Scheduling and IPC mechanisms for continuous media

Presents a paradigm that combines the speed of single address spaces with the traditional protection mechanisms found in multiple address space systems such as UNIX. Multiple address spaces are common today for providing safety and security in operating systems. A process in one address space cannot corrupt or compromise memory locations an another process's address space. However, inter-process communication is slow because it is expensive to context switch between address spaces. Single address space systems provide a solution to the problem of slow context switches. In a single address space system, which is typically implemented in a 64-bit address space, all processes shape a common address space. Hence, the need to move between address spaces during inter-process communication is avoided. It is our position that it is not strictly necessary to use a single address space in order to achieve fast inter-process communication. >

Two broad classes of memory models are available today: models with hardware cache coherence, used in conventional chip multiprocessors, and models that rely upon software to manage coherence, found in compute accelerators. In some systems, both types of models are supported using disjoint address spaces and/or physical memories. In this paper we present Cohesion, a hybrid memory model that enables fine-grained temporal reassignment of data between hardware-managed and software-managed coherence domains, allowing a system to support both. Cohesion can be used to dynamically adapt to the sharing needs of both applications and runtimes. Cohesion requires neither copy operations nor multiple address spaces. Cohesion offers the benefits of reduced message traffic and on-die directory overhead when software-managed coherence can be used and the advantages of hardware coherence for cases in which software-managed coherence is impractical. We demonstrate our protocol using a hierarchical, cached 1024-core processor with a single address space that supports both software-enforced coherence and a directory-based hardware coherence protocol. Relative to an optimistic, hardware-coherent baseline, a realizable Cohesion design achieves competitive performance with a 2× reduction in message traffic, 2.1× reduction in directory utilization, and greater robustness to on-die directory capacity.

Modern computers are built with increasingly complex software stack crossing multiple layers (i.e., worlds), where cross-world call has been a necessity for various important purposes like security, reliability, and reduced complexity. Unfortunately, there is currently limited cross-world call support (e.g., syscall, vmcall), and thus other calls need to be emulated by detouring multiple times to the privileged software layer (i.e., OS kernel and hypervisor). This causes not only significant performance degradation, but also unnecessary implementation complexity.

Memory-centric computing demands careful organization of the virtual address space, but traditional methods for doing so are inflexible and inefficient. If an application wishes to address larger physical memory than virtual address bits allow, if it wishes to maintain pointer-based data structures beyond process lifetimes, or if it wishes to share large amounts of memory across simultaneously executing processes, legacy interfaces for managing the address space are cumbersome and often incur excessive overheads. We propose a new operating system design that promotes virtual address spaces to first-class citizens, enabling process threads to attach to, detach from, and switch between multiple virtual address spaces. Our work enables data-centric applications to utilize vast physical memory beyond the virtual range, represent persistent pointer-rich data structures without special pointer representations, and share large amounts of memory between processes efficiently.

As one of most outstanding embedded real-time systems, QNX operating system is widely used on many key areas. Increasingly mature virtual machine technique is brought into QNX graphical interface program development to establish a "Host machine-Target machine" mode. On one computer, the developing platform for QNX graphical interface program is set up. Test results indicate that the developing platform obviously increases the efficiency of QNX interface program development and is suggested to other system programs development.

The X10 programming language is intended to ease the programming of scalable concurrent and distributed applications. X10 augments a familiar imperative object-oriented programming model with constructs to support light-weight asynchronous tasks as well as execution across multiple address spaces. A crucial aspect of X10's runtime system is the scheduling of concurrent tasks. Work-stealing schedulers have been shown to efficiently load balance fine-grain divide-and-conquer task-parallel program on SMPs and multicores. But X10 is not limited to shared-memory fork-join parallelism. X10 permits tasks to suspend and synchronize by means of conditional atomic blocks and remote task invocations.In this paper, we demonstrate that work-stealing scheduling principles are applicable to a rich programming language such as X10, achieving performance at scale without compromising expressivity, ease of use, or portability. We design and implement a portable work-stealing execution engine for X10. While this engine is biased toward the efficient execution of fork-join parallelism in shared memory, it handles the full X10 language, especially conditional atomic blocks and distribution.We show that this engine improves the run time of a series of benchmark programs by several orders of magnitude when used in combination with the C++ backend compiler and runtime for X10. It achieves scaling comparable to state-of-the art work-stealing scheduler implementations---the Cilk++ compiler and the Java fork/join framework---despite the dramatic increase in generality.

Real-time partitioned operating systems meet the current avionics standard of reliable software; they are capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. Model-based Checking is a formal verification technique in which a software model is developed and then it is automatically checked for the compliance with formal requirements. This method allows proving the correct operation of the model on all possible input data, all possible ways of processes switching and interactions. In this article, we describe a formalized model of an open-source partitioned operating system POK. We implement the model in Promela language for SPIN tool with the purposes of formal verification using the Model Checking method. The model is designed to describe the behavior of: partition and process schedulers, system calls through a software interrupt, kernel libraries for working with synchronization primitives and processes awaiting, user code which consists of several processes in different partitions that are synchronized through a semaphore. The described approach can be used to verify the correct synchronization, the proper operation of the scheduler algorithms, and the accurate data access from different partitions by introducing the corresponding requirements in the form of formulas of the linear-time temporal logic.

