System Support for Distributed Energy Management in Modular Operating Systems

Total Page:16

File Type:pdf, Size:1020Kb

System Support for Distributed Energy Management in Modular Operating Systems ' $ System Support for Distributed Energy Management in Modular Operating Systems zur Erlangung des akademischen Grades eines Doktors der Ingenieurwissenschaften von der Fakultat¨ fur¨ Informatik des Karlsruher Instituts fur¨ Technologie genehmigte Dissertation von Jan Stoess aus Karlsruhe Tag der mundlichen¨ Prufung¨ : 5. Februar 2010 Hauptreferent: Prof. Dr. Frank Bellosa Karlsruher Institut fur¨ Technologie Korreferent: Prof. Dr. Gernot Heiser University of New South Wales &KIT – Universitat¨ des Landes Baden-Wurttemberg¨ und nationales Forschungszentrum in der Helmholtz-Gemeinschaft www.kit.edu % ii Abstract Energy management has become a challenge for modern computing environments that needs to be addressed by all involved components, including the operating system. At the same time, the trend in operating-system design is moving away from monolithic to modular structures; modern operating systems often come as a small kernel and a set of unprivileged service modules atop. Their custom operating-system abstractions render them extensible; their integrated virtualiza- tion capabilities retain compatibility to existing applications. Nonetheless, most existing energy-management schemes are tailored to monolithic operating sys- tems, where software and hardware can be directly controlled to meet thermal or energy constraints. A modern operating system, however, consists of multiple components, and direct or centralized energy management is unfeasible. This thesis proposes a novel approach for managing energy in modular opera- ting systems. Our approach strives to enable energy awareness and energy mana- gement if the resource-management subsystem is distributed and scattered among operating-system modules rather than being centralized and monolithic. There are four key achievements: a model for modularization-aware energy management; the support for exposed and distributed energy accounting and allocation; the use of different energy-management interaction protocols; and, finally, the support for virtualization of energy effects. We have implemented a prototype of our approach for a modular, virtualization- capable microkernel operating system. Our prototype supports processor and disk energy management, at the level of physical and virtual devices. To that end, it features distributed and exposed mechanisms for accounting and allocation of processor and disk energy both to complete virtual machines and to individual virtualized applications. Experiments show that the prototype accurately accounts and allocates processor and disk energy consumption to different notions of appli- cations at runtime. Our mechanisms enable extensible and easily adaptable energy policies. Overheads for processor energy management may be dramatic for micro- benchmarks, but percolate to application level at a more moderate level. Over- heads for combined processor and disk management are limited to an increase in processor utilization. Our experiments also reveal that there is an interdependen- cy between accuracy and performance of energy-management mechanisms; using different management protocols, our prototype enables developers of energy poli- cies to choose themselves the particular point in the trade-off space. iii iv Zusammenfassung Uber¨ Jahrzehnte hinweg waren Leistung und Leistungssteigerung die bestimmen- den Ziele bei der Entwicklung von Rechensystemen. In jungster¨ Zeit hat sich allerdings eine weitere Herausforderung dazugesellt: die Energieeffizienz. Der Wunsch nach energieeffizienteren Computern hat zwei Hauptursachen: Erstens erfreuen sich mobile Rechensysteme wie tragbare Telefone oder andere Klein- computer einer zunehmenden Verbreitung, was Computerhersteller vor die Her- ausforderung stellt, leistungsfahige¨ Computergerate¨ mit begrenztem Energievor- rat zu entwickeln. Zweitens hat die Computerindustrie insgesamt mit einem stetig steigenden Energiehunger der Rechensysteme (insbesondere der Serversysteme) und einer damit verbundenen Kostenexplosion zu kampfen.