SlideShare a Scribd company logo
1 of 26
Download to read offline
https://trustworthy.systems
The Quest for the Perfect API
Gernot Heiser | gernot.heiser@data61.csiro.au | @GernotHeiser
Trustworthy Systems | Data61
Observation: Operating Systems Suck
VMware Research, April'182 |
Mungi Single-Address-Space OS
Mungi: Single-Address-Space OS
De-couple translation
from protection
VMware Research, April'184 |
Mungi Retrospective
Mungi was a roaring success – not
• never found a convincing killer app
• workarounds for 32-bit limitations (Unix model) too accepted
• it was naïve to think we could change mainstream computing
• 64-bit address space already too small for all data
Lesson: If you want to change the world, pick the right world to change
Long-term benefits of Mungi
• built a systems group
• got us into L4
VMware Research, April'185 |
L4 Microkernel
L4 Microkernel
VMware Research, April'187 |
A concept is tolerated inside the microkernel only if
moving it outside the kernel, i.e. permitting
competing implementations, would prevent the
implementation of the system’s required
functionality. [Liedtke, SOSP’95]
25 Years of L4 Microkernel R&D
VMware Research, April'188 |
L3→L4 “X” Hazelnut Pistachio
L4/Alpha
L4/MIPS
OKL4-µKernel
OKL4-Microvisor
Codezero
P4 → PikeOS
Fiasco Fiasco.OC
L4-embed.
Nova
GMD/IBM/Karlsruhe
UNSW/NICTA/Data61
Dresden
Other (commercial)
OK Labs
API Inheritance
Code Inheritance
93 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
Qualcomm
modem chips
iOS secure
enclave
L4 IPC Performance Over the Years
VMware Research, April'189 |
Name Year Processor MHz Cycles µs
Original 1993 i486 50 250 5.00
Original 1997 Pentium 160 121 0.75
L4/MIPS 1997 R4700 100 86 0.86
L4/Alpha 1997 21064 433 45 0.10
Hazelnut 2002 Pentium 4 1,400 2,000 1.38
Pistachio 2005 Itanium 1,500 36 0.02
OKL4 2007 XScale 255 400 151 0.64
NOVA 2010 i7 Bloomfield (32-bit) 2,660 288 0.11
seL4 2013 ARM11 532 188 0.35
seL4 2018 i7 Haswell (64-bit) 3,400 442 0.13
seL4 2018 Cortex A9 1,000 303 0.30
Minimality: Source-Code Size
VMware Research, April'1810 |
Name Architecture C/C++ asm total kSLOC
Original i486 0 6.4 6.4
L4/Alpha Alpha 0 14.2 14.2
L4/MIPS MIPS64 6.0 4.5 10.5
Hazelnut x86 10.0 0.8 10.8
Pistachio x86 22.4 1.4 23.0
L4-embedded ARMv5 7.6 1.4 9.0
OKL4 3.0 ARMv6 15.0 0.0 15.0
Fiasco.OC x86 36.2 1.1 37.6
seL4 ARMv6 9.7 0.5 10.2
Original L4: Design & Implementation
Implementation Tricks [SOSP’93]
• Process kernel
• Virtual TCB array
• Lazy scheduling
• Direct process switch
• Non-preemptible
• Non-portable
• Non-standard calling convention
• Assembler
• Design Decisions [SOSP’95]
• Synchronous IPC
• Rich message structure, arbitrary out-
of-line messages
• Zero-copy register messages
• User-mode page-fault handlers
• Threads as IPC destinations
• IPC timeouts
• Hierarchical IPC control
• User-mode device drivers
• Process hierarchy
• Recursive address-space construction
VMware Research, April'1811 |
Objective: Minimise cache footprint and TLB misses
seL4:
Rethinking Resource Management
Memory Management
VMware Research, April'1813 |
Global Resource Manager
RAM
I+D
GRM
I+D
Resource Manager
RM
I+D
Resource Manager
RM
I+D
Addr
Space
AS
Addr
Space
Addr
Space
RM
RM
I+DResources fully
delegated, allows
autonomous operation
enabled by capabilities
Strong isolation,
No shared kernel
resources
Design for isolation:
No memory
allocation by kernel
Isolation Goes Deep
VMware Research, April'18
High Low
TCBs Caps
PTs
TCBs Caps
PTs
Kernel data
partitioned
like user data
14 |
How About Temporal Isolation?
Safety: Timeliness
• Execution interference
Security: Confidentiality
• Leakage via timing channels
High Low
Observe execution speed:
Confidentiality violation
Affect execution speed:
Integrity violation
VMware Research, April'1815 |
Integrity Challenge: Mixed Criticality
Runs every 100 ms
for few millisecods
Runs frequently but for
short time (order of µs)
Control
loopSensor
readings
NW
driver
NW
interrupts
NW driver must preempt control loop
• … to avoid packet loss
• Driver must run at high prio
• Driver must be trusted not to monopolise CPU
VMware Research, April'1816 |
Scheduling Contexts: Caps for Time
Classical thread attributes
• Priority
• Time slice
New thread attributes
• Priority
• Scheduling context capability
VMware Research, April'1817 |
Not
runnable
if null
Not
runnable
if null
Scheduling context object
• T: period
• C: budget (≤ T)
Limits CPU
access!
SchedControl capability
conveys right to assign
budgets (i.e. perform
admission control)
C = 2
T = 3
C = 250
T = 1000
Capability
for time
Confidentiality: Closing Timing-Channels
VMware Research, April'1818 |
High Low
Prevent observation of
execution speed
• Black-box, OS-enforced isolation
• No requirement to trust High code not to leak
• No requirement for modifying High code
• High and Low code untrusted – mandatory confinement
• Should also protect against data-dependent execution time
Time protection,
just like standard
memory protection
Eliminates covert channels
required for
Meltdown/Spectre
exploits
Mitigation: Prevent Sharing of State
VMware Research, April'1819 |
High Low
Cache
Context Switch
Flush
Cannot partition on-core
caches (L1, TLB, branch
predictor, prefetchers)
• virtually-indexed
• OS cannot control access
Cache
High Low
High Low
Cache
Partition thru
page colouring
Colouring User Memory is Easy
VMware Research, April'1820 |
Global Resource Manager
RAM
I+D
GRM
I+D
Resource Manager
RM
I+D
Resource Manager
RM
I+D
Partitions restricted
to coloured
memory
System permanently
coloured
Colouring the Kernel
VMware Research, April'1821 |
Global Resource Manager
RAM
I+D
GRM
I+D
Resource Manager
RM
I+D
Resource Manager
RM
I+D
Each partition has
own kernel image
Kernel
clone!
I+DI+D
Only shared kernel data:
• Scheduler queue array & bitmap
• Pointers to current: thread, kernel,
page table, cap space, FPU state
Formal Verification –
The Killer “App”
Abstract
Model
Integrity
Proof
C Imple-
mentation
Proof
Confidentiality Availability
Binary code
ProofProofProof
Functional
correctness
Isolation properties
Translation
correctness
Exclusions (all in progress):
• Initialisation
• Privileged state & caches
• Multicore
• Temporal isolation
Worst-case
execution time
World’s fastest
microkernel!
Provable Security Enforcement
VMware Research, April'1823 |
What Made Verification Possible?
• Suitable design:
• Microkernel, of course!
• Isolation-oriented resource management helped proving global invariants
• Resource-management model crucial for proving isolation properties
• From-scratch implementation:
• Verifying code not written for verification is infeasible
• Feedback loop between implementers and verifiers is essential
VMware Research, April'1824 |
Why Build Your Own OS?
• Cannot really rethink abstractions on an legacy OS
• From-scratch implementation feasible and necessary for high-
performance microkernels
• Verification of existing code bases infeasible
VMware Research, April'1825 |
https://trustworthy.systems
Thank you!

