Embedded JavaScript for extending C, mJS, takes 25K Flash

[jnz]

Found this recently! Not associated with them, but I'm excited to find something that might work for me. Looking for opinions.

Not sure what to think of it yet. Seems like it's PERFECT for a scripting project I have where I want to take in a remotely generated list of C functions and run them handle from script.

I was on the DSL path but handling logic like "wait for state to be true", "if else branch" and etc was going to be a lot of work. Plus just keeping up to date on the DSL device and remote side was going to be a challenge.

Looked at MicroPython and eLua from advice here, 128K and 192K MINIMUM respectively.

No std library, seems designed for embedded. Same guy who does "V7" JS interpreter. This seems to be a deconteded derivative with one addition I like. FFI, Foriegn Feature Interface.

In order to call a C function from JS it's:

Code: [Select]

let f = ffi('int gpio_write(int, int)'); 
f(2, 1);

25KB Flash, 1KB RAM, one C file one H file, both look easy enough to follow and have decent comments. It SEEMS like exactly what I was looking for. Not sure. Thoughts anyone?

https://mongoose-os.com/blog/mjs-a-new-approach-to-embedded-scripting/
https://github.com/cesanta/mjs

[asgard20032]

A 17k line of code file... NEVER. Its impossible to maintain such a big blob. He should have structured it in many file, easier to debug and maintain. How do you know if there ware bug in that big thing?

[jnz]

A 17k line of code file... NEVER. Its impossible to maintain such a big blob. He should have structured it in many file, easier to debug and maintain. How do you know if there ware bug in that big thing?

Saw that too. I think it's amalgamated for convenience once you know your code works. You can break that apart with the same app they use to combine it.

Certainly not a deal breaker for me. But question... since it's compiled with your code, wouldn't you just see it as debugging? When you are processing JS code you'll see the debugger jump to their code, execute and return context.

If you mean how do you debug your JavaScript code while in C, that applies to all scripting languages regardless of their c/h makeup. No?

[jancumps]

A 17k line of code file... NEVER. Its impossible to maintain such a big blob. He should have structured it in many file, easier to debug and maintain. How do you know if there ware bug in that big thing?

It is amalgamated, yes. The developer documented that in the C header.
Nothing wrong with that.

[ebclr]

That piece of software is amazing, works well and easy

[nctnico]

Any idea about security? How well can you isolate a user from doing harmfull things? A scripting language on a microcontroller should be a sandbox where a user can play but not break things.

[ebclr]

SSL and Certificates  is supported, everything works very easily, Just encrypt everything

[nctnico]

You can't implement SSL in 25k but that is not what I meant: how to prevent a script from doing harmfull things? Buffer overflows?

[jnz]

You can't implement SSL in 25k but that is not what I meant: how to prevent a script from doing harmfull things? Buffer overflows?

Right, and that's a good point. I'll argue that if you have any scripting language that you have the same issue. Right? It becomes a matter of sanatizing input just like form to SQL hacks.

So what do you do? Well, for one I'm writing the only scripts, so I'll just have to test everything I write. Two, end to end encryption and/or sign the scripts with a separate tool, this should keep anyone else from submitting JS scripts. Three, something like a syntax checker (JS Lint?) that checks for commands outside of an allowed set. Like if you were trying to address a pointer to a memory location outside of an allowed range you could put a stop to that, this would be tricky because of the range of commands you could come up with.

Even if you write your own DSL, there is a chance someone could abuse it. Doesn't seem unique to this particular scripting implementation.


Maybe it just seems easier here because the developer thought to put an easy an obvious way to call C functions from JS?

[ebclr]

"You can't implement SSL in 25k "

Wrong !!!!  25K is only the Java wrapper to call C functions ESP32 supports SSL natively with the SDK and Cryptographic hardware acceleration:
– AES
– HASH (SHA-2) library
– RSA
– ECC
– Random Number Generator (RNG)

[Jeroen3]

So not wrong. You need several hundred K of library to compile against.

448 KB ROM for booting and core functions

Yeah.

Title should be:
"Embedded JavaScript for extending C, mJS, takes 473K Flash" for ESP32's

But the concept looks nice. But I think it won't stay small for long.

* 15 thousand source lines of code*

[ebclr]

I'm sorry but you missed the point

That tool is amazing, and you are wrong again still only 25K, and that is the smallest and easiest path to mix C and javascript, Does not exist anything smaller with same functionality, At least try before  getting "smart"

[Jeroen3]

About the SSL? I think not.

