5 ms·

I wonder what is the benefit of rewriting the libc in Rust, as most of the functions are actually unsafe. Implementing memcpy in Rust won't make memcpy any safe

by nikital 10y ago

I wonder what is the benefit of rewriting the libc in Rust, as most of the functions are actually unsafe. Implementing memcpy in Rust won't make memcpy any safer. As far as I understand, the main selling point of Rust is safety, so if we don't get any safety, why bother? Am I missing something? (Other than having some fun with Rust, which is obviously welcome :) )

mwcampbell 10y ago
For simple functions like memcpy, I think you're right. But it may be worthwhile to implement higher-level libc features like the DNS resolver in Rust.
pcwalton 10y ago
I came to this thread hoping to answer this exact question. :) There isn't a huge benefit to writing things like strlen in Rust. But a lot of libc is big, complicated things like the DNS resolution logic in gethostbyname. These are also where we find a huge number of vulnerabilities in popular libcs. The internal logic of functions like gethostbyname should be able to profitably take advantage of Rust's safety features.
- dikaiosune 10y ago
  For this project, the advantage to rewriting strlen in Rust is for my learning and to test my Frankenstein-ian link-time munging, not because Rust is better at unsafely dereferencing random pointers (C's got that pretty well covered). I do hope to soon move on to the more meaty bits and show ways in which Rust can improve safety, but I wanted to get my initial thoughts and results written down so I could reference back to the post later. Frankly did not expect to see it here :).
- chubot 10y ago
  Also, stuff like glob(), fnmatch(), regcomp()/regexec(), should be better in Rust. They involve a bit of parsing.
  - dikaiosune 10y ago
    I'm eager to try out some of the Rust parser combinators for different sections, but I need to make it possible to start using parts of the standard library to import those crates, which is why I'm working on malloc/free and friends right now.
- deleted 10y ago
  [deleted]
- panic 10y ago
  Here's musl's DNS resolution logic, for other people who may be curious: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n...
  - kbenson 10y ago
    This exemplifies why I've always been mystified by those that say Perl is line noise, but don't seem to have a problem with C. It's obvious to me that what one considers hard to read code, or colloquially as "line noise", is greatly impacted with how familiar one is with a language and the idioms of that language being used in the code in question.
  - asveikau 10y ago
    That is crazy simple. I bet glibc's is a lot longer.
    - jcranmer 10y ago
      Here's part of glibc's: https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/getaddrinfo.c;h=31bb7e66dcbe1868b8e5e34185e048fe5bde15ab;hb=0d261f406d7c8f70b4ad7ca7d9247da1db3dfb41 https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/pos...
- jpgvm 10y ago
  There are other advantages too. If you rewrite libc in Rust you can also take advantage of link time optimisation, full static compilation and (further) platform independence. That and people underestimate the value of the entire codebase being in a single programming language and environment. If your language continues to rely on C dynamically linked libraries there remains a barrier that your workflow can't be translated across. This is more pronounced in languages like Ruby/Python/Java ofcourse but it's still true for Rust to some extent. Having everything written in Rust (or whatever language you prefer) has compounding benefits when it comes to productively programming on really large systems.
  - dikaiosune 10y ago
    Don't get me wrong (I mean I'm rewriting in Rust), but: LTO and static compilation are available to binaries built and statically linked with musl (it's one of the main advantages musl has over glibc, aside from being a more readable and cleaner codebase). And musl has done a lot of work to have correct cross-platform implementations. Granted whenever Rust adds a new target, it should be easier for things to "just work" when cross-compiled, but Rust is far less portable than C + a modicum of macros at the moment.
dikaiosune 10y ago
I agree that with very unsafe functions Rust's memory guarantees are not particularly relevant. There are however some other benefits which I discussed in the post (sum types, strict integer typing without promotion, etc.).

by nikital 10y ago

mwcampbell 10y ago

For simple functions like memcpy, I think you're right. But it may be worthwhile to implement higher-level libc features like the DNS resolver in Rust.

pcwalton 10y ago

I came to this thread hoping to answer this exact question. :) There isn't a huge benefit to writing things like strlen in Rust. But a lot of libc is big, complicated things like the DNS resolution logic in gethostbyname. These are also where we find a huge number of vulnerabilities in popular libcs. The internal logic of functions like gethostbyname should be able to profitably take advantage of Rust's safety features.

dikaiosune 10y ago
For this project, the advantage to rewriting strlen in Rust is for my learning and to test my Frankenstein-ian link-time munging, not because Rust is better at unsafely dereferencing random pointers (C's got that pretty well covered). I do hope to soon move on to the more meaty bits and show ways in which Rust can improve safety, but I wanted to get my initial thoughts and results written down so I could reference back to the post later. Frankly did not expect to see it here :).
chubot 10y ago
Also, stuff like glob(), fnmatch(), regcomp()/regexec(), should be better in Rust. They involve a bit of parsing.
- dikaiosune 10y ago
  I'm eager to try out some of the Rust parser combinators for different sections, but I need to make it possible to start using parts of the standard library to import those crates, which is why I'm working on malloc/free and friends right now.
deleted 10y ago
[deleted]
panic 10y ago
Here's musl's DNS resolution logic, for other people who may be curious: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n...
- kbenson 10y ago
  This exemplifies why I've always been mystified by those that say Perl is line noise, but don't seem to have a problem with C. It's obvious to me that what one considers hard to read code, or colloquially as "line noise", is greatly impacted with how familiar one is with a language and the idioms of that language being used in the code in question.
- asveikau 10y ago
  That is crazy simple. I bet glibc's is a lot longer.
  - jcranmer 10y ago
    Here's part of glibc's: https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/getaddrinfo.c;h=31bb7e66dcbe1868b8e5e34185e048fe5bde15ab;hb=0d261f406d7c8f70b4ad7ca7d9247da1db3dfb41 https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/pos...
jpgvm 10y ago
There are other advantages too. If you rewrite libc in Rust you can also take advantage of link time optimisation, full static compilation and (further) platform independence. That and people underestimate the value of the entire codebase being in a single programming language and environment. If your language continues to rely on C dynamically linked libraries there remains a barrier that your workflow can't be translated across. This is more pronounced in languages like Ruby/Python/Java ofcourse but it's still true for Rust to some extent. Having everything written in Rust (or whatever language you prefer) has compounding benefits when it comes to productively programming on really large systems.
- dikaiosune 10y ago
  Don't get me wrong (I mean I'm rewriting in Rust), but: LTO and static compilation are available to binaries built and statically linked with musl (it's one of the main advantages musl has over glibc, aside from being a more readable and cleaner codebase). And musl has done a lot of work to have correct cross-platform implementations. Granted whenever Rust adds a new target, it should be easier for things to "just work" when cross-compiled, but Rust is far less portable than C + a modicum of macros at the moment.

dikaiosune 10y ago

I agree that with very unsafe functions Rust's memory guarantees are not particularly relevant. There are however some other benefits which I discussed in the post (sum types, strict integer typing without promotion, etc.).