% // vim: set ft=tex:
\chapter{Evaluation}
This chapter summarizes the findings of the previous parts. 
The summary is then evaluated against the hypothesis, to create the foundation of a concise conclusion.

\section{Summary}
After defining an exact definition for memory-safety within the OS was found in \cref{context::introduction::memory-safety::def}, various aspects of software vulnerability origin were discussed.
The human was identified to be an error prone weak spot in the process of OS development.
It was found that technical solutions that can detect these errors are to be used as early in the development process as possible.
This point in time was declared the time of software compilation.

OS development concepts were introduced to for the AMD64 architecture, to lay out the knowledge that to allow an understanding and implementation of OS concepts on AMD64, which was set out for the development process.

Common Weaknesses in software were identified, and demonstrated how these lead to concrete vulnerabilities.
The stack clash was explained as an architectural and design issue, which requires changes in stack overflow detection in userspace software.
The origin of many of the weaknesses was identified to be based on weak languages, and Rust was verified to be a good alternative to C.
Research was conducted on these common weaknesses through other scientific studies.
This found weaknesses based on
\begin{itemize}
    \item use-after-free
    \item indexing out of bounds
    \item iterator invalidation
    \item data races
\end{itemize}
to be prevented by Rust's ownership system\cite{Beingessner2015}.
Stack protection experiments were conducted and found Rust to be less vulnerable to return address manipulation.
These were found to be effectively prevented by static analysis under normal circumstances, since it required multiple explicit features to intentionally force the manipulation to succeed.
Stack overflow could not be statically detected by trying various tweaks to the compiler.
Information that would be required for this static detection was evaluated, and was found to be not completely available in the present compiler architecture.

A practical introduction to Rust was given, overviewing the encountered language features and the ones that were explicitly investigated.
Rust was found to have extension features only limited by the complexity of its usage, demonstrated by an implementation of pure-software information flow control.

Existing OS development efforts were investigated to serve as a codebase for the development and to evaluate their usage of Rust for achieving memory-safety.
Redox OS was found to not be vulnerable to the Stack Clash due to design decisions in the OS.
Blog OS was found to demonstrate extensive usage of Rust's type system to model underlying hardware and prevent mistakes in the paging implementation.

Implementation of preemptive multitasking was chosen to be based on intermezzOS for its simplicity.
After initial problems with the build and debugging tools were solved, the development could proceed quickly.
Based on the state of intermezzOS that allowed the system to boot, a working preemptive multitasking was implemented successfully.
The implementation only supports static memory allocation and no dynamic memory management.
Writing a hardware-driver for the Programmable-Interrupt-Timer was well supported by the module and type system, which allowed an accurate modeling of the underlying hardware.
Global OS state variables can be protected by requiring Rust's unsafe keyword and disallowing the same within additional defined tasks.
Extensive usage of the unsafe keyword was required to perform raw hardware access, but could be limited to well-defined functions.
Inline machine-instructions were found to be well designed and in-line with the rest of the language.
One occurrence of a cast from an untyped pointer was necessary, within the context-switching interrupt handler, to manipulate data on the stack.
A stack overflow on user defined tasks could not be prevented by static analysis, only detected by the OS at runtime.

\subsection{Thesis Evaluation}
Rust's static analysis lacks the ability of static stack overflow detection, which is a significant counter-indication to the hypothesis.
Using Rust's static memory analysis does not fully guarantee In-Kernel memory-safe.

\chapter{Conclusions}
While hypothesis was not proven, Rust is still considered to be a significant improvement over C for OS development purposes.

\paragraph{Rust detects many errors early}
It prevents many errors at compile-time where, they are harmless.
The language is fully extendable via language extensions that allow the insertion of new language features that can be hooked into the static analysis.
The process of making Rust suitable for OS development is driven by many hobby and a few production intended projects.

\section{Hardware is still hard, but Rust is worth learning}
Even though Rust is understood as a memory-safe language, following the hardware specification is still a memory-safety critical requirement.
OS developers must use the unsafe keyword when performing raw hardware access, which is designed to make them think twice when using it.
If the chance is presented, Rust should be chosen any time over C for implementing software that is close to hardware.
This might be difficult in the first place, but should pay off long-term, as less vulnerabilities will be detected throughout the extended life-cycle of the software.

\section{Next Step}
Further investigation is required to propose a solution for the lack of static stack size estimation in \gls{Rust}.
The immediate next step is to bring this issue up for a discussion in the Rust community.

