Towards a User-Mode Approach to Partitioned Scheduling in the seL4 Microkernel

1. Towards a User-Mode Approach to Partitioned Scheduling in the seL4 Microkernel Mikael Åsberg and Thomas Nolte MRTC/Mälardalen University

2. Outline • Introduction • Problem formulation • General solution • Contribution summary • Background • Related work • Implementation • Results • Conclusion

3. Introduction Shift to software complexity • Increasing software complexity=increase integration

4. Problem formulation • Increasing software complexity implies a higher degree of software integration • This can be observed in automotive industry - AUTOSAR • More unpredictable ”interference” (difficult to analyze) when software execute together

5. General solution • Solution: separate software into ”partitions” • Seems to be the way to go in industry – ARINC653, pikeOS etc. • Advocated by researchers in our community – Secure Embedded L4 (seL4) • Partitioning facilitates: • Certification/verification • Reusability (clear interfaces) • Controlled interference between applications • Isolates CPU/memory overruns in each partition

6. Contribution summary • An implementation of a one-level partition scheduler in the seL4 microkernel user-space • Why: • seL4 (currently) lacks proper time partitioning • It’s a difficult trade-off between flexibility and performance • Investigate the performance at user-space • It’s flexible but potentially bad in performance • The results will reveal if a ”verified” user-space scheduler is reasonable to develop for seL4

7. Background • Partitioned/hierarchical scheduling • seL4: a fully verified microkernel (machine-checked proof of ~9000 LOC) Trusted components Untrusted components Real-time application Device driver Linux Device driver … … … … seL4 microkernel Hardware

8. Related work • Partitioned/hierarchical scheduler implementations • Wang et al. (1999), Linux • Oikawa et al. (1999), Linux • Kim et al. (2000), SPIRIT-uKernel • Regehr et al. (2001), Windows 2000 • …VxWorks, uC/OS-II, FreeRTOS… • Yang et al. (2011), L4/Fiasco • Verified scheduler implementations • Muller et al. (2002/2004), Bossa/Linux • Ha et al. (2004), DEOS kernel • Åsberg et al. (2011), VxWorks

9. Implementation (1/3) • Timepartitioning in seL4: • Privileged mode: • + Goodperformance (fast schedulingdecisions) • - Flexibility (re-verificationof the kernel) • User mode: • + Flexibility (re-verify a user-space module) • - Bad performance (extra overhead ofschedulingdecisions) How bad is it?

10. Implementation (2/3) • Scheduling in seL4: FPPS and Round robin • Proposed scheduling: EDF with periodic partitions

11. Implementation (3/3) • Implementation details: • The scheduler is implemented as a user-space thread • Highestpriority (rootthread) • Triggered by periodicinterruptsrelayed from the seL4 kernel • Timebetweeninterrupts is the scheduler resolution • Scheduledthreadsareactivated/deactivatedusing seL4 thread-management API functions • Complexity O(1) for release and deadline queues (usingbitmaps)

12. Results (1/3) • Hardware/software setup: • seL4 kernel (version 1.1) • Emulated seL4 on QEMU (version 0.13.91) • QEMU settings: Intel 533 MHz Pentium3 (Katmai, model 7, stepping 3) • Time measurements using RDTSC (x86 register)

13. Results (2/3) • Average scheduler overhead with 2-9 partitions: • Comparison to related work: Scheduler invocation: ~213us seL4 context switch: ~109us

14. Results (3/3)

15. Conclusion • Is the scheduler performance bad, i.e., to much overhead? • Well, its not ”much” larger than related overheads, i.e., context switches, system calls, interrupt latency etc. • 2x seL4 context switches, 4x IPC calls, 2,5x interrupt latency in a closed system (limitations on API calls) • If further optimizations could squeeze down the overhead a bit then it could be a promising approach • Future work: • Optimize the implementation • Perhaps develop a verified version

16. Thank you!