TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Experiences Building an OS in Rust

117 pointsby jaxonduover 9 years ago

9 comments

zokierover 9 years ago
I haven&#x27;t yet read the paper proper but this statement surprised me a little:<p>&gt; In particular, ownership has forced us to avoid concurrency in the kernel and include more code than we would have liked in the TCB.<p>One of the strong points of Rust and its owenership system is that it allows writing concurrent code with greater confidence. I would have hoped that it&#x27;d encourage rather than discourage using concurrency.
评论 #10323257 未加载
评论 #10323358 未加载
steveklabnikover 9 years ago
The Reddit thread and the users.r-l.o thread have insightful posts: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;rust&#x2F;comments&#x2F;3nauhy&#x2F;experiences_building_an_os_in_rust_feedback&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;rust&#x2F;comments&#x2F;3nauhy&#x2F;experiences_bu...</a> <a href="https:&#x2F;&#x2F;users.rust-lang.org&#x2F;t&#x2F;rfc-and-paper-experiences-building-an-os-in-rust&#x2F;3110&#x2F;2" rel="nofollow">https:&#x2F;&#x2F;users.rust-lang.org&#x2F;t&#x2F;rfc-and-paper-experiences-buil...</a>
twicover 9 years ago
The &quot;new hardware protection mechanism called MPU available on some new ARM Cortex-M microcontrollers&quot; is a device which lets the operating system define up to eight memory regions (sixteen on the M7), optionally with holes in them. In each region, permissions can be set for read, write, and execute, and the policy for cacheing and sharing between cores can be controlled (although this is presumably not really relevant for single-core microcontrollers).<p><a href="http:&#x2F;&#x2F;infocenter.arm.com&#x2F;help&#x2F;index.jsp?topic=&#x2F;com.arm.doc.dui0553a&#x2F;BIHJJABA.html" rel="nofollow">http:&#x2F;&#x2F;infocenter.arm.com&#x2F;help&#x2F;index.jsp?topic=&#x2F;com.arm.doc....</a><p><a href="https:&#x2F;&#x2F;blog.feabhas.com&#x2F;2013&#x2F;02&#x2F;setting-up-the-cortex-m34-armv7-m-memory-protection-unit-mpu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.feabhas.com&#x2F;2013&#x2F;02&#x2F;setting-up-the-cortex-m34-a...</a><p>It&#x27;s a bit like a normal MMU bit without virtual memory.
评论 #10325108 未加载
评论 #10324702 未加载
kibwenover 9 years ago
Quoting the great feedback from Gankro on Reddit:<p>Discussing this on Twitter&#x2F;IRC:<p>* Wants const size_of closures (for statically allocating that many bytes). We just need RFC #1245 to get implemented (it has been accepted), and for someone to mark the size_of intrinsic as a const fn. However this might get into the weeds pretty bad since &quot;size&quot; is handled by trans (LLVM even). Dunno those details.<p>* Shared mutability of hardware registers should be able to be soundly handled by Cell.<p>This leaves the big issue:<p>The kernel has been architected as a single &quot;main&quot; thread, and a bunch of interrupt handling threads. All the interrupt-handling threads do is enqueue a message for the main thread to handle. The main thread then drives all the drivers off of this queue, so they all run on one thread. However they want to do some shared mutable stuff. In particular, I think they want closures that close over the same value mutably? RefCell isn&#x27;t particularly acceptable because crashing is Super Bad, and they would like to avoid runtime checks anyway. They just found out about Cell, so it might work, but they seem to think this wouldn&#x27;t be right.<p>You can make Cells pretty fine-grained. You can also consider &#x2F;u&#x2F;SimonSapin&#x27;s proposed extension to Cell which has a replace method for non-Copy types so you could replace (say) an arbitrary Cell&lt;Option&lt;T&gt;&gt; with None temporarily through a shared reference.<p>Alternatively, it might be possible to manually thread the shared mutable state since it&#x27;s all being driven by some top-level event-loop (as far as I can tell). This was actually an old std pattern: <a href="https:&#x2F;&#x2F;doc.rust-lang.org&#x2F;0.11.0&#x2F;std&#x2F;collections&#x2F;hashmap&#x2F;struct.HashMap.html#method.find_with_or_insert_with" rel="nofollow">https:&#x2F;&#x2F;doc.rust-lang.org&#x2F;0.11.0&#x2F;std&#x2F;collections&#x2F;hashmap&#x2F;str...</a> (the A is &quot;shared&quot; closed state).<p>Interested to hear more about the finer details of the shared mutable state!
f_over 9 years ago
