Device Driver Reliability - Advanced Operating Systems and Kernel Applications - page 19

Figure 2. The Nooks Isolation Manager as a layer between device drivers and the kernel. The black
lines indicate the minor changes needed to each.

design all driver-to-kernel and kernel-to-driver control

flow occurs through the communication mecha-
nism, and (2) all data transfer between the kernel
and driver is viewed and managed by Nooks'
object-tracking code (described below).
The interface between the extension, the NIM,
and the kernel is provided by a set of wrapper
stubs that are part of the interposition mechanism.
Wrappers resemble the stubs in an RPC system
that provide transparent control and data transfer
across address space (and machine) boundaries.
Nooks' stubs provide safe and transparent control
and data transfer between the kernel and driver.
Thus, from the driver's viewpoint, the stubs ap-
pear to be the kernel's extension API. From the
kernel's point of view, the stubs appear to be the
driver's function entry points.
In addition, wrapper stubs provide support for
recovery. When the driver functions correctly,
wrappers pass information about the state of the
driver to shadow drivers. During recovery, wrap-
pers disable communication between the driver
and the kernel to ensure that the kernel is isolated
from the recovery process.

Nooks operates as a layer that is inserted between
drivers and the OS kernel. This layer intercepts
all interactions between drivers and the kernel
to facilitate isolation and recovery. Figure 2
shows this new layer, called the Nooks Isolation
Manager ( NIM). Above the NIM is the operating
system kernel. The NIM function lines jutting
up into the kernel represent kernel-dependent
modifications, if any, the OS kernel program-
mer makes to insert Nooks into a particular OS.
These modifications need only be made once.
Underneath the NIM is the set of isolated drivers.
The function lines jutting down below the NIM
represent the changes, if any, the driver writer
makes to interface a specific driver or driver class
to Nooks. In general, no modifications should be
required at this level.
The NIM provides five major architectural
functions, as shown in Figure 2: interposition,
isolation, communication, object tracking, and
recovery.

Interposition

Isolation

The Nooks interposition mechanisms transpar-
ently integrate existing extensions into the Nooks
environment. Interposition code ensures that: (1)

The Nooks isolation mechanisms prevent driver
faults from damaging the kernel (or other isolated