¨ Der wachsende Ener- giehunger ist vor allem auf die gesteigerten Energiedichten in modernen Rechne- rarchitekturen zuruckzuf¨ uhren;¨ der dadurch entstehende Bedarf an aufwandiger¨ Kuhlung¨ vergroßert¨ den Energiebedarf entsprechend zusatzlich.¨ Nicht uberraschend¨ herrscht daher mittlerweile ein breiter Konses in Forschung und Technik, dass Energieeffizienz ein Hauptkriterium bei der Entwicklung von Computeranlagen sein sollte. Im Bereich der mobilen Computergerate¨ steht dabei naturgemaߨ der Wunsch im Vordergrund, moglichst¨ lange Batterielaufzeiten zu ermoglichen.¨ Bei Standrechnern und Serversystemen wiederum stellt die Reduk- tion der Energiekosten das Hauptziel dar. Das allgemeingehaltene Ziel der Ener- gieeffizienz zergliedert sich somit in mehrere Teilziele, von denen die folgenden vier als maßgeblich bezeichnet werden konnen:¨ erstens sollten Computersysteme naturlich¨ weniger Leistung aufnehmen, sowohl um die Nutzbarkeit der Mobil- gerate¨ zu erhohen¨ als auch um Energiekosten und deren okologische¨ Auswirkun- gen zu reduzieren; daruber¨ hinaus sollten zweitens Computersysteme aber auch moglichst¨ die Betriebstemperaturen gering halten, weil sich dadurch Bedarf und Kosten der Kuhlung¨ in Grenzen halten lassen, was erneut den Energieverbrauch der Rechenanlage verringert. Drittens sollten Computersysteme nach Moglichkeit¨ das Auftreten von Leistungs- und Temperaturspitzen vermeiden, weil Kuhlung¨ und Elektizitatsversorgung¨ von Computern oftmals nach Maximalbedarf und Ma- ximaltemperaturen entworfen werden; jedes Vermeiden von Spitzenbedarf erlaubt daher eine bessere Anpassung der Strom- und Kuhlinfrastruktur¨ an tatsachliche,¨ durchschnittliche Gegebenheiten. Viertens schließlich sollten Computersysteme eine anwendungsgetriebene Form des Energiemanagements betreiben, da nur der v vi ZUSAMMENFASSUNG Miteinbezug von Software und Anwendungen die Ziele der Energieeffizienz mit anderen, ebenso wichtigen Anforderungen an Rechenanlagen wie Dienstgute,¨ Be- nutzerfairness, oder bedarfsgerechter Kostenabrechnung in Einklang zu bringen erlaubt. Traditionell hat man sich dem Ziel energieeffizienter Computer meist auf der Ebene der Hardware und Anlagen gewidmet, beispielsweise durch energieeffizi- ente Rechnerarchitekturen oder durch thermodynamisch effizientere Kuhlanlagen.¨ Tatsachlich¨ sollte dieses Ziel aber auf allen Ebenen der Rechenanlagen ange- gangen werden; insbesondere das Betriebssystem tragt¨ hierbei eine Schlussel-¨ rolle, da diesem die Laufzeitkontrolle sowohl der Hardware als auch der Soft- ware untersteht. Ein betriebsystemseitiges Energiemanagement kann somit dafur¨ sorgen, dass das Erreichen von Energieeffienz global und dynamisch erfolgt, al- so alle Hardwaregerate¨ und Anwendungen umfasst und zur Laufzeit stattfindet. In der Tat hat sich eine Vielzahl von wissenschaftlichen Untersuchungen dem Problem des betriebssystemseitigen Energiemanagements verschrieben. Generell stutzt¨ man sich hier zumeist auf Laufzeitmechanismen zur Uberwachung¨ und Steuerung sowohl der Gerate¨ und ihrer Energiezustande,¨ als auch der Anwendun- gen und deren Auswirkungen auf den Energieverbrauch. Mit Hilfe solcher Me- chanismen versucht man sodann, Leistungs- und Nutzbarkeitsanforderungen mit Energiezielen unter einen Hut zu bringen; ublicherweise¨ bedeutet das entweder, ein gegebenes Mass an Rechenleistung und Dienstgute¨ zur Verfugung¨ zustellen, das aber mit moglichst¨ wenig Energie, mit moglichst¨ geringer Temperatur und mit moglichst¨ wenig Energie- und Temperaturspitzen. Oder man konzentriert sich um- gekehrt darauf, im