Hard Constant Bandwidth Server: Comprehensive Formulation and Critical Scenarios

Transcription

1 Hard Consan Bandwidh Server: Comprehensive Formulaion and Criical Scenarios Alessandro Biondi, Alessandra Melani, Marko Berogna Scuola Superiore San Anna, Pisa, Ialy Universiy of Modena and Reggio Emilia, Modena, Ialy {alessandro.biondi, Absrac The Consan Bandwidh Server (CBS) is one of he mos used algorihms for implemening resource reservaion upon deadlinebased schedulers. Alhough many CBS varians are available in he lieraure, no proper formalizaion has been proposed for he CBS in he conex of hard reservaions, where i is essenial o guaranee a bounded-delay service across applicaions. Exising formulaions are affeced by a problem ha can expose he sysem o dangerous deadline misses in he presence of blocking. This paper analyzes such a problem and presens a comprehensive and consisen formulaion of he CBS for hard reservaion scenarios. An overview of he conexs in which a hard CBS can be applied is also provided, focusing on he impac ha previous formulaions can have on schedulabiliy, when used in conjuncion wih specific resource sharing proocols or oher scheduling mechanisms ha may cause a server o block. 1. Inroducion In real-ime compuing sysems running muliple concurren asks, a fundamenal propery ha has o be ensured o suppor a componen-based developmen is emporal proecion, which prevens unexpeced overruns occurring in a ask from affecing he execuion of oher asks. Resource Reservaion [1] represens he mos powerful scheduling mechanism specifically conceived o achieve such a propery. The idea behind he noion of Resource Reservaion is ha each ask (or se of asks) is assigned a fracion of he CPU, and is scheduled in such a way ha i will never demand more han is reserved bandwidh. Wih his absracion, processor capaciy is viewed as a quanifiable resource ha can be reserved, like physical memory or disk blocks. The need for emporal isolaion arises in many conexs. In he real-ime communiy, is primary moivaion was o inegrae hard, sof, and non-real-ime asks. Indeed, many real-ime sysems are no characerized by hard iming consrains, as is he case of mulimedia applicaions, audio/video sreaming, ec. For hese applicaions, missing a deadline has no caasrophic consequences, bu i only leads o performance degradaion. When dealing wih hybrid ask-ses, composed of hard and sof asks, emporal isolaion allows proecing hard asks from overruns generaed by sof asks. More in general, achieving emporal isolaion is necessary whenever a imely service has o be ensured in a sysem wih heerogenous iming requiremens and poenial overload condiions. In case of dynamic or unpredicable compuaional workload, he sysem mus be able o reconfigure or adap iself, wihou affecing oher funcionaliies. In such circumsances, each applicaion can be proeced from he iming inerferences of oher componens by using a proper enforcemen mechanism ha preserves he emporal isolaion. The resource reservaion framework is also effecively employed for hierarchical sysems composed of a se of modular componens, each handling is own applicaion, where a differen scheduling algorihm may be used wihin each componen [2], [3]. Componen-based design is increasingly used as a de faco approach o design complex embedded sysems. In paricular, i gives he possibiliy o handle he growing complexiy of curren indusrial sofware sysems and o suppor he design of open environmens [4], [5], where independenly developed realime applicaions need o be validaed and execued in isolaion. Resource reservaion can be efficienly used in such siuaions, by allocaing differen applicaions on differen virual processors, so ha each applicaion can execue in isolaion, wihou being affeced by he behavior of he oher componens. Resource Reservaion is ypically implemened by assigning o each applicaion a dedicaed real-ime server, called reservaion server. Each server is characerized by a budge Q and period P, so ha i provides o he corresponding applicaion Q unis of service every P ime-unis. The raio α = Q/P is called server bandwidh. If an applicaion A is assigned a reservaion bandwidh α, i behaves as i were execuing on a dedicaed slower processor, wih speed α imes he original speed. However, he reserved budge may be graned wih some delay wih respec o a dedicaed virual processor, depending on he paricular implemenaion of he server. Definiion 1 (Bounded-delay): A server is said o implemen a bounded delay pariion if in any ime inerval of lengh L he server provides he corresponding share of budge αl wih a delay of a mos. The bounded-delay propery of a server is influenced by he budge replenishmen policy, i.e., he rule(s) used o recharge he server budge upon depleion. Depending on he replenishmen rule, i is possible o disinguish beween hard and sof reservaions. Definiion 2 (Hard reservaion): A server is said o implemen a hard reservaion if, when he server budge is depleed, he server is suspended unil he nex replenishmen ime. Definiion 3 (Sof reservaion): A server is said o implemen

