Page 1 Towards a Schedu Capturing OS Expertise in an Event Type System: the Bossa Experience Julia L. Lawall DIKU, University of Copenhagen Joint work with: Gilles Muller Obasco Group, Ecole des Mines de Nantes/INRIA

Page 2 Program issues u Approach: exploit the restricted nature of DSLs to address all of these issues. Does nothing wrong Does something right Executes efficiently

Page 3 Context: OS extensibility u Goals: –Policies for specific applications. –Policies for specific execution contexts. –Eliminate unnecessary functionality for speed / reduced resource consumption. u Safety is critical

Page 4 Approaches to OS extensibility u Berkeley Packet Filter: –interpreted for safety u Exo-kernel –extensions run at the user level u Proof-carrying code –extensions accompanied by a correctness proof u SPIN, OKE: –extensions written in a safe language u Address safety, correctness at best ad hoc.

Page 5 A domain-specific approach Bossa, a DSL for developing CPU schedulers RTS Kernel (Linux) DSL policy Compiled policy Bossa compiler/verifier kernel expertpolicy developers

Page 6 Bossa DSL: policy structure u Declarations –states –process attributes –process priorities u OS interface u Programmer interface

Page 7 Extract of a scheduling policy states = { RUNNING running : process; READY ready : select sorted queue; READY expired : sorted queue; READY yield : process; BLOCKED blocked : queue; TERMINATED terminated; }

Page 8 Event handlers handler (event e) { … On block.* { running => blocked; } On unblock.preemptive.* { if (!empty(running) && e.target > running) running => ready; e.target => ready; } … }

Page 9 Correctness issues u Is the chosen algorithm appropriate? u Is the algorithm implemented faithfully? u Does the implementation interact correctly with the target OS? This work focuses on the third issue...

Page 10 Event handlers handler (event e) { … On block.* { running => blocked; } On unblock.preemptive.* { if (!empty(running) && e.target > running) running => ready; e.target => ready; } … } Reasonable behavior, but what does the kernel expect?

Page 11 Event types u For each event, describe: –Event notification context. –Expected handler effect. –block.*: [tgt in RUNNING]  [tgt in BLOCKED] u Provided by the OS expert. u Goals: –Document kernel expectations. –Check that these expectations are satisfied. –Encapsulate kernel expertise. –Policy independent.

Page 12 Event type examples u block.*: –[tgt in RUNNING]  [tgt in BLOCKED]  unblock.preemptive.*: –[tgt in BLOCKED]  [tgt in READY] –[p in RUNNING, tgt in BLOCKED]  [[p, tgt] in READY] u Missing Linux expertise: –unblock.preemptive.* is an interrupt; affects block.*. –a process can be unblocked before it blocks.

Page 13 Corrected types and handlers u block.*: –[tgt in RUNNING]  [tgt in BLOCKED] –[[] = RUNNING, tgt in READY]  [tgt in BLOCKED] On block.* { running => blocked; } should be: On block.* { e.target => blocked; }

Page 14 Corrected types and handlers u unblock.preemptive.*: –[tgt in BLOCKED]  [tgt in READY] –[p in RUNNING, tgt in BLOCKED]  [[p, tgt] in READY] –[tgt in RUNNING]  [tgt in RUNNING] –[[] in RUNNING, tgt in READY]  [tgt in READY] On unblock.preemptive.* { if (e.target in blocked) { if (!empty(running) && e.target > running) running => ready; e.target => ready; }}

Page 15 Event types for safety u bossa.schedule –[[] = RUNNING, q in READY]  [q in RUNNING] On bossa.schedule { if (empty(ready)) { if (empty(expired)) { yield => ready; } else { expired => ready; } select() => running; }

Page 16 Event types for optimization u block.*: –[tgt in RUNNING]  [tgt in BLOCKED] –[[] = RUNNING, tgt in READY]  [tgt in BLOCKED] u Specialized event sequences. if (tgt == running) move_proc_queue(running,blocked); else move_queue_queue(tgt,blocked);

Page 17 Assessment u For critical OS services, need more than safety guarantees. u Analyzing the entire kernel with respect to each new policy is both expensive and not so necessary. u Event types guide the developer and permit relevant verifications.

Page 18 Current status u Bossa versions of Linux 2.2 and 2.4 kernels. u Policies: –Process schedulers: »Linux, BSD, EDF, Progress-based, Linux O(1) –Virtual schedulers: »Fixed-priority, proportional share u Automatic kernel instrumentation in progress u Low overhead for lat_ctx. No overhead for more typical applications.

Page 19 Future work u Test event type expressiveness: –New OSes: »BSD, OSes for real-time or embedded systems... –New policies »multimedia, real-time, energy aware… u Model checking for verifying policies. u Model checking for verifying event types.