Rechensystem gewisse Auflagen bezuglich¨ Energieverbrauch oder Temperatur nicht zu uberschreiten,¨ dabei aber ein Maximum an Leistung und Dienstgute¨ herauszuholen. Neben der gesteigerten Wichtigkeit des betriebssystemseitigen Energiemana- gements lasst¨ sich noch ein zweiter wichtiger Trend in der Betriebsystemfor- schung und -praxis beobachten: der Trend zu modularen Betriebssystemstruk- turen. Der traditionelle Betriebssystemaufbau unterscheidet lediglich zwischen Nutzer- und Kernbereich: Anwendungen laufen im Nutzerbereich, wahrend¨ die gesamte Funktionalitat¨ des Betriebssystems monolithisch im privilegierten Kern- bereich verbleibt. Waren fruhe¨ Betriebssysteme verhaltnism¨ aßig¨ klein und ber- schrankt¨ in ihren Funktionen, so sind mit zunehmender Leistungsfahigkeit¨ der Rechenanlagen auch Große¨ und Komplexitat¨ des Betriebssystems betrachtlich¨ gewachsen: ein moderner Betriebssystemkern wie Windows or Linux hat einen Quellcodeumfang von Millionen von Zeilen Code und umfasst eine unuberschau-¨ bare Anzahl von Funktionen und Diensten. Die wachsende Anzahl von Anwen- dungsszenarien, welcher sich moderne Betriebsysteme ausgesetzt sehen — so wird beispielsweise Linux heutzutage sowohl in mobilen Kleinstgeraten¨ als auch in Rechenzentren eingesetzt —, hat ihren Teil zur wachsenden Komplexitat¨ beige- vi vii tragen. Die Kombination aus monolitischem Betriebssystemaufbau einerseits und wachsender Betriebssystemkomplexitat¨ anderseits fuhrt¨ jedoch zu betrachtlichen¨ strukturellen Problemen. Als wichtigste Probleme sind die starken Einschrankung-¨ en hinsichtlich Flexibilitat¨ und Ausfallsicherheit zu nennen, welche sich aus der gemeinsamen Unterbringung aller Betriebssystemfunktionen in einem einzigen privilegierten Kern und aus dem Fehlen von Modulgrenzen innerhalb dieses Kerns ergeben. Zur Behebung der Probleme monolitschen Betriebssystemaufbaus hat die For- schung eine Vielzahl unterschiedlicher Losungsans¨ atze¨ beigetragen; die vorlie- gende Arbeit befasst
Recommended publications
  • A Microkernel API for Fine-Grained Decomposition
    A Microkernel API for Fine-Grained Decomposition Sebastian Reichelt Jan Stoess Frank Bellosa System Architecture Group, University of Karlsruhe, Germany freichelt,stoess,[email protected] ABSTRACT from the microkernel APIs in existence. The need, for in- Microkernel-based operating systems typically require spe- stance, to explicitly pass messages between servers, or the cial attention to issues that otherwise arise only in dis- need to set up threads and address spaces in every server for tributed systems. The resulting extra code degrades per- parallelism or protection require OS developers to adopt the formance and increases development effort, severely limiting mindset of a distributed-system programmer rather than to decomposition granularity. take advantage of their knowledge on traditional OS design. We present a new microkernel design that enables OS devel- Distributed-system paradigms, though well-understood and opers to decompose systems into very fine-grained servers. suited for physically (and, thus, coarsely) partitioned sys- We avoid the typical obstacles by defining servers as light- tems, present obstacles to the fine-grained decomposition weight, passive objects. We replace complex IPC mecha- required to exploit the benefits of microkernels: First, a nisms by a simple function-call approach, and our passive, lot of development effort must be spent into matching the module-like server model obviates the need to create threads OS structure to the architecture of the selected microkernel, in every server. Server code is compiled into small self- which also hinders porting existing code from monolithic sys- contained files, which can be loaded into the same address tems. Second, the more servers exist | a desired property space (for speed) or different address spaces (for safety).
