8 ms·
Cervus: A WebAssembly subsystem for Linux
- kccqzy 8y agoThe next step of evolution predicted by Gary Bernhardt. https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...
- brian_herman 8y agoThe end is neigh and it is the death of javascript.
- giancarlostoro 8y agoI've seen this talk linked so many times and now that I've finally watched it, definitely recommend it it's pretty good.
- no_identd 8y agoA few related matters which might seem unrelated until one starts seeing the bigger picture: http://lampwww.epfl.ch/~amin/pub/collapsing-towers.pdf http://lampwww.epfl.ch/~amin/pub/collapsing-towers.pdf Amin, Nada; Rompf, Tiark - Collapsing Towers of Interpreters [January 2018] http://bootstrappable.org/ http://bootstrappable.org/ (see also http://langsec.org http://langsec.org ) https://docs.racket-lang.org/medic/index.html https://docs.racket-lang.org/medic/index.html - paper explaining it: https://www.cs.utah.edu/plt/publications/fpw15-lf.pdf https://www.cs.utah.edu/plt/publications/fpw15-lf.pdf sequel to that paper: https://dl.acm.org/citation.cfm?id=3136019 https://dl.acm.org/citation.cfm?id=3136019 https://www.reddit.com/r/nosyntax https://www.reddit.com/r/nosyntax https://www.reddit.com/r/programming/comments/2gw9u8/programming_should_eat_itself_by_nada_amin/ https://www.reddit.com/r/programming/comments/2gw9u8/program... https://grothoff.org/christian/habil.pdf https://grothoff.org/christian/habil.pdf The GNUnet System https://wiki.debian.org/SameKernel https://wiki.debian.org/SameKernel http://drops.dagstuhl.de/opus/volltexte/2017/7276/pdf/LIPIcs-ECOOP-2017-27.pdf http://drops.dagstuhl.de/opus/volltexte/2017/7276/pdf/LIPIcs... Wang, Fei; Rompf, Tiark - Towards Strong Normalization for Dependent Object Types (DOT) https://www.reddit.com/r/MachineLearning/comments/7s9etv/r_biological_selforganisation_and_markov_blankets/ https://www.reddit.com/r/MachineLearning/comments/7s9etv/r_b... https://news.ycombinator.com/item?id=16343020 https://news.ycombinator.com/item?id=16343020 Symbolic Assembly: Using Clojure to Meta-program Bytecode - Ramsey Nasser http://conal.net/papers/compiling-to-categories/ http://conal.net/papers/compiling-to-categories/ https://icfp17.sigplan.org/event/icfp-2017-papers-kami-a-platform-for-high-level-parametric-hardware-specification-and-its-modular-verification https://icfp17.sigplan.org/event/icfp-2017-papers-kami-a-pla... https://www.reddit.com/r/asm/comments/7af7a4/def_con_25_xlogicx_assembly_language_is_too_high/ https://www.reddit.com/r/asm/comments/7af7a4/def_con_25_xlog... Each of these, and this, paves another brick into a road to a very very different computational paradigm... I post this here without much explanation (and I've left a lot of other very relevant stuff out) of how these parts fit together, and I apologize for that, but I simply lack the time to give this the proper writeup it would deserve.
- jchw 8y agoHaving web assembly be a native subsystem... That's brilliant. Why has this not been attempted for Java or anything else for that matter? I guess you could count Microsoft's .NET implementation. In any case, you could extend this beyond just user mode. Currently the domain of safe ring0 execution is eBPF as far as I know, but this would be way more approachable and other operating systems could implement it. I've got no idea what the future is for this project but I really hope it doesn't stay in the realm of "fascinating but not practical."
- masklinn 8y ago> Having web assembly be a native subsystem... That's brilliant. Why has this not been attempted for Java or anything else for that matter? There have been CPUs which could execute Java bytecode directly… And not just actual Java processors, ARM has/had an extension for that: https://en.wikipedia.org/wiki/Jazelle https://en.wikipedia.org/wiki/Jazelle
- jchw 8y agoI was aware of the Java CPUs, but somehow that seems less interesting. Maybe because at that point, it's not so different from any other CPU architecture.