Many contemporary operating systems utilize a system call interface between the operating system and its clients. Increasing numbers of systems are providing low-level mechanisms for intercepting and handling system calls in user code. Nonetheless, they typically provide no higher-level tools or abstractions for effectively utilizing these mechanisms. Using them has typically required reimplementation of a substantial portion of the system interface from scratch, making the use of such facilities unwieldy at best.This paper presents a toolkit that substantially increases the ease of interposing user code between clients and instances of the system interface by allowing such code to be written in terms of the high-level objects provided by this interface, rather than in terms of the intercepted system calls themselves. This toolkit helps enable new interposition agents to be written, many of which would not otherwise have been attempted.This toolkit has also been used to construct several agents including: system call tracing tools, file reference tracing tools, and customizable filesystem views. Examples of other agents that could be built include: protected environments for running untrusted binaries, logical devices implemented entirely in user space, transparent data compression and/or encryption agents, transactional software environments, and emulators for other operating system environments.

Processes running under an operating system are independent and autonomous entities. However, they need to share resources, communicate, use OS services, etc. The operating system's services can be reached through system calls, which contribute - sometimes excessive - overhead activity. In some cases the payload activity, used in the system call, is much shorter than that needed for implementing the Exceptional Control Flow, implementing the system call frame. In certain cases, the OS service in question can be implemented in an alternative way, practically without overhead. The paper presents such a case, using an easy to understand simple example, an alternative implementation of a simple binary semaphore. The semaphore has been implemented and tested in a prototyping environment, using an operating system running on a soft processor equipped with custom instruction. For implementing the semaphores, a reconfigurable device was used.

The combination of a real-time executive and an off-the-shelf time-sharing operating system has the potential of providing both predictability and the comfort of a large application base. To isolate the real-time section from a significant class of faults in the (ever-growing) time-sharing operating system, address spaces can be used to encapsulate the time-sharing subsystem. However, in practice, designers seldom use address spaces for this purpose, fearing that the extra cost induced limits the system's predictability. To analyze this cost, we compared in detail two systems with almost identical interfaces-both are a combination of the Linux operating system and a small real-time executive. Our analysis revealed that for interrupt-response times, the delay and jitter caused by address spaces are similar to or even smaller than those caused by caches and blocked interrupts. As a side effect of our analysis, we observed that published figures on predictability must be carefully checked whether or not such hardware features are included in the analysis. This paper is a follow-up of an earlier publication at the 3rd Real-Time Linux workshop. It is different in that we have further optimized our microkernel and examined more hardware.

This paper proposes a virtual memory management system suitable for interactive continuous media applications. Interactive continuous media applications usually require a large amount of memory for storing their code, data, and stack segments. In traditional operating systems, demand paging makes it possible to execute such large applications by storing most pages in secondary disks. However, continuous media applications should avoid page faults for ensuring timing constraints of continuous media since it takes a long time to swap pages between physical memory and secondary storage. Thus, it is difficult to satisfy timing constraints of continuous media. Therefore, some operating systems provide memory wiring primitives that enable applications to wire pages in physical memory by specifying the range of virtual address spaces explicitly. On the other hand, our virtual memory management system enables continuous media applications to reserve physical memory for allocating pages as soon as possible when the applications require the pages. The system implicitly and incrementally allocates and wires pages used for processing timing critical media data. Also, our system supports applications that adapt the amount of wired memory to the memory usage of other continuous media applications.

V60 real-time operating system

An important goal of software security is to ensure sensitive/secret data owned by a program shall be exclusively accessible by the program. An obstacle to such security goal is that modern commodity operating systems (OS) for the sake of speed and flexibility have a unified linear address space--any OS kernel program can access all the linear addresses. As a result, rootkits or malicious system software are able to control the OS virtual address space, harvest the sensitive data used by software programs on the compromised computer, and report the data to remote entities controlled by hackers.In this paper, we present a holistic approach against sophisticated malware. Instead of focusing on the security of various abstraction layers of OS, we utilize the hardware techniques to directly provide the trust services to software programs. Without modifying OS, we leverage the virtual machine monitor technologies to create a lightweight hypervisor for fine-grain software runtime memory protection. As a result, a program's memory could be hidden from other high privilege system software in a single commodity OS. In addition, we propose the data locker component in the hypervisor, which prevents the sensitive data of software program in persistent storage from leaking to rootkits or other malware. For the performance evaluation, the implementation based on hardware-assisted x86 virtualization technology is presented and experimental results are reported.

System call interposition is a powerful method for regulating and monitoring program behavior. A wide variety of security tools have been developed which use this technique. However, traditional system call interposition techniques are vulnerable to kernel attacks and have some limitations on effectiveness and transparency. In this paper, we propose a novel approach named VSyscall, which leverages virtualization technology to enable system call interposition outside the operating system. A system call correlating method is proposed to identify the coherent system calls belonging to the same process from the system call sequence. We have developed a prototype of VSyscall and implemented it in two mainstream virtual machine monitors, Qemu and KVM, respectively. We also evaluate the effectiveness and performance overhead of our approach by comprehensive experiments. The results show that VSyscall achieves effectiveness with a small overhead, and our experiments with six real-world applications indicate its practicality.

It is very important but quite difficult to test the security of an operating system. In this paper, some essential problems about security testing of an operating system are discussed, including conception and extension of security testing, feasibility and technical scheme for automated security testing of an operating system, security of system calls, testing sequence for system calls, and etc. Thereafter, a prototype system (i.e. a series of testing tools) for automated security testing of system calls is designed and implemented based on Fedora 9 and Linux kernel 2.6.25-14.fc9.i686, which is made up of control module, objects setup module, standard test module, special test module and test configuration database for each system call. Furthermore, test cases as well as test results for systems calls such as creat, access and etc are discussed and analyzed. Finally, the research work in this paper is summarized while further research directions are pointed out.