CSLNotebookEntryToAlpineusersDateJune7,1983FromMarkBrownandEdTaftLocationPaloAltoSubjectAlpinepublicinterfaces(version9)OrganizationPARC/CSLXEROXReleaseas[Indigo]Documentation>AlpineInterfaces.tiogaDraft[Indigo]Doc>AlpineInterfaces.tiogaLasteditedbyTaft,June7,19835:36pmAbstractThesearethelowest-levelpublicinterfacestotheAlpinefilesystem.ThismemodescribesthefunctionsprovidedbyAlpineatthislevel,andaccompaniestheMesadefinitionsfilesthemselvesindescribingtheinterfacesAlpineEnvironment,AlpineFile,AlpineTransaction,andseveralothers.Seetheendofthismemoforachangehistoryandalistofunfinishedbusiness.1.IntroductionThismemodocumentsthelowest-levelfilesysteminterfacesseenbyAlpineclients.TheAlpineinterfacesareintendedtosupporthigher-levelfacilitiessuchastheCedardatabaseandtheCedarfilesystem,andnottosupportapplication-levelclientsdirectly.Multipleinstancesoftheseinterfacesmaybeimportedbyasingleclient,somerepresentinglocalfilesystemsandothersrepresentingremoteserversthatareaccessedthroughremoteprocedurecalls(RPC).AnAlpinefilesystemconsistsofasinglelog,usedtoimplementatomictransactionsondata,andasetoflogicaldiskvolumescontainingfiles.Alogisstoredondiskforonlinerecoveryfromclient-abortedtransactionsandsoftfailures,andistransferredtoofflinestorageforusebythebackupsystemincaseofhardmediafailures.Avolumemaybequiescedandmovedfromoneservermachinetoanother,orstoredofflineforextendedperiods.TheseinterfacesaretheonlyonesseenbyclientsofanAlpineserver.Thisincludesclientsthatmaysharetheservermachine,suchasadirectoryordatabasesystem.2.OrganizationAlltheinterfacesandotherfilesrequiredbyaclientofAlpinearemadeavailablevia[Indigo]Top>AlpineUser.df.TheprimarydocumentationfortheAlpineinterfacesistheinterfacesourcefilesthemselves,whichareheavilycommented.Thedocumentyouarereadingisintendedprincipallyasahigh-leveloverviewofAlpine'sconceptsandfacilities,thoughitalsocontainsmoredetailedelaborationsonthesemanticsofsomeoftheoperations.(IfyouarereadingthisdocumentinPressform,youwillfindlistingsofthepublicinterfacesattheend.)pa ?q ^r^xq+^r6^9W:q Z!rZ!!" q+Z!s6Z!9q V:rV:x #)q+V: r6V:s:V:;V:t{Nq D sD3q BsB*q A< VsA<P# 2q >s> s !&, ,\.0u57p@ G ;g  % ,8;o@r 7. }< Cg" &)H*l,.X 5":>@D+ 5 nS"r&-#0j 79K;?Af p 1U r - 3 !#(G .Z1]3A7<5>Ce ,P 5 %f(*1,0369L;?BF * q.J!'W- 248O >AC ) ?@p !$e&+.3 :?DVG; 'ZfE" $ C9x#&B)+426 > @)CFEGr #,   H"$.&(,0.@1937=]@ ! v8. e 'k)$-2O479;@cDF  [!#),U04S7;@B_G 6t  SBy"%)z+Q-_269?=CF   %'r*w-p  r y  ^"Z(+U-6149\AdG 5 t3 "9&s ,.50`TVm$hTherearetwolayersofpublicAlpineinterfaces.Theonesinthelowerlayeraretheonesdirectlyexported(remotelyorlocally)byanAlpineinstanceitself.Whenusingtheseinterfaces,theclientprogramisrequiredtointeractdirectlywiththeRPCfacilities,todealwiththecomplexitiesofbindingtomultipleinstancesofthesameinterfaces(whennecessary),andtoexplicitlymanagevariousAlpineobjectssuchastransactionsandopenfiles.ThehigherlayerisathinveneerovertheloweronecalledtheAlpineUserpackage.ItisimplementedbytheAlpineUserImplsconfiguration,whichrunsontheclientmachine.IthidesmostofthecomplexitiesofRPCandbinding,anditprovidesautomaticallymanagedobject-orientedaccesstoalltheoperationsexportedbyanAlpineinstance.MostclientprogramsareexpectedtousetheAlpineUserinterfacesinsteadofthedirectAlpineinterfaces.Nevertheless,thedirectAlpineinterfacesareofinteresttoclientprogrammersbecausetheyalonecontaintheauthoritativedocumentationofthesemanticsoftheAlpineoperations.2.1.AlpineinterfacesAnAlpineinstancedirectlyexportsfourpublicAlpineinterfaces.TheinterfacesAlpineFileandAlpineTransactioncontainalltheoperationsmostclientswillrequire.AlpineOwnerandAlpineVolumeconsistprimarilyofadministrativeoperations,thoughthereareafewthatmayusefullybecalledbyordinaryclients.(Alpineexportsotherinterfacesaswell,buttheyareintendedonlyforadministratorsorwizardsandarenotdocumentedhere.)Additionally,thereisapublicdefinitionsfile,AlpineEnvironment,thatdeclarespublictypes,constants,andotherthingsusedinoneormoreoftheinterfaces.Thesedefinitionsarealsodeclared(indirectly)intheinterfacesthatusethem,somostclientsshouldnotneedtorefertoAlpineEnvironmentdirectly;thus,forexample,AlpineTransaction.TransIDandAlpineFile.TransIDarethesametype,whichisactuallydefinedinAlpineEnvironment.ThisislikewisetrueofSIGNALsandERRORswiththesamenameinmultipleinterfaces;forexample,AlpineFile.UnknownandAlpineOwner.Unknownhavethesamevalue,soenablingonewillalsocatchoccurrencesoftheother.AlpineFileprovidesalloperationsonfilesthemselves,includingcreatinganddeletingfiles,readingandwritingdata,andmanipulatinganyofafixedsetoffileproperties.AlpineTransactioncontainseverythingtodowithtransactions.AnAlpineservermaybeaskedtobethecoordinatorforanewtransactionoraworkerforanexistingone;thisinterfaceincludesoperationsforbothpurposes.AlpineOwnerdealswithadatastructurecalledtheownerdatabase,whosemainpurposeistoprovideaclientrootfileandadministrativecontrolssuchasdiskspaceaccounting.AlpineVolumeprovidesoperationsforinterrogatingand(forqualifiedclients)changingthesetofvolumesinoperationonaserver.Foreachprocedureineachinterface,thelistofSIGNALsandERRORsthattheprocedurecanraiseisgivenasastylizedcommentintroducedby!''immediatelyfollowingthedeclaration.Forsignalsthattakeenumeratedarguments,thepossiblevaluesoftheargumentsaregiven(butareomittedifallthevaluesarepossible).Additionally,RPC.CallFailedcanberaisedduringanyremotecall;seesection3.4.2.2.AlpineUserpackageTheAlpineUserpackageexportsthreemaininterfacesofinteresttoordinaryclients.TheyaredistinguishedfromthedirectAlpineinterfacesinthattheirnamesbeginwithAlp''ratherthanAlpine''.AlpInstancecontainsanoperationforobtainingahandleonaspecificAlpineinstance,localorremote.ItmanagestheinteractionswithRPCanddealswithalltheproblemsofdynamicinstantiationofinterfaces.AlpTransactioncontainsthesameoperationsasAlpineTransactions.However,theoperationthatcreatesanewtransactionreturnsahandleforalocalobjectwhichembodiesboththetransactionitselfandits2r b)$" ),/14v8v<>A3D `C$ )9,04R7 >@_D ^ AR1!]$ *H+.14 ;=~B}D ]3x ! (+-H 398W=(AF] [ D Y +J9!$E(*.1@ 8>C?A= W_   !2%()u,0W_,W_r/W_0W_57':=?pA U  ;S )_/@8<>@|B T"N&:,y.469[; Ce Ri_2 ! *&,0n4 ;&=}?:DE P Nkv%"%Z -Z 68p:@BE  O v K  r H I!%M). 59 ? F GGlUO %p(-%/5 =@W E  &+/Z13%58< A^CuG C:K1! ()-5/25O;>I@ BQ [$  ? 88h #}&D25;?QCC >$ 2Cw|!"% +/ 6J8;Z@ G <} k 56!%*-(02q57D  : &@%(-496j8<?EC0Dx 9.9!o"(I+Iq-9.-9.r19.29.q59.6<9.r99.:9.=@lDG 7_ 2+-<~?BE 5 Jm $x&1( 3Z [N !# +E1\69Q>AF 1 !i"&(-),P /-] !y#"%$(9 0 2Y6:=?CEDG/ - Q  !&f(*/25;2@ GR + ( )Y |%Xe#+'+)-04Q8<AYBD ' - %(9),0 %, r ! )!+.N38>N@BD! #   l !$Q&q( ) r, . q0 1 r4 6 9;B$DH# X z "$'p /]57 ?zB;F   -#'), 2599<>|CuEErG/G  b  - )+-t1p58v=@BdFv  r  & #' . 0)5j7{=lCQG; 6 /| &'*L-y15T8T "s *,(.36;%>Ru@SDASDEw Qr?QQ( "O$n' / 47M >AC O  )$&*,?/>3[57];c<@BD NN }A %4(O* K 6( $'&$'C* 1479b>nAQE(F J+ ]4 m"&s),"-1y36:> H# H )"$([* +.2 Fi  #%o),0 6 G A U6  "&( 0J5:< ?AE ?k/I !$ +p05 <=CsH# = g $Wv :t r 7 rOau7H7 r&b7'7(7)~5:>A E 6 5"d(+/& 9,BG/ 0@ ^ !:$'2!39c;$A`C . %P(*i.2n7 >@DF ,  !$ +15}9~; +J ( l~^\!S')+ 38=7@EU '' <2#%|&)> 3 93; = %l5@ "%39>;BG # bBe &,-/0 7:B=hBuC#rD # "1u"1rz"1A $F*8B  ) #'+069C     #[   !&T(4 ;o?CFI  k]. ! (.0t4E7 ASBF NQV 6 &+-0W6:?WBC S +  b"( ).d16h8':> DG 9-m $)0m2q49>Q@ u r a z!%),/^159?vC 5 h W&)-/46) >A w) >TVm$<TheimplementationoftheAlpineUserpackageprovidesoneexampleofhowthismaybedone.3.2.ConversationestablishmentCallingImportInterfaceisstrictlyaruntimebindingoperation;itdoesnotgiverisetoanyexplicitcommunicationwiththeserver.BeforecallinganyAlpineprocedure,itisfirstnecessarytoestablishaconversationwiththeservermachine.Theconversationembodiestheauthenticatedidentitiesofboththeclientandtheserver,anditisalsothebasisfor(optional)encryption-basedsecurecommunication.AconversationisestablishedbycallingRPC.StartConversation,passingtheclient'sRNameandpassword(ordinarilyobtainedfromCedar'sUserCredentialsinterface)andtheserver'sRName.StartConversationfirstcommunicateswithaGrapevineauthenticationservertoobtainaconversationkeythatwillbeknownonlytotheclientandserverRPCmachinery,anditassociatesanewly-allocatedRPC.Conversation(whosepurposewillbeexplainedshortly)withthiskey.Thisisallthatisrequiredtocarryonasecure,authenticatedconversationwiththeserver[Needham&Schroeder,1978].ConversationmaintenanceisfacilitatedbythefollowingRPCconvention:ifthefirstargumentofaremoteprocedurecallisoftypeRPC.Conversation,thenRPCwillensurethatthecommunicationbetweenclientandservermachines(forthatcall)isencryptedbythekeycorrespondingtotheConversation.Thus,allproceduresexportedbyAlpineinterfacesrequireaConversationastheirfirstargument.ThisConversationservestwopurposes:itcausesRPCtoencryptthecommunication,asjustexplained;andontheserversideitidentifiestheclientofeachcall.Afewremarksmaybemadeaboutthisorganization.AConversationrepresentsnothingmorethananauthenticatedcommunicationpathbetweenapairofprincipals;thereisnoinherentassociationbetweenconversationsandanythingelse(interfaces,processes,transactions,etc.)SoasingleConversationcanbe(andtypicallywillbe)usedtomakecallstomultipleremoteinterfaces,suchastheAlpineFileandAlpineTransactioninterfacesexportedbyoneAlpineserver.Asingleremoteimplementationcansupportconversationswithmultipleclients,eachidentifiedbyitsownConversation.MultipleclientprogramsonthesamemachinecancommunicatewithagivenAlpineserverusingthesameordifferentConversations,dependingonwhethertheyaremutuallycooperativeorsuspicious.CallingRPC.EndConversationcausestheremoteandlocalRPCstoforgetaboutaconversation(i.e.,aboutanassociationbetweenConversationandconversationkey).AclientthatknowsitisfinishedwithaconversationshouldinvokethistoconserveresourcesintheRPCmachinery.3.3.AlpineUserpackageoperationToaccessAlpineviatheAlpineUserpackage,thefirststepisalwaystocallAlpInstance.Create.TheonlyrequiredargumentisthenameoftheAlpineinstance(orFileStore)tobeaccessed.ThenameLocal.alpine''referstotheAlpineinstanceonthelocalmachine,ifoneexists.Optionalargumentsarethenameandpasswordofthecaller;ordinarilytheseshouldbedefaulted,inwhichcasethecredentialsofthelogged-inuser(obtainedfromUserCredentials)areused.ThesuccessfulresultofthisoperationisanAlpInstance.Handle,whichrefersbothtoaboundsetofinterfacestothatAlpineinstanceandtoanauthenticatedRPCconversation.Thishandlemayinturnbepassedtoseveraloftheproceduresdescribedbelow,eitherforperformingoperationsorforobtainingother,morespecializedhandles.Theobjectreferencedbythehandleisautomaticallymanagedandwillbereclaimedafterallreferencestoitaregone.Thenextstepisusuallytocreateatransaction.AlpTransaction.CreatetakesanAlpInstance.Handle,createsatransactiononthedesignatedAlpineinstanceandreturnsanAlpTransaction.HandlethatdesignatesboththeAlpineinstanceandthetransaction.TheotheroperationsinAlpTransactionalltakeanAlpTransaction.Handleastheirfirstargument.ThismeansthatthoseoperationsaremembersoftheHandle'scluster'',sotheymaybeinvokedwithobjectnotation;forexample,ifhisaHandlethenthe4r b) \ "'P,/569e Q, j! */!15w6 >ADG OTO!