More Related Content

What's hot

Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...
Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...
Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...IO Visor Project
 
Docker at and with SignalFx
Docker at and with SignalFxDocker at and with SignalFx
Docker at and with SignalFxSignalFx
 
Improving Network Application Performance using Load Aware Libeventdev
Improving Network Application Performance using Load Aware LibeventdevImproving Network Application Performance using Load Aware Libeventdev
Improving Network Application Performance using Load Aware LibeventdevMichelle Holley
 
SGX Trusted Execution Environment
SGX Trusted Execution EnvironmentSGX Trusted Execution Environment
SGX Trusted Execution EnvironmentKernel TLV
 
Overview of OpenDaylight Container Orchestration Engine Integration
Overview of OpenDaylight Container Orchestration Engine IntegrationOverview of OpenDaylight Container Orchestration Engine Integration
Overview of OpenDaylight Container Orchestration Engine IntegrationMichelle Holley
 
HKG18-318 - OpenAMP Workshop
HKG18-318 - OpenAMP WorkshopHKG18-318 - OpenAMP Workshop
HKG18-318 - OpenAMP WorkshopLinaro
 
Extending Sysdig with Chisel
Extending Sysdig with ChiselExtending Sysdig with Chisel
Extending Sysdig with ChiselSysdig
 
OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...
OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...
OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...ScyllaDB
 
"OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P...
"OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P..."OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P...
"OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P...Edge AI and Vision Alliance
 
HKG18-100K1 - George Grey: Opening Keynote
HKG18-100K1 - George Grey: Opening KeynoteHKG18-100K1 - George Grey: Opening Keynote
HKG18-100K1 - George Grey: Opening KeynoteLinaro
 
ICALEPCS 2011: Testing Environments using Virtualization
ICALEPCS 2011: Testing Environments using VirtualizationICALEPCS 2011: Testing Environments using Virtualization
ICALEPCS 2011: Testing Environments using VirtualizationOmer Khalid
 
