1. Tessellation: Refactoring the OS around Explicit Resource Containers with Continuous Adaptation John Kubiatowicz UC Berkeley June 5 th, 2013 Juan Colmenares, Gage Eads, Steven Hofmeyr, Sarah Bird, Miquel Moreto, David Chou, Brian Gluzman, Eric Roman, Davide Bartolini, Nitesh Mor, Krste Asanovic

2. Slide 2June 5 th, 2013DAC 2013, Special Session on Embedded OS Resources in a Smart Space Potential Displays Everywhere – Walls, Tables, Appliances, Smart Phones, Google Glasses…. Audio Output Everywhere Inputs Everywhere – Touch Surfaces – Cameras/ Gesture Tracking – Voice Context Tracking – Who is Where – What do they want – Which Inputs map to which applications

3. Slide 3June 5 th, 2013DAC 2013, Special Session on Embedded OS Support for Applications Real Time Requirements – Sophisticated multimedia interactions – Control of/interaction with health-related devices Responsiveness Requirements – Provide a good interactive experience to users Explicitly Parallel Components – However, parallelism may be “hard won” (not embarrassingly parallel) – Must not interfere with this parallelism Direct Interaction with Cloud services (including storage and compute) – Potentially extensive use of remote services – Serious security/data vulnerability concerns No existing OS handles all of these well….

4. Slide 4June 5 th, 2013DAC 2013, Special Session on Embedded OS Changing the Structure of Operating Systems (and Applications that run on them)

5. Slide 5June 5 th, 2013DAC 2013, Special Session on Embedded OS Guaranteeing Resources What might we want to guarantee? – Examples: Guarantees of BW (say data committed to Cloud Storage) Guarantees of Requests/Unit time (DB service) Guarantees of Latency to Response (Deadline scheduling) Guarantees of maximum time to Durability in cloud Guarantees of total energy/battery power available to Cell What level of guarantee? – Firm Guarantee (Better than existing systems) With high confidence (specified), Maximum deviation, etc. What does it mean to have guaranteed resources? – A Service Level Agreement (SLA)? – Something else? “Impedance-mismatch” problem – The SLA guarantees properties that programmer/user wants – The resources required to satisfy SLA are not things that programmer/user really understands

6. Slide 6June 5 th, 2013DAC 2013, Special Session on Embedded OS Resource Allocation must be Adaptive Three applications: – 2 Guaranteed Performance apps (RayTrace, Swaptions) – 1 Best-Effort App (Fluidanimate) Fraction Swaptions Throughput Fraction RayTRace Throughput

7. Slide 7June 5 th, 2013DAC 2013, Special Session on Embedded OS New Abstraction: the Cell Properties of a Cell – A user-level software component with guaranteed resources – Has full control over resources it owns (“Bare Metal”) – Contains at least one memory protection domain (possibly more) – Contains a set of secured channel endpoints to other Cells – Contains a security context which may protect and decrypt information When mapped to the hardware, a cell gets: – Gang-schedule hardware thread resources (“Harts”) – Guaranteed fractions of other physical resources Physical Pages (DRAM), Cache partitions, memory bandwidth, power – Guaranteed fractions of system services Predictability of performance  – Ability to model performance vs resources – Ability for user-level schedulers to better provide QoS

8. Slide 8June 5 th, 2013DAC 2013, Special Session on Embedded OS Implementing Cells: Space-Time Partitioning Spatial Partition: Performance isolation – Each partition receives a vector of basic resources A number HW threads Chunk of physical memory A portion of shared cache A fraction of memory BW Shared fractions of services Partitioning varies over time – Fine-grained multiplexing and guarantee of resources Resources are gang-scheduled Controlled multiplexing, not uncontrolled virtualization Partitioning adapted to the system’s needs Time Space Space

9. Slide 9June 5 th, 2013DAC 2013, Special Session on Embedded OS Applications Composed of Interconnected Cells Component-based model of computation – Applications consist of interacting components – Components may be local or remote Communication impacts Security and Performance – Channels are points at which data may be compromised – Channels define points for QoS constraints Naming process for initiating endpoints – Need to find compatible remote services – Continuous adaptation: links changing over time! SecureChannel Device Drivers File Service SecureChannel SecureChannel SecureChannel SecureChannel Real-Time Cells (Audio, Video) Core Application Parallel Library

10. Slide 10June 5 th, 2013DAC 2013, Special Session on Embedded OS Impact on the Programmer Connected graph of Cells  Object-Oriented Programming – Lowest-Impact: Wrap a functional interface around channel Cells hold “Objects”, Channels carry RPCs for “method calls” – Greater Parallelism: Event triggered programming Shared services complicate resource isolation: – How to provide each client with guaranteed fraction of service? Must somehow request the right number of resources – Analytically? AdHoc Profiling? Over commitment of resources? – Clearly doesn’t make it easy to adapt to changes in environment SecureChannel SecureChannel Application B Application A Shared File Service

