Abolish Runtime Systems!

Transcription

1 Abolish Runtie Systes! Operating Systes Should Control the Execution Environent Jaes Larus Microsoft Research Second International Conference on Virtual Execution Environents June 14, 2006

2 If you coe to a fork in the road, take it. Yogi Berra Jaes Larus Abolish Runtie Systes

3 Crossroad for Languages Jaes Larus Abolish Runtie Systes

4 Abstraction Jaes Larus Abolish Runtie Systes

5 Why Did it Turn Out this Way? Abstraction is good sipler to build runtie on OS than bare hardware ore work to ipleent OS + runtie Liited eory and processor cycles liit language abitions Good OS perforance difficult on liited hardware Expertise and goals languages/systes researchers Copatibility/interoperability existing software and languages Portable platfor was an unfilled niche any processors, any O S es Jaes Larus Abolish Runtie Systes

6 Not the Right Path Language/runtie iproveents do not benefit OS or syste software Duplicate functionality runtie reipleents OS features Elaborate runties increase cost of language safety decrease attractiveness of better languages Foreclose innovation in syste architecture cannot trust software properties rely on hardware for isolation and protection Jaes Larus Abolish Runtie Systes

7 Singularity Project Microsoft Research project Galen Hunt & Ji Larus & any others basis for building ore dependable software attack dependable fro ultiple perspectives New OS, languages, and tools working research prototype not Windows or CLR replaceent no copatibility No single agic bullet utually reinforcing iproveents to languages and copilers, systes, and tools Jaes Larus Abolish Runtie Systes

8 Key Directions 1. Use safe prograing languages everywhere safe = type safe and eory safe (like C# or Java) applications, extensions, OS services, device drivers, kernel 2. Iprove syste resilience despite software errors failure containent boundaries between coponents and extensions explicit failure notification odel 3. Architecture supports verification specify and check behavior at any levels of abstraction core OS architecture facilitates static verification Jaes Larus Abolish Runtie Systes

9 processes Singularity OS content extension ext. class library runtie web server server class library runtie channels TCP/IP stack tcp class library runtie network driver driver class library runtie Safe icro-kernel 95% written in C# 17% of files contain unsafe C# 5% of files contain x86 as or C++ kernel sealed at boot tie services & device drivers in processes Software isolated processes (SIPs) all user code is verified safe soe unsafe code in trusted runtie processes sealed at start tie kernel API kernel page gr scheduler chan gr proc gr i/o gr kernel class library runtie Safe and efficient counication via strong interfaces (channels) channel behavior is specified, checked. checked behavior allows us to ake counication efficient Type safety is key to verification and protection HAL Jaes Larus Abolish Runtie Systes

10 Written in extended C# Challenge 1: Pervasive Safe Languages actually Spec# (C# + pre/post-conditions and invariants) Added features for systes prograing increase prograer control over allocation, initialization, and eory layout Explore language design to support prograing and verification essage passing factoring libraries into coposable pieces copile-tie reflection Jaes Larus Abolish Runtie Systes

11 What About The Runtie? JVM & CLR s design not always appropriate rich runti e ( one size fits all ) onolithic, general-purpose environent large eory footprints (~4 MB process for CLR) any dependencies (CLR PAL requires >300 Win32 APIs) JIT copilation increases runtie size and coplexity unpredictable perforance replicate OS functionality security, threading, configuration, etc. ore is less Jaes Larus Abolish Runtie Systes

12 Singularity Runtie Libraries Singularity Process Application Whole Bartok Progra Optiization Copiler x86 Executable Singularity Runtie (GC, etc.) TAL Proof Jaes Larus Abolish Runtie Systes

13 Sall, Custoizable Runtie Sall execution environent ahead-of-tie, global optiizing copiler (MSR Bartok) specializes runtie and libraries eliinate code for unused/disabled language features and unused application/library code factorable runtie and libraries Runtie, garbage collector, and libraries selectable on per-process basis reduce eory and coputation overhead enforce design discipline and syste policies per process Eliinate OS functionality fro runtie security, resource allocation, etc. Provide OS echanis for enforcing syste policy runtie can constrain behavior (e.g. driver environent) Jaes Larus Abolish Runtie Systes

14 Challenge 2: Iprove Resilience Software errors should not cause syste failure A resilient syste architecture should isolate syste coponents to prevent data corruption provide clear failure notification ipleent policy for restarting failed coponent Jaes Larus Abolish Runtie Systes

