Abstract: In one embodiment, a microkernel of an operating system executing on a computing system receives, from an application, a first system call requesting to communicate with a service registry. The first system call being associated with an operation request. The microkernel sends a first instruction to the service registry. The microkernel receives, from the service registry, a second system call requesting to communicate with at least one of an application service or a protocol service. The second system call being associated with the operation request. The microkernel sends a second instruction to at least one of the application service or the protocol service. The microkernel receives, from at least one of the application service or the protocol service, a third system call requesting to communicate with a driver service. The third system call being associated with the operation request. The microkernel sends a third instruction to the driver service.

Abstract: In one embodiment, a method includes generating a handle that references a checkpoint for a service, sending the handle to the service, wherein the handle is configured to be used by the service to store one or more states of the service in the checkpoint, determining that the service needs to be restarted, restarting the service, accessing the handle for the checkpoint, and sending the handle for the checkpoint to the restarted service, wherein the handle for the checkpoint is configured to be used by the restarted service to restore the one or more states.

Abstract: In one embodiment, a method includes generating one or more queues by an application executing on a client system, wherein each queue is associated with one or more declarative attributes, wherein each declarative attribute declares a processing requirement or a processing preference, generating one or more work items to be processed, for each of the one or more work items enqueuing the work item into a selected one of the one or more queues based on the one or more declarative attributes associated with the selected queue, and providing the one or more queues to a scheduler of an operating system of the client system, wherein the scheduler is configured to schedule each of the one or more work items for processing based on one or more policies and the one or more declarative attributes of the selected queue for that work item.

Abstract: In one embodiment, a method includes allocating, by an operating system of a computing device, computer-implemented memory into a discardable portion and a durable portion; receiving, from a computer-executable program, a designation indicator of a particular data file that is associated with the computer-executable program indicating that the particular file is to be stored in the discardable portion of the memory and in response, storing the particular data file in one or more particular pages of the discardable portion of the memory; identifying an occurrence of a computing condition and in response, marking the one or more particular pages that include the particular data file as invalid for the computer-executable program; receiving, from the computer-executable program, a request for the particular data file; and in response to receiving the request, providing, to the computer-executable program, a notification that the particular data file is invalid for the computer-executable program.

Abstract: In one embodiment, an access control method includes receiving an access request that identifies a resource and an application requesting the resource. The method includes identifying permission settings associated with the application, where the permission settings include a contextual criterion. The method includes accessing context information associated with the contextual criterion. The method includes determining the context information satisfies the contextual criterion of the permission settings. The method includes allowing the application to access the resource in response to determining the context information satisfies the contextual criterion of the permission settings.

Abstract: In one embodiment, an access control method includes receiving, from an application, a permission rule defining a criterion for permitting the application to access a resource, where the criterion identifies a logic predefined by the operating system and a condition for satisfying the logic. The method includes storing the permission rule and associating the stored permission rule with the application. The method includes receiving, from the application, a request to access the resource. The method includes accessing the stored permission rule associated with the application. The method includes determining that the application is permitted to access the resource by processing the logic and the condition. The method includes allowing the application to access the resource.

Abstract: In one embodiment, a method includes allocating a shared memory region accessible by a tracing service and services running in user mode outside of a microkernel of an operating system, in which the shared memory region is used by each service to store entries of execution data from operations executed by the service and each entry of execution data has a task identifier, receiving a query for execution data with a desired task identifier by the tracing service, retrieving a set of entries of execution data from the shared memory region by the tracing service based on the desired task identifier, in which the task identifier of each entry of execution data in the set matches the desired task identifier, and returning the set of entries of execution data by the tracing service.

Abstract: In one embodiment, a method includes receiving an augmented-reality object and an associated display rule from each of a plurality of third-party systems, receiving one or more signals associated with a current view of an environment of a first user from a client system associated with the first user, selecting at least one of the augmented-reality objects received from the plurality of third-party systems based on the one or more signals and the display rule associated with the selected augmented-reality object, and sending instructions for presenting the selected augmented-reality object with the current view of the environment to the client system.

Abstract: In one embodiment, a microkernel of an operating system executing on a computing system receives, from an application, a first system call requesting to communicate with a service registry. The first system call being associated with an operation request. The microkernel sends a first instruction to the service registry. The microkernel receives, from the service registry, a second system call requesting to communicate with at least one of an application service or a protocol service. The second system call being associated with the operation request. The microkernel sends a second instruction to at least one of the application service or the protocol service. The microkernel receives, from at least one of the application service or the protocol service, a third system call requesting to communicate with a driver service. The third system call being associated with the operation request. The microkernel sends a third instruction to the driver service.

Abstract: In one embodiment, a kernel of an operating system executing on a computing system receives a system call from a process requesting to perform an operation on a kernel object. The system call includes an object handle to the kernel object. The kernel accesses, from a memory space allocated to the kernel, data associated with the object handle. The data identifies an object type of the kernel object and specifies a bit string. The kernel identifies, based on the object type and the bit string, a list of capabilities of the process. The kernel determines whether the process has permission to perform the operation on the kernel object by comparing the operation to the list of capabilities. The kernel, in response to determining the process has permission to perform the operation, allows the operation on the kernel object to be performed.

Abstract: In one embodiment, a method includes generating a handle that references a checkpoint for a service, sending the handle to the service, wherein the handle is configured to be used by the service to store one or more states of the service in the checkpoint, determining that the service needs to be restarted, restarting the service, accessing the handle for the checkpoint, and sending the handle for the checkpoint to the restarted service, wherein the handle for the checkpoint is configured to be used by the restarted service to restore the one or more states.

Abstract: In one embodiment, a method includes allocating, by an operating system of a computing device, computer-implemented memory into a discardable portion and a durable portion; receiving, from a computer-executable program, a designation indicator of a particular data file that is associated with the computer-executable program indicating that the particular file is to be stored in the discardable portion of the memory and in response, storing the particular data file in one or more particular pages of the discardable portion of the memory; identifying an occurrence of a computing condition and in response, marking the one or more particular pages that include the particular data file as invalid for the computer-executable program; receiving, from the computer-executable program, a request for the particular data file; and in response to receiving the request, providing, to the computer-executable program, a notification that the particular data file is invalid for the computer-executable program.