Writing an OS in Rust

http://blog.phil-opp.com/

by jfreax • 11 years ago

202 34 11 years ago

blog.phil-opp.com

achanda358• 11 years ago

https://github.com/flosse/rust-os-comparison

bitdivision• 11 years ago

I recently found out about Redux:

https://github.com/redox-os/redox

It's pretty incredible how quickly it's come together, there's a reasonable looking GUI already!

Edit: The author also did an AMA on reddit: https://www.reddit.com/r/rust/comments/3mw67c/i_am_jackpot51...

kibwen2• 11 years ago

Now with weekly progress reports: http://www.redox-os.org/news/this-week-in-redox-3/

mtgx• 11 years ago

Relevant: https://github.com/wbthomason/ironkernel

cwzwarich2• 11 years ago

As far as I can tell, Rust OS projects generally use gratuitous amounts of unsafe code and are not substantially different than if they were written in C. I could just be looking in the wrong places. Are there any that take advantage of Rust's type system to provide real guarantees?

Rusky• 11 years ago

That may just be the impression given by tutorials, which spend most of their time dealing with the hardware. In a real OS, you'd wrap that up in safe interfaces and then the core of things like scheduling, file systems, etc. could be in a safe layer on top of the unsafe drivers.

cwzwarich2• 11 years ago

But has anyone actually done that? Can you even express those as safe interfaces in Rust?

kibwen2• 11 years ago

The OP talks about this in the most recent post:

"In the previous post we switched from assembly to Rust, a systems programming language that provides great safety. But so far we are using unsafe features like raw pointers whenever we want to print to screen. In this post we will create a Rust module that provides a safe and easy-to-use interface for the VGA text buffer."

steveklabnik5• 11 years ago

I expect a lot of this to be like this at first: https://www.reddit.com/r/rust/comments/3mw67c/i_am_jackpot51...

There's a period of writing only all the usual stuff that you've done before, then slowly discovering what kinds of abstractions you can put over it, and what kinds of stuff needs to remain super-low.

ntrepid8• 11 years ago

There are times that you have to do "unsafe" things when interacting directly with hardware. That's not to say one shouldn't attempt to limit the use of "unsafe" to use cases that absolutely require it.

steveklabnik5• 11 years ago

I've read through what was here, and last night, actually built the first post's code. I really like the depth and style of this particular posts, it really hits a sweet spot.

bulutsuzku2• 11 years ago

What's the value and novelty of writing an OS in Rust?

steveklabnik5• 11 years ago

  > value

Well, Rust is a systems language, and so it should be a good fit for OS development. We're still working on bits of it, but it's a stated goal of the language, so testing that out is valuable.

  > Novelty

Well, Rust is still a fairly young language, so there aren't a ton of people doing things with it yet, relatively speaking. And for OS dev, which is kind of a niche subject anyway (as much as I love it), there's naturally even less. So it's basically novel by definition.

bulutsuzku2• 11 years ago

Well, Rust is a systems language, and so it should be a good fit for OS development. We're still working on bits of it, but it's a stated goal of the language, so testing that out is valuable.

My questions was not well formulated. Let me rephrase it: C is also a system language and there are plenty of OS libraries written in C. C++ could be seen as another system language. Even the syntax of Rust is similar to C/C++ according to Wikipedia article. So, what's the advantage of Rust over other systems language? Better support for autonomous systems? Reflective model? Do you have a paper? It is a research project? Do you plan to replace Linux or something like that?

pjmlp• 11 years ago

To prove to all C fanboys that believe it is the only language that ever existed for systems programming, that there are memory safe ways to do systems programming. And in the process advance the current state of OS safety.

monocasa• 11 years ago

No -mno-redzone?

Animats3• 11 years ago

I'd like to see someone re-implement the QNX real-time microkernel in Rust. That would be useful. We need a QNX-like OS for embedded devices. Linux is really the wrong tool for the job. Too much extra stuff which allows attacks.

walterbell• 11 years ago

Could RIM open-source QNX, if the Blackberry Android device is successful?

protomyth• 11 years ago

I doubt they would give up that money stream in their current condition (automobiles for one market).

jacquesm• 11 years ago

I asked, both before QS sold it to RIM and after the deal, in both cases I didn't even get an answer (and I would have been in a position to put up a substantial chunk of money in order to get a dual license deal in place). Real pity, but maybe it will still happen.

QnX is one of the most elegant OSs out there and having a public domain or GPL'd version of it would be a great thing.

Animats3• 11 years ago

I'm hoping they open source QNX after the Blackberry disappears. The Blackberry is a dead end, but we really need something solid for embedded work.

nickpsecurity• 11 years ago

I agree. That or at least MINIX 3's core components as there's already source available. Plus, that would likely get extended by all the people building servers and stuff. Be two versions like with Linux.

xj92• 11 years ago

What about seL4[1]? It isn't real-time, but it is small, performant, and formally verified.

[1] http://sel4.systems

Animats3• 11 years ago

seL4 is quite good, but their approach to message passing has a problem. Messages are limited to a few bytes passed in registers. Anything bigger has to be done through shared memory between processes. This is great for the kernel; it never has to do a long operation like a big copy, so there's an upper bound on the time for each kernel operation. But with shared memory, one process may be able to mess up another. The usual library for L4 shared memory puts multiple "chunks" into one shared memory area, with an allocator. "A shared memory area can have multiple chunks."[1] Messing with the chunk structure or the wrong chunk from one process may adversely affect another one. That's a bad kind of attack surface.

So, although the kernel is secure, server processes with higher privileges than their callers may not be. Since this is how processes talk to file systems and drivers, it's an obvious way to attack.

QNX copies data from one process space to another. This adds copying overhead, but it's usually not too bad, because 1) most messages are short, and 2) if you just created a message and sent it, it's in the cache. In practice, the big overhead item today is context switching.

[1] http://l4re.org/doc/group__api__l4shm.html

codepie• 11 years ago

I was looking for something similar in C. Most of the resources I found (eg : os dev-wiki) do not cover the implementation details in such depth. Can anyone give few pointers?

devit2• 11 years ago

If anyone is considering working on an OS in Rust, they could perhaps consider writing a small hypervisor that could replace Xen, Nova and similar hypervisors.

This provides the same low-level challenges of writing a kernel, but it's far easier to get practically usable software than attempting to replace Linux and would actually be useful in practice.

At the moment, the only way to make a sandbox that has a chance of being perfectly secure (i.e. no security holes, ever) while still running all kinds of useful software is to use VMs to sandbox Linux/Windows kernels, and here the hypervisor is of course the weak point, and current usable hypervisors are written in C or C++.

steveklabnik5• 11 years ago

https://internals.rust-lang.org/t/unikernels-in-rust/2494

devit2• 11 years ago

This seems to be about using Rust for the kernel running inside the virtual machines, not for the hypervisor itself, which is what I was talking about.

Writing an OS in Rust

Related Stories