RapiLog: Reducing System Complexity Through Verification

Transcription

1 : Reducing System Complexity Through Verification Gernot Heiser, Etienne Le Sueur, Adrian Danis, Aleksander Budzynowski, Tudor-Ioan Salomie, Gustavo Alonso 1

2 Database Transactions Transactions implement database ACID properties Usually implemented by write-ahead logging: App db.write (recno, &dat) DBMS log.append (&db[recno]); db[recno] = *dat; Log must be recoverable in case of fault! Storage Device 213 Gernot Heiser, NICTA 2

3 DBMS Threat Model App Crash Abort & Restart Transaction DBMS Crash Crash Recover from Log OS Fault RAID! Hardware 213 Gernot Heiser, NICTA 3

4 Log Data Must Be Recoverable! App db.write (recno, &dat) DBMS log.append (&db[recno]); db[recno] = *dat; Sync() Storage Device Transaction processing limited by I/O speed, not CPU speed! 213 Gernot Heiser, NICTA 4

5 Database Systems Write cache + asynchronous logging 1 8% throughput increase! Disk write cache enabled Normal DB operation Load (#clients) 213 Gernot Heiser, NICTA

6 What If We Could Trust the OS? App db.write (recno, &dat) Write() DBMS Copy(); OS Buffer Asynchronous write! Hardware 213 Gernot Heiser, NICTA 6

7 : Leveraging Robust OS Kernel (sel4) Simplify DBMS Avoid sync logging Other OS Services DBMS Reliable Storage Service sel4 Problem: Need to re-engineer DBMS Data Log 213 Gernot Heiser, NICTA 7 7

8 Virtualization to the Rescue Unmodified DBMS and OS DBMS OS Virtual Driver Reliable Virtual Disk Virtualization support sel4 Data Log 213 Gernot Heiser, NICTA 8 8

9 Virtual Disk Architecture Virtual Disk Mapped Guest Phys. Memory Multiple buffers for maximising sequential writes Buffer DMA Asynchronous Synchronous memcpy() sel4 Disk Driver Simple, synthesized 213 Gernot Heiser, NICTA 9 9 IRQ Log

10 What if Power is Cut? Rely on UPS or: Computer power supplies have capacitances storing energy 2 ms window for saving data Signal power failure to system power-down interrupt from power supply simple hardware costing a few On power emergency: 1. signal virtual disk to flush buffers 2. suspend all other activities 213 Gernot Heiser, NICTA 1 1

11 Implementation Complexity and Robustness Component LoC Critical? Assurance Virtual disk driver 24 no not needed Virtualization support 68 no not needed Virtual disk 1174 yes small, simple Real disk driver 44 yes small, synthesised sel4 microkernel 1k yes formally verified Verification possible x86-specific code not yet verified 213 Gernot Heiser, NICTA 11 11

12 Performance: Evaluation Scenarios DBMS Linux DBMS Linux DBMS Linux Virt. Driv Virt. Disk Data Log Virt. Supp sel4 Virt. Supp sel4 PostgresSQL open source MySQL open source Data Log DBMS X commercial Data Log Benchmark load: TPC-C 1 warehouses measure successful NewOrder transactions 213 Gernot Heiser, NICTA 12 12

13 Performance PostgreSQL 2 1 Data disk Volatile bottleneck results Throughput degradation 213 Gernot Heiser, NICTA 13 13

14 Performance PostgreSQL Gernot Heiser, NICTA Avg. response time/tx (msec) 1 Load (#clients)

15 Performance PostgreSQL Avg. response time/tx (msec) Load (#clients) throughput 8% average doubled throughput increase 2 1 Log disk bottleneck MySQL 213 Gernot Heiser, NICTA

16 Performance PostgreSQL MySQL DBMS X Avg. response time/tx (msec) 2 1 Load (#clients) 2 1 max 63%, average 2% throughput increase 213 Gernot Heiser, NICTA 16 16

17 Performance PostgreSQL MySQL DBMS X Avg. response time/tx (msec) 2 1 Load (#clients) 2 1 vs Unsafe - MySQL Unsafe: WC Unsafe: Async WC+Async 213 Gernot Heiser, NICTA Load (#clients)

18 Performance PostgreSQL MySQL DBMS X Avg. response time/tx (msec) 2 1 Load (#clients) 213 Gernot Heiser, NICTA vs Unsafe - MySQL Unsafe: WC Unsafe: Async WC+Async Load (#clients) 18 1 Log on SSD - DBMS X

19 Sensitivity to Buffer Size 2 1 PostgreSQL Buffer Size (KiB) MySQL Buffer Size (KiB) DBMS X # buffers: Buffer Size (KiB) Standard benchmark configuration 213 Gernot Heiser, NICTA 19 19

20 Protection Against Power Outages Mains Input To Computer A E N 24V Relay Coil Serial Port RTS 7 4 DTR DSR Gernot Heiser, NICTA 2 2

21 Power-Cut Robustness Approach Create fresh database Run DBMS insert-only load Cut power virtual disk logs to console Recover and check database Repeat 4 times Findings Never a corrupted database with! once debugged Never have to flush more than 3 buffers of 6 buffers available Never takes more than 2 ms to flush window is ms 213 Gernot Heiser, NICTA 21 21

22 Summary leverages robustness resulting from verification to: Provide logically synchronous, physically asynchronous I/O combines benefits of both: performance and durability Support legacy systems without modifying DBMS or OS Create opportunity to modularise durability support in DBMS without performance degradation Limitations of present prototype: Verification of durability-critical components incomplete x86-specific parts of sel4 device driver: work in progress virtual disk: feasible but working on less costly approaches Presently no protection against fail-stop hardware faults should be possible to reboot while preserving user memory state standard server BIOS insists on memory check 213 Gernot Heiser, NICTA 22 22