15 Process Architectures Process App OS OS Kernel Jaes Larus Abolish Runtie Systes

16 Open Process Architecture Open processes dynaic code loading and runtie code generation DLLs, Java class loading, browser plug-ins, device drivers in kernel, etc. cross-process eory sharing syste API allows one process to alter state of another Near ubiquitous (Windows, Unix, etc.) originated in Multics Shared state reduces dependability 85% of Windows crashes are caused by third party code in kernel interfaces between extension and host are often poorly docuented and understood no isolation boundary between code and extension extension can access non-public interfaces (reflection) Jaes Larus Abolish Runtie Systes

17 Single Process Architecture All code and data in single address space rely on language and eory safety to isolate coponents dynaic code loading and runtie code generation easy data sharing Xerox PARC (Cedar, Salltalk, etc.) and Lisp Machine odel Java and.net odel as well Runtie is single point of failure shared runti e ust also eet allapplications require ents Java isolates and CLR AppDoains have coplex, shared runtie Rely on garbage collection to reclai resources finalizers Difficult to constraint interactions Jaes Larus Abolish Runtie Systes

18 Isolates and AppDoains are Still Interdependent App App App Runtie Singularity Singularity Overview

19 Singularity Sealed Processes Process OS Kernel Singularity processes are sealed no dynaic code loading or runtie code generation all code present when process starts execution extensions execute in separate processes separate closed environents with well-defined interfaces no shared eory Process is fundaental unit of failure isolation Better: optiization, verification, security, failure handling Jaes Larus Abolish Runtie Systes

20 Size Benefits of Sealed Processes Progra Code Whole Reduces process code size by up to 75%. Code w/ Tree Shake Fewer code paths => better optiization & error analysis % Reduction Kernel 2.37 MB 1.29 MB 46% IDE Disk Driver 1.85 MB 455 KB 75% Web Server 2.73 MB 765 KB 72% Content Extension 2.14 MB 502 KB 77% Jaes Larus Abolish Runtie Systes

21 Need for Lightweight Processes Existing processes rely on expensive hardware virtual eory and protection echaniss VM prevents reference to other processes pages protection prevents unprivileged code fro access syste resources (e.g. VM page tables) Processes are expensive to create and schedule encourages onolithic progra developent large, undifferentiated applications dynaic code loading threading to allow independent control flow Jaes Larus Abolish Runtie Systes

22 Software Isolated Processes (SIPs) Protection and isolation enforced by language safety and kernel API design, not hardware process owns a set of pages allof a process s objects reside on its pages (object space,not address space) language safety ensures process can t create or utate references to other pages Global invariants: no process contains a pointer to another process s object space no pointers fro exchange heap into process P1 P2 P3 Jaes Larus Abolish Runtie Systes

23 Interprocess Counications Channels are strongly typed (value & behavior), bidirectional counications ports essages passing with extensive language support Messages live outside processes, in exchange heap only a single reference to a essage M ailbox se antics enforced by linear types P1 P2 P3 exchange heap Jaes Larus Abolish Runtie Systes

24 Micro Bencharks Athlon (1.8GHz) nforce4 SLI Singularity FreeBSD 5.3 Cost (CPU Cycles) Linux (Red Hat FC4) Windows XP (SP2) Miniu kernel API call Message request/reply Process create & start ,041 13,300 5,800 6, ,000 1,030, ,000 5,380,000 Why? static verification replaces hardware protection all SIPs run in ring 0 Jaes Larus good optiizing copiler (not JIT) Abolish Runtie Systes

25 OS Controls Resources OS owns, allocates, and reclais resources On process terination, OS reclais eory pages and channels not dependent on finalization or garbage collection Clean failure notification sent essages still available to other process Jaes Larus Abolish Runtie Systes

26 Would You Trust Your Syste to a Type Syste? Process integrity depends on type and eory safety currently trust copiler and runtie TAL can eliinate copiler fro trusted coputing base Working on verifying the GC as well Sing# C# source csc sgc MSIL+ x86 Singularity TCB Singularity TCB bartok x86 Singularity safety Singularity syste proof syste copiler verification byte code verification application verification Jaes Larus Abolish Runtie Systes

27 Hardware Protection is Orthogonal SIP-Phys SIP-Page HIP-R0 HIP-R0-S HIP-R3 HIP-R3-S Kernel Syste process Application SIP Kernel doain Non-kernel doain Jaes Larus Abolish Runtie Systes

28 Relative perforance Relative perforance Cost of Hardware & Software Isolation Bartok SIP-Phys SIP-Page HIP-R0 HIP-R0-S HIP-R3 HIP-R3-S WebFiles SIP-Phys SIP-Page HIP-R0 HIP-R0-S HIP-R3 HIP-R3-S Metric Metric Jaes Larus Abolish Runtie Systes