% \chapter{Scratchpad}
% 
% \begin{figure}[ht!]
% \centering
% \begin{subfigure}[T]{0.50\textwidth}
%     \tikzmarkcountprep{callee}
%     \begin{compactminted}[
%             escapeinside=??,linenos,autogobble,highlightlines={}
%     ]{nasm}
%     mov    rax,QWORD PTR [rbp-0x48]?\tikzmarkcount?
%     add    rsp,0x50?\tikzmarkcount?             
%     pop    rbp?\tikzmarkcount?
%     ret?\tikzmarkcount?
%     \end{compactminted} 
%     \tikzmarkdrawcircles
% \caption{Subfig A}
% \end{subfigure}
% \begin{subfigure}[T]{0.45\textwidth}
%     \foreach \x/\xtext in {
%         1/{
%             this is going to be a really long sentence with line wraps 
%         },
%         2/{
%             second
%         }
%     } {\tikzmarkcircle{\x}\xtext\\}
% \caption{Subfig B}
% \end{subfigure}
% \caption{Whadup}
% \label{Whadup}
% \end{figure}
% 
% \begin{listing}
%     \tikzmarkcountprep{example1}
%     \begin{minted}[
%             label=example1,labelposition=all,escapeinside=??,linenos,autogobble,highlightlines={}
%     ]{nasm}
%     mov    rax,QWORD PTR [rbp-0x48]?\tikzmarkcount?  ?\tikzmark{brace1upper}?
%     add    rsp,0x50?\tikzmarkcount?             
%     pop    rbp?\tikzmarkcount?
%     ret?\tikzmarkcount?                              ?\tikzmark{brace1lower}?
%     \end{minted} 
%     \begin{minted}[
%             escapeinside=??,linenos,autogobble,highlightlines={}
%     ]{nasm}
%     mov    rax,QWORD PTR [rbp-0x48]?\tikzmarkcount?
%     add    rsp,0x50                ?\tikzmarkcount?
%     pop    rbp                     ?\tikzmarkcount?
%     ret                            ?\tikzmarkcount?
%     \end{minted} 
%     \begin{tikzpicture}[remember picture,overlay]
%         \draw[thick,decorate,decoration={brace,raise=1ex}] 
%             (pic cs:brace1upper)+(0,1.5ex) -- node[shape=coordinate][right=1.5ex] (a) {} (pic cs:brace1lower);
%         \fill (a)+(2ex,0) circle[opacity=1,radius=1.1ex] node[white,font=\small]{a};
%     \end{tikzpicture}
%     \tikzmarkdrawcircles
%     \caption{Minted Listing A}
% %
%     \foreach \x/\xtext in {
%         1/{
%             this is going to be a really long sentence with line wraps 
%         \\}
%         ,2/{
%             second
%         \\} 
%         ,5/{},6/{
%             hi
%         \\}
%         ,a/{
%             hi
%         \\}
%     } {\tikzmarkcircle{\x}\xtext}
% %
% \end{listing}
% \FloatBarrier
% 
% \begin{listing}
%     \tikzset{/minted/basename=example}
%     \begin{minted}[label=caller,labelposition=topline,escapeinside=??,highlightlines={},autogobble,linenos,breaklines=true]{nasm}
%     mov    rcx,QWORD PTR [rbp-0x40] ; copy 1st arg to rcx
%     mov    rsi,QWORD PTR [rbp-0x38] ; copy 2nd arg to rsi
%     mov    rdx,QWORD PTR [rbp-0x30] ; copy 3rd arg to rdx
%     mov    QWORD PTR [rbp-0x60],rdi ; save rdi to make it available
%     mov    rdi,rcx                  ; copy 1st arg to rdi
%     mov    QWORD PTR [rbp-0x68],rax ; save rax to make it available
%     call   7490?\tikzmark{exampleprecallfrom}? <_ZN14stack_handling3sum17h8f12d2383e075691E> ; push '756e' onto the stack and jump to the first instruction of sum
%     mov    QWORD PTR [rbp-0x28],rax ; save return value
%     \end{minted}
%     \caption{Function Call with Three Arguments}
%     \begin{tikzpicture}[remember picture,overlay]
%         \draw[red,thick] (pic cs:exampleprecallfrom) ellipse (0.7cm and 12pt) node { \textbf{1} };
%         \fill[blue] (pic cs:example1) circle (0.1cm);
%         \fill[yellow] (pic cs:example2) circle (0.1cm);
%     \end{tikzpicture}
% \end{listing}
% 
% \begin{tikzpicture}[node distance=2cm,
