In 2D, it would become sokoban, wouldn't it?

No? Sokoban involves a single agent pushing blocks around a grid. No block can ever move without being pushed, and nothing can ever cross anything else.

In this puzzle, the only way for anything to move is independently, and everything is free to cross anything else.

The one I'm most excited about is improved error recovery:

https://soft-dev.org/pubs/html/diekmann_tratt__dont_panic/

https://drops.dagstuhl.de/storage/00lipics/lipics-vol166-eco...

The USB driver itself can not access arbitrary memory. But it may be able to program the DMA controller of the USB peripheral to access arbitrary memory. So the WebAssembly sandboxing of a driver alone is not enough. You still need some hardware mechanism like an SMMU. Or a trusted module that abstracts the DMA controller.

Indeed we thought this would be a challenge and I didn’t explain this aspect in the blog post. But on this chip, DMA is its own peripheral and the DMA peripheral is not used by the USB driver. Instead, the USB peripheral and the main CPU share a small memory region. The USB peripheral is then programmed in terms of offsets into this shared memory region, rather than physical memory addresses—-the USB peripheral does not have access to all of physical memory. This is discussed at the bottom of page 48 of the thesis itself [1].

This saved a lot of trouble, but in intro work on this I was using another chip (nRF52840) that worked the way you describe. To safely handle DMA in that case, without an IOMMU, we had to add somewhat complex reasoning that looked at each memory read and write to see if it was modifying a DMA control register and reject the write if it could lead to unsafe behavior. More info is on pages 52-55 of the thesis PDF.

This was pretty messy, so it was fortunate that the chip we used had a different plan. Let me know if I’m misunderstanding you!

[1]: https://pdos.csail.mit.edu/papers/bkettle-meng.pdf#page48

Are there NX pages/flags?

NX bit: https://en.wikipedia.org/wiki/NX_bit

Tagged architecture / Memory tagging: https://en.wikipedia.org/wiki/Tagged_architecture & type unions

Harvard architecture > memory details > Contrast with modified Harvard architecture: https://en.wikipedia.org/wiki/Harvard_architecture#Contrast_...

IIUC Ideally there should be an NX bit on pages, registers, names, and/or variables; and the programming language supports it.

(IIRC, with CPython the NX bit doesn't work when any imported C extension has nested functions / trampolines?)

"performance and control of C" also means that you can make datastructures with arbitrary pointers, right? The simplest example that doesn't work in rust is a linked list.

How can you do that when you only have multiple stacks, but no heap?

A singly-linked list is perfectly possible in safe Rust (https://rust-unofficial.github.io/too-many-lists/third-layou...):

    pub struct List<T> {
        head: Link<T>,
    }

    type Link<T> = Option<Rc<Node<T>>>;

    struct Node<T> {
        elem: T,
        next: Link<T>,
    }

Or you can replace `Rc` with `Box` if you don't need multiple links to each node.

In high-level Dawn, it's basically the same as in Haskell:

    {data v0 List {cons Nil} {cons v0 (v0 List) Cons}}

The first compiler will be quite simple and will produce roughly the equivalent of the above Rust implementation.

As for cyclic doubly-linked lists and arbitrary cyclic graphs, I'll describe how those will work in a future post.