File Edit Win Newcol Kill --:--:-- glenda@p9.rs

p9.rs

// a research-grade port of Plan 9 from Bell Labs to the Rust programming language.

We are reconstructing Rob Pike, Ken Thompson, Dave Presotto, Phil Winterbottom and Howard Trickey's distributed operating system as a memory-safe, capability-oriented kernel. Everything is a file, every file is a 9P resource, and every resource is reachable from every node in the mesh. 

fn main() -> ! {
    let ns = Namespace::bind("/", "#root")?;
    ns.mount("/net",   "tcp!*!9fs")?;
    ns.mount("/proc",  "#p")?;
    ns.serve_9p().forever()
}
  • version0.4.1-pre (2026.05.04)
  • licenseLucent Public License 1.02
  • archamd64 / aarch64 / riscv64
  • protocol9P2000.L over TCP, TLS, virtio
total 14
drwxr-xr-x  glenda  sys      512  Apr  4 21:56 .
drwxr-xr-x  root    sys      512  Mar 19 11:02 ..
-rw-r--r--  glenda  sys     2048  Apr  4 21:51 README
-rw-r--r--  glenda  sys     8192  Apr  4 21:54 kernel.rs
-rw-r--r--  glenda  sys     1024  Apr  4 21:55 ninep.rs
-rw-r--r--  glenda  sys      640  Apr  4 21:55 namespace.rs
drwxr-xr-x  glenda  sys      512  Apr  4 21:56 drivers
drwxr-xr-x  glenda  sys      512  Apr  4 21:56 fs
-rwxr-xr-x  glenda  sys    32768  Apr  4 21:56 rc
lrwxrwxrwx  glenda  sys        7  Apr  4 21:56 acme -> /bin/acme

Glenda -- mascot of Plan 9, drawn in CSS, ported to Rust.

cpu0 idle 12%

cpu1 idle 09%

9fs bound on /n

cs listening tcp!*!564

kbdfs waiting for /dev/kbd

rio attached fb 1920x1200

load [##.... ] 0.21

uptime 0d 00:00:00

Why rewrite Plan 9 in Rust

Plan 9 from Bell Labs was the operating system Unix wanted to grow into. Networked namespaces, per-process file trees, and a single uniform protocol (9P) made distribution feel local. Thirty years on, the ideas remain unmatched, but the original C code shows its age: pointer arithmetic, ad-hoc error handling, and a threading model that predates SMP.

Rust is the first systems language since C with the discipline to be a kernel target while supplying the type-system rigour that the original authors had to impose by hand. We treat each plan9 idea -- the namespace, the channel, the kproc -- as an algebraic data structure with affine ownership and explicit lifetimes.

The result is not a clone. It is a new kernel that reads like a textbook explanation of why Plan 9 was right.

  1. Everything is a file.
  2. Every file is a 9P resource.
  3. Every resource is mountable.
  4. Every process has its own namespace.
  5. Every namespace is composable.
  6. No null pointers escape the kernel.
  7. No data race compiles.

/src -- modules

kernel

no_std, no_alloc until init

The boot path, page allocator, scheduler, and trap frame. ~3,400 lines. Boots on QEMU virt and on real Pi 4 in 320 ms cold.

/src/kernel/{boot,trap,sched,vm}.rs

ninep

9P2000.L codec

Zero-copy parser and serializer for the nine messages of the protocol. Verified against plan9port and diod.

/src/ninep/{parse,write,fid}.rs

namespace

per-process mount tables

Bind, mount, and union directories without a global VFS. Each fork carries an Arc to its parent's namespace.

/src/ns/{bind,mount,union}.rs

rio

tiling window manager

The userspace window manager you are looking at, more or less. Tiled, never overlapping, served as /mnt/wsys.

/src/rio/{tile,draw,wsys}.rs

acme

programmable text editor

Rob Pike's mouse-driven editor, faithfully reproduced. Tag bars, chorded clicks, win, plumb, and all.

/src/acme/{frame,tag,plumb}.rs

venti

archival block store

Content-addressed, write-once block storage. The BLAKE3 hash replaces SHA-1; everything else is bug-for-bug.

/src/venti/{score,arena}.rs

cpu

remote execution

Run a shell on another node with your namespace exported. The original distributed-systems demo, restored.

/src/cpu/{dial,export}.rs

factotum

authentication agent

Holds keys, speaks p9sk1, p9sk2 and, new in 0.4, Ed25519. The kernel never sees a secret.

/src/factotum/{key,proto}.rs

The 9P protocol, drawn flat

client
Tversion »
« Rversion
Tattach fid=0 »
« Rattach qid=...
Twalk fid=0 -> 1 ["src","kernel"] »
« Rwalk [qid,qid]
Topen fid=1 mode=OREAD »
« Ropen qid iounit
Tread fid=1 offset=0 count=8192 »
9fs server

// nine message types, two of which (version, attach) bootstrap the rest. 30 years of consistency.

roadmap

0.12024 Q3boot + 9P loopbackdone
0.22025 Q1rio tiling wmdone
0.32025 Q3acme + plumbdone
0.42026 Q2cpu, factotum, ventiin progress
0.52026 Q4fossil + drawtermplanned
1.02027self-hosting buildplanned

benchmarks

vs. plan9port on identical x86_64 hardware

  • 9P walk (warm) 3.4 us
  • 9P read 4 KiB 4.8 us
  • fork + exec /bin/rc 620 us
  • cold boot to login 320 ms
  • venti put 1 MiB 2.1 ms
"Not only is UNIX dead, it's starting to smell really bad."

-- Rob Pike, 1991

"When in doubt, use brute force."

-- Ken Thompson

"The protocol is the operating system."

-- Dave Presotto

drawterm in your browser

The shortest path from "I read about Plan 9 once" to "I am running Plan 9":

glenda%
Compiling p9rs v0.4.1
Compiling ninep v0.4.1
Compiling rio v0.4.1
Finished release [optimized] target(s) in 38.4s
glenda%
[ok] kernel handed off to /boot/start
[ok] rio: serving /mnt/wsys
[ok] acme: ready
glenda%

references

  • [1] Pike, Presotto, Dorward et al. Plan 9 from Bell Labs. Computing Systems 8, 1995.
  • [2] Pike. Lexical File Names in Plan 9. 2000.
  • [3] Cox, Grosse, Pike et al. Security in Plan 9. Usenix 2002.
  • [4] Quinlan, Dorward. Venti: a new approach to archival storage. FAST 2002.
  • [5] Thompson. Reflections on Trusting Trust. CACM, 1984.