Aversion of this pap er app eared in the Pro ceedings of the Fifteenth Symp osium on Op erating Systems Principles Extensibility Safety and Performance in the SPIN Op erating System Brian N Bershad Stefan Savage PrzemyslawPardyak Emin Gun Sirer Marc E Fiuczynski David Becker Craig Chambers Susan Eggers Department of Computer Science and Engineering UniversityofWashington Seattle WA paging algorithms found in mo dern op erating systems Abstract can b e inappropriate for database applications result ing in p o or p erformance Stonebraker General pur This pap er describ es the motivation architecture and p ose network proto col implementations are frequently p erformance of SPIN an extensible op erating system inadequate for supp orting the demands of high p erfor SPIN provides an extension infrastructure together mance parallel applications von Eicken et al Other with a core set of extensible services that allow applica applications suchasmultimedia clients and servers and tions to safely change the op erating systems interface realtime and fault tolerant programs can also present and implementation Extensions allow an application to demands that p o orly match op erating system services sp ecialize the underlying op erating system in order to Using SPIN an application can extend the op erating achieve a particular level of p erformance and function systems interfaces and implementations to provide a ality SPIN uses language and linktime mechanisms to b etter matchbetween the needs of the application and inexp ensively exp ort negrained interfaces to op erat the p erformance and functional characteristics of the ing system services Extensions are written in a typ e system safe language and are dynamically linked into the op erating system kernel This approach oers extensions rapid access to system services while protecting the op Goals and approach erating system co de executing within the kernel address space SPIN and its extensions are written in Mo dula The goal of our research is to build a general purp ose and run on DEC Alpha workstations op erating system that provides extensibility safety and go o d p erformance Extensibilit y is determined bythe interfaces to services and resources that are exp orted Intro duction to applications it dep ends on an infrastructure that allows negrained access to system services Safetyde SPIN is an op erating system that can b e dynamically termines the exp osure of applications to the actions of sp ecialized to safely meet the p erformance and function others and requires that access b e controlled at the ality requirements of applications SPIN is motivated same granularity at which extensions are dened Fi by the need to supp ort applications that presentde nally go o d p erformance requires lowoverhead commu mands p o orly matched by an op erating systems imple nication b etween an extension and the system mentation or interface A p o orly matched implementa The design of SPIN reects our view that an op erat tion prevents an application from working well while a p o orly matched interface prevents it from working at all ing system can b e extensible safe and fast through the use of language and runtime services that provide low For example the implementations of disk buering and cost negrained protected access to op erating system This researchwas sp onsored by the Advanced Research resources Sp ecicallythe SPIN op erating system re Pro jects Agency the National Science Foundation Grants no CDA and CCR and by an equipmentgrant liesonfourtechniques implemented at the level of the from Digital Equipment Corp oration Bershad was partially sup language or its runtime p orted by a National Science Foundation Presidential FacultyFel lowship Chamb ers was partially sp onsored by a National Science Foundation Presidential Young Investigator Award Sirer was Colocation Op erating system extensions are dy supp orted by an IBM Graduate StudentFellowship Fiuczynski namically linked into the kernel virtual address was partially supp orted by a National Science Foundation GEE space Colo cation enables communication b etween Fellowship system and extension co de to havelow cost to system services is written in the systems safe ex Enforcedmodularity Extensions are written in tension language For example wehaveused SPIN to Mo dula Nelson a mo dular programming lan implement a UNIX op erating system server The bulk guage for which the compiler enforces interface of the server is written in C and executes within its own b oundaries b etween mo dules Extensions which address space as do applications The server consists execute in the kernels virtual address space can of a large b o dy of co de that implements the DEC OSF not access memory or execute privileged instruc SPIN ex system call interface and a small number of tions unless they have b een given explicit access tensions that provide the thread virtual memory and through an interface Mo dularity enforced bythe device interfaces required by the server compiler enables mo dules to b e isolated from one another with low cost Wehave also used extensions to sp ecialize SPIN to the needs of individual application programs For ex Logical protection domains Extensions exist ample wehave built a clientserver video system that within logical protection domains which are ker requires few control and data transfers as images move nel namespaces that contain co de and exp orted in from the servers disk to the clients screen Using SPIN terfaces Interfaces which are languagelevel units the server denes an extension that implements a direct represent views on system resources that are pro stream b etween the disk and the network The client tected by the op erating system An inkernel dy viewer application installs an extension into the kernel namic linker resolves co de in separate logical pro that decompresses incoming network video packets and tection domains at runtime enabling crossdomain displays them to the video frame buer communication to o ccur with the overhead of a pro cedure call The rest of this pap er Dynamic cal l binding Extensions execute in re The rest of this pap er describ es the motivation design sp onse to system events An event can describ e and p erformance of SPIN In the next section we moti any p otential action in the system such as a virtual vate the need for extensible op erating systems and dis memory page fault or the scheduling of a thread cuss related work In Section we describ e the sys Events are declared within interfaces and can b e tems architecture in terms of its protection and exten dispatched with the overhead of a pro cedure call sion facilities In Section we describ e the core services provided by the system In Section we discuss the Colo cation enforced mo dularity logical protection systems p erformance and compare it against that of domains and dynamic call binding enable interfaces to several other op erating systems In Section we discuss b e dened and safely accessed with lowoverhead How our exp eriences writing an op erating system in Mo dula ever these techniques do not guarantee the systems ex Finally in Section we present our conclusions tensibility Ultimately extensibilityisachieved through the system service interfaces themselves which dene the set of resources and op erations that are exp orted to applications SPIN provides a set of interfaces to Motivation core system services such as memory management and scheduling that rely on colo cation to eciently exp ort Most op erating systems are forced to balance gener negrained op erations enforced mo dularity and logical ality and sp ecialization A general system runs many protection domains to manage protection and dynamic programs but may run few well In contrast a sp e call binding to dene relationships b etween system com cialized system may run few programs but runs them p onents and extensions at runtime all well In practice most general systems can with some eort b e sp ecialized to address the p erformance and functional requiremen ts of a particular applications System overview needs suchasinterpro cess communication synchro The SPIN op erating system consists of a set of extension nization thread management networking virtual mem services and core system services that execute within the ory and cache managementDraves et al Bershad kernels virtual address space Extensions can b e loaded et al b Sto dolsky et al Bershad Yuhara into the kernel at any time Once loaded they integrate et al Maeda Bershad Felten Young themselves into the existing infrastructure and provide et al Harty Cheriton McNamee Armstrong system services sp ecic to the applications that require Anderson et al Fall Pasquale Wheeler them SPIN is primarily written in Mo dula which Bershad Romer et al Romer et al Cao allows extensions to directly use system interfaces with et al Unfortunately existing system structures out requiring runtime conversion when communicating are not wellsuited for sp ecialization often requiring a with other system co de substantial programming eort to aect evenasmall Although SPIN relies on language features to ensure change in system b ehavior Moreover changes intended safety within the kernel applications can b e written in to improve the p erformance of one class of applications any language and execute within their own virtual ad can often degrade that of others As a result system dress space Only co de that requires lowlatency access sp ecialization is a costly and errorprone pro cess An extensible system is one