2 a sof reservaion if, when he server budge is depleed, i is immediaely replenished, so ha he server remains always acive. In his paper, we will discuss he relaion beween he boundeddelay propery and he budge replenishmen policy for he mos popular dynamic server: he Consan Bandwidh Server (CBS) [6], [7]. The basic idea behind he classic CBS is ha, when he budge is exhaused, i is immediaely recharged o q i = Q i, posponing he server deadline o d i = d i +P i. Since a backlogged server 1 remains always acive, he classic CBS implemens a sof reservaion. However, as shown in [8], such a formulaion presens a deadline aging problem. To undersand his issue, consider a sysem consising of wo asks τ 1 and τ 2 served by servers S 1 and S 2, respecively. As illusraed in Figure 1, a a cerain insan, τ 1 is he only acive ask in he sysem and execues wihou being preemped. The associaed server S 1 consumes all is budge, posponing is deadline several imes. When ask τ 2 is acivaed, server S 2 is assigned a shor deadline and, according o EDF scheduling policy, i is allowed o execue. When he budge of S 2 is exhaused, is deadline is posponed. However, since he deadline of server S 1 is far away, S 2 has sill he earlies deadline and can coninue execuing. As shown in he figure, S 1 will need o wai for a long ime, wihou being able o guaranee Q 1 unis of execuion wihin P 1 ime unis, for muliple server periods. This problem is called deadline aging, and causes he amoun of execuion effecively graned by a server o depend on he acivaions and periods of he oher servers. Since i is no possible o provide an upper bound on he service delay wih which he server provides he reserved processor share in any ime inerval, he sof CBS is no a bounded-delay server 2. S 1 S 2 Figure 1: The deadline aging problem of CBS. This issue is paricularly negaive for mulimedia or ineracive sysems, because he poenially long service delay migh deermine a significan loss of qualiy of service and responsiveness. Even more imporanly, his problem prevens he sof CBS o be used for hierarchical sysems, where a se of real-ime asks needs o be guaraneed on each server wih a given scheduling algorihm. If he server does no implemen a bounded-delay pariion, i would be difficul o analyze he schedulabiliy of each ask on he given server, because no lower-bound can be given on he supply provided o each ask by he server in any ime inerval. For example, if a high prioriy ask arrives a he beginning of a long black-ou period, i would ineviably miss 1. A server is said o be backlogged whenever i has some pending workload o execue. 2. Noe ha he server is insead able o guaranee a reserved budge of αl in an inerval of lengh L saring wih a server acivaion, wih a delay of a mos =2(P Q). is deadline. Even if he supply curve of he server since is iniial acivaion is always wihin = 2(P Q) ime-unis from a dedicaed virual processor of speed α, here could be long subinervals (longer han ) in which no service is graned. This is due o he over-provisioning of budge accorded o lower prioriy asks previously scheduled ono he same server. If a high prioriy ask happens o arrive during such inervals, a deadline is likely o be missed. The deadline aging problem has been addressed by inroducing a bounded-delay varian of CBS implemening hard reservaions, denoed as Hard Consan Bandwidh Server (H-CBS). Many works in he lieraure refer o he H-CBS algorihm, bu none of hem provides a reference wih a proper formalizaion. In his paper, we inend o close his gap, giving once and for all a consisen formulaion for he H-CBS, and showing ha differen exising H-CBS formulaions are affeced by an algorihmic issue ha can jeopardize he server behavior in criical scenarios. Sysem model. This paper considers a uniprocessor sysem, composed of N subsysems S k S, k = 1,...,N, each implemened by a reservaion server (also denoed as S k ) characerized by a budge Q k and a period P k. Each server is also characerized by a server bandwidh α k = Q k /P k, and a wors-case service delay k = 2(P k Q k ). We assume each subsysem S k runs an applicaion Γ k consising of n k periodic or sporadic preempive asks. A local scheduler is in charge of selecing he running ask on each subsysem. For he sake of simpliciy, in his work we consider a wo-level hierarchical sysem, alhough our conribuions can be exended o a generic muli-level hierarchical sysem, using he composiional real-ime scheduling framework proposed by Shin and Lee [3]. All he resuls presened in his paper also hold in he paricular case in which each server handles one single ask, ha is when k=1,...,n, n k = 1. This model can be useful o achieve iming proecion among asks, e.g., as specified by he AUTomoive Open Sysem ARchiecure (AUTOSAR) [9]. Each ask τ i is characerized by a wors-case execuion ime (WCET) C i, a period (or minimum inerarrival ime) T i, and a relaive deadline D i T i. Wihin each subsysem, asks are indexed by increasing relaive deadlines. Paper srucure. The remainder of he paper is organized as follows. Secion 2 discusses he relaed work. Secion 3 summarizes he rules of he H-CBS, giving a consisen formulaion for such a scheduling mechanism. Secion 4 discusses some problems wih exising formulaions under resource sharing and heir impac on he sae of he ar. Finally, Secion 5 saes our conclusions. 2. Relaed work The classical CBS algorihm [6] has been inroduced by Abeni and Buazzo wih he purpose of providing efficien run-ime suppor o mulimedia applicaions in a real-ime sysem. They proposed i as a scheduling mehodology based on reserving a fracion of he processor bandwidh o each ask, under he EDF scheduling algorihm. Rajkumar e al. in [10] inroduced he noion of hard reservaion. They presened an algorihm ha suspends he server upon budge depleion unil he nex replenishmen ime. The downside