\J" )|,-M 3Y4d> Mq#&)w,d/~0257<>PACD L6 l e#*,5 3 I v B "$'-1J 9:=@&F~He Hie+.25:)=:? FaL!$'+L-36(8; E&G/ D  %', 279 ACPF Cu  ") *f.2 38;% E8F Ak ]c %(O,-0 > /{Q =" +#, 5! ;@DmG =< d ,$%(*4 04q57=D D  ; ^ Z $K * 2b578< EG 9 My!$&,r1J 7;_=>? F 8FO g!"%*.W/38> B D 6 _qs" (*,/ 8-=AG 4 3v "#'+/3s59:@W 3Ph#/ *,G 0!b#(+/3 49=>b F /"   $G& .2G37:K>?A9Ft -z   U%+-03a *Ub  #H ,.. 47:=BDG/ )Ls v % r # { >%(*-/3m5 7CFu !tj8!7#(.10 7: ?AEG O  t3 "$k ,03 8y;@BDG g* .&n*.1; 8 ?EACp  z b $ +-/4i5 >LD*F Y 'cS  #-  A\ !g (7:< +. sk #(R-058F v "$ ,</2 9Y; DF  =:"(+026t =&?}EsG/ 5 $',14$9u;U 5r< 5>?*D G/w)TVm$transactionmaybecommittedby:h.Finish[commit];Alloperationsonfilesrequirefirstthatthefilebeopened.TheproceduresAlpFile.OpenandAlpFile.CreatetakeanAlpTransaction.Handle,alongwithvariousotherarguments,andreturnanAlpFile.HandlethatdesignatestheAlpineinstance,thetransaction,andthefile.TheotheroperationsinAlpFiletakesuchahandleastheirfirstargumentandmaybeinvokedwithobjectnotationasdescribedabove.AlpTransaction.HandlesandAlpFile.HandlesaremanagedautomaticallyinthesensethattheydesignateCedarreclaimableobjects,sonoexplicitfreeingoperationisrequired.However,whensuchanobjectisreclaimedbecausenoreferencestoitexist,butthetransactionoropenfilecorrespondingtoitisstillactive,nochangeoccursinthestateofthattransactionoropenfile(i.e.,itisnotautomaticallyterminatedorclosed).3.4.CallingTheAlpinepublicinterfacesrestrictthemselvestotheprocedurecallsemanticsimposedbyRPC.Inparticular,address-containingargumentsandresultsaredereferencedbyRPC(toasinglelevel)andpassedbyvalue.(ThisiscomplicatedbytheVALUEandRESULTconventions,discussedinsection4.4.)ROPEsandLISTsareflattenedandsentintheirentirety.ExportedvariablesandthetypeREFANYarenotsupported.Procedureargumentsarenotsupportednow,thoughtheymaybeeventually.SIGNALsandERRORsworkacrossremoteinterfacesinthenormalway,withonevariation.Inordertobepassedthroughtotheclient,asignalmustbedefinedintheinterfacethatexportstheprocedureraisingthesignal.SpecialmeasureshavebeentakenintheAlpineimplementationtoensurethatasignalwithagivennameisexportedwiththesamevaluefromeveryinterfacethatcanraiseit.ThesignalRPC.CallFailedmayberaisedbyanyremotecall;itindicatesabreakdownincommunicationorinthebindingwiththeremoteAlpineinstance.Thiswillnotbementionedintheinterfacedescriptionsintheremainderofthisdocument.CallFailedindicatesapersistentfailure(thatis,theRPCmachineryhasalreadytriedveryhardtomakethecallsucceed);soingeneralitisnotappropriatefortheclientsimplytoretrythecall.RecoveryathigherlevelsofclientsoftwaremaysucceedifitreestablishesthebindingtothesameoradifferentAlpineinstance,perhapsafterinterventionbythehumanuser.Nearlyallproceduresinthepublicinterfacesaresafe''intheCedarsense.However,theinterfacesdirectlyexportedfromAlpinearenotdeclaredasCEDARDEFINITIONSbecausethisdeclarationisnotyetsupportedbyRPC;soalltheproceduresareinfactUNSAFEatthepresenttimeandmustbecalledfromwithinTRUSTEDorUNCHECKEDblocks.Ontheotherhand,theAlpineUserpackageinterfacesareCEDARDEFINITIONS,andallproceduresdefinedinthem,withtheexceptionofAlpFile.ReadPagesand.ReadPagesWritePages,areSAFE.3.5.AccesscontrolAccesstofilesandotherobjectsiscontrolledbyaccesscontrollists,whichconsistofGrapevineRNamesthatmaybeindividualsorgroups.Clientmembershipinanaccesscontrollistisdeterminedbyfirstcheckingwhethertheclient'sRNameispresentinthelistandthenconsultingGrapevinetodeterminewhethertheclient'sRNameisamemberofanyofthegroupsinthelist.Eachfilehastwoaccesscontrolliststhatcontrolreadingandmodifyingthatfile.TheseaccesscontrollistsarefilepropertiesthatmaybemanipulatedviatheAlpineFileinterface,describedinsection4.AnaccesscontrollistissimplyalistofRNameswhichareordinarilyGrapevineindividualsorgroups.Thereisaspecialpseudo-RNameWorld'',whichincludesanyauthenticatedclientasamember.Theamountofspaceavailableforstoringaccesscontrollistsisfixedforeachfile.Alpineguaranteesthatthereisenoughroomforanaverageoftwomaximum-lengthRNamesperaccesscontrollist,butdoesnotdictatethedistributionofspaceamongthelists.Eachfilehasanownerproperty,whichisasinglename(usuallybutnotnecessarilyanRName).Aclient5r b)  _ ] @"%X(&*-^36K = F [s (,2/48 @CG Y i I#)g+ 3 58:=A: G X%$F"R(s+!.05:8K<[ACd V} Sn%'- 6,7:&=@C RO UJ "'-/5;8>BD H# PO B !w%'*) 1=369& B5CEjF O _!c$ *,02Z5P67:B B MY  "'Q, 459Tv I r G(  D (),i35<ACG E i#C&&*-! 5}7;-=>BF C]er !A#Hq%C&~Cr*C*Cq,C-Cr1C2rC 9?AFHq B2r B2B2qB2B2raB2~B2"z$<'-3 8;>/qASB2B'B2DrGB2GB2 @ } h #K%,p/47;= qD@D@rH@ >q > ^>r>>?M $"%(2,0"3?5 <=AC7E) =<?  "')w+149<BG/ ;I!- #%(, 68<?A+E0He 9 `!%)(,D147C:~ 7f  _T6#(u%7f%7fr'7f(#7f,7/,0s670>=? 5  %ica/"("+ -018:,, 5Z9:;AD   nx %s(S)-x/3!6: AD|H# cW]H *"/26:=2?BE  K o$  5 Pu 5 5r 5 5!#$:(+03W5 <>jDQEw) TVm$6whoseRNamematchesthefile'sownerproperty(orisamemberoftheowner'screatelistseesection3.6)ispermittedtochangethefile'saccesscontrollists.EachAlpinesystemhasaspecialAlpinewheels''accesscontrollistwhoseRNameispartofthefilesystem'sglobalstate.Membershipinthisgrouppermitsunlimitedaccesstofilesandotherobjects,regardlessoftheiraccesscontrollists;additionally,therearesomeadministrativeanddebuggingfunctionsthatcanbeinvokedonlybyAlpinewheels.Topreventaccidentaluseofthisdangerouscapability,theclient'smembershipintheAlpinewheelsgroupisnotnoticeduntilexplicitlyenabled.WheelmembershipisenabledordisabledbycallingAlpineTransaction.AssertAlpineWheel.3.6.OwnerdatabaseConsumptionofdiskspaceinanAlpineserveriscontrolledonthebasisofinformationinanownerdatabase.Anownerissimplyaname(usuallybutnotnecessarilyanRName)associatedwithafixedsetofinformation:adiskspacequota,presentconsumption,rootfileID(seebelow),andtwoaccesscontrollistsspecifyingwhomaycreatefilesforthatowner(i.e.,allocatediskspaceagainsttheowner'squota)andwhomaychangetheownerinformationitself.Forthepurposeofdiskspaceaccounting,severalvolumesonagivenservermaybegroupedintoasinglevolumegroup,whichhasassociatedwithitasingleownerdatabase.Permissiontoallocatespaceonbehalfofanownerappliestoanyvolumeinthegroup.Additionally,whencreatingafile,aclientmayidentifyavolumegroupratherthananindividualvolume,leavingthechoiceofvolumeuptotheserver;thisisdiscussedintheAlpineFilesection.AlsoassociatedwitheachownerisarootfileID,whichisintendedforclientuseinidentifyingadirectoryorotherdatastructureforlocatingallfilesbelongingtothatowner.4.AlpineFileinterfaceTheAlpineFileinterface(andAlpFileintheAlpineUserpackage)includesalloperationsonfiles.ThissectionshouldbereadinconjunctionwithAlpineFile.mesaitself.Beforecallinganyoftheseprocedures,onemustfirststartatransaction,usingoperationsthatwillbepresentedinsection5.4.1.FilesystemorganizationTheprotocoldescribedinsection3bindsaclienttoaspecificAlpineinstance,identifiedbyanRName.EachAlpineinstanceconsistsofalog,usedtoimplementatomictransactions,andsomenumberofvolumes,organizedintovolumegroups.AvolumeisanalogoustoaPilotlogicalvolume'':initsquiescentstateitisaself-containedfilesystem.ThesetofvolumescomposinganAlpineinstancemaychangedynamicallyasvolumesaremountedanddismounted,thoughtherateofchangeisexpectedtobeslow.Afileisasequenceoffixed-sizepagesstoredinasinglevolume.AfileisidentifiedbyaFileID,anditspagesarenumberedconsecutivelyfromzero.Associatedwithafileisafixedsetofpropertiesthatmaybemanipulatedbyseparateoperations.4.2.OpenfilesAclientdesiringtogainaccesstoafilemustfirstOpenit.Openingafileservestwopurposes.First,itdefinesapointatwhichfileaccesscontrolandwhole-filelockingaredone.Second,itassociatesabriefhandle,theOpenFileID,withaconsiderableamountofstatethatisthereafterkeptbytheserverandneednotbesuppliedineachcall.Thatis,anOpenFileIDrepresentsasingleconversation'saccesstoasinglefileunderasingletransaction.NotethatOpenrequirestheclienttosupplyaUniversalFile,whichcontainsbothaVolumeIDandaFileID,eventhoughincurrentPilotafileisuniquelyidentifiedbyaFileIDalone.ThisisbecauseintheforthcomingCedarNucleus(aswellasinfutureversionsofPilot),FileIDswillnotbeuniversallyuniquebutonlyuniquerelativetoaparticularVolumeID.Inanticipationofthis,Alpinenowrequires6r b!C="m( *J+,2T46q;}?D `y Y U$c) ] w3u$V)-249#>_?BDG% \R| !$(.48:=@D Z 1 (i+.1 :W<C Y \X b%@'s,~ 25w7;9@ G/ W\k 1l"&'*S/2? 8 =oA U XH$v R` r O tR,#') 0"2F48=: ACuEOFEO M rMsMY"+'j), 3s5v;' ADF LJ % al>"' 0+3658:?BE Jz  "0%*'u*P.169=oBD HG"< ) F| >k $)/1G26l:=?EiHe Du DyDrDDL #&(?)p-b148 ?@E C- O[!&(A*/ 7u;<@ADE A B2: N#z%p +1@68i<>sCbE{G/ ?r7 #o =_ P @ "%('*{.0]6N8<?^A@ He ;!& %L'<**0285p 7 r 4; a!#h% -/28c:] AC%Fu 2{z #.16:u=>B/ 0  f" (+.70'6h8<v - N r * #F#g$(A)+ /4k: @6B*D )( ;u )( {)(r!)(")(&J(#/43 ;>B~Gu 'r'Q'uE''r '!i'"')/Y0251:$@ ACz % >B x!$'-).577 rC D& F d  v  6r H }C~1:M ."& (,.i45B7;>rDH9 u$K' -o2C48c=> EF= u_rrh_ %+,0$3 4 :>!@7BF R P]K5"$O&G . 459 BFHe  ACmX + y^@!&>'~ 0t4:=f>EHe & "$& + 24'5a9>A3BG  ` Cp # $&*0@26;;O>@B 5/V  '*.i0E 79<A1DBw) TVm$thattheclientpresentthecorrectvolumeforthefile,andraisesUnknown[fileID]ifitisincorrect.AFileIDconsistsofboththefileidentifieritself,whichispermanentlyunique,andsomelocationinformation,whichistreatedasahintandissubjecttochangeduringthelifetimeofthefile.OpenreturnsaFileIDwhoselocationhintmaydifferfromthehintintheFileIDthatwaspresented.IftheFileIDsdodiffer,theclientisencouragedtoretaintherevisedFileIDinitsowndatastructuressothatsubsequentOpencallsmaybeperformedmoreefficiently.Theentirefileislockedinthemodespecifiedbythelockargument.Ifthefilecannotbelockedinthatmode,OpeneitherwaitsuntilthelockcanbesetorraisesLockFailed[conflict]immediately,dependingonlock.ifConflict.(ThesemanticsofLockModesarediscussedinsection5.2.)4.3.FilecreationTheCreateprocedurecreatesandopensanewfile.TheinitialsizeofthefileisspecifiedbyinitialSize;clientsareencouragedtocreatefilesoftherequiredsizeratherthangrowingthempiecemeal.Thespaceischargedagainstownerintheownerdatabase;theclientisrequiredtobeamemberofowner'screateaccesscontrollist,andtheallocationmustnotexceedowner'squota.Notethatallocationisconsumedatthemomentafileiscreated;butwhenafileisdeleted,theallocationisnotcreditedwiththefreedpagesuntiltransactioncommittime.ThefileiscreatedwithaPilotFileTypeoftype,andwithPilotattributesimmutable=FALSEandtemporary=FALSE(supportforimmutablefilesisbeingeliminatedfromPilot;andsinceAlpineistransaction-based,thePilottemporaryattributeisnotofanyuse).Allfilepropertiesaresettodefaultvalues;theymaybechangedbymeansoftheproceduresdescribedbelow.4.4.OperationsonopenfilesTheproceduresthataccessthevolatilestateassociatedwithanOpenFileIDarefullydocumentedintheinterface,asaretheDeleteandSetSizeoperations.Whenatransactionterminates,allfilesopenedunderthattransactionareordinarilyclosedautomatically.However,ifthereisacontinuationtransaction(i.e.,continue=TRUEandoutcome=commitinthecalltoAlpineTransaction.Finish)thenthefilesareleftopen.TheReadPagesandWritePagesproceduresaccessafile'sdatainunitsofPageRunssequencesofconsecutivecompletepages.ThePageBufferarguments,whichdesignateblocksofmemoryinthecaller'svirtualaddressspace,deservesomeexplanation.ThetypesVALUEPageBufferandRESULTPageBufferareequivalentfromMesa'spointofview,butaretreateddifferentlybyRPC(thistreatmentisinvokedbythespecialprefixesVALUEandRESULT).AVALUEPageBufferisdereferencedatthetimeofthecall;i.e.,thecontentsofthearraydesignatedbytheDESCRIPTORaresent.ThisisconsistentwithnormalRPCcallsemantics.However,aRESULTPageBufferdesignatesaplacewherearesultistobeputatreturntime.Nodataispassedatcalltime,butablockofdataofthecorrectsizeisreturnedbytheprocedureandstoredinthedesignatedarray.Pagesareordinarilylockedautomaticallyasaside-effectofcallingReadPagesandWritePages,andunlockedbyterminatingthetransaction(seesection5.2fordetails).However,itisoccasionallyusefultolockpagesinadvanceofdoingI/Otothem,inordertobeassuredthatlockingwillbepossible;this7r b! #%(&*-1^<=y>@; _ c 6 &a*M.05 8f=@DX ] h7"%^&+-2L69]>@bBE \Kq #'+I-02g49_<=> EG/ Zx9 #%)+05%68;> DF X #'; Vv  py &Z(Pu*Vv+Vvr-Vv.DVv457:V>@EF TZ"$&(*i.