10 ms·
Platform that enables Windows driver development in Rust
- mustache_kimono 3y agoOG Tweet: https://twitter.com/markrussinovich/status/1705730703957405826 https://twitter.com/markrussinovich/status/17057307039574058...
- 38 3y agonon crap link: http://farside.link/twitter.com/markrussinovich/status/1705730703957405826 http://farside.link/twitter.com/markrussinovich/status/17057...
- fortran77 3y agoYou know what would be even better? Device drivers in a memory managed language like C#!
- j16sdiz 3y agoMany common device class supports user mode driver. I think that supports writing in memory managed languages
- AlectronikLabs 3y agoYeah, this is one of the reasons why I think a microkernel would be excellent for today's computing.
- danparsonson 3y agoWould that be better though? I have no experience of driver development by my feeling is that device drivers being low-level and fundamental building blocks of a working operating system, doesn't fit well with garbage collection interrupting execution on its own schedule.
- sonthonax 3y agoDepends what you’re writing to be honest.
- ndiddy 3y agoI’d prefer not to have my mouse stutter because the driver paused to run the garbage collector.
- londons_explore 3y agoDays of lag-free mice are well and truly over... (Sitting here running wayland, where the mouse feels stuck in molasses!)
- morjom 3y ago(Sitting here running Wayland aswell, where the mouse feels just fine)
- self_awareness 3y agoI wish I had a problem with mouse on Wayland, but it doesn't run for me at all
- tentacleuno 3y ago(Sat here using KDE Plasma on Wayland where the mouse lagged and glitched every time you opened a program.) I think later versions fixed this one, though.
- viraptor 3y agoThat's not a Wayland issue. It may be a specific Wayland bug that affects you, but the architecture of the system does not force any extra delays.
- londons_explore 3y agoImagine we are half way through sending a frame to the display. The cursor is in the bottom half of the screen. If I move the cursor, that should be represented in the frame that's being currently outputted, not the next frame. Wayland has no support for that, by design. The end result is that there is always a delay of at least one Frame.
- dataking 3y agoI'm not aware that C# has security or reliability advantages over Rust. It may be better integrated into the Microsoft ecosystem but from the point of view of a driver developer who has to support more than one OS, Rust would seem to be a good tradeoff between security, performance, and reliability vs. C/C++.
- Yoric 3y agoI'm a big fan of Rust (and a minor contributor), but one can't deny that a garbage-collector makes most developments much easier. Now, I'm not convinced that a gc makes much sense in driver development, but I could be wrong.
- deleted 3y ago[deleted]
- dboreham 3y agoNot wrong. Kernels usually have their own memory management schemes, tied to the lifetime of i/o ops and so on. It would make more sense to somehow integrate that into the driver programing language.
- knorker 3y agoIt makes some things easier, and some things harder, or more complex. So I can deny that most development becomes easier with GC. At least if you also intend to actually run the thing. Running Java means forever fighting the GC, needing to do runtime and development to reduce impact of inherent GC problems.
- shanoaice 3y agoBut it's a Java issue: Java relies on Heap Objects way too much. C# and the CLR behind it has a much better support for value types and stack allocations, where some optimization can even be done by the JIT compiler.
- 3y ago
- __jem 3y agoRust is memory managed, it just doesn't have a garbage collector.
- jenadine 3y agoIt's a static garbage collector
- BadBadJellyBean 3y agoOr a garbage denier
- anon25783 3y agoHow would this work? And why would it be a better idea?
- mustache_kimono 3y ago> How would this work? Don't know exactly what you're asking. > And why would it be a better idea? Poorly written device drivers are a significant attack vector. It's one of the reasons Linux is now exploring using Rust for its own device drivers.[0] You may be asking -- why Rust and not some other language? Rust has many of the performance and interoperability advantages of C and C++, but as noted, makes certain classes of memory safety issues impossible. Rust also has significant mindshare among systems programming communities. [0]: https://rust-for-linux.com https://rust-for-linux.com
- anon25783 3y agoYeah okay but device drivers in C#? That sounds very impractical when you could pick any other language. C, C++, Rust, D, Zig, Objective-C, all seem more suitable than C#. I agree with all that stuff you said about Rust; I was asking how drivers in C# would work
- pjmlp 3y agoLike this, for a possible example, https://github.com/WildernessLabs/Meadow.Foundation https://github.com/WildernessLabs/Meadow.Foundation
- raincole 3y agoC# is my main language but this is one of the few cases where it's not the best choices.