3 of his approach is ha he algorihm is no work-conserving, so ha he sysem may remain idle even when here are pending jobs o execue, significanly reducing he hroughpu. To solve he problem of deadline aging presen in he original formulaion of CBS, Marzario e al. [8] presened he Idle-ime Reclaiming Improved Server (IRIS), which implemens hard reservaions guaraneeing a minimum budge in any ime inerval, and ensuring a work-conserving behavior. I presens wo main differences wih respec o he original CBS algorihm. The firs difference is ha IRIS explicily ses a recharging ime for each server, o implemen hard reservaions. Secondly, i inroduces a rule, denoed as ime-warping, which allows he idle ime o be reclaimed and disribued among he needing servers. According o his rule, when an idle ime occurs, i is possible o advance he recharging imes of all he servers ha are ready o execue bu are waiing for replenishmen. As we will show in he following secions, he hard CBS implemenaion proposed for IRIS presens some problem when a server is reacivaed afer being blocked. In [11], Abeni e al. presen he HGRUB server, which combines a hard reservaion CBS wih a reclaiming mechanism ha modifies he CBS accouning and enforcemen rules o ake advanage of he bandwidh reserved o inacive servers. Also HGRUB presens he same problem of IRIS when a server reacivaes afer a blocking ime. A CBS exension o suppor hierarchical scheduling is presened in [12]. Being based on he original formulaion of he CBS algorihm, i suffers from deadline aging, and does no implemen hard reservaions. Moreover, i makes he resricive assumpion of Firs-Come-Firs-Served (FCFS) job scheduling wihin each server. In [5], Berogna e al. propose he Bounded-Delay Resource Open Environmen (BROE) server, which exends he CBS o handle resource sharing in a Hierarchical Scheduling Framework. To address he budge exhausion problem when a global lock is held, BROE performs a budge check before graning access o each global resource. If he budge is sufficien o complee he global criical secion, he lock is graned. Oherwise, i is denied, suspending he server unil a replenishmen ime. Beside his budge-check mechanism, he bounded-delay version of he CBS implemened by BROE differs from he one adoped for IRIS and HGRUB in he rules o execue afer a server reacivaion. Even if no explicily menioned in [5], hese rules allow avoiding a suble problem upon server reacivaion ha may lead o a server deadline miss. As his problem is presen in differen works in he lieraure, we believe i is imporan o highligh i, bringing i o he aenion of he real-ime communiy. 3. H-CBS rules In his secion, he rules of he Hard Consan Bandwidh Server (H-CBS) are described in deail. Since he rules of CBS-based servers are someimes expressed using he noion of virual ime, some oher imes using explici budge relaions, we hereafer provide boh formulaions. To simplify he noaion, he server index is omied in he server parameers. Conending (1) (8) (2) (3) (6) Inacive Execuing Suspended (4) (5) (7) Non- Conending Figure 2: Sae ransiion diagram Virual ime based rules The server is characerized by hree dynamic variables, which are updaed a runime: a deadline d; a virual ime v; a reacivaion ime z. Moreover, a server S is defined o be backlogged if i has any acive jobs awaiing execuion a ha insan, and non-backlogged oherwise. A each ime insan, a server can be in one of five possible saes: 1) Inacive, when i is non-backlogged and v ; 2) Non-Conending, when i is non-backlogged and v > ; 3) Conending, when i is backlogged and eligible o execue; 4) Execuing, when i is backlogged and currenly running; 5) Suspended, when i is backlogged and is virual ime has reached he server deadline (v = d), bu he curren ime insan is before he reacivaion ime z of he server ( < z). Noe ha in he definiion of he Inacive and Non-Conending saes, he curren ime is compared wih he virual ime v. The relaion beween and v gives an indicaion on he possibiliy for he server o execue wihou violaing is bandwidh α. Inuiively, when v >, he server has execued for all is fair share ; he opposie holds when v. The Suspended sae has been inroduced o ensure a hard reservaion behavior. Indeed, no analog of he Suspended sae is presen in he original definiion of CBS [6]. Figure 2 illusraes he sae ransiion diagram ha describes he behavior of he server. Being he curren ime, he server variables are updaed according o he following rules. (i) The server is iniially in he Inacive sae. I ransiions o Conending sae when i wishes o conend for execuion. This ransiion (label (1) in Figure 2) is accompanied by he