    [Show full text]
  • Extensible Distributed Operating System for Reliable Control Systems
    194 Extensible Distributed Operating System for Reliable Control Systems Katsumi Maruyama, Kazuya Kodama, Soichiro Hidaka, Hiromichi Hashizume National Institute of Informatics, 2-1-2 Hitotsubashi, Chiyoda-ku, Tokyo, Japan Email:{maruyama,kazuya,hidaka,has}@nii.ac.jp Abstract small monitor-like OSs are used. However, these monitor- like OSs lack program protection mechanisms, and program Since most control systems software is hardware-related, development is difficult. real-time-oriented and complex, adaptable OSs which help Therefore, an extensible/adaptable OS for control sys- program productivity and maintainability improvement are tems is required . We are developing a new OS character- in strong demand. ized by: We are developing an adaptable and extensible OS based on micro-kernel and multi-server scheme: each server runs • Use of an efficient and flexible micro-kernel (L4-ka). • Multi-server based modular OS. (Each OS service is in a protected mode interacting only via messages, and implemented as individual user-level process.) could be added/extended/deleted easily. Since this OS is • Robustness. Only the micro-kernel runs in kernel highly modularized, inter-process messaging overhead is a mode and in kernel space. Other modules run in a pro- concern. Our implementation proved good efficiency and tected user space and mode. maintainability. • Hardware driver programs in user-level process. • Flexible distributed processing by global message passing. 1. Introduction This OS structure proved to enhance OS modularity and ease of programming. However, inter-process messaging Most systems, from large scale public telephone switch- overhead should be considered . We measured the overhead, ing systems to home electronics, are controlled by software, and the overhead was proved to be small enough.
    [Show full text]
  • Run-Time Reconfigurable RTOS for Reconfigurable Systems-On-Chip
    Run-time Reconfigurable RTOS for Reconfigurable Systems-on-Chip Dissertation A thesis submited to the Faculty of Computer Science, Electrical Engineering and Mathematics of the University of Paderborn and to the Graduate Program in Electrical Engineering (PPGEE) of the Federal University of Rio Grande do Sul in partial fulfillment of the requirements for the degree of Dr. rer. nat. and Dr. in Electrical Engineering Marcelo G¨otz November, 2007 Supervisors: Prof. Dr. rer. nat. Franz J. Rammig, University of Paderborn, Germany Prof. Dr.-Ing. Carlos E. Pereira, Federal University of Rio Grande do Sul, Brazil Public examination in Paderborn, Germany Additional members of examination committee: Prof. Dr. Marco Platzner Prof. Dr. Urlich R¨uckert Dr. Mario Porrmann Date: April 23, 2007 Public examination in Porto Alegre, Brazil Additional members of examination committee: Prof. Dr. Fl´avioRech Wagner Prof. Dr. Luigi Carro Prof. Dr. Altamiro Amadeu Susin Prof. Dr. Leandro Buss Becker Prof. Dr. Fernando Gehm Moraes Date: October 11, 2007 Acknowledgements This PhD thesis was carried out, in his great majority, at the Department of Computer Science, Electrical Engineering and Mathematics of the University of Paderborn, during my time as a fellow of the working group of Prof. Dr. Franz J. Rammig. Due to a formal agreement between Federal University of Rio Grande do Sul (UFRGS) and University of Paderborn, I had the opportunity to receive a bi-national doctoral degree. Therefore, I had to accomplished, in addition, the PhD Graduate Program in Electrical Engineering of UFRGS. So, I hereby acknowledge, without mention everyone personally, all persons involved in making this agreement possible.
    [Show full text]
  • All Computer Applications Need to Store and Retrieve Information
    MyFS: An Enhanced File System for MINIX A Dissertation Submitted in partial fulfillment of the requirement for the award of the degree of MASTER OF ENGINEERING ( COMPUTER TECHNOLOGY & APPLICATIONS ) By ASHISH BHAWSAR College Roll No. 05/CTA/03 Delhi University Roll No. 3005 Under the guidance of Prof. Asok De Department Of Computer Engineering Delhi College Of Engineering, New Delhi-110042 (University of Delhi) July-2005 1 CERTIFICATE This is to certify that the dissertation entitled “MyFS: An Enhanced File System for MINIX” submitted by Ashish Bhawsar in the partial fulfillment of the requirement for the award of degree of Master of Engineering in Computer Technology and Application, Delhi College of Engineering is an account of his work carried out under my guidance and supervision. Professor D. Roy Choudhury Professor Asok De Head of Department Head of Department Department of Computer Engineering Department of Information Technology Delhi College of Engineering Delhi College of Engineering Delhi Delhi 2 ACKNOWLEDGEMENT It is a great pleasure to have the opportunity to extent my heartiest felt gratitude to everybody who helped me throughout the course of this project. I would like to express my heartiest felt regards to Dr. Asok De, Head of the Department, Department of Information Technology for the constant motivation and support during the duration of this project. It is my privilege and owner to have worked under the supervision. His invaluable guidance and helpful discussions in every stage of this thesis really helped me in materializing this project. It is indeed difficult to put his contribution in few words. I would also like to take this opportunity to present my most sincere regards to Dr.
