Kernel Traffic #171 For 16 Jun 2002

We have released the initial implementation of the Adeos nanokernel. The following is a complete description of its background, its implementation, its API, and its potential uses. Please also see the press release (http://www.freesoftware.fsf.org/adeos/pr-2002-06-03.en.txt) and the project's workspace (http://freesoftware.fsf.org/projects/adeos/). The Adeos code is distributed under the GNU GPL.

The Adeos nanokernel is based on research and publications made in the early '90s on the subject of nanokernels. Our basic method was to reverse the approach described in most of the papers on the subject. Instead of first building the nanokernel and then building the client OSes, we started from a live and known-to-be-functional OS, Linux, and inserted a nanokernel beneath it. Starting from Adeos, other client OSes can now be put side-by-side with the Linux kernel.

To this end, Adeos enables multiple domains to exist simultaneously on the same hardware. None of these domains see each other, but all of them see Adeos. A domain is most probably a complete OS, but there is no assumption being made regarding the sophistication of what's in a domain.

To share the hardware among the different OSes, Adeos implements an interrupt pipeline (ipipe). Every OS domain has an entry in the ipipe. Each interrupt that comes in the ipipe is passed on to every domain in the ipipe. Instead of disabling/enabling interrupts, each domain in the pipeline only needs to stall/unstall his pipeline stage. If an ipipe stage is stalled, then the interrupts do not progress in the ipipe until that stage has been unstalled. Each stage of the ipipe can, of course, decide to do a number of things with an interrupt. Among other things, it can decide that it's the last recipient of the interrupt. In that case, the ipipe does not propagate the interrupt to the rest of the domains in the ipipe.

Regardless of the operations being done in the ipipe, the Adeos code does __not__ play with the interrupt masks. The only case where the hardware masks are altered is during the addition/removal of a domain from the ipipe. This also means that no OS is allowed to use the real hardware cli/sti. But this is OK, since the stall/unstall calls achieve the same functionality.

Our approach is based on the following papers (links to these papers are provided at the bottom of this message):

1. D. Probert, J. Bruno, and M. Karzaorman. "Space: a new approach to operating system abstraction." In: International Workshop on Object Orientation in Operating Systems, pages 133-137, October 1991.
2. D. Probert, J. Bruno. "Building fundamentally extensible application- specific operating systems in Space", March 1995.
3. D. Cheriton, K. Duda. "A caching model of operating system kernel functionality". In: Proc. Symp. on Operating Systems Design and Implementation, pages 179-194, Monterey CA (USA), 1994.
4. D. Engler, M. Kaashoek, and J. O'Toole Jr. "Exokernel: an operating system architecture for application-specific resource management", December 1995.

If you don't want to go fetch the complete papers, here's a summary. The first 2 discuss the Space nanokernel, the 3rd discussed the cache nanokernel, and the last discusses exokernel.

The complete Adeos approach has been thoroughly documented in a whitepaper published more than a year ago entitled "Adaptive Domain Environment for Operating Systems" and available here: http://www.opersys.com/adeos The current implementation is slightly different. Mainly, we do not implement the functionality to move Linux out of ring 0. Although of interest, this approach is not very portable.

Instead, our patch taps right into Linux's main source of control over the hardware, the interrupt dispatching code, and inserts an interrupt pipeline which can then serve all the nanokernel's clients, including Linux.

This is not a novelty in itself. Other OSes have been modified in such a way for a wide range of purposes. One of the most interesting examples is described by Stodolsky, Chen, and Bershad in a paper entitled "Fast Interrupt Priority Management in Operating System Kernels" published in 1993 as part of the Usenix Microkernels and Other Kernel Architectures Symposium. In that case, cli/sti were replaced by virtual cli/sti which did not modify the real interrupt mask in any way. Instead, interrupts were defered and delivered to the OS upon a call to the virtualized sti.

Mainly, this resulted in increased performance for the OS. Although we haven't done any measurements on Linux's interrupt handling performance with Adeos, our nanokernel includes by definition the code implementing the technique described in the abovementioned Stodolsky paper, which we use to redirect the hardware interrupt flow to the pipeline.

In terms of implementation, the Adeos' code is rather short since we focused on setting the foundations for sharing interrupts between domains. Here are the files we added:
kernel/adeos.c: Architecture-independent domain code.
arch/i386/kernel/adeos.c: Architecture-dependent domain code.
arch/i386/kernel/ipipe.c: Interrupt pipeline code.
include/asm-i386/adeos.h: Arch-dependent Adeos header.
include/linux/adeos.h: Main (arch-independent) Adeos header.

As you can see, only the i386 is currently supported. Nonetheless, most of the architecture-dependent code is easily portable to other architectures.

