Process N-Modular Redundancy

HBFT captures the state of the entire virtual machine. Other approaches work at a smaller scale, specifically protecting the state of a process. This section will describe various techniques to perform process based N-Modular Redundancy (NMR).

Mushtag, Al-Ars and Bertels created a user-level based scheme for process protec- tion [MAAB13]. In their scheme a process is duplicated and each copy runs separately from the others. The execution of the process is divided into epochs were at each epoch a hash of modified memory is compared to each the other instances. If the hashes are the same one instance, the leader, creates a snapshot of itself and stores that snapshot for poten- tial recovery. The previous snapshot, if one exists, is discarded so only one snapshot ever exists. If the hashes do not match all the redundant copies are destroyed and new copies are created using the previous snapshot. Care is taken to ensure that non-deterministic functions such as gettimeofdate will return the same result across all instances. Fur- thermore, the order of execution for synchronization primitives is ensured to be identical

by adding a counter to locking mechanisms, e.g. mutexes. Whenever the leader process acquires a lock it increments the counter for the mutex. The follower threads are only per- mitted to acquire a mutex if the counter is set to the correct value, ensuring the acquisition of locks is the same across processes. As their approach is a user-level only approach to track modified memory at the beginning of each epoch memory is marked as read only by the process itself. A signal handler is registered to keep track of when read-only memory is written to and also changes the protection to be writable to allow execution to continue. Munk et al. [MAL+15] proposed a similar scheme for multi-core systems. Virtualized Fault Tolerance (VFT) presented in this thesis will use a similar process based NMR ap- proach but will take advantage of the Quest-V separation kernel design for isolation and use recovery techniques that do not require a checkpoint to be created and rolled back to when an error occurs [MAL+15].

I/O Adaptive Mixed-Criticality

Traditional Adaptive Mixed-Criticality analysis assumes tasks follow a periodic model. However, in practice tasks have different characteristics that lend them to be scheduled using different task models. Specifically, as previously discussed in Chapter 2, it has been shown that a system of Sporadic Servers for main tasks and Priority Inheritance Band- width Preserving Servers (PIBS) for interrupt bottom halves outperforms a system of just Sporadic Servers [DLW11]. This chapter will introduce I/O Adaptive Mixed-Criticality (IO-AMC), an Adaptive Mixed-Criticality (AMC) variant using both Sporadic Servers and PIBS. As with the previous work on Sporadic Server and PIBS this work is focused on the scheduling of tasks within a kernel which may or may not be in a Quest-V sandbox. Additionally, this work assumes tasks are independent of each other and therefore share no resources.

3.1

Response Time Analysis for SS and PIBS

In order to perform an Adaptive Mixed-Criticality analysis for a combined Sporadic Server and PIBS system, the response time analysis equation of the system must be derived. First, under the assumption that a Sporadic Server can be treated as an equivalent periodic task [Spr90], the response time equation for taskτi in a system of only Sporadic Servers

is the following: Ri = Ci+ X τj∈hp(i)  Ri Tj  Cj

where hp(i) is the set of tasks of equal or higher priority than task τi. Second, due to the

worst-case phasing of a combined system of PIBS and Sporadic Servers, a PIBS utilization bound of(2 − U ) U cannot repeatedly occur. The worst case phasing results in at most an additional capacity (i.e., execution time) of(Tq−TqUk) Ukfor PIBSτkassigned to the

Sporadic Serverτq. This is only possible if PIBS blocks waiting on I/O before consuming

its full budget capacity. Therefore, a tighter upper bound on the maximum interference a PIBS causes: I_kq(t) = (Tq−TqUk) Uk+  t Tq  TqUk = (1 − Uk) TqUk+  t Tq  TqUk =  1 + t Tq  − Uk  TqUk

This is incorporated into the response time analysis of Sporadic Server τi, in a system

consisting of both Sporadic Servers and PIBS, in the following way:

Ri = Ci+ X τj∈hp(i)  Ri Tj  Cj  + X τk∈ps max τq∈hip(i) {I_kq(Ri)} (3.1)

Where ps is the set of all PIBS and hip(i) =hp (i) ∪ {τi}, i.e. the set containing τi and

all tasks with equal or higher priority than taskτi. This is necessary as the PIBS can be

running on behalf of taskτi. In general, there is no a priori knowledge about which PIBS

interference caused by the PIBS must be considered. If such a priori knowledge existed, it could be used to reduce the possible set of Sporadic Servers on behalf of which a PIBS could be executing. However, without such knowledge all possible Sporadic Server tasks of equal or higher priority must be considered.

The response time analysis for a PIBS is therefore dependent on the associated Spo- radic Server. The response time analysis for PIBSτp when assigned to Sporadic Serverτs

is: sRp = (2 − Up) UpTs+ X τj∈hip(s)  sRp Tj  Cj  + X τk∈ps\{τp} max τq∈hip(s) {I_kq(sRp)} (3.2)

Note that(2−Up) UpTsis the maximum execution time of the PIBS over a time window of

Ts, i.e.Ips(Ts) = (2−Up) UpTs. Besides the first terms differing, Equation 3.2 differs from

Equation 3.1 in that hip(s) is used instead of hp (s) for the set of Sporadic Servers. This is because Sporadic Serverτsmust be included as it has an equal priority to PIBSτp when

τp is running on behalf of τs. Also, the summation over all PIBS does not include PIBS

τp when determining its response time. IfsRp≤Ts, for each and every Sporadic Serverτs

thatτp can be assigned to, thenτpwill never miss a deadline.

3.2

System Model and Analysis

This section describes the system model for I/O Adaptive Mixed-Criticality (IO-AMC), comprising both Sporadic Servers and Priority Inheritance Bandwidth-Preserving Servers (PIBS). IO-AMC focuses on the scheduling of I/O events and application threads in a mixed-criticality setting. Based on the IO-AMC model, we will derive a response time

bound, IO-AMC-rtb, for Sporadic Servers and PIBS.