Stories from building nos: real bugs on real hardware, the hypervisor, Rust in the kernel, and the gates that keep it honest.
RSS feedPosted interrupts, a one-shot timer, moderated receive interrupts, offloads and mapped rings, measured on bare metal; halt polling and a NIC task did not help.
Cleared registers, a refilled return stack, IBPB, IBRS, BHI_DIS_S, VERW: what the nos hypervisor does around every VM exit, what it costs, what is open.
Stage 3 from git log: in a month hv.ko went from switching AMD-V on to booting Alpine, Debian and multi-CPU Linux guests on AMD and Intel silicon.
On QEMU 10.2's TCG a guest's CR4 reads never exit, and a data watchpoint in a nested guest hangs the CPU for good. How we found both, and how the gates cope.
Four fuzzers that compile the kernel's own sources into host programs — hypervisor, network, storage and the C++ — and the bugs they found.
In two days nos moved its block, network and filesystem layers and virtio to Rust, deleted the C++, and cut the layers' unsafe from 924 sites to 113.
nos runs no .init_array, so a global with a real constructor stays zeroes. Two locks went unwatched that way, until the link was made to refuse one.
No page in nos is both writable and executable. How the image was split, the hole under every runtime mapping, and the test that keeps it shut.
A kernel that died before any console existed, on a server whose only console is the network: two counters on its disks and a QEMU replica found why.
The AX41's Intel I210 showed link up, receiver on and 255 descriptors posted, and received nothing: its MAC had latched 10 Mb/s, the PHY ran at 1000.
Under UDP load the EX44 went deaf for good. Seven theories read off the driver were wrong; one reading off the chip found a lost MSI-X edge.
A TLB shootdown waited on a CPU spinning on the lock its sender held. How one silent wedge became a rule, a frame pool, a gate and a ten-second panic.