There is a somewhat expanded README that has yet to be reviewed and checked in here: https://chromium.googlesource.com/chromiumos/platform/crosvm...
Chrome OS KVM - A component written in Rust
51–60 of 109 posts
Re: Chrome OS KVM - A component written in Rust
#52Is Rust an officially sanctioned language at Google?
Author here: Rust is not officially sanctioned at Google, but there are pockets of folks using it here. The trick with using Rust in this component was convincing my coworkers that no other language was right for job, which I believe to be the case in this instance. That being said, there was a ton of work getting Rust to play nice within the Chrome OS build environment. The Rust folks have been super helpful in answ…
> The trick with using Rust in this component was convincing my coworkers that no other language was right for job, which I believe to be the case in this instance.
I ran into a similar use case in one of my own projects—a vobsub subtitle decoder, which parses complicated binary data, and which I someday want to run as web service. So obviously, I want to ensure that there are no vulnerabilities in my code.
I wrote the code in Rust, and then I used 'cargo fuzz' to try and find vulnerabilities. After running a billion(!) fuzz iterations, I found 5 bugs (see the 'vobsub' section of the trophy case for a list https://github.com/rust-fuzz/trophy-case).
Happily, not one of those bugs could actually be escalated into an actual exploit. In each case, Rust's various runtime checks successfully caught the problem and turned it into a controlled panic. (In practice, this would restart the web server cleanly.)
So my takeaway from this was that whenever I want a language (1) with no GC, but (2) which I can trust in a security-critical context, Rust is an excellent choice. The fact that I can statically link Linux binaries (like with Go) is a nice plus.
Re: Chrome OS KVM - A component written in Rust
#53Is Rust an officially sanctioned language at Google?
Author here: Rust is not officially sanctioned at Google, but there are pockets of folks using it here. The trick with using Rust in this component was convincing my coworkers that no other language was right for job, which I believe to be the case in this instance. That being said, there was a ton of work getting Rust to play nice within the Chrome OS build environment. The Rust folks have been super helpful in answ…
I am super excited to see this! Glad we've already been helpful, but I'd like to reaffirm that if you need anything, we'd like to continue being helpful in the future :)
Re: Chrome OS KVM - A component written in Rust
#54Earlier quoted context omitted.
They should rewrite Go in Rust! That way we can avoid all this Go vs Rust discussions ;) Problem with your idea, is that low level kernel will use a lot of unsafe Rust, which will lose lot of benefits.
It would be kind of cool to see a `go gen`-syntax based Go + generics implemented in Rust. Another thing that has been attempted is a stdlib for Rust that uses syscalls into the kernel much like Go's.
> Another thing that has been attempted is a stdlib for Rust that uses syscalls into the kernel much like Go's.
With Rust, it's easier just to replace the C library! In particular, cross-compiling with a static musl-libc has been supported out of the box with for a while now. For pure Rust programs (or ones with small amounts of C handled by cargo), just write:
cargo build --target=x86_64-unknown-linux-musl
For programs which require external C libraries, it's a bit trickier, because you need a static version of those libraries built against musl-libc. For common libraries like OpenSSL and libpq, I have a Docker container that makes this easier: https://github.com/emk/rust-musl-builder
Re: Chrome OS KVM - A component written in Rust
#55The Fuchsia OS microkernel should be rewritten in Rust, too, especially if it's going to take another 5 years before we even see it in a commercial product. If Google wants to make a modern new OS that will help it avoid many of the existing security problems it needs to keep fixing with Android/Chrome OS right now, then it should do it right and avoid collecting a lot of "security debt" down the road because of unsa…
They should rewrite Go in Rust! That way we can avoid all this Go vs Rust discussions ;) Problem with your idea, is that low level kernel will use a lot of unsafe Rust, which will lose lot of benefits.
Both House OS in Haskell and SVA-OS handled that by cleanly hiding unsafe details behind an interface that could be used safely:
http://programatica.cs.pdx.edu/House/
https://llvm.org/pubs/2009-08-12-UsenixSecurity-SafeSVAOS.ht...
So, that's not really a limitation. Worst-case scenario is proving those primitives correct with external tools whose preconditions and invariants are just checked by memory-safe code calling it. The above work shows worst case might not happen, though.