29 processes Challenge 3: Facilitate Verification content extension ext. class library runtie kernel API Jaes Larus web server server class library runtie channels kernel page gr scheduler chan gr proc gr i/o gr HAL TCP/IP stack tcp class library runtie kernel class library runtie network driver driver class library runtie Abolish Runtie Systes Verify process internals (code): type safety object invariants ethod pre- & post- conditions coponent interfaces Verify process externals: channel contract conforance resource access & dependencies Verify syste: counication safety hardware resource conflict free naespace conflict free Static verification: before code runs

30 Exaple: Channel Contracts public contract IoStrea {... state Start : { Open? -> { OK! -> Opened; Error! -> End; } } state Opened : { Read? -> Data! -> Opened; Write? -> OK! -> Opened; Close? -> OK! -> End; } state End;... } Start Open? -> OK! Opened Open? -> Error! Read? -> Data! Write? -> OK! End Close? -> OK! Jaes Larus? = receive! = send Abolish Runtie Systes

31 Exaple: Contract Conforance Contract public contract TcpSocketContract {... state Connected : { Read? -> ReadResultPending; Write? -> WriteResultPending; } GetLocalAddress? -> IPAddress! -> Connected; GetLocalPort? -> Port! -> Connected; DoneSending? -> ReceiveOnly; DoneReceiving? -> SendOnly; Close? -> Closed; Abort? -> Closed; state ReadResultPending : { Data! -> Connected; NoMoreData! -> SendOnly; ReoteClose! -> Zobie; }... }... conn.sendread(); switch receive { case conn.data(readdata) : databuffer.addtotail(readdata); return true; }... Web Server (User) case conn.reoteclose() : return false; Missing Case case conn.nomoredata() : Contract conforance catches subtle errors and coon causes of live-lock statically Jaes Larus Abolish Runtie Systes

32 [DriverCategory] [Signature("/pci/03/00/5333/8811")] Exaple: Configuration Specifications class S3Trio64Config : DriverCategoryDeclaration { [IoMeoryRange(0, Length = 0x400000)] IoMeoryRange fraebuffer; requires PCI Device requires 4MB frae buffer (fro in PCI config) requires syste console buffer [IoFixedMeoryRange(Base = 0xb8000, Length = 0x8000)] IoMeoryRange textbuffer; requires VGA I/O ports... [IoFixedPortRange(Base = 0x3c0, Length = 0x20)] IoPortRange control; [ExtensionEndpoint(typeof(ExtensionContract.Exp))] TRef<ExtensionContract.Exp:Start> pnp; [ServiceEndpoint(typeof(VideoDeviceContract.Exp))] TRef<ServiceProviderContract.Exp:Start> video;... requires control by plug-and-play syste Provides video capability to syste Jaes Larus Abolish Runtie Systes

33 Specification Used in Many Ways Conflict Driver (Source + Spec) Driver Manifest Syste Manifest 1. Load driver 2. Allocate I/O objects File Sys. 3. Create channels Disk Driver driver class library runtie kernel page gr scheduler chan gr proc gr i/o gr HAL kernel class library runtie Singularity Overview Abolish Runtie Systes 33

34 Conclusion How can w e funda entally i prove the dependability of today s softw are and platfors? Tie to rethink language, OS, and syste architecture assuptions O S should controlapplication s execution environ ent new echaniss to enhance syste integrity, verifiability, and dependability Prograing languages and runties are central to iproving software Singularity is a coplete (but siple) syste uses safe languages all the way down to the hardware changes OS architecture iprove syste integrity and verification eliinate wasteful duplication verifies any ore aspects of syste behavior Jaes Larus Abolish Runtie Systes

35 Two roads diverged in a wood, and I I took the one less traveled by, And that has ade all the difference. Robert Frost Jaes Larus Abolish Runtie Systes

36 Large, Diverse Research Tea Lead by Galen Hunt and Ji Larus MSR Cabridge Paul Barha, Richard Black, Ti Harris, Rebecca Isaacs, Dushyanth Narayanan MSR Redond Advanced Copiler Technology Group: Juan Chen, Qunyan Mangus, Mark Plesko, Bjarne Steensgaard, David Tarditi Foundations of Software Engineering Group: Wolfgang Grieskap Operating Systes Group: Mark Aiken, Chris Hawblitzel, Orion Hodson, Galen Hunt, Steven Levi Security and Distributed Systes: Dan Sion, Brian Zill Software Design and Ipleentation Group: John DeTreville, Ben Zorn Software Iproveent Group: Manuel Fahndrich, Jaes Larus, Srira Rajaani, Jakob Rehof MSR Silicon Valley Martin Abadi, Andrew Birrell, Ulfar Erlingsson, Roy Levin, Nick Murphy, Ted Wobber