+: B S(u S( US(rhS(S( @ '*R0\2 6 P q? & - 6#7:+<>D N Q^ !&%w'j), 38;|=cBDu MR rMRMR*y &+u.MR/WMR r7MR9MR=B?B K ?,U".1J5W8}q:K;cKr?kK@KBEw J \V$&J'r,. 5:= CG H\ ~C3!# +L-2g48X:&=?>AEv F 4K[5 $d)l+D.26 8&; CE7G El! v A Nr > &-"$&),0l347*9:@uB>C> rH> =8'q aZ ?!$E),m0q38'**-/O468t9?u@;Aj;rD/;D;E 9 (. e#&1u*9+`9r.%9.}9/~379 @A|G 8B kBVY#-$v&(-0U 68@:@BC|E 6   4 4q"u$4%4r'4(;4 / 57<?[BG 2l  #&) u/2l0Q2lr6 2lq7j2lr;h2l<2lu>2l>2lrC2lqET2lr 0b!D ( +/u2C5:j;G/ / OD"h%(:* 1T357<AQD~G -v[WS &v * r 'H !$ +`.x0f 8$:u= EG/ % Kh"1 #   !&*r-1 46a <@ !rv` x &nu)u!r*!rr.i!rq/!rr3Z!r4!ru6 !r6!rr:!rbAnF Y \'_ -/.268(<=w?2A/CE`  h73 :"#')Y,].0s579>@C    u     $Y&?' .q0b4<'? F  %} "r%8),.:3S9:<6 CG 5  "W&L( +-/47w<]?AFw)+TVm$maybeaccomplishedbycallingLockPages.UnlockPagesmaybecalledtoremoveareadlockpriortotheendofthetransaction;itistheclient'sresponsibilitytoensureconsistencybyavoidinganysubsequentupdatesthatdependonthedataformerlyprotectedbythereadlock.UpdateandwritelockscannotberemovedbyUnlockPages;attemptstodosoareignoredwithouterrorindication.4.5.FilepropertiesAssociatedwitheachfileisafixedsetoffileproperties(seeAlpineEnvironment.PropertyandPropertyValuePair).TheseincludetheunderlyingPilottypepropertyandseveraladditionalpropertiesthatareexpectedtobegenerallyuseful:accesscontrollists,bytelength,createtime,stringname,andversion.Filepropertiesarereadandwrittenunderatransaction,justlikefiledata;propertiesmaybeindividuallylockedorbelockedimplicitlybyafilelock.InthecurrentversionofAlpine,allpropertieswiththeexceptionoftheversionaretreatedtogetherwithrespecttolocking.So,forexample,writinganypropertywilllockoutreadsofanypropertyofthesamefilebyanothertransaction.ThebytelengthisaLONGINTEGERassociatedwiththefile.Alpinedoesnotenforceanypropertiesofafile'sbytelength;inparticular,thebytelengthhasnoinherentrelationtothefile'ssize(numberofpages)ortothehighwatermarkpropertydescribedbelow.ThecreatetimeisaSystem.GreenwichMeanTime,whichbyconventionidentifiesthetimeatwhichtheinformationinthefilewascreated.Alpinedoesnotenforceanypropertiesofthecreatetime.Wediscouragetheuseofcreatetimestoidentifyfiles;weprovideversions(below)forthatpurpose.Afilemaycontainpageswhosecontentsareundefined.Forexample,whenafileiscreated,allitspageshaveundefinedcontents;andwhenSetSizeisusedtoincreasethelengthofafile,thenewly-allocatedpageshaveundefinedcontents.Theboundarybetweenthedefinedandundefinedportionsofafileiscalleditshighwatermark.(Precisely,thehighwatermarkisthenumberofpagesofdefinedcontents,orequivalentlythepagenumberofthefirstpagewithundefinedcontents.)Alpinemaintainsthehighwatermarksoastogainanimportantperformanceadvantage:pagewritesbeyondthehighwatermarkareperformedimmediatelyratherthanbeingdeferreduntilthetransactioniscommitted.Thissubstantiallyreducesthenumberofdisktransfersthattheservermustperform;itisintendedtoimprovetheperformanceofsequentialbulktransfers.Thisoptimizationoccursonlywhentheentirefilehasbeenopenedwithanupdateorwritelock.Thehighwatermarkisadvancedautomaticallybypagewritesbeyondtheprevioushighwatermark;itmayalsobeadjustedbycallingWriteProperties.Decreasingthehighwatermarkisawayofdeclaringthatsomeportion(orall)ofafile'scontentsarenolongerinteresting.Notethatchangingthehighwatermark,likealldestructiveupdateoperations,isdeferreduntiltheendofthetransaction.Soforadecreaseinthehighwatermarktohavetheperformancebenefitdescribedabove,thetransactionmustfirstbecommitted.Eachfilehasanowner,whichisasingleOwnerName,andreadandmodifyaccesscontrollists,eachofwhichisalistofRNames.Theseweredescribedinsection3.6.ThestringnameofafileconsistsofatmostmaxStringNameCharscharacters.Alpinedoesnotenforceanypropertiesofthestringname.TheversionofafileisaLONGINTEGERwhosevalueisthenumberofcommittedtransactionsthathavemodifiedthefileinanyway(viaWritePages,SetSize,WriteProperty,etc.)Asingletransactionmayalsoincrementafile'sversionbyaspecifiedamount.Theversionpropertyisprovidedtoallowremotelystoredcopiesoffilestobevalidated;andmultipleincrementingoftheversionpropertyisprovidedtoallowout-of-datereplicastobeupdatedinasingletransaction.Asmentionedabove,theversionpropertyislockedseparatelyfromtheothers.Committingatransactionthathasupdatedafilesetsawritelockonthatfile'sversionpropertyinordertoincrementit.ReadingtheversionpropertywithReadPropertieslocksitinreadmode.UnlockVersionreleasesaread8r b)   %. -h0v2q6r8+=u>Rb)>b)rAab)Ab)DdG ` .c 6#E +-+1s 8:f?Bf ^#)+.(1A49x<-?C$G ]3 @!#%J',15& v Y N r W! 9iR"%u'W!(7W!* r1DW!1W!4F UzOlg! (u,OUz,Uzr/PUz0Uz57< C S /#W'u,9/d27';:>BF R+ O SZ#$ +.p13^6 =,@A NmLX * o"&`(J*/46b;[=g CG/ LaN$',#-257*<uAwLaB'LarCLaDLa J ]!R#'/)+0 H>u H> sH>rH>%H>,qTH> H>)rH> wH>&<)U+.r26$8=@ FHK F U_0  d#'*,2S79R;?>B G D0({$*@ Bsu Bs bBsrBs2Bs>k(,. 6 ;>[ACG/u @ rz@@d %)+03 :} Q%&&)+03Y79c:=f? 9Z   &,F.36=/BDnEH# 7 u77r77 !:#&*.A/2$7\9!<>C 6  rD"]%5(|+2$ 3Tg"#%'u*,3 ;) B0E 1.P $ ,037s<@7B 0A Y  "$*+.4T7#9=@FH# .{m !#O )-& 36L >WBE , K7sR m"]&(,1 *w ; '-)),o0p5Z7=H@mD-H9 ( [d( /6148AC '( 34<X$'8)1-g 4k7:@dBE % aA " $%+i.035=7 >@BD  # Q" L (a-3U7:0 A=DG "2  dNuCrN#? +u.w.r12&u4=5Sr89Z<ADG  f!().O u  Xre -e "]%3y :M>B!D   qu q \qrRq q.q"qqr"q#q&*m+.13Z5; CdF/ pu! %* 47w8< CF "A-N#}),068=>3@C {V !9#) 136:@BG  aQ"$Y%)n X  ]#%)] /35i9 AvB  /e"^$d'2*x/@46:=;Bc 5h3Q (,q-/{26 @;EHFtw)TVm$llockontheversionproperty.Thisallowsthefiletobeupdatedbyanothertransactionwithoutconflictovertheversion.Notethatifthecurrenttransactionhaslockedtheentirefileinreadmode,thatlockcoverstheversionproperty,soitisuselesstocallUnlockVersion.Forhigherconcurrency,theclientmustlockthefileinintendRead,intendUpdate,orintendWritemodeanduseUnlockVersiontounlocktheversionpropertyafterreadingit.5.TransactionsandlocksAllAlpineactionsarecarriedoutundertransactionsthatensureatomicityandconsistencyofupdatesinthefaceofconcurrentrequestsfrommultipleclients,crashesofserversorclients,etc.TheAlpineTransactioninterfaceprovidesclientaccesstothetransactionfacilities.Briefly,aclientfirstrequeststhatsomeAlpineinstancecreateatransaction;thatinstancesubsequentlyservesasthecoordinatorforthattransaction.IfactionsaretobecarriedoutinotherAlpineinstancesunderthesametransaction,theclientmustcausethoseinstancestobecomeworkersforthattransaction.Readsandwritesareperformedunderthetransaction.ThetransactionmachineryensuresthatotherclientswillnotseethestateofanyoftheAlpineinstancesinapartially-updated(inconsistent)state;thisisdonebysettinglocksonfilesorpartsoffiles,asdiscussedinsection5.2.Eventuallytheclienteithercommitsorabortsthetransaction.Committingcausesallwritesoccurringunderthetransactiontobemadepermanentlyinthestateofthefilesystemandtobemadevisibletoothertransactions.Abortingcausesallthewritestobeabandoned,andmakesthepermanentstatebeasifthosewriteshadneveroccurred.Atransactioncanalsobeabortedbyaserverorclientcrashorbyadetecteddeadlockamongtransactionsattemptingtolockdatainconflictingways.5.1.TransactionmanagementAtransactionisbegunbyaclientcallingAlpineTransaction.CreateonsomeAlpineinstance.ThisreturnsapermanentlyuniquetransactionIDthatmaybepassedtootheroperations.(ProgrammersshouldnotethattheTransIDisaratherbulkyobject,whichiswhyveryfewprocedurestakeTransIDargumentsdirectly.)ATransIDmaybetreatedasacapability,sinceitcontainsenoughbitsofunpredictableinformationtomakeitextremelydifficulttoforge.ThereforeatransactionissharedamongclientsorprivatetotheinitiatoraccordingtowhetherornottheinitiatorhandstheTransIDtootherclients.AlpineenforcesnorestrictionsonwhomaypresentaparticularTransID.IntheAlpineUserpackage,AlpTransaction.CreatereturnsanewAlpTransaction.HandlereferencinganobjectthatholdstheTransID.ThisHandle,beingaCedarREF,isofcoursevalidonlyonthemachinethatcreatedit.Ifclientsonothermachinesneedtoparticipateinthesametransaction,thecallermustextracttheTransIDfromtheobjectandpassittothoseclients.TheymaythencallAlpTransaction.CreateWithTransID,whichcreatesalocalAlpTransaction.Handleforthesametransaction.TheclientmustalsocallCreateWorkeroneachAlpineinstancethatistoparticipateinthetransactionpriortoissuinganyotherrequeststothatinstance.Thiscallinformstheworkeroftheidentityofthetransaction'scoordinator.ItisstandardpracticetocreateatransactionontheAlpineinstancecontainingthedatatobeaccessed,orononesuchinstanceifmultipleserversaretobeaccessed.Toaccomodatethisnormalcase,CreateautomaticallystartsaworkeronthesameAlpineinstanceasthecoordinatorunlessinstructednotto.AclientonaworkstationshouldnotnormallyuseitslocalAlpineinstancetocoordinatetransactionsinvolvingmultipleservers,sinceacrashedcoordinatorcantieupresourcesonotherfilesystems.Itisperfectlyokforaworkstation'sAlpineinstancetocoordinateitsowntransactions,ortoactasaworkerinamultiplefilesystemtransaction,sinceinthesecasestheonlyresourcesthatitcantieupinacrashareitsown.Whentheclienthascompletedperformingthedesiredoperations,itshouldcallFinishtoterminatethe9r b) d4/R#%(a*,1t3x8 ?D ` 1 {# *-K14+8$:fCF Pb $W(e*,r 3n NN"',i0t1 9%;AR L u=LL r{LL &',S.0z2}7,9;t?%C K @ [!$t(#+13,u8;K9"Kr=>K=K?tB; H8D"%a ,/ 7=BE F&0y8 #;'-}/ 0?: CNF E5 Xu,E5E5rE5eE5a"$')v/1.5 B rXujBBr B!Bu"B#~Br'B'pB) 1 8=2?HCp A _ c &(*.4/2]49R<=?CG ?k Z1f!R#')T+@ 25X9;BEG = Mq{! (*-\/M4Y6U7;=PADFiHe <g9 !? (%),/1 8Dv 8 ! r 6 e No"2]4P7@EcG/ +JVE q"'+.O35t9 =B!G )  %) '' . .)-/1@c G %  %?)*?q.]%/1%r0%1%249 )B,a:<>B;   u "j$z',E14t57 >r@*B g p05!_$?)-!/47T< =@HEeG/   D i |Xa %'*.3 :=@AC    $' (*02 :`=AE)  a" 4#(:-/91 8= CEH N & - &)L+`.39(; B   `$v +.028:>A)FH#  Q!')( /1~4 <_>%?B CD X K9 $ %)I,/%2C8E;CE ]3 kWP#z Z   % & -2}9< BG Y Q U ')h+ 3z : BDF Wi`% s %f(/*,0 469;=C U dU` $).279I SF #i &+/2@58w;> E Q ;_u Q!gQr%Qq' Qr*Q+9Q- /U 6&:u=Q>QrBQD%Q O  X!##'),0;2 9=>? F NP fsD #&*E-/F125;)<=AFT L Y!)%(7-/2R5> <?FAD  K"U&)_,[136;,@qBBD IZv F  r CH  !J%(P,R. 62;>XC G; A" ?% '7 C ! (m*-/3 9;>sAD =} Oz$'+ 25F9`?`B ;I Z%\' */o26M:?AD :/ 6 u%:/%:/r':/(7:/*,k/V49;>JC~E) 8 v 1 6 @!5'(^),126J:x<? C-F 4d G[sZ#'l(-J1S47:>?DRF 2g^"'(8+N/W07q;?5AEK 1  k#5%( /268:w?WBF /n vN  w% '+?