# Theis: A Booster for Building Safer Systems Using the Rust Programming Language
## 4 Design and Construction of Thetis
### Performance  
Another goal in the design and optimization of an operating system is high performance. Unsafe Rust, when used with the \"unsafe\" keyword, bypasses the compiler's checks, which can lead to performance improvements to some extent. Thetis, which is based on minimizing the use of Unsafe Rust, incurs certain performance overheads. This section mainly focuses on the analysis and testing of Thetis's performance.  
For defect detection, the feature-based automated defect detection method proposed in this paper utilizes static feature extraction and regular expression matching. As shown in Table 4, compared to traditional static detection methods, our method is based on source code analysis, without the need for actual program execution. Dynamic detection methods, on the other hand, require program execution and monitoring, which incur significant time and resource costs. However, dynamic detection can cover more execution paths and potential error scenarios through monitoring, whereas static analysis may have a higher risk of false negatives and false positives. Our method, which is based on limited feature extraction, narrows down the detection scope, reduces the possibility of false negatives and false positives, and does not incur significant overheads. Lastly, considering deployment and usability aspects, dynamic detection methods usually require deployment and program execution in real environments, requiring certain technical expertise and resources, and in some cases, they may impact the program's performance. In contrast, the feature extraction and static detection method proposed in this paper can be directly applied to the source code or compiled code, making it relatively straightforward to use. Therefore, the automated defect detection method proposed in this paper improves detection accuracy without causing excessive performance overhead.  
For defect elimination, firstly, a theoretical analysis of the potential overhead in defect elimination methods is performed: (1) For unsafe operations accessing union fields, this paper uses struct as an alternative. During this process, it is necessary to allocate memory space and assign values to all fields in the union, which incurs certain memory overheads; (2) For unsafe operations accessing/modifying static variables, this paper uses mutex locks as an alternative, as the use of locks can increase system runtime overhead. When there is no conflict, the processor cost of acquiring and releasing locks is equivalent to the cost of CAS instructions. If there is a conflict, it will enter a sleep state waiting for wake-up, which increases the cost of context switching and thread scheduling. (3) For other types of unsafe operations, interior unsafe encapsulation may incur overheads.  
Despite the performance overhead of the method proposed in this paper, combining the defect detection results reveals that unions and mutable static variables account for a small proportion of system design, and the switching overhead caused by internal unsafe encapsulation is theoretically small as well. Therefore, theoretically, the defect elimination  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Defect Detection** & **Time and Resources** & **Coverage** & **Deployment Difficulty** \\ \hline Feature extraction & Source level & All unsafe code & Automated, Simple \\ Static method & Source code/compiler & Static structure/logic & Relatively simple \\ Dynamic method & Runtime monitoring & Runtime behavior & Requires \\ \hline \hline \end{tabular}
\end{table}
Table 4: Performance analysis of defect detection methods.  
method designed in this paper has little impact on the performance of Rust systems.  
In order to accurately measure these overheads, this section utilizes LMbench [61] to test the Rust system (specifically, the rCore system [62]) before and after defect elimination. The test results, as shown in Figure 9, demonstrate that the overall performance decreases by approximately 1.076%, maintaining the high-performance characteristics of the Rust system.