    [Show full text]
  • Introduction
    1 INTRODUCTION A modern computer consists of one or more processors, some main memory, disks, printers, a keyboard, a mouse, a display, network interfaces, and various other input/output devices. All in all, a complex system.oo If every application pro- grammer had to understand how all these things work in detail, no code would ever get written. Furthermore, managing all these components and using them optimally is an exceedingly challenging job. For this reason, computers are equipped with a layer of software called the operating system, whose job is to provide user pro- grams with a better, simpler, cleaner, model of the computer and to handle manag- ing all the resources just mentioned. Operating systems are the subject of this book. Most readers will have had some experience with an operating system such as Windows, Linux, FreeBSD, or OS X, but appearances can be deceiving. The pro- gram that users interact with, usually called the shell when it is text based and the GUI (Graphical User Interface)—which is pronounced ‘‘gooey’’—when it uses icons, is actually not part of the operating system, although it uses the operating system to get its work done. A simple overview of the main components under discussion here is given in Fig. 1-1. Here we see the hardware at the bottom. The hardware consists of chips, boards, disks, a keyboard, a monitor, and similar physical objects. On top of the hardware is the software. Most computers have two modes of operation: kernel mode and user mode. The operating system, the most fundamental piece of soft- ware, runs in kernel mode (also called supervisor mode).
    [Show full text]
  • Microkernel Construction Introduction
    Microkernel Construction Introduction Nils Asmussen 04/09/2020 1 / 32 Normal Organization Thursday, 4th DS, 2 SWS Slides: www.tudos.org ! Studies ! Lectures ! MKC Subscribe to our mailing list: www.tudos.org/mailman/listinfo/mkc2020 In winter term: Microkernel-based operating systems (MOS) Various labs 2 / 32 Organization due to COVID-19 Slides and video recordings of lectures will be published Questions can be asked on the mailing list Subscribe to the mailing list! Practical exercises are planed for the end of the semester Depending on how COVID-19 continues, exercises are in person or we use some video-conferencing tool 3 / 32 Goals 1 Provide deeper understanding of OS mechanisms 2 Look at the implementation details of microkernels 3 Make you become enthusiastic microkernel hackers 4 Propaganda for OS research done at TU Dresden and Barkhausen Institut 4 / 32 Outline Organization Monolithic vs. Microkernel Kernel design comparison Examples for microkernel-based systems Vision vs. Reality Challenges Overview About L4/NOVA 5 / 32 Monolithic Kernel System Design u s Application Application Application e r k Kernel e r File Network n e Systems Stacks l m Memory Process o Drivers Management Management d e Hardware 6 / 32 Monolithic Kernel OS (Propaganda) System components run in privileged mode No protection between system components Faulty driver can crash the whole system Malicious app could exploit bug in faulty driver More than 2=3 of today's OS code are drivers No need for good system design Direct access to data structures Undocumented
    [Show full text]
  • Microkernel Construction Introduction
    Microkernel Construction Introduction Nils Asmussen 04/06/2017 1 / 28 Outline Introduction Goals Administration Monolithic vs. Microkernel Overview About L4/NOVA 2 / 28 Goals 1 Provide deeper understanding of OS mechanisms 2 Look at the implementation details of microkernels 3 Make you become enthusiastic microkernel hackers 4 Propaganda for OS research at TU Dresden 3 / 28 Administration Thursday, 4th DS, 2 SWS Slides: www.tudos.org ! Teaching ! Microkernel Construction Subscribe to our mailing list: www.tudos.org/mailman/listinfo/mkc2017 In winter term: Microkernel-based operating systems (MOS) Various labs 4 / 28 Outline Introduction Monolithic vs. Microkernel Kernel design comparison Examples for microkernel-based systems Vision vs. Reality Challenges Overview About L4/NOVA 5 / 28 Monolithic Kernel System Design u s Application Application Application e r k Kernel e r File Network n e Systems Stacks l m Memory Process o Drivers Management Management d e Hardware 6 / 28 Monolithic Kernel OS (Propaganda) System components run in privileged mode No protection between system components Faulty driver can crash the whole system Malicious app could exploit bug in faulty driver More than 2=3 of today's OS code are drivers No need for good system design Direct access to data structures Undocumented and frequently changing interfaces Big and inflexible Difficult to replace system components Difficult to understand and maintain Why something different? ! Increasingly difficult to manage growing OS complexity 7 / 28 Microkernel System Design Application
    [Show full text]
  • L4 – Virtualization and Beyond