%         startstop/.style={rectangle, rounded corners, minimum width=3cm, minimum height=1cm,text centered, draw=black, fill=red!30},
%         io/.style = {trapezium, trapezium left angle=70, trapezium right angle=110, minimum width=3cm, minimum height=1cm, text centered, draw=black, fill=blue!30},
%         process/.style = {rectangle, minimum width=1cm, minimum height=1cm, text centered, text width=3cm, draw=black, fill=orange!30},
%         decision/.style = {diamond, minimum width=3cm, minimum height=1cm, text centered, draw=black, fill=green!30},
%         arrow/.style = {thick,->,>=stealth} 
%     ]
% 
% %\node (start) [startstop] {Start};
% %\node (in1) [io, below of=start] {Input};
% %\node (pro1) [process, below of=in1] {Process 1};
% %\node (dec1) [decision, below of=pro1, yshift=-0.5cm] {Decision 1};
% %\node (pro2a) [process, below of=dec1, yshift=-0.5cm] {Process 2a text text text text text text text text text text};
% %\node (pro2b) [process, right of=dec1, xshift=2cm] {Process 2b};
% %\node (out1) [io, below of=pro2a] {Output};
% %\node (stop) [startstop, below of=out1] {Stop};
% %
% %\draw [arrow] (start) -- (in1);
% %\draw [arrow] (in1) -- (pro1);
% %\draw [arrow] (pro1) -- (dec1);
% %\draw [arrow] (dec1) -- node[anchor=east] {yes} (pro2a);
% %\draw [arrow] (dec1) -- node[anchor=south] {no} (pro2b);
% %\draw [arrow] (pro2b) |- (pro1);
% %\draw [arrow] (pro2a) -- (out1);
% %\draw [arrow] (out1) -- (stop);
% 
% \node[process,xshift=0ex,yshift=-0ex] (ua_back) {User Applications};
% \node[process,xshift=0ex,yshift=-1ex] at (ua_back) {User Applications};
% \node[process,xshift=0ex,yshift=-2ex] (ua) at (ua_back) {User Applications};
% 
% \node[process,xshift=0ex,yshift=-0ex,below of=ua] (sl_back) {System Libraries};
% \node[process,xshift=0ex,yshift=-1ex] at (sl_back) {System Libraries};
% \node[process,xshift=0ex,yshift=-2ex] (sl) at (sl_back) {System Libraries};
% 
% \node[process,xshift=0ex,yshift=-0ex,below of=sl] (os_back) {OS};
% \node[process,xshift=0ex,yshift=-1ex] at (os_back) {OS API};
% \node[process,xshift=0ex,yshift=-2ex] (os) at (os_back) {OS};
% 
% \node[process,xshift=0ex,yshift=-0ex,left of=mem, below of=os] (cpu) {CPU};
% \node[process,xshift=0ex,yshift=-0ex,right of=cpu] (mem) {Memory};
% \node[process,xshift=0ex,yshift=-0ex,right of=mem] (otherhw) {Other HW};
% 
% \draw [arrow] (ua) -- (sl);
% \draw [arrow] (sl) -- (os);
% \draw [arrow] (os) -- (cpu);
% \draw [arrow] (os) -- (mem);
% \draw [arrow] (os) -- (otherhw);
% 
% TODO: improve
% 
% \end{tikzpicture}
% 
% \begin{markdown}
% # Flow of Reasoning
% * How to mitigate distributed weaknesses
%     - Don't distribute vulnerable software
%     - Produce less vulnerabilities
%     OR
%     - Detect vulnerabilities
% * How to prevent vulnerabilities distribution?
%     - Human to make less mistakes; NOT VIABLE, see human aspect.
%     - Detect them before the \gls{app} is installed; see time aspect
% * How to detect vulnerabilities
%     - Write runtime tests for the program
%     - Analyze the source code
% * Runtime Tests
%     - Runs on every execution, thus wastes \gls{cpu} resources
%     - Program needs to handle it
%     -> Slow and too late in the software life cycle!
% * Source Code Analysis
%     - Difficult for low-level code, would require hardware knowledge
%     - Compilers are source code analysers by nature
%     - Additional tools can help, but this takes more effort
%     -> chose a compiler with high analysis standards
% * Choice of Compiler: Language Dependent
%     - C: Safe C, Cyclone, etc.: define sub language that is analyzable. MEH
%     - Rust: designed to be analyzable. WIN!
% * Rust
%     - Can the analyzes be extended to suite OS dev? 
% \end{markdown}