/2D45:t , ~"+% -E.1y6;3>@DF +K r !&) ,. 59}<]?E ) u|),)r)A)  %j,&0c2 9@DW ' f"k(&,' 2 ;>AG &U  {T '*,35@7=<@B!E>G $ e "2 l #%(N-u3"2r3"2u4"2r5#"26u:"2r;"2=m>AE Fu rN J9  %7(H*g,0u46; CmDq r  ur q!"Dr%%u&r'+-u/f1u4r58^;uhB WrWW gW g(W()W)*{W*{+BW+B+Wo+,WW,W3CW3C4AW4A4Wc45(Wo5(5W5Bq(3CrBqqq(q3CqrBq(3Cr N "%r& /T49x;-<@BF  [  4"P# *+/!2<36y9;:<?AC8  Q8 p#% ,.'49n:>sA X } &?)O+K/279|>qADC  d  !&l+?.0v37:T= 5 o bu\ 5 5rt 50 5 #'( /0239<[?lDAw)e cTVm$givenbyreadDoc>directory.Inthefilenames,*''standsforanumber;successivereleasesofadocumentareassignedthenexthighernumber.11r b) ME3!e") 24:>@DFt ` [ &(C-/578W:c?AE[G ^ \K V,M#G%(*/D148:>AP G Z F "%*'+j- 5:=BCG/ Xzd !}$(*,16 9I?ACF WU _ -e%!D$|&,/B 6<A}DG/ U L  L!'2)d-04M5;At S MU  %(b,F.026;?kB Qw  1 _$' ).k13 :\ N*1%! )&* 13 :=`AOCE) MA ugMAMArMA=MA#"%|+>.1s7;(?}A K IN !u#K$Kr%K&K u/Kr0zK1u5pKr6Kq7K8Kr;K<0K> uGKrHKu Ir I IuvIr=IuAIrIuIrIu"Ir#2Iu*Ir*Iu+Ir,I-106A<\>=D  HK[Y?7"]$'%( E l Z -"$',f/149;= G% D D %(K-0<16Q8H={?}AEpG Bm ? >4 /$02=A >7 "M(I*/ 6/ <CG < wY"Mq.</<r2<3<8:;>B5DEGq :r : : %'I,I 8Y ^ 'uN8Y8Yr%88Y%8Y+/4z6:n<@BE 6  ."$%Z*f/G16:<@kG; 5 >o u 5 x5 r&5 &5 *,.l146j <>(?DG/ 3c 0   !u$0$0r*0+U0527= E /- .$'.p2r6>9"<?B%E -"$1')!*H/5:<>~B + c  O"1&/)*-n 56 ?HDG *7~p %  r "  !Z#)+059NDocumentation>LupineUsersGuide.press,July1982.[Needham&Schroeder,1978]RogerM.NeedhamandMichaelD.Schroeder,Usingencryptionforauthenticationinlargenetworksofcomputers'',CommunicationsoftheACM,vol.21no.12,December1978.ChangehistoryVersion9;June7,19835:36pm.ConverttoTiogaformat.Removeallexcerptsfromthepublicinterfaces;theinterfacesthemselvesarenowtheprimarydocumentation.BringRPCdescriptionup-to-date.DocumenttheAlpineUserpackage.Version8;October13,19815:29PM.AddAlpineFile.Close,LockPages,UnlockPages.FinishingatransactionwithcommitAndContinuenowreturnsanewTransIDratherthanpermittingadditionaloperationsundertheoldtransaction.SubstantiallysimplifyinterfacetoRPCruntimemachinery.Version7;September21,19818:38AM.FurtherrefinetoconformwithRPCdesign.Addhighwatermarkmechanism.Deletetheindividualpropertyread/writeprocedures.Documentsemanticsoflocks.ChangeLockModetoLockOption.Changetoread/writeownerentryinsamestyleasfileproperties.Version6;September14,19818:46AM.Changestyleofthismemotomakeitservebetterasclientprogrammer'sdocumentationfortheFileStorepublicinterface;removeinternaldetails(implementationstrategiesandthelike)toaseparatememo,FileStoreinterfaceinternals''.SplittheformerFileStoreinterfaceintofourpieces:AlpineEnvironment,AlpineAccess,AlpineFile,andAlpineTransaction.BringconversationinitiationandauthenticationintoconformitywiththecurrentRPCdesign.Makeafirstcutatspecifyingthesignals.Version5;August25,198112:41PM.Makeinterfacehandle-oriented,sinceRPCrequiresit;seeHandle,Create,Destroy.AHandlecorrespondstoaclienttalkingtoaserver,nottoavolumeoramachine;someprocedurestakeavolume(orvolumegroup)parameter.MaketheidentificationFileStore=log,andintroduceaseparatenotionoflogicaldiskvolumeandvolumegroup.Addno-loggingoptiontoOpen/CreateFile;thistakestheplaceofnoTransaction,sinceithandlestheonesituationinwhichwecanseethatclientswillwanttogiveuprecoverytoreducethesizeofthelog(large-scalereplicationoffiles,wherethehomecopyiskeptloggedandothercopiesareunlogged.)OpenFileID->OpenFileID,AccessListID->AccessList(alistofRNames.)Addsectiononownerdatabase(CreateOwner,...,DestroyOwner),andexpandedfilepropertiessectiontoincludeallpropertieswenowplantosupport.Version4;May29,19815:36PM.Introducednotionoffileowner,whoischarged/creditedforpagesused/releasedinCreate/DeleteFileandSetLength.Version3;May15,198111:02AM.IntroducedtypesOpenFileID,ClientID,AccessListID,....AddednoTransaction.Moredetailonfileopeningandcreation;supportfilecreatewithandwithoutanexternallysuppliedID(usedtobeonlywith.)Length->ByteLengththroughout.List-orientedfilepropertyoperations.Muchmoreworkrequiredonpropertyinterface,includinglockingissues.Version2;March12,198111:22AM.AddedmoredetailtotheFiles''section,includingprocedurestomanipulatefileattributes.MadelockmodesconsistentwithLockDesign0.MademinorchangestoTransactionsection:RegisterWorkertakesarestartID''toallowunilateralabortofworker;FinishTransactionandFinishWorkertakearequiredOutcomethatmaybecommitAndContinueorcommitAndTerminate;expandedcommentsonTransactionsectionoperations.Version1;February25,19813:54PM.Lockstuffmovedout(toLockConcepts0.bravo,12r b)MZ 3 _v ! ] P  [*p Y~YQ!'d+91 9;W?F W\|469 U6  T647"% ,=1; 8a: D.F( RC uRR &I'*8r-R.dR125R7>3p N_r Kn 1 "$(E,2E49L<>B I[ ; D #m) 3'7T; B G c E/48 z#&2 9Z BHe C '!%*+{.4l8< C A f (.,358> ?[ $ )$-.4Z7z:?BE = 6) "(s /N 6=CE <  $&\ - 1N46: ==>AU 9!$g),.1>57E; C 4D' / 79E 2  k #_&3 -50K27k:?eCADfG: 1C [ .:  #(-8m<?E3G; -K/ (\*1+/i4!5u7G-7-r:-;->D@AjFzHe +oT F+@#%=*.y 5>9 ;T C ) a 'C!#'*/257;]>i E4 (! D "$D -02;7;9<1ACdGg &y y "(1)._03m5'79 A G $ 3LD`#&**.Z0 8 ?Au #+ tY >!}(,:13K7= FH ! L %*`,02 9U;}>ACI 3  ' '?+-^/4Y7c8CE W O"Q , (+ 39 BD(E + ^B#&I+0369<AkC9 & ="')w 1" 8 AJC  !#)5 /35G: W 8b-"r'*.z0427gXBG   "&%'-]037B =B$Do aqz !$&Z148:`G Z$& .b2 5 $(y,058;w)e -TVm$LockDesign0.bravo.)Sierra->Alpine.Version0;February19,19813:16PM.InterfacenamechangedfromBFS''.Weareattemptingtoerasethedistinctionbetweentheregularinterfaceandonthewire''.ThevolatilestructuresCoordinator'',Worker'',andFile''havedisappeared.ThetypeLockIDhasbeendefined,followingEdTaft'ssuggestion.UnfinishedbusinessLog/recoveryinterface.Cacheregistration(atwhatlevelshouldthisbedone?)Lockinterface(noconceptualdifficulty,detailscanbedeferredtoimplementationtime.)ContentIDproperty?Interfacestobackupandarchivesystems.IndefinitelydeferredbusinessValidationofremotepagecaches(throughahistorydatabasethatiscoordinatedwithfilepageupdates.)Transactionsavepoints?13r b!FH _$t #)-366;>b@ G ] =q Bv!'v*,.25X9 @ \W > $'+#03e7<C0E Z p V /r S? ~ P M_"~%' NI i u "')+12 < K IS 7r;p E0 r A Bf$%/)/K23s :>@iC ?g adw)eTVm$AlpineEnvironment.mesaCommondefinitionsforpublicAlpineinterfacesLasteditedby:TaftonApril8,19835:02pmMBrownonJanuary25,19833:21pmKollingonMay11,198312:01pmDIRECTORYEnvironmentUSING[wordsPerPage,logWordsPerPage,bytesPerPage,logBytesPerPage],FileUSING[maxPagesPerFile,Type],RopeUSING[ROPE],RPCUSING[Conversation,Principal,ShortROPE],SystemUSING[GreenwichMeanTime,nullID,UniversalID];AlpineEnvironment:DEFINITIONS=BEGINGeneraldefinitionsString:TYPE=Rope.ROPE;Identificationandauthentication(seeRPC.mesaandLupinedocumentationfordetails)Principal:TYPE=RPC.Principal;--aGrapevineindividualFileStore:TYPE=Principal;--anAlpineinstanceRName:TYPE=RPC.ShortROPE;--anarbitraryGrapevineRNameOwnerName:TYPE=RPC.ShortROPE;--anAlpineowner,notnecessarilyanRNameAccessList:TYPE=LISTOFRName;Conversation:TYPE=RPC.Conversation;FilesystemVolOrVolGroupID:TYPE[SIZE[System.UniversalID]];VolumeID:TYPE=RECORD[VolOrVolGroupID];VolumeGroupID:TYPE=RECORD[VolOrVolGroupID];nullVolumeID:VolumeID=LOOPHOLE[System.nullID];--theIDofnovolumenullVolumeGroupID:VolumeGroupID=LOOPHOLE[System.nullID];--theIDofnovolumegroupFileID:TYPE[SIZE[System.UniversalID]];--volume-relativeIDofafilenullFileID:FileID=LOOPHOLE[System.nullID];--theIDofnofileUniversalFile:TYPE=RECORD[--globallypermanentlyuniqueidentificationofafilevolumeID:VolumeID,fileID:FileID];nullUniversalFile:UniversalFile=[volumeID:nullVolumeID,fileID:nullFileID];PageNumber:TYPE=LONGINTEGER;--shouldbe[0..maxPagesPerFile]PageCount:TYPE=LONGINTEGER;PageRun:TYPE=RECORD[firstPage:PageNumber,u b& `} Ckm ^  ],h;J [?!N Y2x7q Vs T qNT3Ts}TT " -l 6! S7qS7S7sS7gS7b QqQQsQqDQsUQQ OqZO?OsOO  " N=qN=N=sN=MN=#-( JqJJ sJq IBu E s BqBHBsBBqSB'BsdBu = H  {' ).e 7s9s :S qH:S:Ss:S:S u :S!x:S"v#* s 8 qi8"8s88 u8i8g!Z%s 7q7T7s77 u"7"7#%+1us 5Y q5YM5Ys5Y5Y u%5Y%5Y&(y,13 :=<0s 2 q$22s|2qa22FsE2N2 . q..s)..u ) s &jqf&j&js&jq &js&j&j $qQ$ $s$q$a$s$H$ # qH##s#q#X#s!#"?# !p ~qc!p!ps$!p%!pu.!p/x!p0u2468s  $mq&R' s,-u67f8d:<>@yEs uquusIuqus'uuu%2u%u&/2135 s  Eq^s Wu*@*+.0613s { q{{sU{q:{{s{u y{ {!' .3 ;><>s) Q ! )' 273 / q//s#/q//s#/u$/$/%)+s q} 6 s q r s! q^  s q n s  5 - TVm$count:CARDINAL_1];maxPagesPerFile:LONGINTEGER=File.maxPagesPerFile-1;--subtract1forleaderpagewordsPerPage:CARDINAL=Environment.wordsPerPage;logWordsPerPage:CARDINAL=Environment.logWordsPerPage;bytesPerPage:CARDINAL=Environment.bytesPerPage;logBytesPerPage:CARDINAL=Environment.logBytesPerPage;FilepropertiesProperty:TYPE={byteLength,createTime,highWaterMark,modifyAccess,owner,readAccess,stringName,type,version};PropertyValuePair:TYPE=RECORD[SELECTproperty:PropertyFROMbyteLength=>[byteLength:ByteCount],createTime=>[createTime:System.GreenwichMeanTime],highWaterMark=>[highWaterMark:PageCount],modifyAccess=>[modifyAccess:AccessList],owner=>[owner:OwnerName],readAccess=>[readAccess:AccessList],stringName=>[stringName:String],type=>[type:File.Type],version=>[version:FileVersion],ENDCASE]_[byteLength[0]];--defaultvaluetomakeLupinehappyByteCount:TYPE=LONGINTEGER;maxStringNameChars:CARDINAL=100;--maxlengthofanystringappearinginapropertyFileVersion:TYPE=LONGINTEGER;FileaccessOpenFileID:TYPE[2];--representsasingleclient'saccesstoasinglefileunderasingletransaction.UniqueonlywithinasingleAlpineinstance.nullOpenFileID:OpenFileID=LOOPHOLE[LONG[0]];--IDofnoopenfileAccessRights:TYPE={readOnly,readWrite};LockMode:TYPE={none,read,update,write,readIntendUpdate,readIntendWrite,intendRead,intendUpdate,intendWrite};LockOption:TYPE=RECORD[mode:LockMode,ifConflict:{wait,fail}];RecoveryOption:TYPE={log,noLog};ReferencePattern:TYPE={random,sequential};--aclient-suppliedhintabouttheexpectedpatternofreferencestopagesofafile.Sequentialmeansthatwhentheclientreadsorwritesaninterval[p..p+n)ofthefile,thereisahighlikelihoodthatitwillreferencepages[p+n..p+2*n)inthenearfuture.Randommeansthatnosuchpatternisexpected.Specifying2sb&q_b&)b&sb&b& `}q`}`}s `}"`}u1p`}1`}28 9A;i?ks ^ qK^^s^^ ]+q}]+H]+s]+ ]+ [ q[[st[Y[ YqYYscYHYu T s QqQQssQXQ  ' 1v :x> 1O ^ LqLLsDLq)LLs"LqJsJJqJ9JsIA i "$ G < !E ' DF ^ $ BM @ & ! ?K " "l=/ ;}! q:Qs:Q:Qu":Q#:Q$ (,-1g6s 6 q\66s6q6R6os!6 3q33s 3"3u%3&'3'$*6.T/26_<><?qs 0[ q0[0[s60[q0[0[s"10[u +` s ( q8((s((u(}(z !"&+X/f1 2@68l<<=pAI 1&g @#'ks $ Mq 2$ $s&$q&$s*P$*$u-($-$.02u4h7s !l q!lv!ls!l!l ! qq*s( %)\5"? 1r ? ! q"!!sy!q^!2!s!x]  }q}q}s}}P +q>++s+z+" u*O+*++,58D@1  r!"K%{ ,$0M368<@$AE1 ]!