithm. Why is it sometimes called the "Clock" algorithm?
Pages/Frames considered for replacement are scanned sequentially, but then the scanning wraps around at the end, essentially scanning in a circle, more or less like a clock hand sweeping around.
What is the primary advantage of Contiguous Allocation for storing a file?
Performance - if the blocks of the file are contiguous there are few, if any, seeks needed to read the file - just waiting until the blocks rotate under the disk head.
Draw a diagram showing the relationship between the ilist, inodes (File Control Blocks), and data blocks that make up a particular file. You do NOT have to show directories or how they relate.
Picture Here -> https://ibb.co/tKgC1pg This figure shows the relationship, but you could omit the directories and directory blocks.
Draw a diagram of the Unix multi-level indexed disk allocation method (no explanation necessary, just the diagram).
Picture here -> https://ibb.co/svkcSsq
Which type of RAID would be better for crucial files that you do not want to lose, and why?
RAID 1 (Mirroring) would be better because it always provides a live backup.
Briefly describe the SCAN, C-SCAN, and C-LOOK disk scheduling algorithms.
SCAN — the disk read/write head starts at one end of the disk, and moves toward the other end, servicing requests as it goes. When it gets to the other end of the disk, the head movement is reversed, and it services requests as it returns. Then this process repeats. C-SCAN — the disk read/write head starts at one end of the disk, and moves toward the other end, servicing requests as it goes. When it gets to the other end of the disk, it immediately returns to the beginning of the disk without servicing any requests on the return trip. Then this process repeats. C-LOOK — the disk read/write head starts at the request closest to one end of the disk, and moves toward the other end, servicing requests as it goes. When it gets to the last request in the direction it is moving, it immediately returns to the request closest to the beginning of the disk without servicing any requests on the return trip. Then this process repeats.
Consider the form of demand paging where the entire process image is copied to swap space at process load time, and then demand paging occurs to/from that swap space? What is the advantage of this method?
Swap space uses a "file system" that is much simpler than the regular file system (no directories, etc.) and as such has better performance. Loading pages from this swap space when needed is faster than loading them from the main file system.
What is a denial of service attack?
When a computer is overloaded the point where it cannot perform is normal operation. This may happen due to an overly large number of web requests, or to starting but not finishing an IP-connection handshake (SYN).
In terms of page/fame replacement, what is the distinction between "global replacement" and "local replacement"?
With global replacement, a process can replace a frame belonging to any process, but with local replacement, it can only replace one of its own frames.
In terms of page/fame replacement, what is "global replacement", and what problem does it have?
With global replacement, a process can replace any frame, including a frame belonging to any process. As a result, a process's execution time can vary depending on whether other processes have replaced some of its frames, and a process may not have the pages that it "needs" due to some other process taking those pages, which can in turn lead to thrashing.
In terms of page/fame replacement, what is "local replacement", and what problem does it have?
With local replacement, a process can only replace one of its own frames, not a frame belonging to another process. The main problem is that it may need more frames than it has, so there would need to be some mechanism to increase its number of frames. A related problem is that it may need less frames than it has, so it is wasting memory space, so there would need to be some mechanism to decrease its number of frames.