1 artem mygaiev - testing open-source software in embedded devices
1   artem mygaiev - testing open-source software in embedded devices1   artem mygaiev - testing open-source software in embedded devices
1 artem mygaiev - testing open-source software in embedded devicesIevgenii Katsan
 
Play With Android
Play With AndroidPlay With Android
Play With AndroidChamp Yen
 
Cilium - Bringing the BPF Revolution to Kubernetes Networking and Security
Cilium - Bringing the BPF Revolution to Kubernetes Networking and SecurityCilium - Bringing the BPF Revolution to Kubernetes Networking and Security
Cilium - Bringing the BPF Revolution to Kubernetes Networking and SecurityThomas Graf
 
Sfo17 109 containerized vn fs with data plane acceleration on arm platform
Sfo17 109 containerized vn fs with data plane acceleration on arm platformSfo17 109 containerized vn fs with data plane acceleration on arm platform
Sfo17 109 containerized vn fs with data plane acceleration on arm platformLinaro
 
Kubernetes Meetup - Seattle 2017-06-01
Kubernetes Meetup - Seattle 2017-06-01Kubernetes Meetup - Seattle 2017-06-01
Kubernetes Meetup - Seattle 2017-06-01Bassam Tabbara
 
AWS Loft Talk: Behind the Scenes with SignalFx
AWS Loft Talk: Behind the Scenes with SignalFxAWS Loft Talk: Behind the Scenes with SignalFx
AWS Loft Talk: Behind the Scenes with SignalFxSignalFx
 
Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...
Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...
Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...Cloud Native Day Tel Aviv
 

What's hot (20)

Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...
Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...
Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...
 
Docker at and with SignalFx
Docker at and with SignalFxDocker at and with SignalFx
Docker at and with SignalFx
 
Improving Network Application Performance using Load Aware Libeventdev
Improving Network Application Performance using Load Aware LibeventdevImproving Network Application Performance using Load Aware Libeventdev
Improving Network Application Performance using Load Aware Libeventdev
 
SGX Trusted Execution Environment
SGX Trusted Execution EnvironmentSGX Trusted Execution Environment
SGX Trusted Execution Environment
 
Overview of OpenDaylight Container Orchestration Engine Integration
Overview of OpenDaylight Container Orchestration Engine IntegrationOverview of OpenDaylight Container Orchestration Engine Integration
Overview of OpenDaylight Container Orchestration Engine Integration
 
Contiki Presentation
Contiki PresentationContiki Presentation
Contiki Presentation
 
HKG18-318 - OpenAMP Workshop
HKG18-318 - OpenAMP WorkshopHKG18-318 - OpenAMP Workshop
HKG18-318 - OpenAMP Workshop
 
Extending Sysdig with Chisel
Extending Sysdig with ChiselExtending Sysdig with Chisel
Extending Sysdig with Chisel
 
OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...
OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...
OSv Unikernel — Optimizing Guest OS to Run Stateless and Serverless Apps in t...
 
Fully automated kubernetes deployment and management
Fully automated kubernetes deployment and managementFully automated kubernetes deployment and management
Fully automated kubernetes deployment and management
 
"OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P...
"OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P..."OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P...
"OpenCV on Zynq: Accelerating 4k60 Dense Optical Flow and Stereo Vision," a P...
 
HKG18-100K1 - George Grey: Opening Keynote
HKG18-100K1 - George Grey: Opening KeynoteHKG18-100K1 - George Grey: Opening Keynote
HKG18-100K1 - George Grey: Opening Keynote
 
ICALEPCS 2011: Testing Environments using Virtualization
ICALEPCS 2011: Testing Environments using VirtualizationICALEPCS 2011: Testing Environments using Virtualization
ICALEPCS 2011: Testing Environments using Virtualization
 
1 artem mygaiev - testing open-source software in embedded devices
1   artem mygaiev - testing open-source software in embedded devices1   artem mygaiev - testing open-source software in embedded devices
1 artem mygaiev - testing open-source software in embedded devices
 
Play With Android
Play With AndroidPlay With Android
Play With Android
 
Cilium - Bringing the BPF Revolution to Kubernetes Networking and Security
Cilium - Bringing the BPF Revolution to Kubernetes Networking and SecurityCilium - Bringing the BPF Revolution to Kubernetes Networking and Security
Cilium - Bringing the BPF Revolution to Kubernetes Networking and Security
 
Sfo17 109 containerized vn fs with data plane acceleration on arm platform
Sfo17 109 containerized vn fs with data plane acceleration on arm platformSfo17 109 containerized vn fs with data plane acceleration on arm platform
Sfo17 109 containerized vn fs with data plane acceleration on arm platform
 
Kubernetes Meetup - Seattle 2017-06-01
Kubernetes Meetup - Seattle 2017-06-01Kubernetes Meetup - Seattle 2017-06-01
Kubernetes Meetup - Seattle 2017-06-01
 
AWS Loft Talk: Behind the Scenes with SignalFx
AWS Loft Talk: Behind the Scenes with SignalFxAWS Loft Talk: Behind the Scenes with SignalFx
AWS Loft Talk: Behind the Scenes with SignalFx
 
Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...
Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...
Kafka Mirror Tester: Go and Kubernetes Powered Test Suite for Kafka Replicati...
 