We also modified some files to tap into Linux interrupt dispatching (all the modifications are encapsulated in #ifdef CONFIG_ADEOS/#endif):

kernel/ksyms.c
arch/i386/kernel/apic.c
arch/i386/kernel/entry.S
arch/i386/kernel/i386_ksyms.c
arch/i386/kernel/i8259.c
arch/i386/kernel/irq.c
arch/i386/kernel/smp.c
arch/i386/kernel/time.c
arch/i386/kernel/traps.c
arch/i386/mm/fault.c
include/asm-i386/keyboard.h
include/asm-i386/system.h

We modified the idle task so it gives control back to Adeos in order for the ipipe to continue propagation:
arch/i386/kernel/process.c

We modified init/main.c to initialize Adeos very early in the startup.

Of course, we also added the appropriate makefile modifications and config options so that you can choose to enable/disable Adeos as part of the kernel build configuration.

Here is Adeos' public API:

int adeos_register_domain(adomain_t *adp, adattr_t *attr);
Register a new domain using the properties defined in the attribute.

void adeos_unregister_domain(adomain_t *adp);
Remove "adp" domain.

void adeos_renice_domain(adomain_t *adp, int newpri);
Change "adp"'s priority in the ipipe.

void adeos_suspend_domain(void);
This domain is done dealing with the current interrupt. This signals the ipipe to provide the interrupt to the next ipipe stage.

void adeos_virtualize_irq(unsigned irq, void (*handler)(void), int (*acknowledge)(unsigned));
Provide a handler and an acknowledgment function for "irq".

void adeos_control_irq(unsigned irq, unsigned clrmask, unsigned setmask);
Change the current domain's handling mask for irq "irq". "clrmask" is applied first and then "setmask" is applied.

void adeos_stall_ipipe(void);
Stall the current domain's ipipe stage. Alternative to cli.

void adeos_unstall_ipipe(void);
Unstall the current domain's ipipe stage. Alternative to sti.

void adeos_restore_ipipe(unsigned x);
Restore the ipipe from its saved state. Alternative to __restore_flags() and local_irq_restore(). This is used with the following defines:
#define adeos_test_ipipe() test_bit(IPIPE_STALL_FLAG,&adp_current->status)
#define adeos_test_and_stall_ipipe() test_and_set_bit(IPIPE_STALL_FLAG,&adp_current->status)
Which replace __save_flags and local_irq_save(), respectively.

In Linux's case, adeos_register_domain() is called very early during system startup. set_intr_gate() in arch/i386/kernel/traps.c is then modified to call on adeos_virtualize_irq() so that Linux would tell the ipipe that it needs the irq passed to set_intr_gate().

To add your domain to the ipipe, you need to:

1. Register your domain with Adeos using adeos_register_domain()
2. Call adeos_virtualize_irq() for all the IRQs you wish to be notified about in the ipipe.

That's it. Provided you gave Adeos appropriate handlers in step #2, your interrupts will be delivered via the ipipe.

During runtime, you may change your position in the ipipe using adeos_renice_domain(). You may also stall/unstall the pipeline and change the ipipe's handling of the interrupts according to your needs.

We currently don't support SMP, but we do have APIC support on UP.

Here are some of the possible uses for Adeos (this list is far from complete):

1. Much like User-Mode Linux, it should now be possible to have 2 Linux kernels living side-by-side on the same hardware. In contrast to UML, this would not be 2 kernels one ontop of the other, but really side-by-side. Since Linux can be told at boot time to use only one portion of the available RAM, on a 128MB machine this would mean that the first could be made to use the 0-64MB space and the second would use the 64-128MB space. We realize that many modifications are required. Among other things, one of the 2 kernels will not need to conduct hardware initialization. Nevertheless, this possibility should be studied closer.
2. It follows from #1 that adding other kernels beside Linux should be feasible. BSD is a prime candidate, but it would also be nice to see what virtualizers such as VMWare and Plex86 could do with Adeos. Proprietary operating systems could potentially also be accomodated.
3. All the previous work that has been done on nanokernels should now be easily ported to Linux. Mainly, we would be very interested to hear about extensions to Adeos. Primarily, we have no mechanisms currently enabling multiple domains to share information. The papers mentioned earlier provide such mechanisms, but we'd like to see actual practical examples.
4. By incorporating Adeos into the main kernel tree (I know my inbox is probably going to fill up because of this one), kernel debuggers' main problem (tapping into the kernel's interrupts) is solved and it should then be possible to provide patchless kernel debuggers. They would then become loadable kernel modules.
5. Drivers who require absolute priority and dislike other kernel portions who use cli/sti can now create a domain of their own and place themselves before Linux in the ipipe. This provides a mechanism for the implementation of systems that can provide guaranteed realtime response.