$U'),*a-r 367:q@1CG1 5_Qc#;(,/149P:A w)TVm$Mthishintaccuratelyenablestheservertoperformtheoperationsmorequicklyandefficiently.OwnerpropertiesOwnerProperty:TYPE={createAccessList,modifyAccessList,quota,spaceInUse,rootFile};OwnerPropertyValuePair:TYPE=RECORD[SELECTproperty:OwnerPropertyFROMcreateAccessList=>[createAccessList:AccessList],modifyAccessList=>[modifyAccessList:AccessList],quota=>[quota:PageCount],rootFile=>[rootFile:UniversalFile],--readOnly--spaceInUse=>[spaceInUse:PageCount],ENDCASE]_[createAccessList[NIL]];--defaultvaluetomakeLupinehappynullRootFile:UniversalFile=[nullVolumeID,nullFileID];OwnerPropertySet:TYPE=PACKEDARRAYOwnerPropertyOFFalseBool;FalseBool:TYPE=BOOLEAN_FALSE;allOwnerProperties:OwnerPropertySet=ALL[TRUE];TransactionsTransID:TYPE[9];--globallypermanentlyuniquecapabilityforatransactionnullTransIDRep:ARRAY[0..SIZE[TransID])OFUNSPECIFIED=[0,0,0,0,0,0,0,0,0];nullTransID:TransID=LOOPHOLE[nullTransIDRep];--IDofnotransactionOutcome:TYPE={abort,commit,unknown};CommitOrAbort:TYPE=Outcome[abort..commit];WorkerState:TYPE={notReady,readOnlyReady,ready};ErrorenumerationsNeededAccess:TYPE={alpineWheel,fileModify,fileRead,handleReadWrite,ownerCreate,ownerEntry,spaceQuota};--whenaccessisdenied,indicatesthemissingpermission.OperationFailure:TYPE={busy,--serveristoobusytostartanothertransactiondamagedLeaderPage,--filepropertiesaremessedup(probableAlpinebug)duplicateOwner,duplicateVolumeGroup,duplicateVolume,inconsistentDescriptor,--PageBufferwordcountandPageRunpagecountareinconsistentinsufficientSpace,--involumegrouptocreateorextendfile,orinleaderpagetowritepropertynonexistentFilePage,--attemptedtoaccesspagebeyondlastpageoffilenotAlpineWheel,--failurefromAssertAlpineWheelownerDatabaseFull,ownerFileFormatOrVolGroupMismatch,--fromtheprivilegedoperationRegisterGroup,whentheownerfileformatisoutofdateortheVolumeGroupIDrecordedintheownerfiledoes3u1b&  "%(*/1 8t;@1` [I s X2 qX2X2suX2ZX2&16 = TqTTsFTq!+T!Ts&TqS8sS8S8 q"S8#;S8sQL' O)_ N=U La uJ sJhJ-! ) qICsICICq"IC#iICs$IC$ICu&OIC&IC',E/1t5!9sE  (! * BqBBsPBq5BB"js&B( B q0B1yBs2B3B @ q@@s-@q@@s@q@ b@s#G@ ?Mf#q%?M&?Ms(|?Mq(?Ms, ?M,n?Mu :S s 7q77sQ77u7?7=Q %*g 023 s 3q33sO33q33s33q&Q3'-3(P s0~32c3 2 Nq2p2s"2"i2u-2. 2/ 1<24 s .qi.#.s..M! - q- - sF- +- "& 'S +c qp+c)+cs+c+c + u &h s # q#A#s## # *0< 1!o  u"!o# !o$'+-17,9x>P s q<sxuuu'u$r"' su3 %*'~,-38<s#z(u'(( $(+.a4B7r;-= su|y $&;*5+0N246Y:[=?0BsuTQ"$((6+f/257Zs.u.,.*o!s  "u&P & '+-Q 3e9\ BFB 5< Z"$_'O)+T 5;<?BETw)-TVm$znotmatchtheonespecified.ownerRecordFull,ownerRecordInUse,quotaExceeded,--attempttocreateorextendfilewouldexceedowner'squotaregServersUnavailable,--accesscheckfailedduetoGrapevineunavailabilityreservedType,--attemptedtocreatefilewithillegaltypespaceInUseByThisOwner,totalQuotaExceeded,unwritableProperty};--attemptedtowritethetypeorversionpropertieswithWritePropertiesLockFailure:TYPE={conflict,--failwasspecifiedinthelockoption,andthelockcannotimmediatelybesetbecauseaconflictinglockisalreadysetbyanothertransaction.timeout};--lockcannotbesetevenafterwaitingalongtime,perhapsduetoundetecteddeadlockUnknownType:TYPE={coordinator,--coordinatorRNamenotknowntoGrapevine(CreateWorker)fileID,--nofilewiththisIDinspecifiedvolumeopenFileID,--IDpresentedfromwrongconversation,ornoopenfilewiththisID;thelattercanbeduetothetransactionaborting.owner,--noownerwiththisnameinownerdatabaseforspecifiedvolumegrouptransID,--notransactionactivewiththisIDonthisAlpineinstance.Itmaybethatthetransactionhasabortedorthattheserverhascrashedandrestarted.volumeID,--novolumewiththisIDison-linevolumeGroupID};--novolumegroupwiththisIDison-lineEND.4uBb& s`^]0 u]0s]0pW#%*,c0O49s[u0[[!%)C+-t3 sY uY]Y[ 1$+&){-sX:VTu4TT"$'*,-.3^ 9<s Q q8QQsQtQOuQOO2A #3&-*-P/27 >@XBlGbBNN G$&', sLuOLL,!$#'V,-L0S38;5< Cs IX qIXIXs=IX"IXG uG?G< h#^%*"+2 sF usF F 2-!'sDb uDbIDbGyf"& .02w58 ;=@CFBBC #sAuAA #1$(+.16q;s?lur?l?l !$'B)u+h.2S79y9A B= ;"$?')]-?/478 s<u<m<j]"$&1s:vu:v5:v3&!%(+1-d.q 7's7'w)bTVm$7AlpineFile.mesaLasteditedby:TaftonMay25,19834:51pmMBrownonJanuary21,198310:39pmKollingonFebruary18,19835:40pmDIRECTORYAlpineEnvironment,FileUSING[Type],FileTypesUSING[tUntypedFile];AlpineFile:DEFINITIONS=BEGINAccessList:TYPE=AlpineEnvironment.AccessList;AccessRights:TYPE=AlpineEnvironment.AccessRights;Conversation:TYPE=AlpineEnvironment.Conversation;FileID:TYPE=AlpineEnvironment.FileID;LockOption:TYPE=AlpineEnvironment.LockOption;OpenFileID:TYPE=AlpineEnvironment.OpenFileID;OwnerName:TYPE=AlpineEnvironment.OwnerName;PageCount:TYPE=AlpineEnvironment.PageCount;PageNumber:TYPE=AlpineEnvironment.PageNumber;RecoveryOption:TYPE=AlpineEnvironment.RecoveryOption;ReferencePattern:TYPE=AlpineEnvironment.ReferencePattern;String:TYPE=AlpineEnvironment.String;TransID:TYPE=AlpineEnvironment.TransID;UniversalFile:TYPE=AlpineEnvironment.UniversalFile;VolOrVolGroupID:TYPE=AlpineEnvironment.VolOrVolGroupID;VolumeID:TYPE=AlpineEnvironment.VolumeID;ProceduresthatcreateOpenFileIDsOpen:PROCEDURE[conversation:Conversation,transID:TransID,universalFile:UniversalFile,access:AccessRights_readOnly,lock:LockOption_[intendRead,wait],recoveryOption:RecoveryOption_log,referencePattern:ReferencePattern_random]RETURNS[openFileID:OpenFileID,fileID:FileID];!AccessFailed{fileRead,fileModify},LockFailed,OperationFailed{damagedLeaderPage},PossiblyDamaged,StaticallyInvalid,Unknown{volumeID,fileID,transID};Opensanexistingfiledescribedbyvolumeandfileforaccessundertrans,andreturnsanOpenFileIDthatdesignatestheopenfile.ThereturnedFileIDmaydifferfromtheonethatwaspresentedintheUniversalFile;theclientisencouragedtoretaintherevisedFileIDforallfutureaccessestothefile.Theclientisrequiredtobeamemberoftheaccesscontrollistimpliedbyaccess(readAccessormodifyAccess);andifaccess=readOnly,theclientisrestrictedtoread-onlyoperationsontheOpenFileID.Theentirefileislockedinlock.mode(awaitoraLock.Failedcanresult).lock.ifConflictisalsorememberedandisusedwhenperformingcertainfileactions(e.g.,Delete)whichdonottakeaLockModeasanargument.standardFile:File.Type=FileTypes.tUntypedFile;Create:PROCEDURE[conversation:Conversation,transID:TransID,volumeID:VolOrVolGroupID,owner:OwnerName,initialSize:PageCount,type:File.Type_standardFile,recoveryOption:RecoveryOption_log,referencePattern:ReferencePattern_random]u b& `}  ^W ]*?! [!q Ys WZ UqUUsUgU Tq]TCTsTT Q q>Q$Q sCQq Os L q$LLs|LaL J qJvJsJJ I< qI<I<s)I<I< GqGGsGG E q"EEsyE^E D@ q8D@D@sD@tD@ B qBMBsBB @ q}@6@s@@ ?D q?D?Ds#?D?D =q=q=s==! ;q>;;s;z;# :Hq:HH:Hs:H:H 8q88sQ878 6 q66sU6:6 5Lqf5L5Ls5L5L" 3qQ3 3s33u .  v ,)s.,)q+,),)s,)-,) )S.4 =\ 1*  &*^ 2 3 ;1(g &(6*5@dAq1'3s"'3'3 h (-u%- ' } % ,6#$* 2 6c"94'7!]#7'*{,.36:=<A oA !%1'*/4o7_:>1@~C Et !#'}( /157m E '8)-3. 4u6< BD}K bM$&^)M+,; 36I:CE f v! ',h.3R6;Y?<A!CFStgs  e}v s q  s  !Z */5o\CGV|-'-!#(T)+,238<@E/T  U$ (S!&<7l &Y'+:-04+ :$ xAS!BPS!uES!FkS!Qz x"QzQzuQzQzL %w')+04i8L; O \ "y% -!3) ;ACN+7"&,-0 8<@ELy~ o!" *-<?+ F+J6W &, 146i9;;@B I*9 "')E-(/t14i9>ABG 2!#e% Bj C ?J !.137}=Q_ XK!q%'v+0247;? EG;q ;#% 9_ e!%'g) 1Q6G9;@q v 7qsC7qqA7q7qs7qB7q )h 1K u5-` 4   (*,/=268 @C2d[9 $ &n( /E3x5 <>AD05(N #O& -1w4P8: AER/j["a$* 14-719>@DF-n&* Y#(),136K::sCWC1uc-` v s q  s  'x 0+ 8 q@3 A s1 5 w) TVm$!Unknown{openFileID,transID};GetLockOption:PROCEDURE[conversation:Conversation,openFileID:OpenFileID]RETURNS[lock:LockOption];!Unknown{openFileID,transID};Thismayreturnalockmodestrongerthantheonewithwhichthefilewasoriginallyopenedifoperationshavebeenperformedthatupgradethelock.SuchoperationsmayhavebeenperformedoneitherthisOpenFileIDorsomeotherOpenFileIDreferringtothesamefileunderthesametransaction.SetLockOption:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,lock:LockOption];!LockFailed,StaticallyInvalid,Unknown{openFileID,transID};Thisactuallychangesthefilelock,soitmaywaitorfailaccordingtolock.ifConflict.Filelocksmayonlybeupgradedbythismeans;attemptstodowngradealockareignored.GetRecoveryOption:PROCEDURE[conversation:Conversation,openFileID:OpenFileID]RETURNS[recoveryOption:RecoveryOption];!Unknown{openFileID,transID};GetReferencePattern:PROCEDURE[conversation:Conversation,openFileID:OpenFileID]RETURNS[referencePattern:ReferencePattern];!Unknown{openFileID,transID};SetReferencePattern:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,referencePattern:ReferencePattern];!StaticallyInvalid,Unknown{openFileID,transID};ProceduresthataccesspagesofthefileNote:foroperationsthatreferencethecontentsofafile(dataorproperties),itispossiblethatseveralclientsmaybeaccessingthefileconcurrentlyunderthesametransaction(usingthesameordifferentOpenFileIDs).Alpinemakesnoattempttopreventoradjudicateconflictingaccesstothesamedatainthissituation,excepttoassurethatreadsandwritesofsingleindividualfilepagesandpropertiesareatomicwithrespecttoeachother.PageRun:TYPE=AlpineEnvironment.PageRun;PageBuffer:TYPE=LONGDESCRIPTORFORARRAYOFWORD;VALUEPageBuffer:TYPE=PageBuffer;RESULTPageBuffer:TYPE=PageBuffer;maxPagesPerRun:CARDINAL=LAST[CARDINAL]/AlpineEnvironment.wordsPerPage;--ThisisallthatcanbedescribedwithaDESCRIPTOR(PageBuffer).TherestrictionappliesonlytoReadPagesandWritePages.ReadPages:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,pageRun:PageRun,pageBuffer:RESULTPageBuffer,lock:LockOption_[read,wait]];!OperationFailed{inconsistentDescriptor,nonexistentFilePage},LockFailed,StaticallyInvalid,Unknown{openFileID,transID};ReadsdatafromthepagesdescribedbypageRunofthefileassociatedwithopenFileID,andputsitcontiguouslyintoclientmemoryintheblockdescribedbypageBuffer(whoselengthmustbeconsistentwithpageRun.countorelseOperationFailed[inconsistentDescriptor]israised).Iftheentirefileisnotalreadylockedinatleastthemodespecifiedbylock,setslocksinthatmodeontheindividualpages,andupgradesthefilelocktothecorrespondingintentionmodeifnecessary.WritePages:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,pageRun:3ub&-` v _ sV_qT__s_U_ & /{ 7^ q?_@V_sEs_E_1] u\H-` Z!VP%!(A*-036G8;; AEEX \"$),E/3 91BDLU v S sSqSSsSS & /D 7' ?@1Qs uO- !-'_ /N7Q#C$&T)D,3-0V6x8AEDLioI %*,3N47}9v IsIqIeIs \I I )1 1 9 qAIBIs1H<uF-` v DsDqD*Ds!!D!D ) 2 : qBDCDs1B^Pu@-` v >'sN>'qL>'>'s >'!M>' ) 2s :U 1<u:- ( 5 g W 2V m> #K(*;+o-1B2 9;P<AD 0 C (+.1 8<>BID / 6 )%&+m-& 3 :5>C?B4E -`v . #'G)-/p3I 9;?B- +$s (Uq^(U(Us(U(U & q&L&s&q&& $g':+-s1u& $q$?$s$$ #Aq7#A#As#At#A q](sq s"q#+s)b)u?@cA`DpE16`2".x#b6$?6u+G6+6 36i <A@D<1 v  s~ q| # s } # , 4 <B1b &*G 137Uu-&'4 2BPE  !I#%'=S>C{E aq!#}%"(I*.