    L4 – Virtualization and Beyond Hermann Härtig!," Michael Roitzsch! Adam Lackorzynski" Björn Döbel" Alexander Böttcher! #!Department of Computer Science# "GWT-TUD GmbH # Technische Universität Dresden# 01187 Dresden, Germany # 01062 Dresden, Germany {haertig,mroi,adam,doebel,boettcher}@os.inf.tu-dresden.de Abstract Mac OS X environment, using full hardware After being introduced by IBM in the 1960s, acceleration by the GPU. Virtual machines are virtualization has experienced a renaissance in used to test potentially malicious software recent years. It has become a major industry trend without risking the host environment and they in the server context and is also popular on help developers in debugging crashes with back- consumer desktops. In addition to the well-known in-time execution. benefits of server consolidation and legacy In the server world, virtual machines are used to preservation, virtualization is now considered in consolidate multiple services previously located embedded systems. In this paper, we want to look on dedicated machines. Running them within beyond the term to evaluate advantages and virtual machines on one physical server eases downsides of various virtualization approaches. management and helps saving power by We show how virtualization can be increasing utilization. In server farms, migration complemented or even superseded by modern of virtual machines between servers is used to operating system paradigms. Using L4 as the balance load with the potential of shutting down basis for virtualization and as an advanced completely unloaded servers or adding more to microkernel provides a best-of-both-worlds increase capacity. Lastly, virtual machines also combination. Microkernels can contribute proven isolate different customers who can purchase real-time capabilities and small trusted computing virtual shares of a physical server in a data center.
    [Show full text]
  • L4 Microkernel
    L4 Microkernel See final slide for sources Presented by Michael LeMay L4 Advantages ● Recursive construction of memory spaces – Allows construction of memory managers in userspace that just use memory mapping – Kernel provides map, grant, and flush ● Blazing fast IPC – Passes short messages in registers – Avoids copying large messages and thus avoids TLB flushes and cache misses – Lazy scheduling of thread queues improves small message IPC around 25% L4 Performance OS Microseconds Instructions Mach 115 1150 L4 5 50 Exokernel 1.4 30 SPIN 102 1100 (Exokernel runs on MIPS R2000, which operates more efficiently than the x86 for L4, and has a tagged TLB. It also does not provide a portable API.) L4 Conceptual Contributions ● The author of the L4 paper, Jochen Liedtke, showed that microkernels do not inherently: – Exhibit slow IPC – Impose significant processor overhead ● Instead, he showed that particular implementations are to blame: – Mach was causing lots of cache misses because it's fat, making it look like microkernels have high overhead Microkernel Non-portability ● Liedtke argues that microkernels should be non- portable, but present a uniform API: – Abstract microkernels require additional hardware abstraction layer – Can't take advantage of specific performance-enhancing hardware features – Can't protect against peculiar hardware performance pitfalls L4 Subprojects http://www.dakotacountyswcd.org/treetype.htm ● L3 – Predecessor to L4 ● FIASCO – C++ implementation of L4, poor performer in comparison to “Pip” series ● L4Ka – Most active
    [Show full text]
  • Analysis of Existing Dynamic Software Updating Techniques for Safe and Secure Industrial Control Systems
    I. Mugarza, et al., Int. J. of Safety and Security Eng., Vol. 8, No. 1 (2018) 121–131 ANALYSIS OF EXISTING DYNAMIC SOFTWARE UPDATING TECHNIQUES FOR SAFE AND SECURE INDUSTRIAL CONTROL SYSTEMS IMANOL MUGARZA1, JORGE PARRA1 & EDUARDO JACOB2 1 IK4-Ikerlan Technology Research Centre, Dependable Embedded Systems Area. 2 Faculty of Engineering, University of the Basque Country UPV/EHU. ABSTRACT Higher interconnectivity among devices, machines, the cloud and humans is envisioned in the actual trend of automation, also known as Industrial Internet of Things (IIoT). These industrial control systems, which may require high availability and/or safety related capabilities, are no longer isolated from the corporate environment or Internet. Software updates will be needed during the product life cycle, due to the long service life, the increasing number of security related vulnerabilities discovered on these industrial control systems and the high interconnectivity desired in IIoT. These updates aim at fixing all these security weaknesses, bugs and vulnerabilities that could appear, while the required safety integrity levels are ensured. Security-related concerns have just been addressed by the safety engineering community, because of the increasing number of cyber-attacks against safety-critical systems, such as Stuxnet. Moreover, system shut-downs caused by software updates could not be plausible when high availability is required. Typically, in order to perform the software update, the whole industrial process or the production is halted, so that the software upgrade is safely applied. However, this scenario might not be applied in critical infrastructures, such as nuclear or hydro- electrical power plants, where these production and service interruptions are not acceptable from the business and service point of view.