4 following acions: d v + P (ii) Only Conending servers are eligible o execue. When he earlies deadline Conending server is seleced for execuion, i undergoes ransiion (2) o he Execuing sae. While execuing, is virual ime is incremened a a rae 1/α: dv d = 1 α (iii) When an Execuing server is preemped by a higher prioriy one, i undergoes ransiion (3) back o he Conending sae. (iv) When an Execuing server has no more pending jobs o execue, i ransis o he Non-Conending sae (ransiion (4)), and remains here as long as v>. (v) When v, a Non-Conending server ransiions o he Inacive sae (ransiion (5)). (vi) If he virual ime v of an Execuing server reaches he server deadline d, i undergoes ransiion (6) o he Suspended sae. This ransiion is accompanied by he following acions: z v (1) d v+p (2) (vii) A Non-Conending server which desires o conend once again for execuion (noe < v, oherwise i would be in he Inacive sae) ransis o he Suspended sae (ransiion (7)). This ransiion is accompanied by he same acions (Eq. (1) and (2)) of ransiion (6). (viii) A Suspended server ransiions back o he Conending sae as soon as he curren ime reaches he reacivaion ime z (ransiion (8)). Noe ha a server may ake wo ransiions insananeously one afer anoher. For example, when an Execuing server becomes non-backlogged and v, ransiion (5) is aken insananeously afer ransiion (4). The above rules implemen a non-work-conserving H-CBS server. A simple rule can be added o make he server workconserving: When he processor is idle, every server is rese o he Inacive sae. This allows implemening a simple reclaiming mechanism ha avoids idling he processor when here are backlogged servers Budge based rules The rules of a H-CBS server can also be expressed in erms of period P and maximum budge Q. A any curren ime, he server is characerized by an absolue deadline d and a remaining budge q. When a job execues, q is decreased accordingly. The budge based rules are summarized below. 1) Iniially, q=0 and d = 0. 2) When H-CBS is idle and a job arrives a ime, a replenishmen ime is compued as r = d q/α: a) if < r, he server is suspended unil ime r. A ime r, he server reurns acive replenishing is budge o Q and seing d r + P. b) oherwise he budge is immediaely replenished o Q and d + P; 3) When q=0, he server is suspended unil ime d. A ime d, he server budge is replenished o Q and he deadline is posponed o d d+ P. According o he previous rules, a server running ahead of is guaraneed processor uilizaion may self-suspend when reacivaing afer an idle ime unil he guaraneed processor uilizaion is mached (ime r = d q/α). A ime r, he server budge is replenished o Q and he deadline is se o d r + P. When insead he server consumed less bandwidh han is allowed share, i will immediaely replenish is budge, seing he deadline o d + P. The connecion beween his formulaion and he one presened in Secion 3.1 can be obained considering he relaion v= a + Q q α, which links he virual ime v wih he curren server budge q and he las server acivaion ime a Consideraions The above rules implemen a bounded-delay version of he CBS, which provides he corresponding processor share wihin a service delay of = 2(P Q) in any ime-inerval. The boundeddelay propery is guaraneed by using an addiional Suspended sae, which allows he reservaion o be hard, avoiding he deadline aging problem. I is imporan o noe ha here is no direc ransiion beween he Non-Conending and he Conending/Execuing saes. A server ha reacivaes afer being Non-Conending mus firs pass hrough a Suspended sae before being execued again. This is one of he main differences wih exising hard reservaion formulaions of he CBS, ha insead allow a Non-Conending server o resar execuing immediaely afer a new job reques arrives, using he original deadline and he remaining budge. We believe his mechanism o be poenially dangerous in hard reservaion scheduling scenarios, where a server migh reacivae afer being blocked by shared resource policies, as shown in he following secion. Noe ha a sof CBS ha does no mee he bounded-delay propery could sill be used in hierarchical environmens when a paricular kind of scheduling algorihm is used. For example, when he scheduler replicaes he same job execuion order enforced on a dedicaed virual processor (VP) of speed α. In his case, i is possible o prove ha he schedulabiliy analysis is simplified, as i is sufficien o check wheher each job complees a leas ime-unis before is deadline on he VP. However, noe ha he job execuion order enforced by a given scheduler on a VP may differ from ha enforced on a server, because of he differen processor availabiliy. Therefore, replicaing he VP schedule on he server requires a significan amoun of addiional

5 runime complexiy 3. A corollary of he above observaion concerns he Firs-Come- Firs-Served (FCFS) policy. Noe ha, by definiion, he job execuion order using FCFS is always he same, on a server or a dedicaed VP. As menioned, his significanly simplifies he schedulabiliy analysis, explaining why a sof CBS can be used in [12] for hierarchical environmens adoping FCFS as a job scheduling policy. If oher policies are used insead, like EDF or FP, he schedulabiliy on a sof reservaion is much more difficul o check, due o he difficulies in finding a criical insan siuaion, i.e., he job release insance ha leads o he wors-case response ime of he asks handled by he server. Indeed, while he criical insan on a dedicaed VP is found when all asks are synchronously released, his is no he case on a sof reservaion, where a worse siuaion is found when a high prioriy ask arrives afer a lower prioriy one caused he deadline-aging problem. Besides imposing a larger schedulabiliy penaly, he laer case makes he analysis much more complex. 