Fault isolation for device drivers
Fault isolation for device drivers
复制标题
设备驱动程序的故障隔离
DOI：
10.1109/dsn.2009.5270357
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
A. Tanenbaum
中科院分区：
文献类型：
--
作者：
J. Herder;H. Bos;Ben Gras;P. Homburg;A. Tanenbaum
这项工作探讨了隔离低级设备驱动程序的原则和实践，以提高操作系统的可靠性。特别是，我们将探讨驱动程序可以执行的操作，以及在触发错误的情况下如何防止错误传播。我们在一个开源的多服务器操作系统（MINIX 3）中建立了我们的想法的原型，该操作系统通过严格执行最小权限来隔离驱动程序，并使用基于广泛的软件实现的故障注入（SWIFI）测试的实用方法迭代地改进了我们的隔离技术。最后，在使用编程I/O和DMA随机注入4个不同以太网驱动程序的3,400,000个常见故障中，没有一个故障能够破坏我们的保护机制并使操作系统崩溃。总的来说，我们只遇到了一次挂起，但这似乎是由硬件错误引起的。
This work explores the principles and practice of isolating low-level device drivers in order to improve OS dependability. In particular, we explore the operations drivers can perform and how fault propagation in the event a bug is triggered can be prevented. We have prototyped our ideas in an open-source multiserver OS (MINIX 3) that isolates drivers by strictly enforcing least authority and iteratively refined our isolation techniques using a pragmatic approach based on extensive software-implemented fault-injection (SWIFI) testing. In the end, out of 3,400,000 common faults injected randomly into 4 different Ethernet drivers using both programmed I/O and DMA, no fault was able to break our protection mechanisms and crash the OS. In total, we experienced only one hang, but this appears to be caused by buggy hardware.