Similar to The Quest for the Perfect API

From L3 to seL4: What have we learnt in 20 years of L4 microkernels
From L3 to seL4: What have we learnt in 20 years of L4 microkernelsFrom L3 to seL4: What have we learnt in 20 years of L4 microkernels
From L3 to seL4: What have we learnt in 20 years of L4 microkernelsmicrokerneldude
 
HiPEAC Computing Systems Week 2022_Mario Porrmann presentation
HiPEAC Computing Systems Week 2022_Mario Porrmann presentationHiPEAC Computing Systems Week 2022_Mario Porrmann presentation
HiPEAC Computing Systems Week 2022_Mario Porrmann presentationVEDLIoT Project
 
Introduction to HPC & Supercomputing in AI
Introduction to HPC & Supercomputing in AIIntroduction to HPC & Supercomputing in AI
Introduction to HPC & Supercomputing in AITyrone Systems
 
Trends in Systems and How to Get Efficient Performance
Trends in Systems and How to Get Efficient PerformanceTrends in Systems and How to Get Efficient Performance
Trends in Systems and How to Get Efficient Performanceinside-BigData.com
 
Is That A Penguin In My Windows?
Is That A Penguin In My Windows?Is That A Penguin In My Windows?
Is That A Penguin In My Windows?zeroSteiner
 
HPC and cloud distributed computing, as a journey
HPC and cloud distributed computing, as a journeyHPC and cloud distributed computing, as a journey
HPC and cloud distributed computing, as a journeyPeter Clapham
 
OCP Telco Engineering Workshop at BCE2017
OCP Telco Engineering Workshop at BCE2017OCP Telco Engineering Workshop at BCE2017
OCP Telco Engineering Workshop at BCE2017Radisys Corporation
 
Monomi: Practical Analytical Query Processing over Encrypted Data
Monomi: Practical Analytical Query Processing over Encrypted DataMonomi: Practical Analytical Query Processing over Encrypted Data
Monomi: Practical Analytical Query Processing over Encrypted DataMostafa Arjmand
 
Webinar: OpenEBS - Still Free and now FASTEST Kubernetes storage
Webinar: OpenEBS - Still Free and now FASTEST Kubernetes storageWebinar: OpenEBS - Still Free and now FASTEST Kubernetes storage
Webinar: OpenEBS - Still Free and now FASTEST Kubernetes storageMayaData Inc
 
OpenPOWER Acceleration of HPCC Systems
OpenPOWER Acceleration of HPCC SystemsOpenPOWER Acceleration of HPCC Systems
OpenPOWER Acceleration of HPCC SystemsHPCC Systems
 
High Performance With Java
High Performance With JavaHigh Performance With Java
High Performance With Javamalduarte
 
iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...
iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...
iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...DataStax Academy
 
Leveraging Cassandra for real-time multi-datacenter public cloud analytics
Leveraging Cassandra for real-time multi-datacenter public cloud analyticsLeveraging Cassandra for real-time multi-datacenter public cloud analytics
Leveraging Cassandra for real-time multi-datacenter public cloud analyticsJulien Anguenot
 
Latest (storage IO) patterns for cloud-native applications
Latest (storage IO) patterns for cloud-native applications Latest (storage IO) patterns for cloud-native applications
Latest (storage IO) patterns for cloud-native applications OpenEBS
 
Kubernetes at NU.nl (Kubernetes meetup 2019-09-05)
Kubernetes at NU.nl   (Kubernetes meetup 2019-09-05)Kubernetes at NU.nl   (Kubernetes meetup 2019-09-05)
Kubernetes at NU.nl (Kubernetes meetup 2019-09-05)Tibo Beijen
 
ODSA Sub-Project Launch
ODSA Sub-Project LaunchODSA Sub-Project Launch
ODSA Sub-Project LaunchODSA Workgroup
 
ODSA Sub-Project Launch
 ODSA Sub-Project Launch ODSA Sub-Project Launch
ODSA Sub-Project LaunchNetronome
 
Energy efficient AI workload partitioning on multi-core systems
Energy efficient AI workload partitioning on multi-core systemsEnergy efficient AI workload partitioning on multi-core systems
Energy efficient AI workload partitioning on multi-core systemsDeepak Shankar
 

Similar to The Quest for the Perfect API (20)

From L3 to seL4: What have we learnt in 20 years of L4 microkernels
From L3 to seL4: What have we learnt in 20 years of L4 microkernelsFrom L3 to seL4: What have we learnt in 20 years of L4 microkernels
From L3 to seL4: What have we learnt in 20 years of L4 microkernels
 
Current Trends in HPC
Current Trends in HPCCurrent Trends in HPC
Current Trends in HPC
 