+35t8;^>@CSF - er#&(\+V,/G 7=A'B} v 5 s 5q 5 5s} 5 5 $R - 4 =w) PTVm$1PageRun,pageBuffer:VALUEPageBuffer,lock:LockOption_[write,wait]];!AccessFailed{handleReadWrite},LockFailed,OperationFailed{nonexistentFilePage},StaticallyInvalid,Unknown{openFileID,transID};WritesdatafromclientmemoryintheblockdescribedbypageBuffertothepagesdescribedbypageRunofthefileassociatedwithopenFileID.Iftheentirefileisnotalreadylockedinatleastthemodespecifiedbylock,setslocksinthatmodeontheindividualpages,andupgradesthefilelocktothecorrespondingintentionmodeifnecessary.Thefilemusthavebeenopenedwithaccess=readWrite.LockPages:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,pageRun:PageRun,lock:LockOption_[read,wait]];!LockFailed,StaticallyInvalid,Unknown{openFileID,transID};Explicitlysetslocksonthespecifiedpagesofthefile.UnlockPages:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,pageRun:PageRun];!StaticallyInvalid,Unknown{openFileID,transID};Ifthespecifiedpagesofthefilearelockedinamodenostrongerthanread,thenremovesthoselocks.Itistheclient'sresponsibilitytoassureconsistencyofanysubsequentoperationswhosebehaviordependsonthedatathatwasreadunderthoselocks.Notethatlocksarereference-countedandarenotremoveduntiloneUnlockPageshasbeendoneforeachLockPagesorReadPagespreviouslyperformedonthesamepages.Attemptstoremovenonexistentlocksorlocksstrongerthanreadareignoredwithouterrorindication.Fileintentionlocksthatweresetwhileacquiringthepagelocksarenotreleased.ProceduresthataccesspropertiesofthefileProperty:TYPE=AlpineEnvironment.Property;PropertyValuePair:TYPE=AlpineEnvironment.PropertyValuePair;PropertySet:TYPE=PACKEDARRAYPropertyOFFalseBool;FalseBool:TYPE=BOOLEAN_FALSE;allProperties:PropertySet=ALL[TRUE];ByteCount:TYPE=AlpineEnvironment.ByteCount;FileVersion:TYPE=AlpineEnvironment.FileVersion;ReadProperties:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,desiredProperties:PropertySet_allProperties,lock:LockOption_[read,wait]]RETURNS[properties:LISTOFPropertyValuePair];!LockFailed,StaticallyInvalid,Unknown{openFileID,transID};ReadsthepropertiesspecifiedbydesiredProperties,orderedasinthedeclarationofProperty.Locksthosepropertiesasspecifiedbylock.Currently,allpropertieswiththeexceptionofversionaretreatedtogetherwithrespecttolocking;theversionhasaseparatelock.Notethatreadingtheversionwillpreventanyothertransactionthatupdatesthefilefromcommitting,unlesstheversionlockislaterremoved(byUnlockVersion).WriteProperties:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,properties:LISTOFPropertyValuePair,lock:LockOption_[write,wait]];!AccessFailed{handleReadWrite,ownerCreate,spaceQuota},LockFailed,OperationFailed{insufficientSpace,unwritableProperty},StaticallyInvalid,Unknown{openFileID,owner,transID};Writesthesuppliedproperties,afterfirstlockingtheminthespecifiedmode.Thetypeandversionpropertiesmaynotbewrittenbythismeans.TowritethebyteLength,createTime,highWaterMark,andstringNamepropertiesrequiresthatthe4s1b&q ,c/ 79=Gu`|- '# + 5^` ']+jp]!#(%t).0 79K;?LE[.z !&$! +-2/~3N579q>/BtDEY-2 ^!%t')-/u1 7<>DOFX5 e$') /Q24h7:>BVv Ts~Tq{T#TsT}T # , 4 <B1Rh O"uP- !-'_ /O :PC#')V+v L sLqLmLsdLL %9 - 5 =1JuIE- (GW !P#')*.Y0L58<?D3EG $&M*f 1i3 5 "@jsi"@:"@u - !-'_ /\ !,1a347 >?Dp T#%( /a1\ 7:<BD5"k$)T+05239#AD<  `0 "%/ 5* < $ .1 8 >D Fw) 7TVm$qOpenFileIDbeopenwithaccess=readWrite.TowritereadAccessormodifyAccessrequiresthattheclientbethefile'sowneroramemberofthecreateaccesscontrollistforthefile'sowner,butdoesNOTrequirethatthefilebeopenwithaccess=readWrite.Towriteownerrequiresthatboththeaboveconditionsbesatisfied,andadditionallyrequiresthattheclientbeamemberofthecreateaccesscontrollistforthenewowner;thediskspaceoccupiedbythefileiscreditedtotheoldownerandchargedtothenewone.Ifthereisinsufficientspaceintheleaderpagetorepresentthenewproperties,OperationFailed[insufficientSpace]israised.Notethatifmultiplepropertiesarewrittenbyonecallandanerroroccurs,someofthepropertiesmayneverthelesshavebeenwrittensuccessfully.UnlockVersion:PROCEDURE[conversation:Conversation,openFileID:OpenFileID];!Unknown{openFileID,transID};Unlocksareadlockpreviouslysetontheversionproperty.AllcommentsonUnlockPagesapplyherealso.IncrementVersion:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,increment:LONGINTEGER];!AccessFailed{handleReadWrite},StaticallyInvalid,Unknown{openFileID,transID};Arrangesthatattransactioncommittime,incrementwillbeaddedtotheversionproperty,insteadof1or0(dependingonwhetherornotthetransactionhasperformedanyupdatestothefile).Notethatthechangeinversionnumberisnotvisible,eventothetransactionthatincrementedit,untilcommittime.GetSize:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,lock:LockOption_[read,wait]]RETURNS[size:PageCount];!LockFailed,Unknown{openFileID,transID};Returnsthefile'ssize,aftersettingalockonthesizeproperty.Notethatthereturnedvalueisthenumberofdatapages,anddoesnotincludeanyfileoverhead(e.g.,leaderpage).SetSize:PROCEDURE[conversation:Conversation,openFileID:OpenFileID,size:PageCount,lock:LockOption_[write,wait]];!AccessFailed{handleReadWrite,spaceQuota},LockFailed,OperationFailed{insufficientSpace},StaticallyInvalid,Unknown{openFileID,transID};Changesthefile'ssizetothenewsizespecified,aftersettinganupdateorwritelockonit.Additionally,decreasingthefile'ssizelockstheentirefileinthesamemode.Notethatthesizeisthenumberofdatapages,anddoesnotincludeanyfileoverhead(e.g.,leaderpage).Ifthenewsizeislessthanthefile'shighwatermark,setsthehighwatermarkequaltosize.RequiresthattheOpenFileIDbeopenwithaccess=readWrite.Appropriatelyadjuststhediskspacechargedtothefile'sowner;however,itisnotrequiredthattheclientbeamemberoftheowner'screateaccesscontrollist.Notethatallocationisconsumedimmediatelywhenafile'ssizeisincreased;butwhenthesizeisdecreased,theallocationisnotcreditedwiththefreedpagesuntiltransactioncommittime.Exceptions(seeAlpineEnvironmentfordescriptionsofthearguments)AccessFailed:ERROR[missingAccess:AlpineEnvironment.NeededAccess];LockFailed:ERROR[why:AlpineEnvironment.LockFailure];OperationFailed:ERROR[why:AlpineEnvironment.OperationFailure];StaticallyInvalid:ERROR;Raisedbyanyoperationifpassedunreasonablearguments,whereunreasonablenessmaybedeterminedstaticallyanddoesnotdependonthestateofthefilesystem.Themostcommoncauseisanenumeratedorsubrangeargumentoutofbounds,whichcangenerallyoccuronlyiftheclientpasseditthroughaLOOPHOLE.5ub& o>}y*,// 6h8! @jE`-) "!#(+),04"8:=?kBF^x )!}#M&)5!7=:>C]0? s B %(l /479=?v@E[-'5 "2$~'C+.04: ;>0@AFY-uo #%X$s b "&*&+136 V}"#$)C,/h05 <&>yCDTwj!\"%K +w.g 58<@ v RE sREqREvREslRERE &A . 6 uP-` N^ "$'0+1k39; D#M#v Js~Jq|J$JsJ}J ' 0 8 @ q1HsGHHuG.- '#. 4< D(Cr |o"$8&( /2V8;G@)ADB#4R"#'(t*/G2[46L =E@ G@{v =s=q=T=sK== " * 2 :>C E1],andisguaranteednottoraiseanyoftheerrorsraisedbyCreateWorker.CreateWorker:PROC[conversation:Conversation,transID:TransID,coordinator:FileStore];!Unknown{coordinator,transID};Callfromclienttoworker.InformsthecalledAlpineinstancethatitistoserverasaworkerunderanexistingtransactiontransIDwhichisbeingcoordinatedbytheAlpineinstanceidentifiedbycoordinator.Thisprocedurereturns(i.e.doesnotraiseanerror)ifftransbecomesactive(preparedtodowork)onthecalledAlpineinstance.Ofcourse,thereisnoguaranteethatthisstatewilllastforanylengthoftime.AssertAlpineWheel:PROC[conversation:Conversation,transID:TransID,enable:BOOL_TRUE];!OperationFailed{regServersUnavailable,notAlpineWheel},Unknown{transID}.Whencalledwithenable=TRUE,causesallsubsequentcallsforthis(conversation,transID)pairtopassallaccesscontrolcheckswithoutfurtherchecking;raisesOperationFailed[notAlpineWheel]ifthecalleridentifiedbyconversationisnotamemberoftheAlpineWheelsgroupforthisserver.Whencalledwithenable=FALSE,causesnormalaccesscontrolcheckingtoresumeforthis(conversation,transID)pair.RequestedOutcome:TYPE=AlpineEnvironment.CommitOrAbort;Outcome:TYPE=AlpineEnvironment.Outcome;Finish:PROC[conversation:Conversation,transID:TransID,requestedOutcome:RequestedOutcome--{abort,commit}--,continue:BOOL_FALSE]RETURNS[outcome:Outcome--{abort,commit,unknown}--,newTrans:TransID];!(none);Callfromclienttocoordinator.Requeststhatthetransactionbefinishedinthespecifiedway.Ifthetransactionhasalreadycommittedoraborted,Finishsimplyreturnstheoutcome.Otherwise,Finishwaitsifnecessarytoassureaknownoutcome(whichmaydifferfromtheonerequested)andreturnsthatoutcome.newTransismeaningfulonlyifrequestedOutcome=commit,continue=TRUE,andoutcome=commit.Unknown:ERROR[what:AlpineEnvironment.UnknownType];OperationFailed:ERROR[why:AlpineEnvironment.OperationFailure];END.u b& `l  ^ \h;J [@+ q Xs V TlqTlTl sTlq Rs O? qO?O?s)O?O? MqMMsQM7M K qiK"KsKKv I>sI>qI>I>stI>I> I %q2DI>2I>s5I>q7fI>8I>s:I>q;yI>sAjI>AI>1GuE-&D$E !%'2) 1H3p7S9=AGB|V %),k.14@T #&N'+.-/j159;] v >H so>Hql>H>Hs>H\>H ! *05 = u<-` :Ew#%).3Q6#7z8:>l@%AZ9- %)+. 57: >r7  !!1'\+.147B95= >B<5\A ""$a(B,249><>@FC47zC"$Qv 1sF1qD11s141 $ -Z28q=1>R1sA.1qB1Ct1sE1FI1u/-&'28 .7 #x.7.7u"+.7#.7'7)2 /35?7 @hE,to}"o'I+15*G &( 0w14F5{:<9> )Ax6 2$'+Kx-0)A-)Au0)A1)A5:>C2'C "l(s $&q$&d$&s$&$& "mqi"m#"ms"m"mv sqKs0  %+=118ue88#s)8*8q0818s4i8q5868s98q:{8;O8s@l8@81u$" s)*1ju-E !&)+ 249;K=CFv- 'Z%',05+9<A {m#$).x259Y<>Aq ($&4 -8041<>Cxuis qs] fq fq fs3 f f $q s  ZTVm$DCHANGELOGChangedbyMBrownonJanuary21,198310:28pmAddedcreateLocalWorkerparmtoCreate.Renamedtrans->transIDtobeconsistentwithAlpineFile.ChangedbyMBrownonMarch1,19833:29pmMovedAssertAlpineWheelhere,fromAlpineOwner;itnowraisesOperationFailed[notAlpineWheel]insteadofAccessFailed[alpineWheel].2q b_js _ $5'u ^=a$>*+-/E4`67 >A s [x"%u Z[L ).*-`1 ; XsU  w)TVm$|AlpineOwner.mesaProceduresforownerdatabasemaintenance.Lasteditedby:KollingonMarch8,19834:21pmMBrownonMarch3,19832:45pmTaftonApril2,19831:52pmSomeaspectsofownerdatabasemaintenancearedecentralized,inthatnormalAlpineusersmayperformthem.Theseincludeinspectingindividualownerrecordsandupdatingcertainfieldsofownerrecords(theseupdatesarerestrictedbyaccesscontrolchecksthatareafunctionoftheowner).OtheraspectsofownerdatabasemaintenancearereservedforAlpineadministrators.Theseincludecreatinganddeletingownerrecords,updatingdiskspacequotas,andenumeratingtheentiresetofowners.Onaparticularserver,theseoperationsmayonlybeinvokedbyindividualswhobelongtothatserver'sAlpineWheelsgroup.Sincetheseoperationsarepotentiallydestructive,theymustbeexplicitly"enabled"byacalltoAlpineTransaction.AssertAlpineWheel.DIRECTORYAlpineEnvironment;AlpineOwner:DEFINITIONS=BEGINAccessList:TYPE=AlpineEnvironment.AccessList;--necessary,orlupinebombsout.Conversation:TYPE=AlpineEnvironment.Conversation;OwnerName:TYPE=AlpineEnvironment.OwnerName;PageCount:TYPE=AlpineEnvironment.PageCount;TransID:TYPE=AlpineEnvironment.TransID;VolumeGroupID:TYPE=AlpineEnvironment.VolumeGroupID;WhenaprocedureraisesAccessFailed[alpineWheel]below,thisalwaysmeansthatthe(conversation,transID)pairpassedtotheprocedureneededtobeasserted(byAlpineTransaction.AssertAlpineWheel[enable:TRUE]),butwasnot.ProceduresforbothAlpineusersandAlpineadministrators.OwnerProperty:TYPE=AlpineEnvironment.OwnerProperty;OwnerPropertyValuePair:TYPE=AlpineEnvironment.OwnerPropertyValuePair;OwnerPropertySet:TYPE=AlpineEnvironment.OwnerPropertySet;allOwnerProperties:OwnerPropertySet=AlpineEnvironment.allOwnerProperties;ReadProperties:PROC[conversation:Conversation,transID:TransID,volumeGroupID:VolumeGroupID,owner:OwnerName,desiredProperties:OwnerPropertySet_allOwnerProperties]RETURNS[properties:LISTOFOwnerPropertyValuePair];!LockFailed{timeout},StaticallyInvalid,Unknown{owner,transID,volumeGroupID}.ReadsthepropertiesspecifiedbydesiredProperties,orderedasinthedeclarationofOwnerProperty.WriteProperties:PROC[conversation:Conversation,transID:TransID,volumeGroupID:VolumeGroupID,owner:OwnerName,properties:LISTOFOwnerPropertyValuePair,enforceTotalQuota:BOOL_FALSE];!AccessFailed{alpineWheel,ownerEntry},LockFailed{timeout},OperationFailed{ownerRecordFull,ownerRecordInUse,regServersUnavailable,totalQuotaExceeded},StaticallyInvalid,Unknown{owner,transID,volumeGroupID}.Writesthesuppliedproperties,leavingtheothersunchanged.Obtainsawritelockontheowneru b& `} z ^  ]*+  [ Yh;J V Bd %?' 014x9=k@C T  $(,/[49p<>B S6 !