11 ms·

Can an operating system be developed from scratch using a safe language such as Rust? If yes, why people still even think about doing it with unsafe languages?

wichtounet 10y ago
You can write a kernel in pretty much every language. There are some experiments with Rust: http://www.randomhacks.net/bare-metal-rust/ http://www.randomhacks.net/bare-metal-rust/ There are several reasons to choose a language rather than another. I personally don't like Rust at all, so I don't see any reason to use it, neither do I see any advantage in using it. But that's only my opinion. A lot of osdev currently is made by hobbyist (not counting the handful of really succesful kernels), so the main argument is simply personal and there is nothing wrong with it. Moreover, keep in mind that Rust is pretty new while C/C++ are decades old, this means more support, more portability, more people that know how to use it, ... This is not negligible at all.
- nickpsecurity 10y ago
  Forget the experiments. Try this one: https://www.redox-os.org/ https://www.redox-os.org/
pjmlp 10y ago
Sure it can and it has been done multiple times, although the industry hasn't cared much besides high integrity software, where software errors cost human lives. For an example, check the "Project Oberon" book. http://people.inf.ethz.ch/wirth/ProjectOberon/index.html http://people.inf.ethz.ch/wirth/ProjectOberon/index.html The revised 2013 version, with its own FPGA as replacement for the Ceres Workstation hardware of the original version.
snaky 10y ago
> Can an operating system be developed from scratch using a safe language such as Rust? We don't know. > If yes, why people still even think about doing it with unsafe languages? Because it works.
- vertex-four 10y ago
  > > Can an operating system be developed from scratch using a safe language such as Rust? > We don't know. Sure we do. Redox[0] boots into a desktop environment with a filesystem, etc etc. What we don't really know is how performant/portable/etc you could make it if you put the same amount of manpower into it as went into <other operating system of choice>.
  - snaky 10y ago
    We do know some prototype can boot. We don't know about operating system being in use in any environment for any purpose. Damn, we don't know could the browser engine written in Rust work or not, despite the fact writing a browser engine was the goal of Rust from the day one. By the way, network card driver can be written in LuaJIT (and perform well) too[1]. Shall we do it? [1] http://lukego.github.io/blog/2013/01/03/snabb-switchs-luajit-ethernet-device-driver/ http://lukego.github.io/blog/2013/01/03/snabb-switchs-luajit...
    - vertex-four 10y ago
      > Damn, we don't know could the browser engine written in Rust work or not, despite the fact writing a browser engine was the goal of Rust from the day one. We kind of do at this point. It renders reasonably well, faster on some workloads than existing browsers. The majority of work still to do involves chasing down rendering bugs, and building a shell around it. That's a lot of work, but it's the sort of work that isn't breaking new ground like the work with integrating JS and the DOM and a GC into Rust, it's regular boring work. (There's some exciting things going on - see WebRender - but they're mostly theoretically optional and the browser would work perfectly fine and performant if it had much of the same infrastructure as it has today.) > By the way, network card driver can be written in LuaJIT (and perform well) too[1]. Shall we do it? Lua's already used for some embedded development. Using LuaJIT as a network driver in some cases seems reasonable to me - especially if you were running it as a userspace process under a microkernel.
      - snaky 10y ago
dbcurtis 10y ago
> If yes, why people still even think about doing it with unsafe languages? What you need for OS or embedded development is a language that doesn't get in your way. C doesn't get in your way. C is the first language that both stayed out of your way and also provided reasonable productivity features (over BCPL, B, and assembly). It was only recently that people have figured out how to come close to a "safe" language that doesn't get in your way. Here is a test case: grab an ARM Cortex-Mx processor. Boot, configure the I/O matrix, and set up, oh say, the counter/timer peripherals for PWM motor control and quadrature decode. If you can do that without a trip to an "unsafe" language, that is a worthy accomplishment for your safe language. Another test case might be doing page swapping and page-table updates on a virtual memory subsystem on a multi-core CPU without a trip to an unsafe language. I guess a more direct answer to your question is that when you get down to the hardware, you have to deal with weirdo bit fields, volatile hardware registers, strange read/write ordering requirements, interlocks, and even some totally non-interlockable volatile stuff. C can do it (although I admit it uses language features not everyone sees every day).
- nmjohn 10y ago
  > I guess a more direct answer to your question is that when you get down to the hardware, you have to deal with weirdo bit fields, volatile hardware registers, strange read/write ordering requirements, interlocks, and even some totally non-interlockable volatile stuff. C can do it (although I admit it uses language features not everyone sees every day). I agree with you that building an entire OS to interface with hardware without using _any_ unsafe code is, by some definition of the word, impossible. However that doesn't mean you must limit yourself to unsafe languages for the other 90% of the operating system code.
- steveklabnik 10y ago
  Funny you should mention the Cortex-M :) https://github.com/helena-project/tock/ https://github.com/helena-project/tock/ (written in Rust, just linked to it down thread as well)
  - dbcurtis 10y ago
lgessler 10y ago
Dave Evans at the University of Virginia taught a class on that in Spring 2014: http://rust-class.org/ http://rust-class.org/ Rust has changed a lot since then, but you might take a look there.
kalsk 10y ago
> unsafe languages There is no such thing.
adrusi 10y ago
"Why doesn't everyone agree with me that statically enforced safety is the only necessary consideration when building hobby projects?" And yes, an operating system can be developed from scratch with Rust, maybe with a sprinkle of assembly, but every attempt I've seen makes widespread use of `unsafe', so the value mostly comes from Rust's modern type system with its traits and enums.
- pcwalton 10y ago
  > every attempt I've seen makes widespread use of `unsafe', so the value mostly comes from Rust's modern type system with its traits and enums. http://os.phil-opp.com/ http://os.phil-opp.com/ follows the Rust way of making safe abstractions as much as possible.