HiPEAC Computing Systems Week 2022_Mario Porrmann presentation
HiPEAC Computing Systems Week 2022_Mario Porrmann presentationHiPEAC Computing Systems Week 2022_Mario Porrmann presentation
HiPEAC Computing Systems Week 2022_Mario Porrmann presentation
 
Introduction to HPC & Supercomputing in AI
Introduction to HPC & Supercomputing in AIIntroduction to HPC & Supercomputing in AI
Introduction to HPC & Supercomputing in AI
 
Trends in Systems and How to Get Efficient Performance
Trends in Systems and How to Get Efficient PerformanceTrends in Systems and How to Get Efficient Performance
Trends in Systems and How to Get Efficient Performance
 
Is That A Penguin In My Windows?
Is That A Penguin In My Windows?Is That A Penguin In My Windows?
Is That A Penguin In My Windows?
 
HPC and cloud distributed computing, as a journey
HPC and cloud distributed computing, as a journeyHPC and cloud distributed computing, as a journey
HPC and cloud distributed computing, as a journey
 
OCP Telco Engineering Workshop at BCE2017
OCP Telco Engineering Workshop at BCE2017OCP Telco Engineering Workshop at BCE2017
OCP Telco Engineering Workshop at BCE2017
 
Monomi: Practical Analytical Query Processing over Encrypted Data
Monomi: Practical Analytical Query Processing over Encrypted DataMonomi: Practical Analytical Query Processing over Encrypted Data
Monomi: Practical Analytical Query Processing over Encrypted Data
 
Webinar: OpenEBS - Still Free and now FASTEST Kubernetes storage
Webinar: OpenEBS - Still Free and now FASTEST Kubernetes storageWebinar: OpenEBS - Still Free and now FASTEST Kubernetes storage
Webinar: OpenEBS - Still Free and now FASTEST Kubernetes storage
 
OpenPOWER Acceleration of HPCC Systems
OpenPOWER Acceleration of HPCC SystemsOpenPOWER Acceleration of HPCC Systems
OpenPOWER Acceleration of HPCC Systems
 
Processors selection
Processors selectionProcessors selection
Processors selection
 
High Performance With Java
High Performance With JavaHigh Performance With Java
High Performance With Java
 
iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...
iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...
iland Internet Solutions: Leveraging Cassandra for real-time multi-datacenter...
 
Leveraging Cassandra for real-time multi-datacenter public cloud analytics
Leveraging Cassandra for real-time multi-datacenter public cloud analyticsLeveraging Cassandra for real-time multi-datacenter public cloud analytics
Leveraging Cassandra for real-time multi-datacenter public cloud analytics
 
Latest (storage IO) patterns for cloud-native applications
Latest (storage IO) patterns for cloud-native applications Latest (storage IO) patterns for cloud-native applications
Latest (storage IO) patterns for cloud-native applications
 
Kubernetes at NU.nl (Kubernetes meetup 2019-09-05)
Kubernetes at NU.nl   (Kubernetes meetup 2019-09-05)Kubernetes at NU.nl   (Kubernetes meetup 2019-09-05)
Kubernetes at NU.nl (Kubernetes meetup 2019-09-05)
 
ODSA Sub-Project Launch
ODSA Sub-Project LaunchODSA Sub-Project Launch
ODSA Sub-Project Launch
 
ODSA Sub-Project Launch
 ODSA Sub-Project Launch ODSA Sub-Project Launch
ODSA Sub-Project Launch
 
Energy efficient AI workload partitioning on multi-core systems
Energy efficient AI workload partitioning on multi-core systemsEnergy efficient AI workload partitioning on multi-core systems
Energy efficient AI workload partitioning on multi-core systems
 

Recently uploaded

DNA isolation molecular biology practical.pptx
DNA isolation molecular biology practical.pptxDNA isolation molecular biology practical.pptx
DNA isolation molecular biology practical.pptxGiDMOh
 
ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...
ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...
ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...Chayanika Das
 
DETECTION OF MUTATION BY CLB METHOD.pptx
DETECTION OF MUTATION BY CLB METHOD.pptxDETECTION OF MUTATION BY CLB METHOD.pptx
DETECTION OF MUTATION BY CLB METHOD.pptx201bo007
 
Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...
Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...
Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...Chiheb Ben Hammouda
 
EGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer Zahana
EGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer ZahanaEGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer Zahana
EGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer ZahanaDr.Mahmoud Abbas
 
Fungal Sex Hormones SIRENIN ANTHERIDIOL.
Fungal Sex Hormones SIRENIN ANTHERIDIOL.Fungal Sex Hormones SIRENIN ANTHERIDIOL.
Fungal Sex Hormones SIRENIN ANTHERIDIOL.KARTHIK REDDY C A
 