11. Slide 11June 5 th, 2013DAC 2013, Special Session on Embedded OS Custom Adaptive User-Level Scheduling

12. Slide 12June 5 th, 2013DAC 2013, Special Session on Embedded OS Frameworks for User-Level Runtimes PULSE : Preemptive User-Level SchEdulers Framework Components – Hardware threads (harts) – Timer Interrupts for preemption Able to handle cell resizing – Automatic simulation of suspended scheduler segments Available schedulers – Round-robin (and pthreads) – EDF and Fixed Priority – Constant Bandwidth Server (M-CBS) – Juggle: load balancing SPMD apps Other framework: Lithe – Non-preemptive, Cooperative – Allows construction of schedulers that cooperate with libraries in handling processor resources. Tessellation Kernel (Partition Support) Tessellation Kernel (Partition Support) Application Cell PULSE Framework Scheduler X Hardware cores Timer interrupts

13. Slide 13June 5 th, 2013DAC 2013, Special Session on Embedded OS GUI Service Provides differentiated service to applications – Soft service-time guarantees – Performance isolation from other applications Operates on user-meaningful “actions” – E.g. “draw frame”, “move window” Exploits task parallelism for improved service times QoS-aware Scheduler

14. Slide 14June 5 th, 2013DAC 2013, Special Session on Embedded OS GUI Service Architecture

15. Slide 15June 5 th, 2013DAC 2013, Special Session on Embedded OS Performance of GUI Service Nano-X/ Linux Nano-X/ Tess GuiServ(1)/ Tess GuiServ(2)/ Tess GuiServ(4)/ Tess Out of 4000 frames

16. Slide 16June 5 th, 2013DAC 2013, Special Session on Embedded OS Network Service Supports reservations and proportional share of bandwidth – Using mClock scheduling algorithm (on top of PULSE) NIC driver is entirely contained in user-space – No system calls to transmit and receive buffers

17. Slide 17June 5 th, 2013DAC 2013, Special Session on Embedded OS Resource Distribution and Adaptation

18. Slide 18June 5 th, 2013DAC 2013, Special Session on Embedded OS Two Level Scheduling: Control vs Data Plane Split monolithic scheduling into two pieces: – Course-Grained Resource Allocation and Distribution to Cells Chunks of resources (CPUs, Memory Bandwidth, QoS to Services) Ultimately a hierarchical process negotiated with service providers – Fine-Grained (User-Level) Application-Specific Scheduling Applications allowed to utilize their resources in any way they see fit Performance Isolation: Other components of the system cannot interfere with Cells use of resources Monolithic CPU and Resource Scheduling Application Specific Scheduling Resource Allocation And Distribution Two-Level Scheduling

19. Slide 19June 5 th, 2013DAC 2013, Special Session on Embedded OS Performance-Aware Convex Optimization for Resource Allocation Express problem as an optimization with constraints – Maximize for throughput, performance, battery life, etc. Measure performance as a function of resources for each application – Create performance model – Refine performance function from application history Combine resource-value functions and QoS requirements to make resource decisions – Application is given enough resources for QoS – Turn off resources that don’t improve the system – Developers don’t need to understand resources Basic Solution to Impedance Mismatch problem

20. Slide 20June 5 th, 2013DAC 2013, Special Session on Embedded OS System Penalty Allocations 1 Allocations 2 Continuously minimize the penalty of the system (subject to restrictions on the total amount of resources) Response Time 1 Penalty 1 Response Time 2 ( (0,2), …, (n-1,2) ) Response Time 2 Response Time i Penalty Function Penalty 2 Penalty i Set of Running Applications Resource Allocation using Convex Optimization with Online Application Performance Models Response Time Function Response Time 1 ( (0,1), …, (n-1,1) ) Speech Recognition Stencil Graph Traversal Response Time i ( (0,i), …, (n-1,i) ) PACORA

21. Slide 21June 5 th, 2013DAC 2013, Special Session on Embedded OS Feedback Driven Policies Generic Policies do well but online exploration can cause oscillations in performance Example: Video Player interaction with Network – Server or GUI changes between high and low bit rate – Goal: set guaranteed network rate: Alternative: Application Driven Policy – Static models – Let network choose when to decrease allocation – Application-informed metrics such as needed BW

