In many computer systems, it's important to protect different applications or groups of applications from others. You don't want one application—whether defective or malicious—to corrupt another or prevent it from running.
To address this issue, some systems use virtual walls, called partitions, around a set of applications to ensure that each partition is given an engineered set of resources. The primary resource considered is CPU time, but can also include any shared resource, such as memory and file space (disk or flash).
Figure 1. Static partitions guarantee that processes get the resources specified by the system designer.Partitions provide:
- memory protection—each partition is discrete and controlled by the Memory Management Unit (MMU)
- overload protection—each partition is guaranteed a slice of execution time, as specified by the system designer
By using multiple partitions, you can avoid having a single point of failure. For example, a runaway process can't occupy the entire system's resources; processes in other partitions still receive their allocated share of system resources.
Even without adaptive partitioning, QNX Neutrino's process model provides significantly more protection than some other operating systems do, including:
- full memory protection between processes
- message-passing to provide uniform and controlled IPC
- priority inheritance with a clean client-server model
- hard realtime deterministic scheduling
- a detailed permission model for devices, files, and memory
- memory, file-descriptor, CPU, and priority limits, using the POSIX setrlimit() function to constrain runaway processes
Typically, the main objective of resource partitioning on other systems is to divide a computer into a set of smaller computers that interact as little as possible; however, this approach isn't very flexible. In QNX Neutrino, adaptive partitioning takes a much more flexible view.
Our partitions are adaptive because:
- you can change configurations at run time
- they're typically fixed at one configuration time
- the partition behavior auto-adapts to conditions at run time. For example:
- free time is redistributed to other scheduler partitions
- filesystems can bill time to clients with a mechanism that temporarily moves threads between time partitions