3 ms·
I see where you are going, but I don't get how you get from 4 to 5 to 100 to 1500?
by jstimpfle 10y ago
I see where you are going, but I don't get how you get from 4 to 5 to 100 to 1500?
- kazinator 10y agosafeioctl may have to contain a redundant switch (or more OOP-style dipatch across multiple functions) on the command code in order to convert the safe style arguments to each specific low level ioctl call. That sort of thing can easily explode in line count. I can see exactly what geofft is talking about.
- jstimpfle 10y agoOk - it's true that ioctl has a generic interface (hadn't remembered that). We can think of it as hundreds of functions, not just one. So wrapping ioctl "completely" is correspondingly a lot of work. However the point was of course to make a safe-land layer which contains the needed functionality. The point was never to have a function "safeioctl" in the first place.
- tedunangst 10y agoIt's not like your rust safe ioctl wrapper is going to be any less code, though.
- jdcarter 10y agoI can answer: safe read/write from a simple system call can be "easy." Safe read from the network, possible but no longer easy. Safe call to ioctl, which can literally do anything with any device driver... is a "safe" version of that even possible?
- kazinator 10y agoioctl is a marshaling mechanism that can represent a library API of almost unlimited proportions and variety. A safety wrapper basically has to target the specific functions, rather than ioctl itself. That has happened within Unix, with some library functions having originated as wrappers around ioctls.
- tedunangst 10y agoIf we're expanding the set of possible bugs to "the kernel can do anything and overwrite anything", then it doesn't matter what language you use.