FlaRe: Efficient Capability Semantics for Timely Processor Access

In the seL4 microkernel and other capability-based OSs, the right to use resources is managed using abstract capabilities (i.e., tokens). Capability systems for fungible resources such as memory are well understood, but it has proven difficult to integrate time—i.e., real-time scheduling—into this model, since timeliness (i.e., system-wide schedulability) is a property that is inherently difficult to isolate (without introducing prohibitive inefficiencies). This paper presents FlaRe, a temporal capability system that ensures schedulability and temporal isolation by design. Crucially, FlaRe is shown to be efficient, both analytically (FlaRe does not cause utilization loss) and in practice (two prototypes in seL4 and LITMUS were found to incur only negligible overheads). The key technique employed is the flattening of a hierarchical tree of reservations to regular, non-hierarchical EDF scheduling.