- MStrehovsky 3y agoHere's an example [1] of a device driver in C#. It is possible. It is also not recommended. [1] https://github.com/VollRagm/KernelSharp https://github.com/VollRagm/KernelSharp
- sebazzz 3y agoI thinking “this is some project probably written years ago and loading the .NET Framework runtime into kernel space” but this is actually using NativeAOT and the latest features/SDK.
- nextaccountic 3y agoC# doesn't help against data races Indeed pretty much no mainstream language prevents data races at compile time like Rust does
- deleted 3y ago[deleted]
- pjmlp 3y agoRust only helps in a specifc use case of data races, when the memory belongs to the same process and is being access by threads. Rust type system doesn't help when the data resides in a shared memory segment accessed by multiple processes.
- nextaccountic 3y agoRust helps against data races in a kernel, as shown by the Rust for Linux project and other kernel projects (Redox, etc). Of course if you interact with foreign code (including code in other programs, but also code in the same program written in another language), you need unsafe. Or if you write a new synchronization primitive, etc. The unsafe is there to say "I manually checked and this is okay". What's important is that with Rust, concurrent business logic - in a kernel, things like filesystems and drivers - shouldn't need any unsafe to synchronize correctly. You use unsafe for your lower level infrastructure, but the code that actually does things can be data race free (and thus is easier to modify and assure it's working correctly). And that's incredible.
- pjmlp 3y agoFilesystems get modified by third parties. Also the right way to implement filesystems and drivers in modern OSes should be in userspace drivers, which is the route being taken by Apple, Google and Microsoft across their OSes anyway.
- deleted 3y ago[deleted]
- anaisbetts 3y agoIt is very difficult to write device drivers in even C++ while still maintaining the ability to write pageable kernel drivers. Drivers must have very strict control over availability of memory because it will likely access it at times when a page fault is not possible (i.e. during an interrupt handler). The C# language and runtime would have to add features to explicitly accomodate this at a bare minimum
- tonyedgecombe 3y agoMicrosoft did have an experimental OS[1] written in a variant of C# so it doesn't seem completely unrealistic. [1] https://en.wikipedia.org/wiki/Midori_(operating_system) https://en.wikipedia.org/wiki/Midori_(operating_system) My guess is the internal politics would be a bigger problem than any technical issues.
- anaisbetts 3y agoIt's not unrealistic but Midori made a lot of changes to C# to make it possible, it was almost a different language by the end of the project
- CodeCompost 3y agoMicrosoft tried that already. It failed miserably. I don't think they gave a reason but I suspect that garbage collection caused too many freezes in early 2000s hardware.
- resonious 3y agoMaybe I'm wrong but I suspect your parent comment was alluding to that sarcastically.
- pjmlp 3y agoIt didn't fail, it was sabotaged by Synosfky and friends, which then carried on doing exactly the same ideas with COM and C++. Guess why UWP applications are much slower than regular Win32, app sandboxing and COM reference counting. But hey, they won.
- iknowstuff 3y agomacOS sandboxes apps, which are usually written in Swift or ObjC and thus use reference counting, and doesn’t suffer from the kind of slowness that plagues UWP. So your hypothesis appears to be incorrect
- SSLy 3y ago> it was sabotaged by Synosfky and friends Is this described anywhere in detail?
- pjmlp 3y agoYes, basically when Longhorn started to fail to meet expectations, there were two possible ways, do what Google did with Android, push forward no matter what to make it work, or forcing a rewrite into something else, which is what WinDev ended up doing. "What Really Happened with Vista" https://hackernoon.com/what-really-happened-with-vista-4ca7ffb5a1a https://hackernoon.com/what-really-happened-with-vista-4ca7f... "Turning to the past to power Windows’ future: An in-depth look at WinRT" https://arstechnica.com/features/2012/10/windows-8-and-winrt-everything-old-is-new-again/ https://arstechnica.com/features/2012/10/windows-8-and-winrt...
- ww520 3y agoLook into the Singularity project.
