Utilizing Rust Programming Language for EFI-Based Bootloader Design Tun¸cUzlu and Ediz S¸aykol Beykent University, Department of Computer Engineering, Ayaza˘ga,34396, Istanbul,_ Turkey [email protected]; [email protected] in Servo, Mozilla Foundations massively parallel web browsing engine, which is unique because of its concur- Abstract rent process rendering and compositing steps [JML15]. Rust, as being a systems programming language, has Rust, as being a systems programming lan- ability to operate at the lowest level without any run- guage, offers memory safety with zero cost and time penalty, like C, C++ or Cyclone, but offers com- without any runtime penalty unlike other lan- plete memory safety, unlike these languages. Systems guages like C, C++ or Cyclone. System pro- programming languages are crucial for time criticial gramming languages are mainly used for low tasks like signal processing and also for bare-metal op- level tasks such as design of operating system erations such as design of operating system compo- components, web browsers, game engines and nents, web browsers, game engines where raw hard- time critical missions like signal processing. ware access is a must. Existing systems languages are Main disadvantages of the existing systems memory unsafe and extremely complicated because of languages are being memory unsafe and hav- their low level nature. ing low level design. On the other hand, Rust Systems programming languages are considered es- offers high level language semantics, advanced sential for embedded systems because of low mem- standard library with modern skill set includ- ory availability and exiguous processing power [HL15]. ing most of the features and functional ele- The main reason is the lack of garbage collector which ments of widely-used programming languages. causes non-deterministic delays [LAC+15]. Garbage Moreover, Rust can be used as a scripting lan- collectors provide very safe memory management, but guage like Python, and a functional language poorly manages the memory space and unpredictably like Haskell or any other low level procedural runs at the background. This design choice also affects language like C or C++, since Rust is both energy consumption which is very important for em- imperative and functional having no garbage bedded systems and changes operating system design collector. These design choices make Rust a paradigm [LMP+05]. suitable match for low level tasks via includ- ing high level scalability and maintainability. On the other hand, Rust is both imperative and Meanwhile, EFI (Extensible Firmware Inter- functional language. Although including different fla- face) specification is aimed to remove the lim- vors, Rust is highly scalable with capable standard itations of legacy hardware. Hence, we present library comparable to high level languages. Rich our analysis of utilizing Rust language on EFI- language semantics and haveing no garbage collector based bootloader design for x86 architecture, makes Rust suitable match for low level tasks while to make it useful for both practitioners and having high maintainability level. Moreover, Rust can technology developers. be used as a scripting language like Python or as a functional language like Haskell because of its inher- ited skill set has been mostly adpoted from modern 1 Introduction languages. Rust programming language has been designed by C++ is the most powerful systems programming Graydon Hoare and currently it is actively being de- language today. Because of its multi paradigm de- veloped by Mozilla Foundation. It is also being used sign and zero cost runtime performance, it is widely used by numerous organizations and people with dif- tion. ferent backgrounds. C++ has features with compli- Rust ecosystem includes Rustc compiler but also a cated runtime support like RTTI and exceptions dis- very powerful package manager, Cargo with its registry abled for most bootloader applications. As it includes webpage for crates, Rustfmt for code formatting, and every element from its predecessor C language, it also Rustdoc. for automatic document generation. Cargo includes every memory safety pitfall from C. This vari- has very well dependency management as it offers ation makes C++ even more vulnerable to memory un- strict versions of dependencies to be defined. It allows safety especially architects with C background widely arbitrary flags to pass to Rustc, the Rust compiler, rely on these language elements. Cyclone, on the other but most importantly with target argument [HL15] it hand, developed as an extension to C language to pro- is possible to cross compile to another system differ- vide Rust-like memory safety mechanism with ability entiating from host operating system. There is also to port from C to Cyclone without much effort. How- features argument for conditional compiling. Cargo ever, this design choice caused the language semantics reads projects meta information