There was a recent HN topic here on the redox-os[0] which is written in Rust (and heavy WIP). It did actually use a lot of unsafe, though.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;redox-os&#x2F;redox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;redox-os&#x2F;redox</a>
com2kidover 9 years ago
As someone who works on the innards of a cooperative multitasking embedded OS for a living, I am sick and tired of C and C++.<p>Closures is a huge one. Everything is async in HW land, an interrupt fires and calls you when data is ready, so doing a read looks like<p><pre><code> MyOpInitialFunction() { &#x2F;&#x2F; Business Logic AsyncReadFromFlash(sDataBuffer, sizeOfBuff, sizeToRead MyOpFirstCallback, contextVar); } MyOpFirstCallback(byte* dataBuf, size_t sizeRead, void* context) { &#x2F;&#x2F;Business logic, use data read in some how AsyncReadFromFlash(sDataBuffer, sizeOfBuff, sizeToRead MyOpSecondCallback, contextVar); } MyOpSecondCallback(byte* dataBuf, size_t sizeRead, void* context) &#x2F;&#x2F; and so on and so forth </code></pre> It gets boring really fast. The system has a nice DMA controller that we use a lot, so a similar pattern exists for copying large chunks of data around.<p>You can actually implement a variant of closures in C using Macros, and right now the entire team wishes we had done that! (It isn&#x27;t hard, in embedded land you have complete memory control, you can just memcopy the entire stack down to a given known location and memcopy it back to resume!)<p>Rust has a lot of features that are really useful for embedded, the problem is that it is going to be a long time, if ever, that the embedded world switches over.<p>Embedded systems tend to have very little code space, so efficiency of generated code is a must. LLVM and even GCC aren&#x27;t as efficient as ARM&#x27;s (horribly overpriced, feature lacking) compilers. The one thing ARM&#x27;s compilers do though is minimize code space, and they do a very good job at it.<p>The other issue is that any sort of language run time is questionable. Even the C Run Time is typically not included in embedded (teams opt out of using it), if you want printf you typically write whatever subset of printf functionality you want!<p>Oddly enough memory safety is not a real issue, though slightly better buffer overrun protection than what we get from static analysis would be nice!<p>Consumers hand over a destination buffer to Producers, who return it in a callback. Because of the above async pattern, the consumer isn&#x27;t even running until the data is ready.<p>That&#x27;s solved 99% of our issues. :) (If you want someone else&#x27;s data, you ask for it and get it passed in a buffer you provide!)
评论 #10325284 未加载
评论 #10325262 未加载
wyldfireover 9 years ago
This is valuable feedback. It&#x27;s great that Rust has been so receptive, making changes where appropriate.
评论 #10324293 未加载
nickpsecurityover 9 years ago
There&#x27;s been quite a bit of work at securing embedded systems with safer languages (esp Java) or MPU&#x27;s (esp smartcards). Gemalto&#x27;s EAL7 JavaCard work, MULTOS, IBM&#x27;s Caernarvon... all made stuff to enforce strong protection w&#x2F; similarly, rough constraints. Usually no MPU although some smartcards had them with some public data on design or proper usage. I recommend the authors dig up stuff on systems like that to find strategies for countering various issues.<p>Most that I saw handle resource and security decisions via type system, safe transformations to bytecode, and safe handling of that. Fast paths are sometimes implemented in assembler with safety put into HLL or VM interface to that... if vendor felt like it. (shakes head) Where this didn&#x27;t work, there were coding rules or frameworks for carefully designing and decomposing the system to manually prevent&#x2F;catch issues. Most do all of this on development machine with target system just blindly accepting or trusted booting a signed binary representing system or apps. Cuz what else can you do with such constraints... (shrugs)<p>Far as specific hardware or Rust issues, I can&#x27;t help as I don&#x27;t work with those.
acconstaover 9 years ago
Basic question — when you&#x27;re writing a kernel in Rust with its own threading implementation, how does the rust compiler even know what threads are? It has to identify thread boundaries for send&#x2F;sync, right?
评论 #10325619 未加载