6.1 Pests of Groundnut_Binomics_Identification_Dr.UPR
6.1 Pests of Groundnut_Binomics_Identification_Dr.UPR6.1 Pests of Groundnut_Binomics_Identification_Dr.UPR
6.1 Pests of Groundnut_Binomics_Identification_Dr.UPRPirithiRaju
 
Role of Gibberellins, mode of action and external applications.pptx
Role of Gibberellins, mode of action and external applications.pptxRole of Gibberellins, mode of action and external applications.pptx
Role of Gibberellins, mode of action and external applications.pptxjana861314
 
𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀
𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀
𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀Tokyo Chemicals Industry (TCI)
 
Mycobacterium Mycobacterium tuberculosis
Mycobacterium Mycobacterium tuberculosisMycobacterium Mycobacterium tuberculosis
Mycobacterium Mycobacterium tuberculosisKARTHIK REDDY C A
 
Understanding Nutrition, 16th Edition pdf
Understanding Nutrition, 16th Edition pdfUnderstanding Nutrition, 16th Edition pdf
Understanding Nutrition, 16th Edition pdfHabibouKarbo
 
STELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By Karishma
STELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By KarishmaSTELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By Karishma
STELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By KarishmaAMiracle3
 
Total Legal: A “Joint” Journey into the Chemistry of Cannabinoids
Total Legal: A “Joint” Journey into the Chemistry of CannabinoidsTotal Legal: A “Joint” Journey into the Chemistry of Cannabinoids
Total Legal: A “Joint” Journey into the Chemistry of CannabinoidsMarkus Roggen
 
Presentation about adversarial image attacks
Presentation about adversarial image attacksPresentation about adversarial image attacks
Presentation about adversarial image attacksKoshinKhodiyar
 
DERMATOMYCOSIS Epidermophyton KKR.pptx
DERMATOMYCOSIS Epidermophyton   KKR.pptxDERMATOMYCOSIS Epidermophyton   KKR.pptx
DERMATOMYCOSIS Epidermophyton KKR.pptxKARTHIK REDDY C A
 
Environmental Acoustics- Speech interference level, acoustics calibrator.pptx
Environmental Acoustics- Speech interference level, acoustics calibrator.pptxEnvironmental Acoustics- Speech interference level, acoustics calibrator.pptx
Environmental Acoustics- Speech interference level, acoustics calibrator.pptxpriyankatabhane
 
Interpreting SDSS extragalactic data in the era of JWST
Interpreting SDSS extragalactic data in the era of JWSTInterpreting SDSS extragalactic data in the era of JWST
Interpreting SDSS extragalactic data in the era of JWSTAlexander F. Mayer
 

Recently uploaded (20)

DNA isolation molecular biology practical.pptx
DNA isolation molecular biology practical.pptxDNA isolation molecular biology practical.pptx
DNA isolation molecular biology practical.pptx
 
ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...
ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...
ESSENTIAL FEATURES REQUIRED FOR ESTABLISHING FOUR TYPES OF BIOSAFETY LABORATO...
 
DETECTION OF MUTATION BY CLB METHOD.pptx
DETECTION OF MUTATION BY CLB METHOD.pptxDETECTION OF MUTATION BY CLB METHOD.pptx
DETECTION OF MUTATION BY CLB METHOD.pptx
 
TOPIC OF ELECTROMAGNETISM.PHYSICS NOTES FORM 4
TOPIC OF ELECTROMAGNETISM.PHYSICS NOTES FORM 4TOPIC OF ELECTROMAGNETISM.PHYSICS NOTES FORM 4
TOPIC OF ELECTROMAGNETISM.PHYSICS NOTES FORM 4
 
Bioenergetics and the role of ATP to drive the beats of life.
Bioenergetics and the role of ATP to drive the beats of life.Bioenergetics and the role of ATP to drive the beats of life.
Bioenergetics and the role of ATP to drive the beats of life.
 
Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...
Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...
Efficient Fourier Pricing of Multi-Asset Options: Quasi-Monte Carlo & Domain ...
 
TISSUE TYPING .pptx
TISSUE TYPING                       .pptxTISSUE TYPING                       .pptx
TISSUE TYPING .pptx
 
EGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer Zahana
EGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer ZahanaEGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer Zahana
EGYPTIAN IMPRINT IN SPAIN Lecture by Dr Abeer Zahana
 
Fungal Sex Hormones SIRENIN ANTHERIDIOL.
Fungal Sex Hormones SIRENIN ANTHERIDIOL.Fungal Sex Hormones SIRENIN ANTHERIDIOL.
Fungal Sex Hormones SIRENIN ANTHERIDIOL.
 