- pjmlp 8y agoIt has. I remember there was Linux Journal article about it, almost 20 years ago, regarding Java. Also this is how mainframes like IBM i work. Binaries use the TIMI format and are JITed into native code at installation time or on demand, if needed.
- jacobush 8y agoA lot was going on with Java in the early days. On the one hand, SUN resisted it, back when Java was not open source, then open source but with a heavy hand on it. On the other RM Stallman also resisted everything Java, because it did not mesh with his vision of the future. (Prop up everything GPL, unless the proprietary solution is already an industry standard.) My favourite example was how GCC was on the cusp of getting a backend which could emit Java byte code. Imagine that! That could have kickstarted all the JVM languages a decade earlier. Alas, many forces were against such things. Now, we have everything on everything, but most of all Javascript everywhere. Weird. :-)
- zaarn 8y agoWA in the kernel could lead to drivers being established as WA code with special interfaces. With safe interfaces to stuff like PCIe devices, the linux kernel could transform into a more hybrid kernel, similar to NT. Many funs to be had! I imagine it could also be useful to run user programs without having to switch rings all the time...
- sime2009 8y ago> I imagine it could also be useful to run user programs without having to switch rings all the time That is pretty much exactly what this project is aiming at: "Cervus implements a WebAssembly "usermode" on top of the Linux kernel (which tries to follows the CommonWA specification), enabling wasm applications to run directly in ring 0, while still ensuring safety and security."
- jacobush 8y agoReminds me of how Forth was supposed to be the language for drivers and such, write once, run everywhere drivers.
- erlend_sh 8y agoHighly related: https://github.com/nebulet/nebulet https://github.com/nebulet/nebulet “(Going to be) A microkernel that implements a WebAssembly "usermode" that runs in Ring 0.” It’s inspired by the Microsoft experiment Singularity OS.
- masklinn 8y agoThat description sounds a lot like a unikernel-type system.
- pjmlp 8y agoIt could also be inspired by many others. I suggest some reading about Xerox PARC and ETHZ OSes. JNode and CosmOS are also interesting ones.
- davidgrenier 8y agoI've been wondering for a while as to why nobody was trying to run an entire VM at ring 0, the benefits would be significant. I was just not aware that's what Singularity/Midori were doing. I'm glad more people are picking up on it.
- codetrotter 8y agoWhat are the benefits of doing so?
- naasking 8y agoThe cost of context switching is near zero. No need for expensive TLB flushes, for instance. No need for paged memory whose overhead sometimes accounts for up to 50% of program runtimes. Better isolation properties, since you can sandbox individual objects instead of whole processes.
- lkurusa 8y ago> expensive TLB flushes Note that modern CPUs store a tag of the current "address space ID" next to the TLB line, thus the cost of the flushing is heavily reduced. > No need for paged memory Unless you mean swapping, this doesn't apply as x86_64 long mode requires paging to be enabled.
- deleted 8y ago[deleted]
- qznc 8y agoAnother guy evaluating similar stuff: https://idea.popcount.org/2017-03-28-sandboxing-landscape/ https://idea.popcount.org/2017-03-28-sandboxing-landscape/
- titzer 8y agoDo not run untrusted code at ring 0, regardless of software sandboxing technology. It's just too risky! Otherwise neat.
- davidgrenier 8y agoThere's a difference between software sandboxing of native code and not being able to run native code at all. WA being an intermediate representation, it's a different story. I'm not saying there may not be flaws in WebAssembly or what Cervus delivers.
- titzer 8y agoMaybe my original comment wasn't clear. WebAssembly is a software sandboxing technology. Just because it is JIT compiled and has bounds checked memory does not make it secure enough to run in the kernel; a bug in the WASM engine would be a kernel exploit, and side channels would be kernel side channels. Again, do not run untrusted code at ring 0, regardless of sandboxing technology.
