Challenges of resource management in an os gi environment chris gray + christer larsson

Challenges of Resource Management in an OSGi Environment Chris Gray, /K/ Embedded Java Solutions Christer Larsson, Makewave 20 September 2011 /K/ Embedded Java Solutions OSGi Alliance Marketing © 2008-2010 . All1 Page COPYRIGHT © 2008-2011 OSGi Alliance. All Rights Reserved Rights Reservedonsdag den 21 september 2011

The Problem • OSGi is a ﬁne dynamic modular system which allows many independent modules to co-exist within a single JVM • Supports the business objective of offering 3rd-party services on top of supplier- provided services • BUT: there is a need to protect the platform against badly-written / malicious bundles OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Types of Misbehavior Other OS Process Bundle Bundle Bundle Other OS Process Bundle Bundle Bundle OSGi Framework Other OS Process JVM Process Operating System OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Types of Misbehavior Excessive Memory Allocation Other OS Process Bundle Bundle Bundle Other OS Process Bundle Bundle Bundle OSGi Framework Other OS Process JVM Process Operating System OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Types of Misbehavior Excessive CPU usage, or Excessive Memory using too many Threads Allocation Other OS Process Bundle Bundle Bundle Other OS Process Bundle Bundle Bundle OSGi Framework Other OS Process JVM Process Operating System OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Types of Misbehavior Other OS Process Other OS Process Other OS Process JVM / OSGi Rebooting. Please Wait..... Operating System OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Potential solutions to the problem • Use Resource Management inside the VM • Run multiple VM instances to isolate critical OSGi applications from user application • Careful and rigorous testing of all bundles before the are installed • These three items can of course be combined OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

A Mika / Knopflerfish solution - resource constrain the bundles Add a Resource Manager that can account for Bundle Resources using built-in VM features Other OS Process Bundle Bundle Bundle Other OS Process Bundle Bundle Bundle Resource Knopflerfish OSGi Framework Manager Other OS Process Mika Max Operating System OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Identifying the culprit (1) • The ﬁrst step is to associate resource allocations with modules. • Various systems have been devised for this, but generally they are not transparent • Certain APIs must be called for its resource consumption to be monitored. • But there is no guarantee all code is written in this way • And legacy code, or 3rd party libs are certainly not! • Instead we propose to gather resource usage information by instrumenting the Java runtime itself. OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Identifying the culprit - (2) • OSGi helps us by allocating a unique classloader to each bundle. We deﬁne the “current bundle class loader” of a thread T as follows: • If T is the system startup thread then the current bundle class loader of Ts base frame is the system class loader. • Otherwise the bundle class loader of Ts base frame is inherited from the thread frame which called T.start(). • The bundle class loader of any other frame is the class loader of the method it is executing, or if this is the system class loader then it is inherited from the parent frame. OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Identifying the culprit - (3) • For the purpose of this paper the bootstrap class loader, extension class loader, and system class loader are all lumped together as “system”. Note that this includes resources consumed by the framework itself. • The overhead is much less than for the “stack inspection” required by the Java2 ﬁne-grained security model, because we only need to follow a few pointers (frame→method→class→loader) and test for equality. Could be further optimised using auxiliary data structures. OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Resource Accounting • For each class loader we maintain a data structure with counters for each monitored resource. • Count up when resource is allocated • Count down when released, BUT • Resource is often released by another thread, e.g. Garbage collector or ﬁnalizer thread. Therefore we need to remember which class loader allocated which resource! Furthermore the resource may outlive the classloader which allocated it, so we use a “handle” instead of a direct pointer to the class loader. • CPU usage is tricky, as depends on OS and on threading model. OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Bundle Resource Accounting For each monitored bundle resources are accounted and associated with the bundle’s Class Loader Class Loader Other OS Process Bundle Bundle Bundle Class Loader Other OS Process Bundle Bundle Bundle Knopﬂerﬁsh OSGi Framework Resource Manager Other OS Process Mika Max Operating System OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Resource Accounting (2) • Knopflerfish Pro has a Resource Manager • For every bundle quota can be set on CPU, memory and number of Threads used • When a Bundle has exceeded his quota of some resource the Resource Manager is notified and can take action. • But it is not always obvious what to do! OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Dealing with Resource Overconsumption (1) • The default action when the bundle over- consumes is as follows • Overconsumption of Memory • Throw an OutOfMemoryError • Overconsumption of Threads or CPU • Throw an InternalError • Alternatively a user-deﬁned callback can be invoked at that point OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Dealing with Resource Overconsumption (2) • The Resource Manager can supply information on over- consuming bundles to a Management Agent. • The Management Agent can also query the Resource Manager for current bundle resources use and take action before quota is reached • The Management Agent can then decide to send an alarm and / or stop the bundle. • For a well-behaving bundle this is no problem • But for a malicious, or badly written bundle that has gone bananas there are new problems on the horizon... OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Difficulties with Java Threads • Java threads are not OS processes, i.e. • Java threads can not be destroyed, stopped or suspended. Attempting to do that is unsafe and may lead to unpredictable results. See javadoc for java.lang.Thread for more details. • This means Activator start() and stop() methods that do not return can not be stopped or killed like an OS process. • If this happens in Knopflerfish we: • invalidate the Bundle after a timeout period so that bundle no longer is usable. All its services are unregistered and it can not get new services. • Set the threads prio to lowest possible. OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Showtime! OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Thank you Chris Gray - /K/ Embedded Java Solutions - www.k-embedded-java.com Christer Larsson - Makewave - www.makewave.com OSGi Community Event 2011 Darmstadt - Chris Gray / Christer Larssononsdag den 21 september 2011

Challenges of resource management in an os gi environment chris gray + christer larsson

by mfrancis on Sep 21, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

Statistics

Challenges of resource management in an os gi environment chris gray + christer larsson — Presentation Transcript