Of course, we are interested in hearing about comments and suggestions you have about Adeos.

----------------------------------------------------------------------

Links to papers:

1. http://citeseer.nj.nec.com/probert91space.html
   ftp://ftp.cs.ucsb.edu/pub/papers/space/iwooos91.ps.gz (not working)
   http://www4.informatik.uni-erlangen.de/~tsthiel/Papers/Space-iwooos91.ps.gz
2. http://www.cs.ucsb.edu/research/trcs/abstracts/1995-06.shtml
   http://www4.informatik.uni-erlangen.de/~tsthiel/Papers/Space-trcs95-06.ps.gz
3. http://citeseer.nj.nec.com/kenneth94caching.html
   http://guir.cs.berkeley.edu/projects/osprelims/papers/cachmodel-OSkernel.ps.gz
4. http://citeseer.nj.nec.com/engler95exokernel.html
   ftp://ftp.cag.lcs.mit.edu/multiscale/exokernel.ps.Z

I'll quote the patent for you:

A process for [...] providing a general purpose operating system as one of the non-real time tasks; preempting the general purpose operating system as needed for the real time tasks; and preventing the general purpose operating system from blocking preemption of the non-real time tasks.

Nothing of this is in adeos. And nothing of this will be in the adeosized RTAI.

I fail to see how this is supposed to work, and I guess so does Keith.

Kai (a different Kai!) does not seem to want to integrate the core part of kbuild2.5. He seems to want to only pick the low-hanging fruits and make unsupported (and unbelievable) noises about the rest.

And Linus seems to want to ignore the fact that the core portion of kbuild2.5 is, by its very nature, not something that can be merged "gradually" - just like ALSA, or a new architecture, can't meaningfully be merged "gradually". (And he *also* said that he wasn't interested in pseudo-gradually, i.e. getting the stuff in parts but still making a big exchange.)

Frankly, I see *absolutely no way* how the current Kai-Linus "merge" can possibly end with something even remotely like Keith's kbuild2.5. Unless Linus changes his approach radically.

If I were Keith, I'd be rather upset, too.

Sequent had an interesting hint they cooked up with Oracle. (Or maybe it was the other way around.) As I recall they called it 'twotask.' Essentially Oracle clients processes spend a lot of time exchanging information with its server process. It usually makes sense to bind them to the same CPU in an SMP (and especially NUMA) machine. (Probably obvious to most of the folks on the group, but it is generally lots better to essentially communicate through the cache and local memory than across the NUMA bus.)

As I recall it made a significant difference in Oracle performance, and would probably also translate to similar performance in many situations where you had a client and server process doing lots of interaction in an SMP environment.

This isn't my thing but my flatmate had left a copy of solaris internals on the table ;)

This is briefly mentioned around about page 384 and appears to be targetted at userspace processes for exactly the cases you're suggesting (holding global resources).

A good entry point into the sun online documentation for this stuff is schedctl_init() - http://docs.sun.com/db?q=schedctl_init&p=/doc/816-0216/6m6ngupm0&a=view

Hm, what they export is a bit different. I wonder what the internal kernel interface is like (i.e. how close to sched_hint it is)?

Since they have a start_hint and stop_hint, that is where they are able to enforce their fairness. When you call stop, I suspect they penalize your timeslice by some amount similar to the duration from start to stop. If you don't call stop before you reschedule, then you probably forfeit a large chunk of your timeslice.

This would be doable with our scheduler - and perhaps even with minimal impact (which is my goal). However, since I wrote this more as an exercise in fun than something to merge, I do not know if it is worth it to make a whole infrastructure around this. Those who really see benefit (scientific computing or real-time or whatever) could just grab the patch, remove the permission check, and code their applications to fit -- they trust their application base.

Anyhow, to pique interest, here are some benchmark numbers. I have 5 pthreads contesting over a single semaphore. They loop, doing some busy looping, down the semaphore, busy loop, and then up the semaphore. Thus they use a lot of their timeslice and spend the rest of the time blocking on the semaphore. I let them loop a fixed number of times before exiting.

(These are average of ~10 runs)

With a call to sched_hint(HINT_TIME) after successfully downing the semaphore the avg total duration is 7233459 us. Without the sched_hint, the avg total duration is 7683220 us.

That is an improvement of 6% - with only 5 threads.

A quick glance shows a reduction in context switches, but what really matters is if we are entering schedule and neither (a) rescheduling the same task, or (b) running another thread that quickly blocks on the semaphore.

It is all academic anyhow...

Here's a patch which is designed to make the kernel play more nicely with portable computers. I've been using it for a couple of days and it seems to do the right thing. I'm wondering if anyone has any comments/suggestions/etc.

