Extensibility safety and performance in the SPIN operating system