ITR: Reliable Technologies for Operating Systems and Operating System Services

尽管在可扩展操作系统技术方面进行了数十年的研究，但设备驱动程序等扩展仍然是系统故障的重要原因。例如，在Windows XP中，驱动程序占最近报告的故障的85%。在这个项目中，研究人员正在为商品操作系统开发一个可靠性子系统。 他们的方法是通过将操作系统与驱动程序故障隔离来提高操作系统的可靠性。 他们的目标不是通过一个新的（和不兼容的）操作系统或驱动程序体系结构来实现完全的容错，而是在很少或不改变现有驱动程序和系统代码的情况下防止绝大多数由驱动程序引起的崩溃。 为了实现这一点，它们将驱动程序隔离在内核地址空间内的轻量级保护域中。驱动程序在内核模式下运行时基本不变，但通过软件和硬件手段防止其损坏内核。 该系统还跟踪驱动程序对内核资源的使用，以加快恢复过程中的自动清理。为了证明他们的方法的可行性，他们正在Linux操作系统中实现一个名为“Nooks”的系统，并使用它来隔离几个设备。 他们的初步结果表明，Nooks大大提高了操作系统的可靠性，能够捕捉到99%的可能导致系统崩溃的错误并快速恢复。虽然Nooks是为驱动程序设计的，但他们的技术也适用于其他内核扩展。 研究人员通过隔离内核模式文件系统和内核内互联网服务来证明这一点。总的来说，由于Nooks支持现有的C语言扩展，运行在通用操作系统和通用硬件上，并支持自动恢复，它代表了比以前针对安全可扩展性的标准所要求的专业架构和类型安全语言迈出的重要一步。

Despite decades of research in extensible operating systemtechnology, extensions such as device drivers remaina significant cause of system failures. In Windows XP, for example,drivers account for 85% of recently reported failures.In this project, the researchers are developing a reliability subsystemfor commodity operating systems. Their approach isto improve OS reliability by isolating the OS from driverfailures. Rather than guaranteeingcomplete fault tolerance through a new (and incompatible) OS ordriver architecture, their goal is to prevent the vast majority ofdriver-caused crashes with little or no change to existingdriver and system code. To achieve this, they isolate drivers withinlightweight protection domains inside the kernel address space.Drivers run largely unchanged in kernel mode, but are preventedfrom corrupting the kernel by both software and hardware means. The systemalso tracks a driver's use of kernel resources to hasten automaticclean-up during recovery.To prove the viability of their approach, they are implementing a systemcalled "Nooks" in the Linux operating system and are using itto fault-isolate several devicedrivers. Their initial results show that Nooks offers a substantial increasein the reliability of operating systems, catching and quicklyrecovering from 99% of the faults that would otherwise crash the system.While Nooks was designed for drivers, their techniques generalize toother kernel extensions as well. The researchers are demonstratingthis by isolating a kernel-mode file system and anin-kernel Internet service.Overall, because Nooks supports existing C-language extensions, runs on acommodity operating system and commodity hardware, and enablesautomated recovery, it represents a substantial step beyond thespecialized architectures and type-safe languages required by previousefforts directed at safe extensibility.