4. H-CBS blocking problem Beside he inerference from higher prioriy insances, each server may experience some blocking due o globally shared resources concurrenly accessed by oher servers, or due o suspension mechanisms implemened in he sysem. In his secion, we analyze more in deail how he blocking may jeopardize he behavior of classic H-CBS formulaions, exposing he sysem o dangerous deadline misses. Noe ha he presened problem is differen from (and orhogonal o) anoher blocking-relaed problem analyzed in many differen papers, concerning he budge exhausion problem of resource sharing servers [5], [13] [15]. While differen echniques are available o limi he blocking due o servers exhausing heir budge while holding a global lock, mos of hese echniques do no solve he problem presened in his secion. As shown in [5], [15], a sufficien schedulabiliy condiion o safely compose muliple reservaion servers in he presence of a generic blocking erm can be derived as follows. Theorem 1: A se of subsysems S 1,...,S N may be composed upon a uni-capaciy processor wihou missing any deadline if k=1,...,n : i:p i P k α i + B k P k 1, (3) where B k represens he maximum blocking ha can be imposed over a server S k. To clarify he blocking problem wih exising H-CBS formulaion, we hereafer show he case of blocking due o globally shared resources accessed hrough SRP-G [5], [13], one of he mos popular proocols for arbiraing he access o resources shared by differen servers. A similar problem arises also when he blocking is due o oher scheduling mechanisms. 3. Noe ha he replicaed schedule is non-work-conserving, as i migh leave he server idle even when i has some pending job o execue, in order o enforce he same job execuion order of he VP schedule Resource model Two ypes of shared resource can be defined: Local resource 4 : a resource shared among asks wihin he same subsysem; Global resource: a resource shared among asks belonging o differen subsysems. In he following, Z i, j denoes he longes criical secion of τ i relaed o resource R j and δ i, j denoes he WCET of Z i, j. From now on, he noaion {x} 0 denoes {0} {x}. Definiion 4: The Resource Holding Time H k, j (i) of a global resource R j accessed by a ask τ i Γ k is he maximum amoun of budge consumed by S k beween he lock and he corresponding release of R j performed by τ i. Noe ha, if global resources are accessed by disabling local preempion, H k, j (i) is equal o δ i, j of ask τ i Γ k. If local preempion is no disabled, H k, j (i) akes ino accoun he worscase local inerference experienced by τ i during he lock of R j (deails on how o compue H k, j (i) can be found in [5]). In addiion, he maximum Resource Holding Time of a resource R j for an applicaion Γ k is defined as H k, j = max τ i Γ k {H k, j (i)}. (4) Finally, he maximum Resource Holding Time for an applicaion Γ k is defined as H k = max j {H k, j }. (5) In order o access shared resources, he Sack Resource Policy (SRP) [16] can be used as i is for local resources, while i has o be exended for global resources. The global version of SRP is summarized below [5], [13]. Global SRP (SRP-G). To handle global resources, each server S k is assigned a preempion level πk S. Server preempion levels are ordered in inverse period order, such ha πh S > πs k P h< P k. Each global resource is assigned a global ceiling equal o C G j = max{π S k τ i Γ k τ i holds global R j } 0. A global sysem ceiling is defined as Π G = max j {C G j }. A server S k can preemp he currenly scheduled server only if π S k > ΠG. Noe ha, when a global resource is locked, he sysem ceiling Π G is incremened, poenially causing a number of servers o be blocked. According o SRP-G, a server S k can be blocked for a ime B k by a server S l wih P k P l. This happens when S l locks a resource R, which is used by S l and by a server S h wih period P h P k. Hence, he global blocking facor B k can be formally expressed as follows: B k = max P l >P k {H l, j R j used by S h P h P k } 0. (6) 4. Please noe ha local resources are no defined when n k = 1 (i.e., when he applicaion Γ k is composed by a single ask).

6 4.2. Problem descripion In he lieraure, differen works [8], [11] proposed a formulaion of a hard reservaion CBS. Unforunaely, as we are going o show, all hese formulaions presen a problem arising whenever a server is blocked upon re-acivaion. This is for insance he case when servers may share muually exclusive global resources, and he earlies deadline server is waiing for a global lock o be released by anoher server. The same problem may however arise also for oher kinds of blocking ha a server may experience, as wih suspension-based mechanisms or sysem sleep inervals. To presen he problem, we here focus on he case of hard reservaion CBS servers ha may access globally shared resources using he SRP-G proocol. Please consider Rule (vii) of he H-CBS server in Secion 3.2. In exising formulaions of hard reservaion CBS [8], his rule is no presen, and a Non-Conending server wishing o once again conend for execuion is allowed o direcly ransiion o he Conending sae. Equivalenly, in he budge-based formulaion, Rule (2a) in Secion 3.2 is replaced by he following rule: Rule (2a)-OLD: If < r, he server mainains is curren budge q and deadline d. Therefore, a server ha reacivaes when running ahead of is guaraneed processor share is no suspended, bu may immediaely conend for execuion using he exising budge and deadline. We hereafer show how such a differen