The State of COMPOSITE∗

I. THE TAO OF COMPOSITE. COMPOSITE is a component-based operating system that has been under development since 2006 with design goals including configurability, predictability, and reliability. Unlike many previous component-based operating systems that focus on kernelbased configurability, COMPOSITE implements most system policies, mechanisms and abstractions as user-level, hardwareprotected, fine-grained units of functionality that are harnessed through well-defined interfaces. COMPOSITE’s structure is most similar to μ-kernels: “A concept is tolerated inside the microkernel only if moving it outside the kernel, i.e., permitting competing implementations, would prevent the implementation of the system’s required functionality”[1]. COMPOSITE philosophically expands on this in two ways: 1) Component-based policy definition. We strive to eliminate policies from the kernel, thus including only mechanisms. This enables for both customized resource management, and for designers to trade between complexity and TCB size, for flexibility and capability. Though the line between policy and mechanism is not clean [2], functionality common to most modern microkernels including scheduling and structured memory mapping is moved to user-level components where it can be redefined. Unlike exokernels [3] we avoid distributed management of resources, instead centralizing the policy into specific manager components. To enable flexibility of resource management (diversity of policy), resource managment abstraction is enabled via inter-component protocols to hierarchically control scheduling, manage memory, or perform I/O [4]. This support enables concurrent execution of multiple virtual environments that trade between heightened isolation with customized resource management, and resource sharing. 2) System behavior via composition of fine-grained components. One of the most successful component-based systems is the UNIX command line, based on the composition of simple programs into pipelines of complex functionality. COMPOSITE emphasizes the composition of complex systems from finegrained components. The structure of this composition is a general DAG, and the functional protocols between components are encoded in explicit interfaces. Though a pervasive separation of concerns, and extensive interface-level polymorphism, developers have significant leeway in programming a system all the way down to resource management policies at the composition-level. Mutable Protection Domains enables protection boundaries between components to be dynamically raised and lowered [5] to trade protection and performance. Collections of components can be collapsed into the same protection domain to mimic the structure of μ-kernels, monolithic systems, or exokernels. This