- mbrumlow 8y agoI thought the point was that it became trusted code as it was transpiled into WA, due to all the checks and what not that could be applied. So as you said a bug in the system would be a kernel exploit. How would this be any different than a exploit in today's kernels? The result would be the same, a bug fix to a kernel, or a fix to the transpiler. My point is while user running programs in ring 3 protect from bugs and exploits from trashing the system, but they do not protect from bugs in the kernel from trashing the system. In this case you have semantically moved where the bugs can be from the kernel to compile time. WEBASM engine bug would == kernel bug; if that system is working right then there should be no issue with running in ring 0. Think of it as compile time protection vs run time protection. I have just woke up and feel I am doing a terrible job of conveying this. (side note, is the ring system not just another sandboxing technology just facilitated by the CPU? And have we not just had major failures in some of those systems?)
- deleted 8y ago[deleted]
- chatmasta 8y agoFrom the readme: > I'm busy with my College Entrance Examination until ~June 10, 2018 This dude is in high school?! When I was your age I thought I was smart for writing a youtube scraper in PHP... Awesome work, really creative solution. Good luck to you.
- akhilcacharya 8y agoAnd now I'm sad
- rqs 8y agoFrom hes profile: https://github.com/losfair https://github.com/losfair > High school student. Interested in rust, operating systems, distributed systems and virtualization. Hehe, when I was in hes age, my friend call me a hacker because I know how to use ping and ipconfig command on Windows. Compare to him, I was really lame. What makes me more sad is, I'm still lame even today LOL.
- tenaciousDaniel 8y agoIf you want to feel better, I didn't know what a variable was until I was 28. I feel pretty lame compared to virtually everyone here on HN haha.
- rqs 8y agoWell, then, here, take my hug (>^_^)>
- tenaciousDaniel 8y ago<(^_^<)
- steveklabnik 8y agoI believe the other person working on a wasm kernel in Rust is also in high school. They take two different approaches, I can’t wait to see how all of this turns out!
- vitno 8y agoThis is a cool idea I've seen increasingly talked about, but in practice? I hope it never happens. Single Address space computing is a bad idea. https://www.cs.princeton.edu/~appel/papers/memerr.pdf https://www.cs.princeton.edu/~appel/papers/memerr.pdf
- tree_of_item 8y agoCan someone explain what this is actually useful for, if you're not a kernel developer? Would people in userland care about anything like this?
- IshKebab 8y agoYou can run safely userland code in the kernel context. Makes it faster. Does make Spectre rather more potent thought!
- traverseda 8y agoGary Bernhardt explains it better in this talk: https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death... But to summarize, jumps between kernal-space and user-space are expensive. Instead of doing that, we can run a well-vetted interpretor in kernal-space, and run "userspace" programs in kernal-space, in the interpretor. This actually isn't slower (or so it is claimed), because a JITed interpretor can be native speed on hot-code paths, and the inefficiencies for most workloads are more than made up for by not having expensive syscalls. So what you end up with is something that is about as fast as normal compiled code for cpu-intensive workloads (maybe faster sometimes), much faster for workloads involving a lot of syscalls, and interpreted languages like python/javascript end up much faster as well, presuming they can take advantage of the efficient JIT implementation. Personally, what most exites me about this technology path, is that it should reduce the cost of interprocess communication to near zero. Combined with a shared object model, and a capabilities system, it could be pretty awesome.
- solidsnack9000 8y agoThe most important applications are likely data processing -- batch and real-time -- and very high performance web applications. These are environments where: * Different applications are typically isolated from one another by being on different machines. * Application and hardware failures are handled with the "let if fail" philosophy, where individual machines are treated as disposable. * Components are written in-house and typically are quite trusted (even if they don't deserve to be). People in "userspace" do, on occasion, care a lot about the overhead of syscalls. Userspace networking -- https://lwn.net/Articles/713918/ https://lwn.net/Articles/713918/ -- is a different approach, where a functionality is moved wholly out of the kernel.
- Asiasweatworker 8y agoSo NaCL and PNaCL are not good enough to be comparable with WASM?
- monocasa 8y agoNaCL relied on a lot of segment register tricks that are only available to ring 3 AFAIK.
- deleted 8y ago[deleted]