rule can affec he server schedulabiliy in presence of blocking. S 1 Q 1 q 1 ( w ) S 2 Normal Execuion Criical Secion w d s d 2 Figure 3: The unbounded blocking bandwidh problem. Q 1 12 Q 2 20 P 1 24 P 2 80 q 1 ( w ) 3 H 2 10 Table 1: Example values for he unbounded blocking bandwidh problem. Consider wo servers S 1 and S 2 sharing a global resource R, whose parameers are repored in Table 1. As shown in Figure 3, boh servers are released a he same ime insan = 0, wih deadlines d 1 = P 1 = 24 and d 2 = P 2 = 80, respecively. According o he global EDF policy, S 1 sars execuing a = 0. A ime s = 9, S 1 has no more pending jobs o execue, so ha S 2 may sar execuing. A some poin, S 2 locks he resource R. Then, a ime w = 17, he server S 1 becomes backlogged again. Using he budge-based rules, he replenishmen ime is compued as r = d 1 q( w )/α 1 = 18. Since w < r, in our formulaion of he H-CBS, he server would be suspended unil he reacivaion ime r, when he budge is refilled and he deadline updaed. Insead, hose approaches based on he original formulaion (using Rule (2a)-OLD) do no suspend he server, bu allow i o conend for execuion wih is old budge q 1 ( w ) and deadline d 1. However, according o SRP-G, S 1 is prevened from execuing, since R is currenly locked. As shown in Figure 3, he blocking imposed by S 2 causes he original deadline d 1 o be missed. In his example, using Theorem 1, i is easy o verify he schedulabiliy of he sysem. In paricular, for k= 1, α 1 +B 1 /P 1 = α 1 + H 2 /P 1 = 22/24< 1, while for k = 2, α 1 + α 2 = 12/24+ 20/80 = 3/4 < 1. Therefore, despie he schedulabiliy es of Theorem 1 is passed, he above example shows ha, no exending he deadline of S 1 upon reacivaion, a deadline miss occurs Problem analysis To undersand why he schedulabiliy es of Theorem 1 does no hold for exising hard reservaion CBS servers implemenaions, i is necessary o analyze how he blocking impacs he insances generaed by servers re-using he old deadline and budge upon reacivaion. In Theorem 1, he server blocking inroduced by SRP-G is considered as in he original analysis for SRP, where nonsuspending asks are addressed. A non-suspending ask incurs only arrival blocking, i.e., i can only be blocked upon is arrival. Equaion (3) considers only his kind of blocking, inroducing a blocking bandwidh erm of B/P. In he case depiced in Figure 3, insead, he server behaves as a ask ha is suspended and reacivaed, making he exising analysis unsuiable for such a scenario. When he server is resumed a ime w, he blocking ime B impacs on a ime inerval of d 1 w unis. This leads o a blocking bandwidh of B/(d 1 w ), which is greaer han he one considered in Equaion (3), being d 1 w < P 1. More in general, as w may poenially be arbirarily close o he server deadline d 1, he blocking bandwidh may end o infiniy, being lim w d 1 B d 1 w =. The original hard reservaion CBS implemenaion are herefore said o suffer from an unbounded blocking bandwidh problem Problem soluion The unbounded blocking bandwidh problem of exising implemenaions can be solved by ensuring ha when a server reacivaes, is deadline will be a leas P ime-unis away. While his is always he case when he server execued for less han is allocaed budge (execuing ransiion (1) from he Inacive sae, or, equivalenly, Rule 2-b), his is no rue for

7 exising implemenaions when he server is running ahead of is proporional processor share. Insead, our H-CBS implemenaion suspends he server, undergoing ransiion (7) (or, equivalenly, applying Rule (2a) in Secion 3.2). The ransiion is accompanied by a full budge replenishmen when he reacivaion ime is reached, posponing he deadline P ime unis afer he reacivaion ime. Therefore, a bounded blocking bandwidh facor of B/P is mainained. In he example of Figure 3, he server S 1 would be suspended a ime w, and reacivaed a ime r wih a deadline d 1 = r + P 1 greaer han w + P 1. Please also noe ha he server suspension imposed by Rule (2a) is crucial o guaranee a maximum service delay of = 2(P Q). Omiing such a rule would lead o a maximum service delay greaer han, as shown in he following example. S q() Q 0 w r w + Q r + P r + 2P Figure 4: Scenario wih a service delay greaer han =2(P Q). Consider he scenario illusraed in Figure 4, where a server S sars execuing a ime = 0, and hen becomes Non-Conending when i has no more job o execue. A ime w, he server becomes backlogged again. Assuming w < r, Rule (2a) is applied, enforcing a full budge replenishmen q = Q and shifing he deadline o d = r + P. Rule (2a) also requires he server be suspended unil ime r. If he server is no suspended, i may immediaely sar execuing a ime w, as shown in he figure. The server may execue unil ime w + Q, when he server exhauss is budge. Applying Rule 3, he server is suspended unil is deadline d= r +P. When = d, he budge is refilled, posponing he deadline o d = r + 2P. In he wors-case scenario, he server resars execuing a he laes possible ime ha guaranees is schedulabiliy, ha is = r +2P Q. In his case, he maximum service delay can be compued as = ( w + Q). By replacing in he above equaion, = r + 2P Q ( w + Q)=( r w )+2(P Q). Since =2(P Q), =( r w )+. Since Rule (2a) is applied only when r > w, i follows( r w )> 0, obaining a service delay sricly greaer han 2(P Q). When insead he server is suspended unil ime r, i is easy o see ha he