&-*-[/06/7: Q c %a',/ 3[<@h O &1),1R3 ;>AC N= L 'm*]-X/(4+6 <?CE L}   u# *[, 3M :N=@@B[ J V$q Hrs F DK qDKDK sDKq Bs ?O q$?O?Os|?Oa?Ou,2?O,?O- 359=s = q==s)== ; q;M;s;; :S q}:S6:Ss:S:S 8q88sQ878 7 qH77s77u 2-X # +/2d6:=@ 0\d0iZ#')+n0 .+x( .(.u+C.+.-/h2  )  ^ k$s &f q&f&fsu&fZ&f $q$$sF$!+$) !jq!j!jsP!j5!j# f#%%v C sCqCCsCC "s +'06 1 Z" *v5A81qWs$t$ q+,.s01uK- U 's-28\ !,1a347 >? v %sw%qt%%s%d% " +16 1~ Z" *v q1g~2 ~4Ls6L~7_~1qXs!q#z$3s''{u-- '  (9 /a 5 [&R4+ `$* 5j q%']+b 389D<?AC TVm$record.(Fornow,WritePropertiesfailsbyraisingOperationFailed[ownerRecordInUse]ifawriteofthequotaisrequestedandanothertransactionisconcurrentlychangingthespaceinusebythegivenowner.Retryingmaysucceed.)Theowner,andmembersoftheowner'sModifyaccesslist,canupdatetheCreateaccesslistpropertyofanownerrecord.Theowner,andmembersoftheowner'sCreateaccesslistcanupdatetherootFilepropertyofanownerrecord.Ifanupdateisrestrictedtothetheseproperties,buttheaccesscontrolchecksfail,thenWritePropertiesraisesAccessFailed[ownerEntry].ThespaceInUsepropertyisreadonly.IfenforceTotalQuota=TRUEandpropertiesincludesquota,thenWritePropertiesraisesOperationFailed[totalQuotaExceeded]ifthetotalofallquotasintheownerdatabase,includingthespecifiedupdate,exceedsthetotalnumberofdiskpagesonthevolumegroup.Onallupdates,certainhigh-levelinvariantsareenforced:owneraccesslistsalwayshaveworld=FALSEandowner=TRUE.AnupdatetoanaccesscontrollistmayraiseOperationFailed[ownerRecordFull].Thesystemguaranteestoreserveenoughspaceforaccesscontrolliststoragesothateachlistcancontaintwomaximum-lengthRNames,butdoesnotcontrolthedivisionofspacebetweenlists.Inordertoaddanelementtoonelistitmaybenecessarytoremoveanelementfromanother.ProceduresforAlpineadministratorsonly.Theseproceduresrequirethat(conversation,transID)beassertedasanAlpineWheel.Create:PROC[conversation:Conversation,transID:TransID,volumeGroupID:VolumeGroupID,owner:OwnerName,properties:LISTOFOwnerPropertyValuePair,enforceTotalQuota:BOOL_FALSE]RETURNS[spaceLeftOnVolumeGroup:PageCount];!AccessFailed{alpineWheel},LockFailed{timeout},OperationFailed{duplicateOwner,ownerDatabaseFull,ownerRecordFull,totalQuotaExceeded},StaticallyInvalid,Unknown{transID,volumeGroupID}.CreatesanewownerinthespecifiedVolumeGroup.Thepropertiesofthenewownerarederivedby(ineffect)settingallpropertiestotheirdefaultvalues,thencallingWritePropertieswiththespecifiedlistofproperties.Destroy:PROC[conversation:Conversation,transID:TransID,volumeGroupID:VolumeGroupID,owner:OwnerName];!AccessFailed{alpineWheel},LockFailed{timeout},OperationFailed{ownerRecordInUse,spaceInUseByThisOwner},StaticallyInvalid,Unknown{owner,transID,volumeGroupID}.DestroysanexistingownerinthespecifiedVolumeGroup.RaisesOperationFailed[spaceInUseByThisOwner]ifanyfilesexistwhosediskspaceischargedagainstowner.ReadNext:PROC[conversation:Conversation,transID:TransID,volumeGroupID:VolumeGroupID,previousOwner:OwnerName,desiredProperties:OwnerPropertySet_allOwnerProperties]RETURNS[owner:OwnerName,properties:LISTOFOwnerPropertyValuePair];!AccessFailed{alpineWheel},LockFailed{timeout},StaticallyInvalid,Unknown{owner,transID,volumeGroupID}.Statelessenumeratorfortheownerdatabase.previousOwner=NILstartsanenumeration,andowner=NILisreturnedattheendofanenumeration.Thiscalllockstheentireownerdatabaseinwritemodetoensureconsistency,whichisthereasonforrestrictingitsusetoAlpineadministrators.ReadDBProperties:PROC[conversation:Conversation,transID:TransID,volumeGroupID:VolumeGroupID]RETURNS[nOwners,nEntriesUsed,nEntries:NAT,totalQuota,totalSpaceInUse,volumeGroupSize:PageCount];!AccessFailed{alpineWheel},LockFailed{timeout},Unknown{transID,volumeGroupID}.Returnsaggregateinformationabouttheownerdatabase.2ub&##&(-7 CDF` %} ,w- 5;p=A[CEaG;^mD],$f !V&,*.148m:?C$[0 #'*y0148=:AHCY>!#'+-/}35F ;<? Bx X6C3 #R&\03 ; DV  [TxTTu T!2T#% )Q.25?\S<&'\),.t0o46\8<BQ-R ="%*,:/247;Oe` "; (w*048;w?BFxNCuNCNCx~NC7NCuNCLOQDR #'&)R3K>AJ E z$&A*O.1$57:W=?BLIIm !$'){.0]5I6:?CGE$G > }!$&,.0249< B L #' .35 >~D @v >zs>zq>z>zst>z>z I %+1] <[ 1< M q&><&<)#s+"<,6<:q1;+s;+qR;+ ;+s;+q;+s!;+";+39 u9- ' ' .b8Z7%3=614$$D -0 68U:=fA`C2LG #s%(K,114;8BYEU17P3 v .s.q.I.s...  &,<2 = 1- u+f- ' ' .b8Z))/4:8( 7"' 05%&l ;"%(,/3d49>v #s#q##sy## N (-3b 1"F Z 'd /;F1 q W s$t $ )~ 1 q8 9 ;s1uL- ' ' .b8?D :#4) 2x45su77:< DRxRRuERR"$&1($ 0?3O59b;?Cx{ ^ $(* ,U02 9 :=\?v sqs $z --28 1 qe9s#V#) 2q89s;*< 16(y u - ' ' .b4: @ $T&* 5 w) jTVm$nOwnersisthenumberofownersinthedatabase,whilenEntriesUsedisthenumberofdatabaseentriesinuse(deletedentriesmayoccupyspace).WhennEntriesUsed=nEntries,anyCreatecallwillraiseOperationFailed[ownerDatabaseFull];acalltoReorganizeDBisrequired(seebelow)ReorganizeDB:PROC[conversation:Conversation,transID:TransID,volumeGroupID:VolumeGroupID,nEntries:NAT];!AccessFailed{alpineWheel},LockFailed{timeout},OperationFailed{insufficientSpace,ownerDatabaseFull},Unknown{transID,volumeGroupID}.Performsacompletereorganizationoftheownerdatabase,lockingitinwritemodeandtherebymakingitunavailableduringthereorganization.Reorganizationiscalledforwhentheownerdatabasebecomesfull(CreateraisesOperationFailed[ownerDatabaseFull]),orwhentheperformanceofownerdatabaseoperationsdegradesduetohashcollisionsordeletions.ThenewownerdatabasefileallowsuptonEntriesowners;ReorganizeDBraisesOperationFailed[ownerDatabaseFull]iftheexistingdatabasecontainsmorethanthismanyowners.ReorganizeDBraisesOperationFailed[insufficientSpace]ifthereisnotenoughscratchspaceonthevolumegrouptoperformthereorganization.ErrorsAccessFailed:ERROR[missingAccess:AlpineEnvironment.NeededAccess];LockFailed:ERROR[why:AlpineEnvironment.LockFailure];OperationFailed:ERROR[why:AlpineEnvironment.OperationFailure];StaticallyInvalid:ERROR;Unknown:ERROR[what:AlpineEnvironment.UnknownType];END.3ub&fK"l$&^,</ 89;@BT`6<> #(,p0k 8:@bB^w G!@.S/23 <>>C]0v Z sZqZKZs0ZZ " *0=6 1Y Zq#LY$5Ys%Y&%YuWf- ' ' .b8ZU!'T  #%6'+|1Z6%7}9#<@BRp = ", 5r6:<@hBPg-!$.<&=AaO" 70! (1-0A15 :< BEUMza "b', 59K{$-)/2q58*;J, %02>579x>0BFoH-I V" Cs A qA`As"AA " > q>l>s/>> <q<q<s3<< $ 9q9F9s9 7'q7'7's]7'7'q 3s3w)1TVm$AlpineVolume.mesaLasteditedbyKollingonMarch9,198311:08amMBrownonMarch1,19834:13pmTaftonApril2,19831:53pmThisisaninteriminterface.Weexpectittoevolveinthedirectionof:controlofvolumegrouplocking,controllingtheonline/offlinestatusofvolumegroups,etc.DIRECTORYAlpineEnvironment;AlpineVolume:DEFINITIONS=BEGINConversation:TYPE=AlpineEnvironment.Conversation;LockOption:TYPE=AlpineEnvironment.LockOption;TransID:TYPE=AlpineEnvironment.TransID;nullTransID:TransID=AlpineEnvironment.nullTransID;VolumeID:TYPE=AlpineEnvironment.VolumeID;VolumeGroupID:TYPE=AlpineEnvironment.VolumeGroupID;nullVolumeGroupID:VolumeGroupID=AlpineEnvironment.nullVolumeGroupID;ProceduresGetNextGroup:PROC[conversation:Conversation,transID:TransID_nullTransID,previousGroup:VolumeGroupID_nullVolumeGroupID,lock:LockOption_[none,wait]]RETURNS[volumeGroupID:VolumeGroupID];!Unknown{volumeGroupID};Statelessenumeratorfortheon-linevolumegroupsofthisAlpineinstance.previousGroup=nullVolumeGroupIDstartsanenumeration,andvolumeGroupID=nullVolumeGroupIDisreturnedattheendofanenumeration.Fornow,thetransIDandlockparmsareignored.Theproposedusageisasfollows:IftransID#nullTransIDandlock.mode#nonethensetsthespecifiedlockonthereturnedvolumegroup.Settingareadlockguaranteesthatthevolumegroupwillremainon-linefortheremainderofthetransaction.Settingawritelockexcludesallotheraccesstothevolumegroupfortheremainderofthetransaction(includingopeningfilesonthevolumegroup);thisrequiresthecallertobeanassertedAlpineWheel.GetGroup:PROC[conversation:Conversation,transID:TransID_nullTransID,volumeGroupID:VolumeGroupID,lock:LockOption_[none,wait]]RETURNS[volumes:LISTOFVolumeID];!Unknown{volumeGroupID};ReturnsthelistofvolumesbelongingtothespecifiedvolumeGroup.LockingisasforGetNextGroup.GetEnclosingGroup:PROC[conversation:Conversation,transID:TransID_nullTransID,volumeID:VolumeID,lock:LockOption_[none,wait]]RETURNS[volumeGroupID:VolumeGroupID];!Unknown{volumeID};ReturnstheVolumeGroupIDofthevolumegroupcontainingthespecifiedvolume.LockingisasforGetNextGroup.Errorsu b& `t  ^+ ] [_h;J W h[ p",#%)),*-249e;?C VT  G !!&e+q Ss R O qOO sOq Ms J qJJs)JJ H q"HHsyH^H GqGGsQG7G Em N CqQC CsCC B qHB B sB B  @X $m&R$u ;B v 8 s8q88sf88 "; *0t57 17 0 '(6 9~ A*B15nq5n5ns5nE5n 'Bu3-`2  :#(f,.e05O: C0dt! )#+ 57D,.@1bU - #= $'2,/5A9:n<'A&B+c =!#&),u.407)9;i@)Bw{u &4)+R/36^:?uA(<, !%&*C-<248(<6=@'D&m US $ *0247;@C $-WJb v "@s"@q"@"@sy"@"@ N (-3 4 < 1 Z (x*.3q1 2 s7 8F q>- > As1 u@-`kNr$&;(- 6;=U? v asaqaXas=aa % -3J8:[ 17 i# +-1Aq55s:;U 1ua-` k !`#(L," 25:?xDF@ TVm$7AccessFailed:ERROR[missingAccess:AlpineEnvironment.NeededAccess];Unknown:ERROR[what:AlpineEnvironment.UnknownType];StaticallyInvalid:ERROR;END.2s b& qb&`b&s"b&b& " _q__s]__ ]0q]0F]0s]0q YsYw)TVm$QAlpInstance.mesaLasteditedby:KollingonJune3,19832:43pmTaft,June2,198311:16amDIRECTORYAlpineEnvironmentUSING[Conversation,FileStore,LockFailure,NeededAccess,OperationFailure,Principal,UnknownType],AlpineFileRpcControlUSING[InterfaceRecord],AlpineOwnerRpcControlUSING[InterfaceRecord],AlpineTransactionRpcControlUSING[InterfaceRecord],AlpineVolumeRpcControlUSING[InterfaceRecord],RPCUSING[EncryptionKey];AlpInstance:CEDARDEFINITIONS=BEGINFileStore:TYPE=AlpineEnvironment.FileStore;Principal:TYPE=AlpineEnvironment.Principal;EncryptionKey:TYPE=RPC.EncryptionKey;AccessFailed:READONLYERROR[missingAccess:AlpineEnvironment.NeededAccess];LockFailed:READONLYERROR[why:AlpineEnvironment.LockFailure];OperationFailed:READONLYERROR[why:AlpineEnvironment.OperationFailure];StaticallyInvalid:READONLYERROR;Unknown:READONLYERROR[what:AlpineEnvironment.UnknownType];PossiblyDamaged:READONLYSIGNAL;Handle:TYPE=REFObject;Object:TYPE=RECORD[trans:AlpineTransactionRpcControl.InterfaceRecord,file:AlpineFileRpcControl.InterfaceRecord,owner:AlpineOwnerRpcControl.InterfaceRecord,volume:AlpineVolumeRpcControl.InterfaceRecord,otherInterfaces:LISTOFREFANY,conversation:AlpineEnvironment.Conversation,fileStore:FileStore];Create:PROCEDURE[fileStore:FileStore,caller:Principal_NIL,key:EncryptionKey_ALL[0]]RETURNS[Handle];!Failed{authenticateFailed,other,unbound}.EstablishesanewruntimebindingtotheAlpineinstancespecifiedbyfileStore,andestablishesanRPCConversationwiththeserveronwhichthatinstanceislocated.caller=NILmeanscalleristhelogged-inuserandderivesthekeyfromthepassword.Note:ifacallusingaHandlefailsviaRPC.CallFailed[unbound],thisgenerallymeansthattheserverhascrashedandrestartedsincethehandlewascreated;discardthehandle(andanyhandlesderivedfromit)andcreateanewhandle.Failed:ERROR[why:Failure];Failure:TYPE={authenticateFailed,other,unbound};authenticateFailedmeansbadcallernameorkey,unboundmeansnoexportedversionintherequiredrange,otheriseverythingelse.END.EditLogu b& `x  ^ ]PXq Zs XqOX5Xs~XX % + 3 =b1WD Z UqUUsUdU SqSfSsS S R9qoR9UR9s"R9#R9 Pq1PPs `P P NqZN?NsNN L[ qL[L[ sL[q Js GQ qiGQ"GQsGQGQ E qHEEsEE C q CCsaCqFCCsCC @ q@z@s #@ @ ) > q>>s0>># =;q=;=;s"5=;"=;& $ ;q;a;s!; 9q99s_99" 81q81R81s"81 5qV55s5q5f5sC5V5 3-q3-3-s?3-q$3-3-s3-1,/%."