wichtounet 10y ago

You can write a kernel in pretty much every language. There are some experiments with Rust: http://www.randomhacks.net/bare-metal-rust/ http://www.randomhacks.net/bare-metal-rust/ There are several reasons to choose a language rather than another. I personally don't like Rust at all, so I don't see any reason to use it, neither do I see any advantage in using it. But that's only my opinion. A lot of osdev currently is made by hobbyist (not counting the handful of really succesful kernels), so the main argument is simply personal and there is nothing wrong with it. Moreover, keep in mind that Rust is pretty new while C/C++ are decades old, this means more support, more portability, more people that know how to use it, ... This is not negligible at all.

nickpsecurity 10y ago
Forget the experiments. Try this one: https://www.redox-os.org/ https://www.redox-os.org/

pjmlp 10y ago

Sure it can and it has been done multiple times, although the industry hasn't cared much besides high integrity software, where software errors cost human lives. For an example, check the "Project Oberon" book. http://people.inf.ethz.ch/wirth/ProjectOberon/index.html http://people.inf.ethz.ch/wirth/ProjectOberon/index.html The revised 2013 version, with its own FPGA as replacement for the Ceres Workstation hardware of the original version.

snaky 10y ago

> Can an operating system be developed from scratch using a safe language such as Rust? We don't know. > If yes, why people still even think about doing it with unsafe languages? Because it works.

vertex-four 10y ago
> > Can an operating system be developed from scratch using a safe language such as Rust? > We don't know. Sure we do. Redox[0] boots into a desktop environment with a filesystem, etc etc. What we don't really know is how performant/portable/etc you could make it if you put the same amount of manpower into it as went into <other operating system of choice>.
- snaky 10y ago
  We do know some prototype can boot. We don't know about operating system being in use in any environment for any purpose. Damn, we don't know could the browser engine written in Rust work or not, despite the fact writing a browser engine was the goal of Rust from the day one. By the way, network card driver can be written in LuaJIT (and perform well) too[1]. Shall we do it? [1] http://lukego.github.io/blog/2013/01/03/snabb-switchs-luajit-ethernet-device-driver/ http://lukego.github.io/blog/2013/01/03/snabb-switchs-luajit...
  - vertex-four 10y ago
    > Damn, we don't know could the browser engine written in Rust work or not, despite the fact writing a browser engine was the goal of Rust from the day one. We kind of do at this point. It renders reasonably well, faster on some workloads than existing browsers. The majority of work still to do involves chasing down rendering bugs, and building a shell around it. That's a lot of work, but it's the sort of work that isn't breaking new ground like the work with integrating JS and the DOM and a GC into Rust, it's regular boring work. (There's some exciting things going on - see WebRender - but they're mostly theoretically optional and the browser would work perfectly fine and performant if it had much of the same infrastructure as it has today.) > By the way, network card driver can be written in LuaJIT (and perform well) too[1]. Shall we do it? Lua's already used for some embedded development. Using LuaJIT as a network driver in some cases seems reasonable to me - especially if you were running it as a userspace process under a microkernel.
    - snaky 10y ago

dbcurtis 10y ago

> If yes, why people still even think about doing it with unsafe languages? What you need for OS or embedded development is a language that doesn't get in your way. C doesn't get in your way. C is the first language that both stayed out of your way and also provided reasonable productivity features (over BCPL, B, and assembly). It was only recently that people have figured out how to come close to a "safe" language that doesn't get in your way. Here is a test case: grab an ARM Cortex-Mx processor. Boot, configure the I/O matrix, and set up, oh say, the counter/timer peripherals for PWM motor control and quadrature decode. If you can do that without a trip to an "unsafe" language, that is a worthy accomplishment for your safe language. Another test case might be doing page swapping and page-table updates on a virtual memory subsystem on a multi-core CPU without a trip to an unsafe language. I guess a more direct answer to your question is that when you get down to the hardware, you have to deal with weirdo bit fields, volatile hardware registers, strange read/write ordering requirements, interlocks, and even some totally non-interlockable volatile stuff. C can do it (although I admit it uses language features not everyone sees every day).

nmjohn 10y ago
> I guess a more direct answer to your question is that when you get down to the hardware, you have to deal with weirdo bit fields, volatile hardware registers, strange read/write ordering requirements, interlocks, and even some totally non-interlockable volatile stuff. C can do it (although I admit it uses language features not everyone sees every day). I agree with you that building an entire OS to interface with hardware without using _any_ unsafe code is, by some definition of the word, impossible. However that doesn't mean you must limit yourself to unsafe languages for the other 90% of the operating system code.
steveklabnik 10y ago
Funny you should mention the Cortex-M :) https://github.com/helena-project/tock/ https://github.com/helena-project/tock/ (written in Rust, just linked to it down thread as well)
- dbcurtis 10y ago

lgessler 10y ago

Dave Evans at the University of Virginia taught a class on that in Spring 2014: http://rust-class.org/ http://rust-class.org/ Rust has changed a lot since then, but you might take a look there.

kalsk 10y ago

> unsafe languages There is no such thing.

adrusi 10y ago

"Why doesn't everyone agree with me that statically enforced safety is the only necessary consideration when building hobby projects?" And yes, an operating system can be developed from scratch with Rust, maybe with a sprinkle of assembly, but every attempt I've seen makes widespread use of `unsafe', so the value mostly comes from Rust's modern type system with its traits and enums.

pcwalton 10y ago
> every attempt I've seen makes widespread use of `unsafe', so the value mostly comes from Rust's modern type system with its traits and enums. http://os.phil-opp.com/ http://os.phil-opp.com/ follows the Rust way of making safe abstractions as much as possible.