The mJS is quite small. It does not seem to use any standard library. Someone has been very busy with it.

Although I don't think it can be maintained very well like this.Or am I missing some special tool?

[krho]

But before using this for anything that goes out of the lab. Please remember that you either have to release the source code with your product or. buy a commercial license.

[jnz]

SSL discussion over. Not part of this conversation. It's the JS for C interpiter that is 25K that also seems to include a JSON parser.

As to someone being very busy with this source, it seems to me this is a direct port/modification of the V7 JS for C project reduced in size and features changed. It's also hard to find a lot of on-topic discussion regarding V7.

I've been going over the source and it seems decent. If I'm not pushing the limits of JS inside of C, I imagine it could be fairly reliable. I want to see what kind of overhead and unpredictability I can manage to find in some test examples but won't be able to make time for that for a few weeks :/

[nctnico]

I'm a complete noob when it comes to javascript so I hope somebody can shine some light on this. I recon regular javascript has some kind of standard library. Is this included as well? If not what would be some minimum requirement?

[KE5FX]

GPL?  Really? 

[jnz]

I'm a complete noob when it comes to javascript so I hope somebody can shine some light on this. I recon regular javascript has some kind of standard library. Is this included as well? If not what would be some minimum requirement?

No standard library. If you wanted to extend it with text string handling you'd have to include/import that.

This seems to have logic, loops, math ops, and function calling. That's about it. Javascript's stdlib includes date formatting and etc, I have little use for that in a micro.

FOR ME, I don't care that it's javascript. I care that it's SCRIPTING that happens to use javascript syntax. In 25KB I can create a scripting instance, send in commands, call C functions from elsewhere in ROM from it, awesome. It's not like Espruino where C is entirely replaced with JS, in that case you would want a standard library. With this, you still have access to whatever C stdlib you are using.

[jnz]

GPL?  Really? 

I know GPL is dying, but for me it doesn't apply (commercial license). But what is the issue with GPL in reality (not everyone is a lawyer fantasy world)?

[KE5FX]

GPL?  Really? 

I know GPL is dying, but for me it doesn't apply (commercial license). But what is the issue with GPL in reality (not everyone is a lawyer fantasy world)?

IMHO, and it's definitely just my opinion, it's lame to accept contributions under the GPL while dual-licensing commercially.  Why should I submit code to a GPL project where the maintainer gets paid for relicensing it under the table?

This sort of thing is trivial enough, but at the same time useful enough, that it should be both accessible and maintainable by any user.  Of course, it's easy to sit around telling other people what they should do for free...

[jnz]

GPL?  Really? 

I know GPL is dying, but for me it doesn't apply (commercial license). But what is the issue with GPL in reality (not everyone is a lawyer fantasy world)?

IMHO, and it's definitely just my opinion, it's lame to accept contributions under the GPL while dual-licensing commercially.  Why should I submit code to a GPL project where the maintainer gets paid for relicensing it under the table?

This sort of thing is trivial enough, but at the same time useful enough, that it should be both accessible and maintainable by any user.  Of course, it's easy to sit around telling other people what they should do for free...

Eh, I see your point. Gimme it doesn't matter because I'm just going to pay if I use it commercially and really have nothing to and no time to contribute anyhow.

But I get that asking people for help then using that license is a little dickish. I think if I were to guess as to why it's that this mJS code is what seems to drive one of their "real" products the MongooseOS in the video above. That's the whole IoT/SSL/TCP protocol OS and stack system.

So while I'm not using any of that, mJS should save me from having to do much of anything to get scripting a "Turing compete" system with very little overhead. Compare 25k to "micro"Python at 150k and it's not even a question. Plus without any direct stack work I can call C functions from script - I'm in love!

[Vtile]

AmForth seems to be 8K with whole development system on chip (Arduinos, MSP430). Might be worth to take a look for some hobbyist or obscure prof.project.

[jnz]

AmForth seems to be 8K with whole development system on chip (Arduinos, MSP430). Might be worth to take a look for some hobbyist or obscure prof.project.

Judging by your other thread... It's clear you are really into Forth right now, but go ahead and compare

let x=0;
let f = ffi('int myCfunc(int, int)'); 
let resp = f(10,20);
if (resp == 1)
x=1000;

To whatever that would be in Forth. I'd MUCH rather spend 25k and get something a entry level programmer could read or write to, over 8k for Forth and have something that almost no one can use or read quickly. Forth is manual stack management. If that's your thing, cool, but I think the world has moved on.