{"title":"Hardening an L4 microkernel against soft errors by aspect-oriented programming and whole-program analysis","authors":"C. Borchert, O. Spinczyk","doi":"10.1145/2818302.2818304","DOIUrl":"https://doi.org/10.1145/2818302.2818304","url":null,"abstract":"Transient hardware faults in computer systems have become widespread as shrinking structures and low supply voltages reduce the amount of energy needed to trigger a fault. This paper describes the latest improvements of a software-based fault-tolerance mechanism called Generic Object Protection (GOP). It is based on Aspect-Orientied Programming in AspectC++ and has been used in a case study to harden the L4/Fiasco.OC microkernel. As a result, the improved GOP avoids 60% of kernel failures at an acceptable overhead of 19% code size and less than 1% runtime. The GOP improvements use static whole-program analysis and have been implemented in a prototypical manner. As an outlook, the paper presents envisioned language extensions providing whole-program control-flow and data-flow analyses in future AspectC++ versions.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121957267","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Xinhao Yuan, David Williams-King, Junfeng Yang, S. Sethumadhavan
{"title":"Making lock-free data structures verifiable with artificial transactions","authors":"Xinhao Yuan, David Williams-King, Junfeng Yang, S. Sethumadhavan","doi":"10.1145/2818302.2818309","DOIUrl":"https://doi.org/10.1145/2818302.2818309","url":null,"abstract":"Among all classes of parallel programming abstractions, lock-free data structures are considered one of the most scalable and efficient thanks to their fine-grained style of synchronization. However, they are also challenging for developers and tools to verify because of the huge number of possible interleavings that result from fine-grained synchronizations. This paper addresses this fundamental problem between performance and verifiability of lock-free data structure implementations. We present Txit, a system that greatly reduces the set of possible interleavings by inserting transactions into the implementation of a lock-free data structure. We leverage hardware transactional memory support from Intel Haswell processors to enforce these artificial transactions. Evaluation on six popular lock-free data structure libraries shows that Txit makes it easy to verify lock-free data structures while incurring acceptable runtime overhead. Further analysis shows that two inefficiencies in Haswell are the largest contributors to this overhead.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115429406","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Running application specific kernel code by a just-in-time compiler","authors":"Ake Koomsin, Yasushi Shinjo","doi":"10.1145/2818302.2818305","DOIUrl":"https://doi.org/10.1145/2818302.2818305","url":null,"abstract":"Kernel scripting is a technique to run an extension code in a script language in an operating system kernel. Conventional kernel scripting has two limitations. First, it affects an entire system and only privileged users are allowed to install a new script. This prohibits developers from running their own application-specific code in the kernel. Second, its performance is not sufficient for some time-sensitive applications. In this paper, we address these problems. Our system call scripting allows developers to run their own application-specific code in the kernel without the root privilege. Our system call scripting runs with less overhead because we use a Just-In-Time (JIT) compiler. To evaluate our idea, we ported the LuaJIT compiler into the FreeBSD 10.1 x86 kernel. We modified Memcached to use system call scripting that processes multiple UDP GET requests at a time. With one worker thread and under a high-load condition, we achieved a 33% reduction in the average response time and a 44% improvement in the throughput when the response value size was small.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"10 4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123298502","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","authors":"Shan Lu","doi":"10.1145/2818302","DOIUrl":"https://doi.org/10.1145/2818302","url":null,"abstract":"This year's program committee has put together a program of 7 refereed papers. These papers cover topics on programming language support for building kernels, kernel extensions, embedded systems, parallel data structures, big-data processing systems, and others.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131292149","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Charles Jacobsen, Muktesh Khole, Sarah Spall, Scotty Bauer, A. Burtsev
{"title":"Lightweight capability domains: towards decomposing the Linux kernel","authors":"Charles Jacobsen, Muktesh Khole, Sarah Spall, Scotty Bauer, A. Burtsev","doi":"10.1145/2818302.2818307","DOIUrl":"https://doi.org/10.1145/2818302.2818307","url":null,"abstract":"Despite a number of radical changes in how computer systems are used, the design principles behind the very core of the systems stack---an operating system kernel---has remained unchanged for decades. We run monolithic kernels developed with a combination of an unsafe programming language, global sharing of data structures, opaque interfaces, and no explicit knowledge of kernel protocols. Today, the monolithic architecture of a kernel is the main factor undermining its security, and even worse, limiting its evolution towards a safer, more secure environment. Lack of isolation across kernel