Technical Report - Microsoft Research

mechanisms to control resource utilization in a group of processes [4]. Java has incorporatedmany of these ideas into a new feature called isolates [41] similar to the existing concept ofAppDomains in Microsoft’s CLR. Singularity eliminates the duplication of resource managementand isolation mechanisms between an operating system and language runtime by providing aconsistent mechanism across all levels of the system. Singularity’s SIPs are closed and nonextensible,which provides a greater degree of isolation and fault tolerance than Java or CLRbasedapproaches, which share a common run-time system.7.3 Language SafetySafe programming languages are not recent phenomena. Pascal and Ada are safe, staticallyverifiable imperative languages. Modula-3, Dylan, and Java are safe object-oriented languages.Safe languages have become more popular with faster processors, more refined type systems, andimproved run-time systems. Nevertheless, they are not widely used for system implementationbecause their time and space overhead is higher than low-level languages such as C or C++ andthey offer little control over data layout. In Java, some of this overhead is attributable to thelanguage’s open execution environment, in which reflection and dynamic class loading constraina compiler’s ability to globally analyze and optimize code. Singularity eliminates these features,so a globally optimizing compiler can produce object code competitive with conventional, unsafelanguages [20].Another line of research has led to type safe dialects of C (but not C++). CCured is acompiler and run-time system that extensively analyzes C code to determine where it is staticallysafe [39]. It inserts run-time tests for properties that cannot be statically verified. Cyclone isanother safe C dialect [30]. It is less aggressive about inserting run-time tests than CCured, whichmay need to change the layout of structs to incorporate type information. Cyclone, however, canreject C programs as inherently unsafe. Vault is a more aggressive redesign of C, whichintroduces new safe language constructs and a specification language for explicit resourcemanagement and low-level data representations, It retain some binary compatibility with C anddoes not rely on garbage collection [14].A system that depends on language safety cannot trust a compiler, but must verify the safetyof code before it executes. If executables are delivered as typed intermediate languages, such asJava bytecodes or Microsoft’s MSIL, verification is a relatively straightforward process. This isthe approach that Singularity currently uses to ensure system and application code is type safe. Itis also possible to perform a similar verification on assembly language, if a compiler augments itwith type annotations [36, 38]. Low level, unverified, unsafe code is a potential weakness in anysystem, but is a particular problem in systems that do not rely on memory protection. Singularitycontains unsafe code at the lower levels of the language runtime and operating system. Verifyingthe safety of this code would help ensure system reliability. One area of active research isproducing a safe garbage collector [53].7.4 Defect Detection ToolsSingularity is designed to facilitate the operation of static defect detection tools. Analyzingsystems written in unsafe languages, such as C or C++, is difficult because these languages’ weakguarantees do not provide a clear semantics for use in a tool and are difficult to analyze andenforce. Tools for these languages are either heuristic [10, 16, 18, 31] or make guarantees underthe assumption that programs do not violate language semantics or use loopholes such as castingpointers to integers [5, 13]. Singularity is compiled into MSIL, which is a safe intermediatelanguage with a clear, albeit informal, semantics that provides a firm basis for program analysis.Another difficulty facing defect detection tools is the openness of the environment in whichcode executes. This openness arises from public interfaces that can be invoked in a variety of37