22. Slide 22June 5 th, 2013DAC 2013, Special Session on Embedded OS Tessellation Kernel (Trusted) Architecture of Tessellation OS RAB Service STRG Validator Resource Planner Partition Mapping and Multiplexing Layer Partition Multiplexing Partition Mechanism Layer QoS Enforcement Partition Implementation Channel Authenticator Partitionable (and Trusted) Hardware Cores Physical Memory Network Bandwidth Cache/ Local Store NICs Major Change Request ACK/NACK Cell Creation and Resizing Requests From Users Admission Control Minor Changes ACK/NACK Cell All system resources Cell group with fraction of resources Cell Space-Time Resource Graph (STRG) (Current Resources) Global Policies / User Policies and Preferences Resource Allocation And Adaptation Mechanism Offline Models and Behavioral Parameters Online Performance Monitoring, Model Building, and Prediction Performance Counters Partition #1Partition #2 Partition #3 Cell #1 Cell #2 Cell #3 User/System Performance Reports TPM/ Crypto

23. Slide 23June 5 th, 2013DAC 2013, Special Session on Embedded OS Application1 QoS-aware Scheduler Block Service QoS-aware Scheduler Network Service QoS-aware Scheduler GUI Service Channel Running System (Data Plane) Application2 Channel Performance Reports Resource Assignments Resource Allocation (Control Plane) Partitioning and Distribution Observation and Modeling Adaptive Resource-Centric Computing (ARCC)

24. Slide 24June 5 th, 2013DAC 2013, Special Session on Embedded OS On Toward the Swarm

25. Slide 25June 5 th, 2013DAC 2013, Special Session on Embedded OS Support for the Swarm: – Discover and Manage resource – Integrate sensors, portable devices, cloud components – Guarantee responsiveness, real-time behavior, throughput – Self-adapt to adjust for failure and provide performance predictability – Secure, high-performance, durable, available data Metropolitan Middleware Meeting the needs of the Swarm Personal Swarm Cloud Services

26. Slide 26June 5 th, 2013DAC 2013, Special Session on Embedded OS Cell as Ubiquitous Swarm Primitive Should every component in system host Cells? – Even sensors!? – What is minimal support? Security Primitives Communication support – Alternative: Bare sensors do not host Cells Mobile Environment – Constant changes in resource availability – Adaptation in resource requirements – Change connected graph continuously  Dynamic SLAs? Hierarchical Resource Broker Architecture – Many overlapping broker domains – Resource Ontologies? Cell is a natural way to handle heterogeneity – From the outside: export services to other Cells

27. Slide 27June 5 th, 2013DAC 2013, Special Session on Embedded OS Brokering Service: The Hierarchy of Ownership Discover Resources in “Domain” – Devices, Services, Other Brokers – Resources self-describing? Allocate and Distribute Resources to Cells that need them – Solve Impedance-mismatch problem – Dynamically optimize execution – Hand out Service-Level Agreements (SLAs) to Cells – Deny admission to Cells which violate existing agreements Complete hierarchy – World graph of applications Local Broker Sibling Broker Parent Broker Child Broker

28. Slide 28June 5 th, 2013DAC 2013, Special Session on Embedded OS On Demand Video Conference Local Resources – Display, Compute (encoding, rendering), Video Cameras, Microphones, Speakers Brokered resources – Request Bandwidth reservations along path from source to destination Openflow? QoS API – Request service from compute for rendering – Guaranteed path to data storage Universal Tivo

29. Slide 29June 5 th, 2013DAC 2013, Special Session on Embedded OS DataCentric Vision Hardware resources are a commodity – Computation resource fails? Get another – Sensor fails? Find another – Change your location? Find new resources All that really matters is the data! – Integrity, Privacy, Availability, Durability – Hardware to prevent accidental information leakage Permanent state handled by Universal Data Storage, Distribution, and Archiving Oceanstore Metric of Interest: – 1Mole of Bytes 6×10 23 bytes (i.e. a YottaByte)

30. Slide 30June 5 th, 2013DAC 2013, Special Session on Embedded OS Universal Data: The Great Integrator Universal Data Plane: Archival Storage+Streaming Personal Cache Aggregate/Filter Universal Tivo Cloud Services

31. Slide 31June 5 th, 2013DAC 2013, Special Session on Embedded OS Conclusion Adaptive Resource-Centric Computing – Use of Resources negotiated hierarchically – Underlying Execution environment guarantees QoS – New Resources constructed from Old ones: Aggregate resources in combination with QoS-Aware Scheduler Result is a new resource that can be negotiated for – Continual adaptation and optimization Important components of future OS environment – Cells as Basic Unit of Resource and Security User-Level Software Component with Guaranteed Resources Secure Channels to other Cells – Observation, Monitoring, and Adaptation layers Machine learning, Convex Optimization – Portable Secure Data infrastructure If you can name it, you can use it Tessellation OS: http://tessellation.cs.berkeley.edu SwarmLab: http://swarmlab.eecs.berkeley.edu