3 ms·

At Oxide, we have embedded projects with 100% Rust. We still have the kernel use an MPU (not even an MMU!) to protect each task's memory. Defense in depth is g

• bfrog 2y ago
  No doubt defense in depth is good, but frankly there's a cost to mpu/mmu (mpu does much the same in terms of memory protection but without the benefit of a dynamic page table...). There's a cost to jump from memory protected context (user mode in effect) to supervisor mode, usually an interrupt at minimum. In reality there's typically some syscall mechanism which requires argument marshalling, verification, unmarshalling. Lest you catch a TOCTOU issue. There's a cost to managing the memory regions... both in wasted memory (page aligned/mpu region aligned) and cpu requirements (reprogramming page tables/mpu regions). None of that is free of charge and those costs add up quickly.