Downloaded 38 times
![Budget Expiry Options
• Multi-threaded servers (COMPOSITE [Parmer ‘10])
• Model allows this
• Forcing all servers to be thread-safe is policy !
• Bandwidth inheritance with “helping” (Fiasco [Steinberg ‘10])
• Ugly dependency chains !
• Wrong thread charged for recovery cost !
• Use timeout exceptions to trigger one of several possible actions:
• Provide emergency budget
• Cancel operation & roll-back server
• Change criticality
• Implement priority inheritance (if you must…)
Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 29 |
Mechanism for
implementing other
models, e.g. earliest-
deadline first (EDF)](https://image.slidesharecdn.com/1801-lca-180330012223/75/Flying-Autonomous-Aircraft-Mixed-Criticality-Support-in-seL4-29-2048.jpg)
Flying Autonomous Aircraft: Mixed-Criticality Support in seL4
- 1.
- 2. Why Should You Listen To This? In this talk I’ll explain: • what mixed-criticality system (MCS) are, and why are they important • what their certification needs are • what MCS need from the OS: spatial and temporal isolation • how we support MCS in seL4, the world’s most secure OS • what we are using it for Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 2 |
- 3. Cyberphysical Systems Software Challenge Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 3 | • Growing functionality • Much safety-critical functionality • Expensive safety assurance processes • Cost at least linear in LoC 8 MSLOC 120 MSLOC
- 4.
- 5. Example: Microcontroller in a Car Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 5 | Electronic control unit (ECU) must • be water proof • be dust proof • be grease proof • be acid proof • be highly vibration resistant • operate -30°C to 80°C
- 6.
- 7. Processor Consolidation Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 7 | • Reduces SWaP reduced cost • Improves integration richer functionality • Essential for autonomous vehicles Challenge: • Loss of physical isolation huge assurance problem
- 8. Safety-Critical System Assurance • Every part of a safety-critical system must be certified • Certification asserts that certifier is convinced system will behave safely • Assurance process exists to convince certifier • extensive specs, development documentation • extensive testing & its documentation • extensive code inspection • tracing of requirements to code • convincing argument that no out-of-spec behaviour exists • At highest safety levels, cost is prohibitive for code bases exceeding a few kLOC Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 8 |
- 9.
- 10.
- 11.
- 12. Mixed-Criticality System (MCS) • Multiple components with different criticalities on same system • Idea: Can be cost-effective, if certify most critical stuff in isolation • Requirement: Nothing must depend on anything less critical! Operating System Sensor driver Actuator driver Control Sensor driver Actuator driver Control Sensor driver Actuator driver Control
- 13. MCS: Microkernel Considered Essential • Multiple components with different criticalities on same system • Idea: Can be cost-effective, if certify most critical stuff in isolation • Requirement: Nothing must depend on anything less critical! High-Assurance Microkernel Operating System Sensor driver Actuator driver Control Sensor driver Actuator driver Control Sensor driver Actuator driver Control
- 14.
- 15.
- 16. Capability-Protected Objects • Thread-control blocks (TCBs) • Address spaces (page table objects: PDs, PTs) • Endpoints (IPC) • Notifications (binary semaphores) • Capability spaces (CNodes) • Frames • Interrupt objects (architecture specific) • Untyped (free) memory, re-typeable Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 16 | Capabilities provide: • Fine-grained access control • Reasoning about information flow
- 17.
- 18.
- 19.
- 20. • 256 hard priorities (0–255) • Priorities are strictly observed, suitable for real time • The scheduler will always pick the highest-prio runnable thread • Round-robin scheduling within prio level • Thread scheduling parameters: • Priority • Time slice Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 Classical L4 Scheduling Present (Verified) seL4 Master Branch 20 | prio0 255 Issue: • Highest-prio can monopolise CPU • Priority = “importance”
- 21.
- 22.
- 23. Shared Intra-Core Servers Implement Priority Ceiling Protocol (IPCP) Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 23 | IPCP: PS = max (P1, P2) + 1 Immediate Priority Ceiling: • Requires correct priority configuration • Deadlock-free • Easy to implement • Good worst-case blocking times Client1 P1 Server PS Client2 P2
- 24.
- 25. Requirements for MCS • Certifiable spatial isolation • Certifiable temporal isolation: • Ability to guarantee deadlines without trusting low-criticality, high-priority processes • Ability to share resources (servers) safely, even across criticalities • Ability to re-use all slack for low-criticality processes • Desirable for seL4: capabilities for time control Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 25 |
- 26. Scheduling Contexts: Caps for Time Classical thread attributes • Priority • Time slice New thread attributes • Priority • Scheduling context capability Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 26 | Not runnable if null Not runnable if null Scheduling context object • T: period • C: budget (≤ T) Limits CPU access! SchedControl capability conveys right to assign budgets (i.e. perform admission control) C = 2 T = 3 C = 250 T = 1000 Capability for time
- 27. Scheduling Guarantees • Kernel will run highest-priority runnable thread with non-zero budget • Thread with no budget cannot run until next period • Within priority, threads are scheduled round-robin Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 27 | Criticality Period Budget Utilisation Priority Deadlines Medium 10 1 10% high budget enfored High 100 50 50% medium DL guaranteed Low 1000 N/A 100% low no guarantee
- 28.
- 29. Budget Expiry Options • Multi-threaded servers (COMPOSITE [Parmer ‘10]) • Model allows this • Forcing all servers to be thread-safe is policy ! • Bandwidth inheritance with “helping” (Fiasco [Steinberg ‘10]) • Ugly dependency chains ! • Wrong thread charged for recovery cost ! • Use timeout exceptions to trigger one of several possible actions: • Provide emergency budget • Cancel operation & roll-back server • Change criticality • Implement priority inheritance (if you must…) Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 29 | Mechanism for implementing other models, e.g. earliest- deadline first (EDF)
- 30. Cost of Isolation Operation Mainline MCS Overhead IPC Call (client) 307 307 0% IPC ReplyRecv (server) 320 333 4% IRQ latency 1597 1776 11% Signal semaphore 138 144 4% schedule 878 1048 19% Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 30 | Microbenchmark latencies in cycles on 1 GHZ ARM A9
- 31. Isolation in Action • High-prio CPU hog, budget limited, 10ms period • Lower-prio UDP echo server, 10ms period Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 31 | 0 5 10 15 20 25 30 35 12 3 4 5 6 7 8 9 10 0 20 40 60 80 100 Latency(ms) CPUutilisation(%) Budget (ms) Max Mean Budget CPU %
- 32. Implementing EDF at User Level Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 32 | • EDF scheduling implemented in user-level on seL4 • Compared against kernel-level EDF scheduler in LITMUSRT (Linux testbed) 0 0.5 1 1.5 2 2.5 3 12 3 4 5 6 7 8 9 10 Time(µs) Number of threads seL4 user-level LITMUS kernel
- 33.
- 34. Example: SMACCMcopter HACMS Research UAV Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 34 | Flight Control Board HW Sensors ARM M3 Radio Motors SW Control Monitor Mission Plan Sensor Filtering eChronos RTOS CAN CAN Bus trusted untrusted Mission Board HW C&C RadioCameraARM A15 SW Image Processing Command & Control Linux VMCAN USB
- 35.
- 36. New Mixed-Criticality Kernel • Meets requirements of MCS • Performance very close to old (non-isolation) kernel • Certifiable, presently undergoing formal verification • Capabilities for reasoning about time • Flexible model, fixed-prio based but supports user-level EDF implementation • Usable for real-world systems Flying autonomous aircraft: Mixed-criticality support in seL4 | LCA'18 36 |
- 37.
- 38.