Technical Report - Microsoft Research

• Validation techniques ensure the end-to-end type safety of the compiler, compiled code,and run-time system. Typed intermediate and assembly language validate the properoperations of system components and ensure the language safety guarantees that underliesystem correctness.• Sound, specification-driven defect detection tools ensure the correctness of many aspectsof the system. A sound tool finds all occurrences of an error—along with falsepositives—and consequently can reliably indicate when a particular defect has beeneliminated. Specification-driven tools do not look for a hardwired collection of defects.They are extensible and can be adapted to check that many program or library-specificabstractions are used correctly.Languages and tools based on these advances are in use detecting and preventingprogramming errors. Less well explored is how these mechanisms enable deep changes in systemarchitecture, which in turn might advance the ultimate goal of preventing and mitigating softwaredefects [28].The rest of this paper describes the Singularity system in detail. Section 2 contains anoverview of the system and its novel aspects. Section 3 describes the Singularity systemarchitecture, focusing on the kernel, processes, and the language run-time system. Section 4describes the programming language support for the system. Section 5 describes the I/O andsecurity system. Section 6 provides some performance benchmarks. Section 7 surveys relatedwork. Appendix A contains a list of the kernel ABI calls.2 SingularitySingularity is a new operating system being developed as a basis for more dependablesystem and application software [28]. Singularity exploits advances in programming languagesand tools to create an environment in which software is more likely to be built correctly, programbehavior is easier to verify, and run-time failures can be contained.A key aspect of Singularity is an extension model based on Software-Isolated Processes(SIPs), which encapsulate pieces of an application or a system and provide information hiding,failure isolation, and strong interfaces. SIPs are used throughout the operating system andapplication software. We believe that building a system on this abstraction will lead to moredependable software.SIPs are the OS processes on Singularity. All code outside the kernel executes in a SIP. SIPsdiffer from conventional operating system processes in a number of ways:• SIPs are closed object spaces, not address spaces. Two Singularity processes cannotsimultaneously access an object. Communications between processes transfers exclusiveownership of data.• SIPs are closed code spaces. A process cannot dynamically load or generate code.• SIPs do not rely on memory management hardware for isolation. Multiple SIPs can residein a physical or virtual address space.• Communications between SIPs is through bidirectional, strongly typed, higher-orderchannels. A channel specifies its communications protocol as well as the valuestransferred, and both aspects are verified.• SIPs are inexpensive to create and communication between SIPs incurs low overhead.Low cost makes it practical to use SIPs as a fine-grain isolation and extensionmechanism.3