Deconstructing process isolation

TL;DR: To compare the performance of Singularity's SIPs against traditional isolation techniques, an optional hardware isolation mechanism was implemented and found that hardware-based isolation incurs non-trivial performance costs and complicates system implementation.

Abstract: Most operating systems enforce process isolation through hardware protection mechanisms such as memory segmentation, page mapping, and differentiated user and kernel instructions Singularity is a new operating system that uses software mechanisms to enforce process isolation A software isolated process (SIP) is a process whose boundaries are established by language safety rules and enforced by static type checking SIPs provide a low cost isolation mechanism that provides failure isolation and fast inter-process communicationTo compare the performance of Singularity's SIPs against traditional isolation techniques, we implemented an optional hardware isolation mechanism Protection domains are hardware-enforced address spaces, which can contain one or more SIPs Domains can either run at the kernel's privilege level or be fully isolated from the kernel and run at the normal application privilege level With protection domains, we can construct Singularity configurations that are similar to micro-kernel and monolithic kernel systems We found that hardware-based isolation incurs non-trivial performance costs (up to 25--33%) and complicates system implementation Software isolation has less than 5% overhead on these benchmarksThe lower run-time cost of SIPs makes their use feasible at a finer granularity than conventional processes However, hardware isolation remains valuable as a defense-in-depth against potential failures in software isolation mechanisms Singularity's ability to employ hardware isolation selectively enables careful balancing of the costs and benefits of each isolation technique