The Hierarchical Microkernel: Existing Approaches A Flexible and - PowerPoint PPT Presentation

HM OS Architecture Stefan Winter Problem Statement The Hierarchical Microkernel: Existing Approaches A Flexible and Robust OS Architecture Proposed Solution Summary Stefan Winter, Martin Tsarev, Neeraj Suri DEEDS Group, TU Darmstadt moduli-os@deeds.informatik.tu-darmstadt.de 8th November 2013 1 / 13

HM OS My PhD research focus Architecture Stefan Winter Problem Statement Existing Approaches Proposed Solution Summary Robustness Correct operation despite invalid inputs stressful environmental conditions 2 / 13

HM OS My PhD research focus Architecture Stefan Winter Problem Statement Existing Approaches Proposed Solution Less critical More critical Summary component component Robustness Correct operation despite invalid inputs stressful environmental conditions 2 / 13

HM OS How (most) software systems evolve Architecture Stefan Winter Problem Statement Existing Approaches Composition Proposed Solution static linking Summary dynamic linking Problems static: system down time dynamic. . . ? 3 / 13

HM OS How (most) software systems evolve Architecture Stefan Winter Problem Statement Existing Approaches Composition Proposed Solution static linking Summary dynamic linking Problems static: system down time dynamic. . . ? 3 / 13

HM OS Monolithic compositions do (not) support robust Architecture evolution Stefan Winter Problem Statement Existing Approaches Proposed Solution Summary App Ext OS kernel DD1 DD2 Hardware 4 / 13

HM OS Monolithic compositions do (not) support robust Architecture evolution Stefan Winter Problem Statement Existing Approaches Proposed Solution Summary App Ext OS kernel DD1 DD2 Hardware 4 / 13

HM OS Monolithic compositions do (not) support robust Architecture evolution Stefan Winter Problem Statement Existing Approaches Proposed Solution Summary App Ext OS kernel DD1 DD2 Hardware 4 / 13

HM OS Monolithic compositions do (not) support robust Architecture evolution Stefan Winter Problem Statement Existing Approaches Proposed Solution Summary App Ext OS kernel DD1 DD2 Hardware 4 / 13

HM OS Extensions are difficult to get right Architecture Stefan Winter Problem Statement Existing Approaches Proposed Solution Summary � Palix et al., Faults in Linux: ten years later , ASPLOS’11 c 5 / 13

HM OS Problems with software evolution Architecture Stefan Winter Problem Statement Existing Approaches Proposed Solution 1 components of different criticality Summary 2 components of different origin (COTS/SOUP) 3 uniform privilege 4 complex and volatile interfaces evolve independently 6 / 13

HM OS Solution 1: Sandboxing Architecture Stefan Winter Problem Nooks: Linux driver sandboxing 1 Statement Microdrivers 2 : performance-critical code in the kernel Existing Approaches BGI: Byte-Granularity Isolation 3 Proposed Solution (L)XFI: Windows/Linux in-kernel fault isolation 4 , 5 Summary Sandboxing issues available? working? co-evolution with OS required 1Swift et al.: Improving the Reliability of Commodity Operating Systems , SOSP’03 2Ganapathy et al.: The design and implementation of microdrivers , ASPLOS’08 3Castro et al.: Fast Byte-Granularity Software Fault Isolation , SOSP’09 4Erlingsson et al.: XFI: software guards for system address spaces , OSDI’06 5Mao et al.: Software fault isolation with API integrity and multi-principal modules , SOSP’11 7 / 13

HM OS Solution 1: Sandboxing Architecture Stefan Winter Problem Nooks: Linux driver sandboxing 1 Statement Microdrivers 2 : performance-critical code in the kernel Existing Approaches BGI: Byte-Granularity Isolation 3 Proposed Solution (L)XFI: Windows/Linux in-kernel fault isolation 4 , 5 Summary Sandboxing issues available? working? co-evolution with OS required 1Swift et al.: Improving the Reliability of Commodity Operating Systems , SOSP’03 2Ganapathy et al.: The design and implementation of microdrivers , ASPLOS’08 3Castro et al.: Fast Byte-Granularity Software Fault Isolation , SOSP’09 4Erlingsson et al.: XFI: software guards for system address spaces , OSDI’06 5Mao et al.: Software fault isolation with API integrity and multi-principal modules , SOSP’11 7 / 13

HM OS Solution 2: Isolation by design Architecture Stefan Winter Problem Statement Existing Approaches Proposed Solution Virtual Machines 6 : high redundancy Summary Singularity 7 : type safety, limited runtime protection Microkernels 8 6LeVasseur et al.: Unmodified device driver reuse and improved system dependability via virtual machines , OSDI’04 7Hunt et al.: Broad New OS Research: Challenges and Opportunities , HotOS’05 8Herder et al.: Fault isolation for device drivers , DSN’09 8 / 13

HM OS Proposed solution: “Hierarchical” µ -kernel Architecture Stefan Winter Problem Statement Existing Approaches Proposed Solution Summary Two core concepts: 1 broadcast IPC 2 recursive system (de)composition 9 / 13

HM OS Broadcast communication and scalability Architecture Stefan Winter Problem Statement Shared Random Shadow Driver 9 Driver Existing Library Application Approaches Proposed Solution Communication Bus Summary Microkernel (HAL) HM building blocks Modules : small isolated executable entities Buses : broadcast message-passing for inter-module communication (in software) 9 Swift et al.: Recovering device drivers, ACM TOCS 24 4/2006 10 / 13

HM OS Broadcast communication and scalability Architecture Stefan Winter Shared Random Problem Shadow Driver 9 Driver Statement Library Application Existing Approaches Communication Bus Proposed Solution Microkernel Summary (HAL) Pros Cons safe evolution Congestion no interposition Bus as SPOF mechanisms required Confidentiality? for reconfiguration Availability? unbounded scalability? 9 Swift et al.: Recovering device drivers, ACM TOCS 24 4/2006 10 / 13

HM OS Mitigating the downsides of broadcast: Architecture Hierarchical (de)composition Stefan Winter Problem Statement Untrusted Existing Library Extension Approaches Proposed Solution Summary Application 1 Application 2 Driver Shadow Driver Application File Drivers Group System Communication Bus Microkernel (HAL) 11 / 13

HM OS Hierarchical (de)composition Architecture Stefan Winter Hierarchy Problem Parent/Child relation across modules and buses: Statement Manage children Existing Approaches multiplex resources provided by lower layer Proposed Solution provide “system calls” Summary → Trust parents Pros Cons Broadcast scope Communication restriction overheads (routing) Management load Hierarchy emulation on distribution binary privilege architectures Distance from kernel reflects degree of distrust 12 / 13

HM OS Wrap-up Architecture Stefan Winter Problem Statement Problems Existing Approaches 1 components of different criticality Proposed Solution 2 components of different origin (COTS/SOUP) Summary 3 uniform privilege 4 complex and volatile interfaces evolve independently Proposal localized broadcast communication fair management overhead distribution more fine-grained trust/overhead trade-off 13 / 13