wors-case service delay canno exceed, as illusraed in Figure 5. S q() Q 0 Normal execuion Server suspension w r r + Q r + P r + 2P Figure 5: Scenario wih a service delay equal o =2(P Q). The blocking bandwidh is herefore upper bounded by B/P, and he schedulabiliy es of Theorem 1 can be efficienly used. This explains why Rule (2a) requires he server o suspend Impac of he problem This secion presens an overview of previously proposed CBSbased approaches ha are affeced by he described problem in presence of blocking. The IRIS algorihm was originally presened in [8] for isolaing single asks, and is radiionally seen as a reference implemenaion of a hard reservaion CBS. I was he firs work o highligh he shorcomings of he original CBS, proposing a soluion for he deadline aging problem. However, IRIS suffers from he unbounded blocking bandwidh problem presened in his paper when i is adoped for servers ha may experience blocking condiions. In hese scenarios, IRIS formulaion needs o be revised inroducing a suspension mechanism equivalen o he one of our H-CBS implemenaion. In paricular, enhancing IRIS wih Rule (2a) allows avoiding he unbounded blocking bandwidh problem. A similar hard CBS formulaion suffering from he same problem has been proposed by Mancina e al. in [17], implemening i in he conex of Minix 3, a highly dependable microkernel-based OS. In a hierarchical scheduling conex, a hard reservaion CBS server has been used by Lipari and Bini in [2], [18], as a generic exension of he classic CBS [6]. Alhough he purpose was o propose a generic server for a hierarchical scheduling sysem, he formulaion of such a server reflecs very closely he one of IRIS, and is hus affeced by he same issue. In [19], Kumar e al. proposed an algorihm called R-CBS, o provide an online reconfiguraion mechanism for he CBS server, boh in is sof and hard versions. The hard formulaion proposed in he paper is also prone o he unbounded blocking bandwidh problem. Various servers has been specifically conceived o enhance hard CBS implemenaions wih differen kinds of mechanisms for he reclaiming of unused bandwidh, like HGRUB [11] and SHRUB [20]. Since hey allow a server ha is running ahead of is reserved bandwidh o reacivae wih he exising budge

8 and deadline, hey are all affeced by he unbounded blocking bandwidh problem. As he presened problem arises in presence of blocking, i may affec many exising works dealing wih resource sharing in server-based environmens. When servers may share global resources, a well-known problem concerns he possible budge exhausion inside a criical secion, significanly increasing he blocking over higher prioriy servers. Differen papers have been proposed o deal wih his budge exhausion problem [5], [13] [15], [21], which, as menioned, is orhogonal o he unbounded blocking bandwidh problem highlighed in his paper. We hereafer recall he principal ones. One of he firs soluions is based on budge overrun, i.e., when a server exhauss is budge while holding a global resource, i is allowed o consume exra budge unil he end of he criical secion. This soluion was firs proposed by Ghazalie and Baker in [22], and hen used by Abeni and Buazzo in [6] under he CBS algorihm. Laer, Davis and Burns [13] proposed wo versions of his mechanism: overrun wih payback, where he nex budge replenishmen is decreased by he overrun value, and overrun wihou payback, where no acion is aken afer he overrun. Behnam e al. [14] exended his mechanism under EDF. Anoher soluion has been proposed wih he SIRAP proocol in [15], inroducing a budge check before each global lock, so ha a server is graned access o a global resource only if is budge is sufficien o complee he criical secion. Oherwise, he server mus wai unil he nex budge replenishmen. A similar budge check mechanism has been proposed wih he BROE proocol in [5], using a smarer budge replenishmen mechanism. Whenever he budge is no sufficien o complee he criical secion, a full budge replenishmen is planned a he earlies possible ime ha preserves boh he server bandwidh and he maximum service delay, suspending he server unil he nex budge replenishmen. Noably, BROE is he only server we found in he lieraure ha is no affeced by he unbounded blocking bandwidh problem, as i suspends a server upon reacivaion when i is running ahead of is proporional share. In all oher cases, he unbounded blocking bandwidh problem may appear every ime a hard reservaion CBS is used wihou he suspension enforced by Rule (2a). Since all menioned serverlevel resource sharing proocols do no preven a server o block, a siuaion similar o he one shown in Figure 3 will always be possible. For he same reason, he problem also arises whenever global conenion is arbiraed using oher proocols, such as serverlevel versions of he Prioriy Ceiling Proocol (PCP) or Prioriy Inheriance Proocol (PIP) [23]. Insead, he Bandwidh Inheriance Proocol (BWI), proposed by Lamasra e al. in [24] as an exension of PIP for he CBS algorihm, is no affeced by he same issue. In paricular, BWI is able o guaranee he server schedulabiliy wihou inroducing any blocking bandwidh facor in he feasibiliy es. This ineresing propery however is achieved by significanly increasing he pessimism in he schedulabiliy es of each reservaion server. 