- jeroenhd 3y agoMicrosoft is pushing more and more code into user space. The latest change is that they now insist printer manufacturers use UWP printer apps rather than drivers to add custom functionality to their printers; these apps are usually written in languages like C#. I agree with Microsoft that the best method is probably to run less manufacturer code in the kernel, not to make the kernel accessible more easily. Running a garbage collector in the kernel sounds near impossible to pull off without GC bugs because C# isn't exactly suited for "I want to access some buffer but I can't because it hasn't been paged in and I'm in an interrupt handler".
- pjmlp 3y ago> The latest change is that they now insist printer manufacturers use UWP printer apps rather than drivers to add custom functionality to their printers; these apps are usually written in languages like C# it would be nice, however .NET Native is deprecated, Native AOT doesn't do UWP, and WinDev is pretty bullish in C++.
- GoblinSlayer 3y ago>Native AOT doesn't do UWP Is there a need for it? Printing isn't performance sensitive.
- pjmlp 3y agoThe UWP execution model to start with, no JIT code allowed, based on COM.
- GoblinSlayer 3y agoAIU the package for Windows Store contains msil, then Windows Store figures out what to do with it.
- pjmlp 3y agoDepends, it can be already compiled to native code, in the case of still having MSIL, it is compiled by Windows Store before becoming available for distribution. From the point of view of consumer, it is all AOT compiled code.
- fortran77 3y ago[flagged]
- 1letterunixname 3y agoFor those who don't remember, Russinovich prior to taking over his boss' job and possible succession as the next MSFT CEO, he owned a software tools and NT kernel consulting company where Redmond sent their engineers to learn NT kernel dev. Also, he found Sony's DRM rootkit, Symantec's rootkit-like file protection, and caught Best Buy pirating ERD Commander. I'm kind of kicking myself now that I nuked my LinkedIn in 2014 having 2 degrees from the whole Valley and Mark as 1st. Oh well, there's freedom and agility in relative obscurity. What's that reggae song by Desmond Dekker about it's pointless to talk about how much you did, made, or who you used to know? xD
- kleiba 3y agoApparently it's good for a comment on HN.
- drvdevd 3y agoThe song is Fu Man Chu, by Desmond Dekker and the ACES.
- tester756 3y ago>and possible succession as the next MSFT CEO wat
- ww520 3y agoIs he going to be the CEO? That would be fantastic. He was super technical and super knowledgeable about Windows kernel. He was a true hacker.
- tester756 3y agoI don't think I'd want a "true hacker" to be a CEO. "true hacker" feels good when describing people at the top of engineering career paths like fellows, but for a CEO I'd rather have someone who's mix of decent tech skills and unparalleled business skills. I've had an opportunity to see companies where people didnt know how to do business and that was tragedy. That was way, way worse than non-technical manager trying to push solutions on ya. How he is doing from business perspective?
- zamalek 3y agoNice /s, it's not idiomatic: pub struct QueueContext { buffer: PVOID, length: usize, timer: wdf::Timer, current_request: WDFREQUEST, current_status: NTSTATUS, spin_lock: wdf::SpinLock, }
- kramerger 3y agoI think they would need to rewrite everything to get rid of that
- deleted 3y ago[deleted]
- BaculumMeumEst 3y agocould you clarify what you mean?
- Grimburger 3y agoIdiomatic rust - https://rust-unofficial.github.io/patterns/idioms/index.html https://rust-unofficial.github.io/patterns/idioms/index.html
- c7DJTLrn 3y agoDoesn't use Rust naming convention, imports Windows' PVOID (void pointer) type, when Rust's whole purpose is not to have unsafe pointers.
- jeroenhd 3y agoAlmost all of those refer back to FFI integer types, because that's what the Windows driver API uses. The Linux kernel has similar issues when it comes to writing Rust drivers, and so does every other project interoperating with C. Types like NTSTATUS have a significant amount of documentation attached to it. Unlike C and C++, you can't just assign an integer value to an enum value. I suppose they could've generated a wrapper class and required you to cast every time, but then you'd get code that's 50% .into()s and that would probably add overhead to your driver as well. As far as I can tell, you never set or alter these enum values, other than maybe the void* for buffer; you only ever read from them. A match {} block should work just fine on NTSTATUS. WDFREQUEST is a handle, so you can't really do anything with it other than maybe swap it out for another handle of the same type. Timer and SpinLock have been converted into idiomatic Rust objects, wrapping unsafe library calls in their bodies. Other than that, I don't really see how you'd make this code idiomatic without adding a significant performance burden.
- meresahkaan 3y ago[flagged]