subsystems allows attackers to take control over the entire machine with a single kernel vulnerability. Furthermore, complex, semantically rich monolithic code with globally shared data structures and no explicit interfaces is not amenable to formal analysis and verification tools. Even after decades of work to make monolithic kernels more secure, over a hundred serious kernel vulnerabilities are still reported every year. Modern kernels need decomposition as a practical means of confining the effects of individual attacks. Historically, decomposed kernels were prohibitively slow. Today, the complexity of a modern kernel prevents a trivial decomposition effort. We argue, however, that despite all odds modern kernels can be decomposed. Careful choice of communication abstractions and execution model, a general approach to decomposition, a path for incremental adoption, and automation through proper language tools can address complexity of decomposition and performance overheads of decomposed kernels. Our work on lightweight capability domains (LCDs) develops principles, mechanisms, and tools that enable incremental, practical decomposition of a modern operating system kernel.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"209 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116004465","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Tapir: a language for verified OS kernel probes","authors":"Ilya Yanok, Nathaniel Nystrom","doi":"10.1145/2818302.2818303","DOIUrl":"https://doi.org/10.1145/2818302.2818303","url":null,"abstract":"Kernel probes allow code to be inserted into a running operating system kernel to gather information for debugging or profiling. Inserting code into the kernel raises a number of safety issues. Current solutions follow one of the two paths: a VM-based approach, where safety properties are checked dynamically by an interpreter, or a static-analysis approach, where probe code is guaranteed to be safe statically. While more attractive, existing static solutions depend on ad-hoc and error-prone analysis. We propose to explore enforcing safety properties using a type system, thus building our analysis on top of the well-studied ground of type theory.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"140 3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116591565","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Speculative region-based memory management for big data systems","authors":"Khanh Nguyen, Lu Fang, G. Xu, Brian Demsky","doi":"10.1145/2818302.2818308","DOIUrl":"https://doi.org/10.1145/2818302.2818308","url":null,"abstract":"Most real-world Big Data systems are written in managed languages. These systems suffer from severe memory problems due to the massive volumes of objects created to process input data. Allocating and deallocating a sea of objects puts a severe strain on the garbage collector, leading to excessive GC efforts and/or out-of-memory crashes. Region-based memory management has been recently shown to be effective to reduce GC costs for Big Data systems. However, all existing region-based techniques require significant user annotations, resulting in limited usefulness and practicality. This paper reports an ongoing project, aiming to design and implement a novel speculative region-based technique that requires only minimum user involvement. In our system, objects are allocated speculatively into their respective regions and promoted into the heap if needed. We develop an object promotion algorithm that scans regions for only a small number of times, which will hopefully lead to significantly improved memory management efficiency. We also present an OpenJDK-based implementation plan and an evaluation plan.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130951774","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A. Levy, Michael P. Andersen, Bradford Campbell, D. Culler, P. Dutta, Branden Ghena, P. Levis, P. Pannuto
{"title":"Ownership is theft: experiences building an embedded OS in rust","authors":"A. Levy, Michael P. Andersen, Bradford Campbell, D. Culler, P. Dutta, Branden Ghena, P. Levis, P. Pannuto","doi":"10.1145/2818302.2818306","DOIUrl":"https://doi.org/10.1145/2818302.2818306","url":null,"abstract":"Rust, a new systems programming language, provides compile-time memory safety checks to help eliminate runtime bugs that manifest from improper memory management. This feature is advantageous for operating system development, and especially for embedded OS development, where recovery and debugging are particularly challenging. However, embedded platforms are highly event-based, and Rust's memory safety mechanisms largely presume threads. In our experience developing an operating system for embedded systems in Rust, we have found that Rust's ownership model prevents otherwise safe resource sharing common in the embedded domain, conflicts with the reality of hardware resources, and hinders using closures for programming asynchronously. We describe these experiences and how they relate to memory safety as well as illustrate our workarounds that preserve the safety guarantees to the largest extent possible. In addition, we draw from our experience to propose a new language extension to Rust that would enable it to provide better memory safety tools for event-driven platforms.","PeriodicalId":170899,"journal":{"name":"Proceedings of the 8th Workshop on Programming Languages and Operating Systems","volume":"270 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114565842","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}