Re: Chrome OS KVM - A component written in Rust
#56Earlier quoted context omitted.
Can you expand upon what makes Rust more energy efficient than C or C++? What are the language properties that enable Rust code to be more energy optimised?
It's not even ranked first. Rust comes a good second to third behind C & C++ on most if not all tests listed on https://sites.google.com/view/energy-efficiency-languages/re...
I just clicked that link. Rust is in fact first on a few of those categories. I’m not sure what your point is though, as the comment says that it is “one of” the most energy efficient languages, not the most energy efficient. It appears to gernerally be in the top three.
A couple of points here. Rust is generally as fast as C and C++, but on top of that it is memory and data race safe. Said another way, there is a safe language alternative which doesn’t have the pitfalls of C/C++, and that’s a great thing!
Re: Chrome OS KVM - A component written in Rust
#57Earlier quoted context omitted.
Since Rust is one of the most energy efficient languages and also safe, it sounds like a good fit for Google. I always wondered if they would pick it up.
Can you expand upon what makes Rust more energy efficient than C or C++? What are the language properties that enable Rust code to be more energy optimised?
He/She never said it was more energy efficient than C/C++ so...
Re: Chrome OS KVM - A component written in Rust
#58Earlier quoted context omitted.
> Problem with your idea, is that low level kernel will use a lot of unsafe Rust, which will lose lot of benefits. I've actually worked on a toy kernel in Rust (using the excellent tutorial at https://os.phil-opp.com/ ), and it turns out that, yes, you obviously need to use unsafe code to talk to the actual hardware. But in most cases, you can encapsulate the low-level hardware inside a safe API: https://github.com/e…
Nice to have the dangerous bits annotated – in a C/C++/... kernel, everything is "unsafe". "Given enough eyeballs, all bugs are shallow" - but it helps when the eyeballs are focussed! :-)
It's hard to emphasize the auditability enough. With auditing a C/C++ codebase, in my experience, you rely a lot on intuition. "Well, there's parsing done here, so I'll focus my efforts" or "Historically we've had a lot of CVEs from this part of code so I'll start there".
I'm not a professional RE so my experience is limited, but when I went looking for vulns that's how I went about it, and I think that's generally the case.
With rust there's significantly less guesswork. That parser doesn't use unsafe? OK, let's start elsewhere. That seemingly innocent code uses unsafe? Great, check that out.
You can grep for vulnerabilities, basically.
Re: Chrome OS KVM - A component written in Rust
#59Is Rust an officially sanctioned language at Google?
Author here: Rust is not officially sanctioned at Google, but there are pockets of folks using it here. The trick with using Rust in this component was convincing my coworkers that no other language was right for job, which I believe to be the case in this instance. That being said, there was a ton of work getting Rust to play nice within the Chrome OS build environment. The Rust folks have been super helpful in answ…
Would you consider releasing parts of this as standalone crates on crates.io? I ask because there are many different things developers would like to do with KVM that might not be the same as the goals of ChromiumOS.
Also, the Wayland stuff looks cool but I'm not sure how you are managing the buffers with just the wl protocol.
There is a Wayland crate for Rust that also has support for generating protocol from the xml descriptions, not sure if you used that there.
The library is here: https://github.com/Smithay/wayland-rs and the part you would want is the `wayland-scanner` crate in that repo.
This seems like a good follow on to the work done in Go and python a while back at Google, though it would be cool to support the virtio p9fs as a root filesystem.
And, I know you can't say anything about this, but I'm happy to see the arm support in there, maybe it's possible that Google supports a fully virtualized Android device with the ability to run first class Linux, ChromeOS, etc. even on locked bootloader devices.
It would even be possible to keep a tiny resident e911-compliant dialer persistant as part of a lock screen.
Anyway, awesome work, I might have to revive kvmd at some point.
Re: Chrome OS KVM - A component written in Rust
#60Earlier quoted context omitted.
thankfully C++ has references.
References can still be null.
In C++, null references are Very Bad, and they trigger undefined behavior: https://stackoverflow.com/questions/4364536/is-null-referenc...
I don't think I've ever run into a null reference in the real world. I'm sure it happens, especially if people write "&*some_function_that_might_return_null()". But it shouldn't be a normal thing. There are lots of other issues with C++, but this has never been a major one in my experience.