from a Toml file which to become restrictive and unwieldy. is very much like JSON, but more suitable for human Another language which is popular and somehow editing, rather than data serialization. racing with Rust is Go language because of its low learning curve. Go is supported by Google and is a 2.1 Rust Programming Concepts high level language which can be compared to Python or Ruby. Go neither have generic types nor pro- Ownership is one of the most important language se- vides safety over its concurrency model, Goroutines. mantics of Rust. Variable bindings can have one Rust has generics with monomorphisation so they are unique owner. They can be moved, can be borrowed statically dispatched and has good runtime perfor- numerous times if they are not previously borrowed mance [Bal15]. as mutable, that can be happened only once. Own- Here, we present our analysis of utilizing Rust lan- ership also works on resources like files or sockets and guage on EFI-based bootloader design for x86 architec- across threads. Rust provides traits to offer functional- ture, to make it useful for both practitioners and tech- ity similar to inheritance [JML15]. For example, to du- nology developers. Our analysis in this paper starts plicate an object Rust have Clone trait [LAC+15] also with presenting Rust language basics in detail in Sec- there is Copy trait for bitwise copying. Anonymous tion 2. Then, bootloading basics is presented in Sec- closure functions are also defined in terms of traits in tion 3. Since the main idea behind using Rust is pro- Rust like Fn or FnMut depending on mutability and if gramming a critical-and-safe low-level task with high- the closure is called once it should be FnOnce. They level programming concepts, we found bootloader de- can not be used as a return value so they should be sign a typical application for this purpose, and discuss enclosed into a Box which allocates space from Heap design choices that make Rust suitable in Section 4. memory [Lig15]. Finally, Section 5 concludes our paper and states fu- Rust have Structs in a very similar way to C. The ture work. main difference is data structure itself may be pub- lic whereas its elements may be private in the code 2 Rust Language Details space. Rust offers algebraic Enum which is more func- tional and much more advanced compared to that of Rust is an open source programming language, includ- C++, which only has type checking. Option generic ing an issue system for bug reporting and separate type is a special Enum type with maybe characteris- RFC tracker for language standardization, which are tic. It is being used as a selector between a return located on Github repository. With the help of numer- value, Some, or an error value, Err (or absence None). ous contributors around the world, Rust provides pre- This Option and Error types are suitable for repre- compiled development environment for Linux, Win- senting Null pointers so that it is impossible Rust to dows and OS X. It is also possible to cross compile have Null pointer errors. This paradigm is also suit- Rust for Ios, Android, Rasperry Pi and other operating able for Null pointer optimization as Rust uses LLVM systems. As Rust is a separate development toolchain compiler infrastructure and benefits from same back- from operating system, it is radically closer to deter- end optimizations of C language family. Pointer safety ministic code generation process. Hence, Rust is com- is guaranteed with holding Lifetimes. Like type infer- pletely decoupled in this perspective. On the other ence, reference lifetimes can be guessed by Rust com- hand, languages like C or C++ depends on header piled and this is called lifetime elision. Sometimes ex- files and libraries through the operating system, lots plicit lifetime marks are required as references lifetime of applications along with various operating system must be equal or larger than its originating binding. distributions and updates might influence the collec- Concurrency is the core of Rust. Same owner- ship mechanism applies across threads and Rust offers audience. Like borrowing a master chefs knife, imper- thread safety mostly on compile time. Channel, for ative paradigm is powerful when used correctly, but example, allows data to be send safely across threads tend to fail because of its destructive nature on global if the type satisfy Send Marker trait. Markers are data [Oka99]. Rusts internals to enforce safety rules. Other impor- tant markers are Sync, can be shared across threads, Sized, type has a known size at compile time. When multiple threads need to modify same region of mem- 2.2 Comparing Rust with C and C++ ory classical lock mechanisms like Mutex or RWLock are provided. The key point is locking in Rust works on the data itself, not on the code. Software architects Rust is the remedy for numerous systems program- using C++ tries to prevent data race by locking the ming bugs by design.