To test this code you'll also need http://www.zip.com.au/~akpm/linux/patches/2.4.20/pdflush-sysctl.patch (hmm. Server seems to be dead. So the patches are here, as attachments)

Here's the algorithm, from the Documentation/filesystems/proc.txt section describing /proc/sys/vm/:

laptop_mode
-----------

Setting this entry to '1' will put the kernel's dirty data writeout algorithms into a mode which is better suited to laptop/notebook computers. This mode is specifically designed to minimise the frequency of disk spinups. Laptop mode works as follows:

- Dirty data remains in memory for longer periods of time (controlled by laptop_writeback_centisecs).

- If there is pending dirty data and the disk is spun up for any reason (even for a read) then all dirty data will be written back shortly afterwards. ie: when the disk is spun up, make good use of it.

- When the decision is made to write back some dirty data, the kernel will write back all dirty data.

laptop_writeback_centisecs
--------------------------

This tunable determines the maximum age of dirty data when the machine is operating in Laptop mode. The default value is 30000 - five minutes. This means that if applications are generating a small amount of write traffic, the disk will spin up once per five minutes.

If the disk is spun up for any other reason (such as for a read) then all dirty data will be flushed anyway, and this timer is reset to zero.

laptop_writeback_centisecs has no effect when the machine is not operating in Laptop mode.

This implementation doesn't try to be very smart - there's a direct call out of do_ide_request() into the writeback code. This couldn't be done from within ll_rw_blk.c because then a write to the ramdisk would spin the disk up. Even as-is, a read from the IDE CDROM drive will cause the IDE hard disk to spin up and flush data, so probably that call in do_ide_request() should only be made if the device is writable. Suggestions are sought, but let's try not to get too fancy here...

Twenty it is, thanks.

BTW, the "use a gigabyte of readahead" idea would cause VM hysteria if you access a 600 megabyte file, so I've wound that back to twenty megs.

Also, it has been suggested that the feature become more fully-fleshed, to support desktops with one disk spun down, etc. It's not really rocket science to do that - the `struct backing_dev_info' gives a specific communication channel between the high-level VFS code and the request queue. But that would require significantly more surgery against the writeback code, so I'm fishing for requirements here. If the current (simple) patch is sufficient then, well, it is sufficient.

I have had a recent experience in using the "EXTRAVERSION" in the Linux 2.2.x Kernel series. The context of my question applies to both the 2.2.x and 2.4.x Linux Kernels.

The questions are:

1. Is there a specification that states the maximum length that the "EXTRAVERSION" string may be?
2. Does the Kernel make/build process enforce any specified limit of (1) above?

The EVMS team is announcing the next development release of the Enterprise Volume Management System, which will eventually become EVMS 2.0. Package 1.1.0-pre1 is now available for download at the project web site: http://www.sf.net/projects/evms

As this package is just a pre-releaes, only the source tarball is available for download. RPM files will be available when 1.1.0 is released.

Also, please use the appropriate level of caution when using this version! There are several very new features which have not yet undergone extensive testing! In other words, you probably shouldn't run this version on any critical systems.

Please report any problems or bugs to the EVMS mailing list: evms-devel@lists.sf.net.

Highlights for version 1.1.0-pre1 include:

v1.1.0-pre1 - 6/7/02

• Engine Core
  • Volume converting
    • Automatically changing a compatibility volume to an EVMS volume, and converting an EVMS volume to compatibility.
  • Add-A-Feature
    • Adding a new feature to an existing EVMS volume.
  • Plug-in-specific tasks
    • Currently used by RAID-1, RAID-5, and Snapshotting for certain actions.
  • Progress Indicators
    • Plug-ins can use this to indicate progress of long-running operations.
• GUI
  • Support for plug-in-specific tasks.
  • Support for converting compatibility volumes to EVMS volumes.
  • Support for adding a new feature to an existing EVMS volume.
  • Support for progress indicators (used by plug-ins).
• Command Line
  • Improved query system with new filters.
  • Support for converting compatibility volumes to EVMS volumes.
  • Support for adding a new feature to an existing EVMS volume.
• Filesystem Interface Modules (FSIMs)
  • Four new FSIM plug-ins
    • Ext2/Ext3
    • JFS
    • ReiserFS
    • Swap
• Snapshotting
  • Rollback - can revert all changes saved to the snapshot back to the original volume.
  • Asynchronous - choice of using asynchronous Copy-On-Writes for better performance, or synchronous COWs for better reliability.
• Software RAID
  • Improved method for handling incomplete RAID objects.
  • Improved I/O path.
• S/390 Segment Manager
  • Added multi-path I/O support in kernel.
  • Improved engine support.
• GPT Segment Manager
  • New segment manager for IA-64, GUID-Partition-Table partitions.