1. Department of Computer ScienceJanos Project Janos A Java-oriented Active Network Operating System Jay Lepreau, Patrick Tullmann, Kristin Wright Wilson Hsieh, Godmar Back, many more... University of Utah Flux Research Group www.cs.utah.edu/flux/ March 30, 1999

2. Department of Computer Science Janos Project Goals l Develop a principled yet efficient local OS architecture for active nodes, oriented to hierarchical structure, resource control, and security. l Produce separately useful OS, security, and Java VM components.

3. Department of Computer Science Janos Project Goals 2 l Investigate local resource management and security in language-based systems –Java, in particular l Investigate OS support for active networking l Investigate broader resource management issues

4. Department of Computer Science Janos Project Resources (obvious) l Memory l CPU l Network bandwidth

5. Department of Computer Science Janos Project Resources (less obvious) l Backing/caching store l Persistent store l Encryption hardware l Other specialized hardware… –DSPsl –Reconfigurable HW? –Special links (eg long set up time) l Specialized data... –Routing table entries? –...

6. Department of Computer Science Janos Project Genesis l Builds on three lines of existing work: –Fluke Nested Process Model »Strong OS model with a new protection mechanism: focus on resource control –Flask security architecture »Policy-flexible fine-grain mechanisms –The OSKit »Reusable low-level components and a framework (COM, APIs) l Other: –Optimization of Java for systems code »predictability, speed –Network testbed (possibly)

7. Department of Computer Science Janos Project Janos Structure The OSKit AN Execution Environment Janos VM Hardware or Unix

8. Department of Computer Science Janos Project Primary Execution Environment l Java-based l Prototype will be based on ANTS [Wetherall et al. 97] –Initial changes to ANTS structure and execution model to better support resource control (released June ‘98) l Integration with Janos resource management –Admission control –Prevent denial of service –Fair sharing

9. Department of Computer Science Janos Project “Incoming” Bandwidth »Early demultiplexing and packet discard. »Minimize unaccounted processing through lazy receiver processing. »Flexible and extensible dispatch. Link ANEP ANTS Prot AProt B PLAN... Unknown

10. Department of Computer Science The Nested Process Model Child process is encapsulated in its parent. Parent has complete control over the child. Traditional Process ModelNested Process Model Parent Process State Child State Child State Child State Child State Parent Process State

11. Department of Computer Science Janos Project Nested Process Model l Derived from a recursive virtual machine model l Resources for a process are obtained from parent l Parent services requests for new resources and for management l Strict hierarchy enabled, not enforced Parent Process State Child State Child State Child State Child State Parent Process State TraditionalFluke

12. Department of Computer Science Janos Project Obscure Names l Fluke: microkernel and server implementation of OS model l Flask: high-security version of Fluke Alta: Fluke architecture implemented in a JVM, using type-safety for memory protection

13. Department of Computer Science Janos Project Swap in Patrick

14. Department of Computer Science Janos Project Flask: High-security version of Fluke l Joint with NSA R23, SCC l Security architecture orthogonal to Flask implementation l Augments Fluke with fine grained security mechanisms –Explicit security bindings –Mandatory controls –Mutual authentication

15. Department of Computer Science Janos Project Flask: Security Policy l Policy flexibility: –Dynamic both in time and in configuration –Economic and market reasons –Separate security policy “decider” makes all policy decisions –Revocation support l Investigating extensions to multiple policy servers

16. Department of Computer Science Janos Project The OSKit

17. Department of Computer Science Janos Project Dual Execution Modes

18. Department of Computer Science Janos Project User Friendly OS Development ….!?

19. Department of Computer Science Example Working Kernel #include main() { printf("Hello, world.\n"); return 0; }

20. Department of Computer Science Janos Project OSKit Status l Major releases 18 Dec 98, 15 Jan 99 –Unique downloads running 1000/month –600 on mailing list l Base for Janos prototype on bare hardware l Another route for Utah/NSA security tech xfer l Likely vehicle for external OS research tech xfer (Quorum, NT) l Evolving into flexible OS itself

21. Department of Computer Science Janos Project OSKit: Ongoing and Future l Make components more separable l Dynamic loading and linking l Module configuration language & GUI l “Protection” component l Further integrate with languages –Java –Scheme (Indiana, Kansas, Rice) –ML (MIT, CMU) l ….

22. Department of Computer Science Janos Project OSKit future components l Buffering/caching (IO-Lite?), network mgmt protocols,... l Modular protocol impl. l Secure boot (Penn), filesys (Linux xfer), policy engine l Network components –access checks at all levels and objects (local node, remote node, interface, routing table, …) l Crypto, auth, l PCC verifier (w/ CMU/Cedilla) l ….

23. Department of Computer Science Janos Project CPU Inheritance Scheduling l Threads schedule each other by donating the CPU using a directed yield primitive l One root scheduler per processor sources all CPU time l Kernel dispatcher manages threads, events, and CPU donation without making any scheduling policy decisions

24. Department of Computer Science Janos Project CPU Inheritance Scheduling l Did prototype for OSDI’96.. l Now making it real in the OSKit and Janos: –Fast context switches. –Client-scheduler communication (NPM). –Integration with I/O, Synchronization. –Extensible policy modules.

25. Department of Computer Science Janos Project Stride (WFQ) Scheduling 400 600 50 20 % CPU 60 % CPU

26. Department of Computer Science Janos Project Possible Curves in the Road l Fluke model will likely be modified l Hardware protection may be included l Flask security architecture may not map well to Java and Janos l Challenges in GC and cpu interactions. l More surprises undoubtedly await…

27. Department of Computer Science Janos Project The Big Todo l GVM and Alta prototypes: evaluate, choose best pieces, synthesize l Evaluate use of hardware protection in the OSKit l Refine and integrate AN execution environment l Measure and tune performance l Leverage AN-specifc fine-grained sharing

28. Department of Computer Science Janos Project Summary l Resource control and security in Java –Applicable in other language-based systems –Explore power/speed of software mechanisms l Primary motivation: active networks and other mobile code l Useful in other contexts –Servlet environments –Active service environments –OS without hardware protection l Wide applicability and tech xfer thru the OSKit l www.cs.utah.edu/flux/