&,tq'*q**s"*) 'j  v $s$q$$s$~$ | $(.q0S$1;$s2^$3;$6I ?qAi$B=$sC$D$q1#@s"#@#@u!-" 6"$&+0^57 =p@ F=H jf#%)j,<1{27;x=w=>T=u?=A=D$G- !#Q%)+g_L!$&86F8>BE@9"D%',O.48:?YBvap $ %B(s qts6  hq?hhsh{h"&uNv #'e),157=0ACj$?, #q s u 5 TVm$mInitial:Kolling:February14,19832:45pm:packagetoaidclients,inconjunctionwithAlpTransactionandAlpFile.2u aq9v!$(-U.1B57t > _ Rw)eTVm$6AlpFile.mesaLasteditedby:KollingonJune3,19832:44pmTaftonJune2,198311:29amDIRECTORYAlpineEnvironmentUSING[AccessRights,FileID,LockFailure,LockOption,NeededAccess,OpenFileID,OperationFailure,OwnerName,PageCount,PageRun,PropertyValuePair,RecoveryOption,ReferencePattern,UnknownType,UniversalFile,VolOrVolGroupID],AlpineFileUSING[allProperties,PropertySet,RESULTPageBuffer,standardFile,VALUEPageBuffer],AlpTransactionUSING[Handle],FileUSING[Type];AlpFile:CEDARDEFINITIONS=BEGINAccessRights:TYPE=AlpineEnvironment.AccessRights;allProperties:PropertySet=AlpineFile.allProperties;FileID:TYPE=AlpineEnvironment.FileID;LockOption:TYPE=AlpineEnvironment.LockOption;OpenFileID:TYPE=AlpineEnvironment.OpenFileID;OwnerName:TYPE=AlpineEnvironment.OwnerName;PageCount:TYPE=AlpineEnvironment.PageCount;PageRun:TYPE=AlpineEnvironment.PageRun;PropertySet:TYPE=AlpineFile.PropertySet;PropertyValuePair:TYPE=AlpineEnvironment.PropertyValuePair;RecoveryOption:TYPE=AlpineEnvironment.RecoveryOption;ReferencePattern:TYPE=AlpineEnvironment.ReferencePattern;RESULTPageBuffer:TYPE=AlpineFile.RESULTPageBuffer;standardFile:File.Type=AlpineFile.standardFile;UniversalFile:TYPE=AlpineEnvironment.UniversalFile;VALUEPageBuffer:TYPE=AlpineFile.VALUEPageBuffer;VolOrVolGroupID:TYPE=AlpineEnvironment.VolOrVolGroupID;AccessFailed:READONLYERROR[missingAccess:AlpineEnvironment.NeededAccess];LockFailed:READONLYERROR[why:AlpineEnvironment.LockFailure];OperationFailed:READONLYERROR[why:AlpineEnvironment.OperationFailure];StaticallyInvalid:READONLYERROR;Unknown:READONLYERROR[what:AlpineEnvironment.UnknownType];PossiblyDamaged:READONLYSIGNAL;Handle:TYPE=REFObject;Object:TYPE=RECORD[trans:AlpTransaction.Handle,openFileID:OpenFileID];InadditiontotheerrorsdocumentedforthecorrespondingAlpineprocedures,alloftheproceduresdefinedinthisinterfacecanalsoerrorRPC.CallFailed[RPC.CallFailure].Open:PROCEDURE[transHandle:AlpTransaction.Handle,universalFile:UniversalFile,access:AccessRights_readOnly,lock:LockOption_[intendRead,wait],recoveryOption:RecoveryOption_log,referencePattern:ReferencePattern_random]RETURNS[handle:Handle,fileID:FileID];Create:PROCEDURE[transHandle:AlpTransaction.Handle,volumeID:VolOrVolGroupID,owner:u b& `}  ^ ]+!q Zs YqOY5Ys~YY %*T 2m :q 1W] J%h - 5<;|1U' 1 : T qT T sT hT  '4 1Rf P qPPsP6P OqOOsOgO LqoL:L sLq Js G qGvGsGG E d  DIqDIDIsIDI.DI B q"BBsyB^B @ q8@@s@t@ ?N q?NM?Ns?N?N = q}=6=s== ;q^;;s;; :R q:R:RsN:R3:R 8q88sD8)8$ 7q7q7s77! 5Wq>5W5Ws5Wz5W# 3q733s3t3 2 e} 0\ q0\0\sU0\:0\ .q.?.s.. - qf- - s- - " ) q)z)s #) ) ) ( q((s0((# &eq&e&es"5&e"&e& $ $q$a$s!$ #q##s_##" !jq!jR!js"!j qVsqfsCV pqpps?pq$ppsp  u   "O$w& /\3 :<>T@ ${!D #v s.q+s` . 7Z @91 w"e% -/ 75:1Y r +f6-7q=>Y>YsBYC)Y1 iv 5s 5q 5 5s 5~ 5 /m6sBTVm$YOwnerName,initialSize:PageCount,type:File.Type_standardFile,recoveryOption:RecoveryOption_log,referencePattern:ReferencePattern_random]RETURNS[handle:Handle,refUniversalFile:REFUniversalFile];Close:PROCEDURE[handle:Handle];Delete:PROCEDURE[handle:Handle];ReadPages:PROCEDURE[handle:Handle,pageRun:PageRun,pageBuffer:RESULTPageBuffer,lock:LockOption_[read,wait]];WritePages:PROCEDURE[handle:Handle,pageRun:PageRun,pageBuffer:VALUEPageBuffer,lock:LockOption_[write,wait]];ReadProperties:PROCEDURE[handle:Handle,desiredProperties:PropertySet_allProperties,lock:LockOption_[read,wait]]RETURNS[properties:LISTOFPropertyValuePair];WriteProperties:PROCEDURE[handle:Handle,properties:LISTOFPropertyValuePair,lock:LockOption_[write,wait]];LockPages:PROCEDURE[handle:Handle,pageRun:PageRun,lock:LockOption_[read,wait]];UnlockPages:PROCEDURE[handle:Handle,pageRun:PageRun];GetAccessRights:PROCEDURE[handle:Handle]RETURNS[access:AccessRights];GetLockOption:PROCEDURE[handle:Handle]RETURNS[lock:LockOption];SetLockOption:PROCEDURE[handle:Handle,lock:LockOption];GetRecoveryOption:PROCEDURE[handle:Handle]RETURNS[recoveryOption:RecoveryOption];GetReferencePattern:PROCEDURE[handle:Handle]RETURNS[referencePattern:ReferencePattern];SetReferencePattern:PROCEDURE[handle:Handle,referencePattern:ReferencePattern];GetSize:PROCEDURE[handle:Handle,lock:LockOption_[read,wait]]RETURNS[size:PageCount];SetSize:PROCEDURE[handle:Handle,size:PageCount,lock:LockOption_[write,wait]];GetUniversalFile:PROCEDURE[handle:Handle]RETURNS[universalFile:UniversalFile];UnlockVersion:PROCEDURE[handle:Handle];IncrementVersion:PROCEDURE[handle:Handle,increment:INT];END.EditLogInitial:Kolling:February14,19835:08pm:packagetoaidclients,inconjunctionwithAlpInstanceandAlpTransaction.2s1b&  !u (,]24 `>`sB`C)`1^iq" ^"^s$^%^ v \\sC\\qA\\\\su\\\\v YsYqYYsYsYsv Wfs~Wfq|Wf#WfsWfWf %K+1 9l1U O"v SD sSDqSDSDsSDvSD v%,2E 91Q O#v O" sO"qO"O"sEO"O""'3 :<. Dt1Mz i?q"Mz#Mzs(Mz(Mz q/Mz0Mz2s4Mz5Mzv JswJqtJJsJ J# (D q/4J/J2s4J4J?1IX iv Fs~Fq{F#FsFF %K+15S <>Bbv Db sDbqDbmDbsDb]Db!]&,v AsAqAAs8AA#q(A)As.fA.A3P v ?l sV?lqT?l?ls?l?l"q(.?l)?ls-?l.?l1 v < s<q<<sQ<<"'+_ v :vs:vq:ve:vs:v U:v%Uq*:v+l:vs0 :v0:v:v 7s7q7*7s 7!7&q+]7,17s071H7<v 5sN5qL55s 5 5%+5v 3s3q3T3s3D3D#|& .0'3q7383s=D3=3@ v 0sx0qv00s0 0 #E&j -1; 8:s>v .s.q..sB..#q(.).s.p... 7|v + s+q+v+s+e+"fv )s~)q|)$)s))$)L q0<)0)s2H)2)q &s&u #O  q9v!$(-U.1B57t >A Ytw)TVm$AlpTransaction.mesaLasteditedbyKollingonJune3,19832:44pmTaftonJune2,198311:22amDIRECTORYAlpineEnvironmentUSING[allOwnerProperties,CommitOrAbort,FileStore,LockFailure,LockOption,NeededAccess,nullVolumeGroupID,OperationFailure,Outcome,OwnerName,OwnerPropertySet,OwnerPropertyValuePair,PageCount,TransID,UnknownType,VolumeID,VolumeGroupID],AlpInstanceUSING[Handle],AlpineTransactionUSING[RequestedOutcome];AlpTransaction:CEDARDEFINITIONS=BEGINallOwnerProperties:OwnerPropertySet=AlpineEnvironment.allOwnerProperties;FileStore:TYPE=AlpineEnvironment.FileStore;LockOption:TYPE=AlpineEnvironment.LockOption;nullVolumeGroupID:VolumeGroupID=AlpineEnvironment.nullVolumeGroupID;Outcome:TYPE=AlpineEnvironment.Outcome;OwnerName:TYPE=AlpineEnvironment.OwnerName;OwnerPropertySet:TYPE=AlpineEnvironment.OwnerPropertySet;OwnerPropertyValuePair:TYPE=AlpineEnvironment.OwnerPropertyValuePair;PageCount:TYPE=AlpineEnvironment.PageCount;RequestedOutcome:TYPE=AlpineTransaction.RequestedOutcome;TransID:TYPE=AlpineEnvironment.TransID;VolumeID:TYPE=AlpineEnvironment.VolumeID;VolumeGroupID:TYPE=AlpineEnvironment.VolumeGroupID;AccessFailed:READONLYERROR[missingAccess:AlpineEnvironment.NeededAccess];LockFailed:READONLYERROR[why:AlpineEnvironment.LockFailure];OperationFailed:READONLYERROR[why:AlpineEnvironment.OperationFailure];StaticallyInvalid:READONLYERROR;Unknown:READONLYERROR[what:AlpineEnvironment.UnknownType];PossiblyDamaged:READONLYSIGNAL;Handle:TYPE=REFObject;Object:TYPE=RECORD[inst:AlpInstance.Handle,transID:TransID];InadditiontotheerrorsdocumentedforthecorrespondingAlpineprocedures,alloftheproceduresdefinedinthisinterfacecanalsoerrorRPC.CallFailed[RPC.CallFailure].Atthemoment,AlpineignoresthetransIDandlockparametersforGetVolumeGroup,GetNextVolumeGroup,andGetEnclosingVolumeGroup.Create:PROCEDURE[instHandle:AlpInstance.Handle,createLocalWorker:BOOLEAN_TRUE]RETURNS[handle:Handle];CreateWithTransID:PROCEDURE[instHandle:AlpInstance.Handle,transID:TransID,createLocalWorker:BOOLEAN_TRUE]RETURNS[handle:Handle];CreateWorker:PROCEDURE[handle:Handle,coordinator:FileStore];Finish:PROCEDURE[handle:Handle,requestedOutcome:RequestedOutcome,continue:BOOLEAN_FALSE]RETURNS[outcome:Outcome];AssertAlpineWheel:PROCEDURE[handle:Handle,enable:BOOLEAN];u b& `w  ^ ]!q Zs XqOX5Xs~XX)) 3 :C 1WA 4 #1<91U &6P =1S #+ RD qRDRDsRD0RD PqsPYPsPP Nq NN s Nq Lds If#%% GX qiGX"GXsGXGX E q"EEsyE^E C $m&R$ BLqiBL#BLsBLBL @ q@M@s@@ >q>>sP>5># =@q=@=@sF=@!+=@) ; q};6;s;; 9q9d9s99# 83q8383sQ83783 6qQ6 6s66 4 qH44s44 1y q1yz1ys #1y 1y ) / q//s0//# .q..s"5.".& $ ,lq,la,ls!,l *q**s_**" )q)R)s") &qV&&s&q&f&sC&V& $ q$ $ s?$ q$$ $ s$ u$ +<0u   "O$w& /\3 :<>T@ {!D #8:=B ^z~ %\'2@p v 4s4q44s44 ^- q9R4: 4s?\4q@4A4sD4q1s"v  s q  s   (a5 :1cqxc1cs$cq&c&cs);cq*"c*cs0c0wc5wv  soqls"'< / v ^s^q'^^s\^^"/ ;qA^B^sG^q1 s q  s=  "v 5sF 5qD 5 5sx 5 5$*q. 5/ 5s4 54 5TVm$GetVolumeGroup:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID,lock:LockOption_[none,wait]]RETURNS[volumes:LISTOFVolumeID];GetNextVolumeGroup:PROCEDURE[handle:Handle,previousGroup:VolumeGroupID_nullVolumeGroupID,lock:LockOption_[none,wait]]RETURNS[volumeGroupID:VolumeGroupID];GetEnclosingVolumeGroup:PROCEDURE[handle:Handle,volumeID:VolumeID,lock:LockOption_[none,wait]]RETURNS[volumeGroupID:VolumeGroupID];CreateOwner:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID,owner:OwnerName,properties:LISTOFOwnerPropertyValuePair,enforceTotalQuota:BOOLEAN_FALSE]RETURNS[spaceLeftOnVolumeGroup:PageCount];DestroyOwner:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID,owner:OwnerName];ReadNextOwner:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID,previousOwner:OwnerName_NIL,desiredProperties:OwnerPropertySet_allOwnerProperties]RETURNS[owner:OwnerName,properties:LISTOFOwnerPropertyValuePair];ReadOwnerProperties:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID,owner:OwnerName,desiredProperties:OwnerPropertySet_allOwnerProperties]RETURNS[properties:LISTOFOwnerPropertyValuePair];WriteOwnerProperties:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID,owner:OwnerName,overCommitQuotasIfNeeded:BOOLEAN_FALSE,properties:LISTOFOwnerPropertyValuePair];ReadOwnerDBProperties:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID]RETURNS[nOwners,nEntriesUsed,nEntries:NAT,totalQuota,totalSpaceInUse,volumeGroupSize:PageCount];ReorganizeOwnerDB:PROCEDURE[handle:Handle,volumeGroupID:VolumeGroupID,nEntries:NAT];END.EditLogInitial:Kolling:February14,19833:56pm:packagetoaidclients,inconjunctionwithAlpInstanceandAlpFile.2v b& stb&qrb&b&sb& b&$ )A 4? ?h1` iq#V`$*`s(`)A`q/(`/`2 s4 `5 `v ^sa^q_^^s!^!^&,/ 6/ A1\\# *,Y0q4F\\5\\s9\\:0\\ 1Zv X:s8X:q6X:X:s$jX:$X:)/6 =>@ 1VqVVs!2V!V ,v T sTqTzTsTjT!k& 1 <1Rp  q!Rp"PRp$|s&{Rp'Rp6KqBrRpC,Rps1PqPwPs\PqCPPsP-P/U v NN sNNqNN5NNsNN%NN"%'] 2[ =1L v J, sJ,qJ,J,s J,oJ,#p( 3 > 1HNqHHsHH*57q1FsFF %7 q,(F,F/ s1 F2 Fv DbsDbqDbDbs!1Db!Db&+ 6 A1B %1h2q1AsAA q AA!s#A%Av >sc>q`>>s!>!>&,0 7- BW1< q,<-<s2<q4{<54<s8<8< q?<@<Bs1;Jv 8s8q88s#88#8(- 8 q17's7'7'D '%q-7'-7's/7'0h7' 715 v 3s3q373s 3!&3&'+_ 6\ Aq11^s1^ 1^q .s.u +  (Eq9v!$(-U.1B57t >A &tw)XTVm$ TIMESROMAN HELVETICA TIMESROMAN TIMESROMANLOGOLAUREL TIMESROMAN TIMESROMAN TIMESROMANYg  $ 2-; HIVd Cq zW '  y fa'. 7>j/A%? 4AlpineInterfaces.etc 7-Jun-83 17:45:56