5. Conclusions This paper presened a comprehensive formalizaion for he Hard Consan Bandwidh Server (H-CBS), a varian of he CBS algorihm which guaranees a hard-reservaion scheme for CPU allocaion. In he lieraure, previous hard reservaion formulaions for he CBS have been proposed; however, hey are affeced by he unbounded blocking bandwidh effec, which can lead o dangerous deadline misses. Specifically, we highlighed how such inconsisen formulaions can impac he sysem schedulabiliy when resource sharing is considered. More in general, he idenified issue is no sricly relaed o resource sharing, bu i may emerge whenever a hard reservaion CBS is inegraed wih oher scheduling mechanisms, such as suspension-based proocols or sysem sleep inervals, which require he reservaion server o block. This work gives, once and for all, a consisen formulaion for he H-CBS, leaving i as a reference for he real-ime research communiy. Acknowledgmens This work has been suppored in par by he European Commission under he P-SOCRATES projec (FP7-ICT-6116). References [1] C. W. Mercer, S. Savage, and H. Tokuda, Processor capaciy reserves for mulimedia operaing sysems, in Proceedings of IEEE inernaional conference on Mulimedia Compuing and Sysem, May [2] G. Lipari and E. Bini, A mehodology for designing hierarchical scheduling sysems, Journal of Embedded Compuing, vol. 1, no. 2, pp , April [3] I. Shin and I. Lee, Composiional real-ime scheduling framework, in Proceedings of he 25h IEEE Real-Time Sysems Symposium, Lisbon, Porugal, December 5-8, 2004, pp [4] Z. Deng and J. W.-S. Liu, Scheduling real-ime applicaions in an Open environmen, in Proceedings of he 18h IEEE Real- Time Sysems Symposium (RTSS 1997), San Francisco, CA, USA, December 3-5, 1997, pp [5] M. Berogna, N. Fisher, and S. Baruah, Resource-sharing servers for open environmens, IEEE Transacions on Indusrial Informaics, vol. 5, no. 3, pp , Augus [6] L. Abeni and G. Buazzo, Inegraing mulimedia applicaions in hard real-ime sysems, in Proceedings of he IEEE Real-Time Sysems Symposium, Madrid, Spain, December [7], Resource reservaions in dynamic real-ime sysems, Real- Time Sysems, vol. 27, no. 2, pp , [8] L. Marzario, G. Lipari, P. Balbasre, and A. Crespo, IRIS: A new reclaiming algorihm for server-based real-ime sysems, in Proc. of he IEEE Real-Time and Embedded Technology and Applicaions Symposium, Torono, Canada, May [9] AUTOSAR, AUTOSAR Release 4.1, Specificaion of Operaing Sysem, hp:// 23. [10] R. Rajkumar, K. Juvva, A. Molano, and S. Oikawa, Resource kernels: A resource-cenric approach o real-ime and mulimedia sysems, in SPIE/ACM Conference on Mulimedia Compuing and Neworking, San Jose, CA, USA, January [11] L. Abeni, L. Palopoli, C. Scordino, and G. Lipari, Resource reservaions for general purpose applicaions, IEEE Transacions on Indusrial Informaics, vol. 5, no. 1, pp , February [12] G. Lipari and S. Baruah, A hierarchical exension o he consan bandwidh server framework, in Proceedings of he 7h Real-Time Technology and Applicaion Symposium, Taipei, Taiwan, 30 May - 1 June 20, pp

9 [13] R. I. Davis and A. Burns, Resource sharing in hierarchical fixed prioriy preempive sysems, in Proc. of he 27h IEEE Real-Time Sysems Symposium, Rio de Janeiro, Brazil, December 5-8, [14] M. Behnam, I. Shin, T. Nole, and M. Nolin, Scheduling of semiindependen real-ime componens: Overrun mehods and resource holding imes, in Proceedings of 13h IEEE In. Conference on Emerging Technologies and Facory Auomaion (ETFA 08), Hamburg, Germany, Sepember 15-18, [15], SIRAP: a synchronizaion proocol for hierarchical resource sharing in real-ime open sysems, in Proceedings of he 7h ACM & IEEE Inernaional Conference on Embedded Sofware (EMSOFT 2007), Salzburg, Ausria, Ocober 1-3, [16] T. P. Baker, Sack-based scheduling for realime processes, Real- Time Sysems, vol. 3, no. 1, pp , April [17] A. Mancina, D. Faggioli, G. Lipari, J. N. Herder, B. Gras, and A. S. Tanenbaum, Enhancing a dependable muliserver operaing sysem wih emporal proecion via resource reservaions, Real- Time Sysems, vol. 43, no. 2, pp , [18] G. Lipari and E. Bini, Resource pariioning among real-ime applicaions, in Proceedings of he 15h Euromicro Conference on Real-Time Sysems. Poro, Porugal: IEEE, 2003, pp [19] P. Kumar, N. Soimenov, and L. Thiele, An algorihm for online reconfiguraion of resource reservaions for hard real-ime sysems, in Proc. of he 24h Euromicro Conference on Real-Time Sysems, Pisa, Ialy, July , pp [20] T. Cucinoa, L. Abeni, L. Palopoli, and G. Lipari, A robus mechanism for adapive scheduling of mulimedia applicaions, ACM Transacions on Embedded Compuing Sysems (TECS), vol. 10, no. 46, pp. 1 24, November 21. [21] M. Åsberg, T. Nole, and M. Behnam, Resource sharing using he rollback mechanism in hierarchically scheduled real-ime open sysems, in Proc. of he 19h Real-Time and Embedded Technology and Applicaions Symposium, Philadelphia, PA, USA, April , pp [22] T. Ghazalie and T. Baker, Aperiodic servers in a deadline scheduling environmen, Real-Time Sysems, vol. 9, pp , [23] L. Sha, R. Rajkumar, and J. Lehoczky, Prioriy inheriance proocols: An approach o real-ime synchronizaion, IEEE Transacions on Compuers, vol. 39, no. 9, pp , Sepember [24] G. Lamasra, G. Lipari, and L. Abeni, A bandwidh inheriance algorihm for real-ime ask synchronizaion in open sysems, in Proc. of he 22nd IEEE Real-Time Sysems Symposium, London, UK, December , pp