6.1 Pests of Groundnut_Binomics_Identification_Dr.UPR
6.1 Pests of Groundnut_Binomics_Identification_Dr.UPR6.1 Pests of Groundnut_Binomics_Identification_Dr.UPR
6.1 Pests of Groundnut_Binomics_Identification_Dr.UPR
 
Role of Gibberellins, mode of action and external applications.pptx
Role of Gibberellins, mode of action and external applications.pptxRole of Gibberellins, mode of action and external applications.pptx
Role of Gibberellins, mode of action and external applications.pptx
 
𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀
𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀
𝗧𝗖𝗢 (𝙩𝙧𝙖𝙣𝙨-𝗰𝘆𝗰𝗹𝗼𝗼𝗰𝘁𝗲𝗻𝗲) 𝗗𝗲𝗿𝗶𝘃𝗮𝘁𝗶𝘃𝗲𝘀: 𝗧𝗵𝗲 𝗙𝗮𝘀𝘁𝗲𝘀𝘁 𝗖𝗹𝗶𝗰𝗸 𝗥𝗲𝗮𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗴𝗲𝗻𝘁𝘀
 
Mycobacterium Mycobacterium tuberculosis
Mycobacterium Mycobacterium tuberculosisMycobacterium Mycobacterium tuberculosis
Mycobacterium Mycobacterium tuberculosis
 
Understanding Nutrition, 16th Edition pdf
Understanding Nutrition, 16th Edition pdfUnderstanding Nutrition, 16th Edition pdf
Understanding Nutrition, 16th Edition pdf
 
STELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By Karishma
STELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By KarishmaSTELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By Karishma
STELLAR SYSTEM IN PTERIDOPHYTE Seminar 2023- By Karishma
 
Total Legal: A “Joint” Journey into the Chemistry of Cannabinoids
Total Legal: A “Joint” Journey into the Chemistry of CannabinoidsTotal Legal: A “Joint” Journey into the Chemistry of Cannabinoids
Total Legal: A “Joint” Journey into the Chemistry of Cannabinoids
 
Presentation about adversarial image attacks
Presentation about adversarial image attacksPresentation about adversarial image attacks
Presentation about adversarial image attacks
 
DERMATOMYCOSIS Epidermophyton KKR.pptx
DERMATOMYCOSIS Epidermophyton   KKR.pptxDERMATOMYCOSIS Epidermophyton   KKR.pptx
DERMATOMYCOSIS Epidermophyton KKR.pptx
 
Environmental Acoustics- Speech interference level, acoustics calibrator.pptx
Environmental Acoustics- Speech interference level, acoustics calibrator.pptxEnvironmental Acoustics- Speech interference level, acoustics calibrator.pptx
Environmental Acoustics- Speech interference level, acoustics calibrator.pptx
 
Interpreting SDSS extragalactic data in the era of JWST
Interpreting SDSS extragalactic data in the era of JWSTInterpreting SDSS extragalactic data in the era of JWST
Interpreting SDSS extragalactic data in the era of JWST
 

