All programs in the QuickSilver distributed system behave atomically with respect to their updates to permanent data. Operating system support for transactions provides the framework required to support this, as well as a mechanism that unifies reclamation of resources af- ter failures or normal process termination. This paper evaluates the use of transactions for these purposes in a general purpose operating system and presents some of the lessons learned from our experience with a complete running system based on transactions. Examples of how transactions are used in QuickSilver and mea- surements of their use demonstrate that the transaction mechanism provides an efficient and powerful means for solving many of the problems introduced by operating system extensibility and distribution.

Introduction Clock s~nc:hrc~rti~nt.ion is ncedcd in many distribt~I,ecl s~~s~,crns (.o ~rreasurc~ the dvration of c~istril~n~ccl a.

The design of a network file service that is tolerant to fail-stop failures and that can be run on top of a standard network file service is described. The fault-tolerance is completely transparent, so the resulting file system supports the same set of heterogeneous workstations and applications as the chosen standard, To demonstrate that the design can provide the benefit of highly available files at a reasonable cost to the user, a prototype has been implemented using the Sun NFS protocol. The approach is not limited to being used with NFS and should apply to any network file service built along the client-server model.>