    [Show full text]
  • The L4 Ecosystem
    Faculty of Computer Science, Operating Systems Group The L4 ecosystem Berlin, Dec 2004 System Issues ● Convential systems are ● Complex ● Linux kernel at least 500,000 LoC ● Prone to errors ● Drivers ● All system components run in privileged mode ● Inflexible ● Global policies ● Large Trusted Computing Base (TCB) 27.12.04 Adam Lackorzynski, Michael Peter Folie 2 Insights Observation: Most kernel functionality does not need CPU privileges, like: – Filesystems – Driver functionality – User management 27.12.04 Adam Lackorzynski, Michael Peter Folie 3 What is really needed Jochen Liedtke: “A microkernel does no real work” Kernel provides only inevitable mechanisms No policies enforced by the kernel What is inevitable? Abstractions Mechanisms . Threads . Communication . Scheduling . Address Spaces . Safe construction This should be sufficient for everything 27.12.04 Adam Lackorzynski, Michael Peter Folie 4 The Marred Perception of Microkernels • Supposed to be slow – Not true any more • No obvious benefit – Infamous dispute Torvalds vs. Tannenbaum – How much worth is manageability of complexity? • GNU Hurd – Late – Slow – Constantly lagging behind other OS in functionality 27.12.04 Adam Lackorzynski, Michael Peter Folie 5 The Case for Microkernels • Complexity needs to be handled – Structure beyond monolithic kernels are needed – Several candidates • Virtualisation • Paravirtualisation • Microkernel • Implementation of some functionality is even simplified – Real time • DROPS • RTLinux – Security • Substantially smaller trusted computing
    [Show full text]
  • Scalability of Microkernel-Based Systems
    Scalability of Microkernel-Based Systems Zur Erlangung des akademischen Grades eines DOKTORS DER INGENIERWISSENSCHAFTEN von der Fakultat¨ fur¨ Informatik der Universitat¨ Fridericiana zu Karlsruhe (TH) genehmigte DISSERTATION von Volkmar Uhlig aus Dresden Tag der mundlichen¨ Prufung:¨ 30.05.2005 Hauptreferent: Prof. Dr. rer. nat. Gerhard Goos Universitat¨ Fridericiana zu Karlsruhe (TH) Korreferent: Prof. Dr. sc. tech. (ETH) Gernot Heiser University of New South Wales, Sydney, Australia Karlsruhe: 15.06.2005 i Abstract Microkernel-based systems divide the operating system functionality into individ- ual and isolated components. The system components are subject to application- class protection and isolation. This structuring method has a number of benefits, such as fault isolation between system components, safe extensibility, co-existence of different policies, and isolation between mutually distrusting components. How- ever, such strict isolation limits the information flow between subsystems including information that is essential for performance and scalability in multiprocessor sys- tems. Semantically richer kernel abstractions scale at the cost of generality and mini- mality–two desired properties of a microkernel. I propose an architecture that al- lows for dynamic adjustment of scalability-relevant parameters in a general, flex- ible, and safe manner. I introduce isolation boundaries for microkernel resources and the system processors. The boundaries are controlled at user-level. Operating system components and applications can transform their semantic information into three basic parameters relevant for scalability: the involved processors (depending on their relation and interconnect), degree of concurrency, and groups of resources. I developed a set of mechanisms that allow a kernel to: 1. efficiently track processors on a per-resource basis with support for very large number of processors, 2.
    [Show full text]