1. TIARA Thread Management
Scheduler interaction with user threads
Containing and partitioning scheduler functionality

2. The Issue
The Process Manager (Scheduler) interacts with every thread running in the system
In a traditional system this means it’s in the kernel and has unlimited privileges
These unlimited privileges imply the potential for undesired information flow between unrelated threads
These unlimited privileges also imply that, if compromised, the Process Manager can do unlimited damage
Scheduler
Potential Information Flow
Potential Information Flow
Kernel Space Barrier
Has Read/Write Access
User Thread
User Thread

3. The Process Manager Scheduler Satellite Satellite
Structure the process manager into a core and satellites
The core has extremely limited privilege with respect to each thread
Each satellite is related to one thread has no access to core data and limited access to thread application data
Accomplished using multiple compartments and principals
The thread’s application code has no access to Process Manager data.
Private
Compartment
Scheduler
Shared
Compartment
Shared
Compartment
Satellite
Satellite
User Thread
User Thread

4. Core and Satellites Process Manager Object Satellite Object
Info About Thread-1
Thread Registers
Info About Thread--2
Satellite Object
For threadi
Satellite Object
For threadj
Info About Thread-n
Scheduling Queue
procedure reference
...
procedure reference
Closure
Area
environment
procedure reference
Closure
Area
environment
principal
Closure
Area
environment
principal
offset
principal
offset
Thread Registers
Register-1
offset
Register
Storage
Thread Registers
Register-1
Register-2
Register
Storage
Thread Registers
Register-2
Register-1
Register-n
Register-2
Register
Storage
Register-n
Entry-1
Entry-1
Entry-2
Thread
Management
Entries
Queue
Register-n
Entry-2
Thread
Management
Entries
Queue
Entry-1
Entry-2
Core Process
Management
Entries
Queue
Entry-n
Entry-n
Closure-1
Closure-1
Closure-2
Request
Queue
Entry-n
Closure-1
Closure-2
Request
Queue
Request
Queue
Closure-2
Closure-n
Closure-n
Compartment =
Process-Mgr.Threadi
Closure-n
Compartment =
Process-Mgr.Thread-j
Compartment = Process-Mgr

5. Core and Satellites Process Manager Thread Specific Satellites
Runs in its own thread
Runs in user thread
Runs with its own unique principal
Runs with thread-specific & unique principal
Maintains its own compartment
Runs in thread-specific & unique compartment
Invoked via Queued Calls
Invoked via Synchronous calls

6. User Invoking Services
Compartments
ProcMgr
for Thread
Compartment
Process
Manager
Compartment
Process
Manager
Thread
User
Thread
User Principal
ProcMgr
for Thread Principal
Queued
Request
Call
Process
Manager Principal
User
Thread
Compartments
User Principal
ProcMgr
for Thread
Compartment
for Thread Principal
Principal Shifting
Procedure Call
Queued
Request
Call
Principal Shifting
Procedure Call

7. Queued Services Queued Request Call Principal Shifting Procedure Call
User
Compartments
ProcMgr
for Thread
Compartment
Process
Manager
Compartment
User
Thread
Process
Manager
Thread
User Principal
Process
Manager Principal
ProcMgr
for Thread Principal
Principal Shifting
Procedure Call
Queued Request Call

8. Saving State in Thread Closure
current procedure
Thread Closure
procedure reference
current environment
current principal
environment
principal
entry instruction
Program Counter
Processor Special Registers
offset
Thread Register 1
Thread Register 2
Register 1
Point of interruption
Register 2
General
Registers
Thread Register n
Register n
There is one Thread Closure per thread, created when the thread is initialized
It is allocated in the unique satellite compartment for that thread
Only the Process-Manager thread (Principal = ProcMgr) can allocate a “Thread-Closure”
Slots of a thread-closure can be read or written only when the principal is the unique satellite principal for the thread
The satellite principal has rights to overwrite any data in this compartment
The thread relinquishes the process through a (forced) call to an closure that switches to the satellite principal
This saves processor state and registers in the thread closure

9. Restoring State from Thread Closure
current procedure
Thread Closure
procedure reference
current environment
current principal
environment
entry instruction
principal
Program Counter
Processor Special Registers
offset
Thread Register 1
Register 1
Thread Register 2
Point of interruption
Register 2
General
Registers
Register n
Thread Register n
The Process Manager, saves its own thread state
Calls a Satellite entry point unique to this thead
Invoking this sets the principal register to the satellite principal
The closure reloads the processor general registers
The satellite principal has rights to load any data in the satellite compartment into processor registers
The thread closure is then invoked, restoring the original principal, etc.
This uses a special procedure call instruction that enters the code block at the offset
This instruction can only be invoked by a satellite principal on data in its satellite compartment

10. Core Structure Scheduling queue Wakeup queue Request queue
Priority queue of threads waiting for the processor
Wakeup queue
Queue of threads that are suspended until a particular time.
Request queue
Queue of calls from individual threads
On each cycle, the core:
Empties the request queue
Removes any entry from the wakeup queue whose wakeup time is before the current time and enters it into the scheduling queue
Pops the scheduling queue and dispatches to the thread removed

11. Process Manager Services
Sleep: Argument is minimum sleep time. A direct call to the satellite manager. Satellite manager saves state in its compartment. Satellite manager makes blocked, queued call to core with minimum sleep time. Core enters thread onto wakeup queue.
Forced relinquish: Similar to direct relinquish, except this happens when the hardware fields timer and other interrupts. The interrupt forces a trap to the satellite manager’s entry point for sleep, with minimum sleep time of 0.
Spawn new thread: Argument is initial closure to invoke. Queued, optionally blocking call to core; core creates the satellite structures, and enters the new thread in its scheduling queue.
Terminate: Queued, blocking call to core without a continuation. Core unthreads all references to the thread then proceeds to other work.
Force terminate: Argument is thread to kill. Queued, optionally blocking call to core. Core unthreads all references to the thread then proceeds to other work.
Block: Like relinquish, but without sleep time. Thread is removed from core’s scheduling queue, but not entered into wakeup queue.
Wake-up: Queued optionally blocking call to core. Argument is another thread. Puts the other thread back onto the scheduling queue.