The Quest for the Perfect API

  • 1. https://trustworthy.systems The Quest for the Perfect API Gernot Heiser | gernot.heiser@data61.csiro.au | @GernotHeiser Trustworthy Systems | Data61
  • 2. Observation: Operating Systems Suck VMware Research, April'182 |
  • 4. Mungi: Single-Address-Space OS De-couple translation from protection VMware Research, April'184 |
  • 5. Mungi Retrospective Mungi was a roaring success – not • never found a convincing killer app • workarounds for 32-bit limitations (Unix model) too accepted • it was naïve to think we could change mainstream computing • 64-bit address space already too small for all data Lesson: If you want to change the world, pick the right world to change Long-term benefits of Mungi • built a systems group • got us into L4 VMware Research, April'185 |
  • 7. L4 Microkernel VMware Research, April'187 | A concept is tolerated inside the microkernel only if moving it outside the kernel, i.e. permitting competing implementations, would prevent the implementation of the system’s required functionality. [Liedtke, SOSP’95]
  • 8. 25 Years of L4 Microkernel R&D VMware Research, April'188 | L3→L4 “X” Hazelnut Pistachio L4/Alpha L4/MIPS OKL4-µKernel OKL4-Microvisor Codezero P4 → PikeOS Fiasco Fiasco.OC L4-embed. Nova GMD/IBM/Karlsruhe UNSW/NICTA/Data61 Dresden Other (commercial) OK Labs API Inheritance Code Inheritance 93 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 Qualcomm modem chips iOS secure enclave
  • 9. L4 IPC Performance Over the Years VMware Research, April'189 | Name Year Processor MHz Cycles µs Original 1993 i486 50 250 5.00 Original 1997 Pentium 160 121 0.75 L4/MIPS 1997 R4700 100 86 0.86 L4/Alpha 1997 21064 433 45 0.10 Hazelnut 2002 Pentium 4 1,400 2,000 1.38 Pistachio 2005 Itanium 1,500 36 0.02 OKL4 2007 XScale 255 400 151 0.64 NOVA 2010 i7 Bloomfield (32-bit) 2,660 288 0.11 seL4 2013 ARM11 532 188 0.35 seL4 2018 i7 Haswell (64-bit) 3,400 442 0.13 seL4 2018 Cortex A9 1,000 303 0.30
  • 10. Minimality: Source-Code Size VMware Research, April'1810 | Name Architecture C/C++ asm total kSLOC Original i486 0 6.4 6.4 L4/Alpha Alpha 0 14.2 14.2 L4/MIPS MIPS64 6.0 4.5 10.5 Hazelnut x86 10.0 0.8 10.8 Pistachio x86 22.4 1.4 23.0 L4-embedded ARMv5 7.6 1.4 9.0 OKL4 3.0 ARMv6 15.0 0.0 15.0 Fiasco.OC x86 36.2 1.1 37.6 seL4 ARMv6 9.7 0.5 10.2
  • 11. Original L4: Design & Implementation Implementation Tricks [SOSP’93] • Process kernel • Virtual TCB array • Lazy scheduling • Direct process switch • Non-preemptible • Non-portable • Non-standard calling convention • Assembler • Design Decisions [SOSP’95] • Synchronous IPC • Rich message structure, arbitrary out- of-line messages • Zero-copy register messages • User-mode page-fault handlers • Threads as IPC destinations • IPC timeouts • Hierarchical IPC control • User-mode device drivers • Process hierarchy • Recursive address-space construction VMware Research, April'1811 | Objective: Minimise cache footprint and TLB misses
  • 13. Memory Management VMware Research, April'1813 | Global Resource Manager RAM I+D GRM I+D Resource Manager RM I+D Resource Manager RM I+D Addr Space AS Addr Space Addr Space RM RM I+DResources fully delegated, allows autonomous operation enabled by capabilities Strong isolation, No shared kernel resources Design for isolation: No memory allocation by kernel
  • 14. Isolation Goes Deep VMware Research, April'18 High Low TCBs Caps PTs TCBs Caps PTs Kernel data partitioned like user data 14 |
  • 15. How About Temporal Isolation? Safety: Timeliness • Execution interference Security: Confidentiality • Leakage via timing channels High Low Observe execution speed: Confidentiality violation Affect execution speed: Integrity violation VMware Research, April'1815 |
  • 16. Integrity Challenge: Mixed Criticality Runs every 100 ms for few millisecods Runs frequently but for short time (order of µs) Control loopSensor readings NW driver NW interrupts NW driver must preempt control loop • … to avoid packet loss • Driver must run at high prio • Driver must be trusted not to monopolise CPU VMware Research, April'1816 |
  • 17. Scheduling Contexts: Caps for Time Classical thread attributes • Priority • Time slice New thread attributes • Priority • Scheduling context capability VMware Research, April'1817 | Not runnable if null Not runnable if null Scheduling context object • T: period • C: budget (≤ T) Limits CPU access! SchedControl capability conveys right to assign budgets (i.e. perform admission control) C = 2 T = 3 C = 250 T = 1000 Capability for time
  • 18. Confidentiality: Closing Timing-Channels VMware Research, April'1818 | High Low Prevent observation of execution speed • Black-box, OS-enforced isolation • No requirement to trust High code not to leak • No requirement for modifying High code • High and Low code untrusted – mandatory confinement • Should also protect against data-dependent execution time Time protection, just like standard memory protection Eliminates covert channels required for Meltdown/Spectre exploits
  • 19. Mitigation: Prevent Sharing of State VMware Research, April'1819 | High Low Cache Context Switch Flush Cannot partition on-core caches (L1, TLB, branch predictor, prefetchers) • virtually-indexed • OS cannot control access Cache High Low High Low Cache Partition thru page colouring
  • 20. Colouring User Memory is Easy VMware Research, April'1820 | Global Resource Manager RAM I+D GRM I+D Resource Manager RM I+D Resource Manager RM I+D Partitions restricted to coloured memory System permanently coloured
  • 21. Colouring the Kernel VMware Research, April'1821 | Global Resource Manager RAM I+D GRM I+D Resource Manager RM I+D Resource Manager RM I+D Each partition has own kernel image Kernel clone! I+DI+D Only shared kernel data: • Scheduler queue array & bitmap • Pointers to current: thread, kernel, page table, cap space, FPU state
  • 22. Formal Verification – The Killer “App”
  • 23. Abstract Model Integrity Proof C Imple- mentation Proof Confidentiality Availability Binary code ProofProofProof Functional correctness Isolation properties Translation correctness Exclusions (all in progress): • Initialisation • Privileged state & caches • Multicore • Temporal isolation Worst-case execution time World’s fastest microkernel! Provable Security Enforcement VMware Research, April'1823 |
  • 24. What Made Verification Possible? • Suitable design: • Microkernel, of course! • Isolation-oriented resource management helped proving global invariants • Resource-management model crucial for proving isolation properties • From-scratch implementation: • Verifying code not written for verification is infeasible • Feedback loop between implementers and verifiers is essential VMware Research, April'1824 |
  • 25. Why Build Your Own OS? • Cannot really rethink abstractions on an legacy OS • From-scratch implementation feasible and necessary for high- performance microkernels • Verification of existing code bases infeasible VMware Research, April'1825 |