3 ms·

Indeed. I wonder why they didn't go with Rust? They seem to be trying to make the perfect architecture from scratch without worries about complexity or how expe

Indeed. I wonder why they didn't go with Rust? They seem to be trying to make the perfect architecture from scratch without worries about complexity or how experimental it is or even how long it'll take, and yet they don't go with a language that'll solve a whole other class of problems? Seems like an odd choice. Maybe they're just making use of the existing C++ talent pool at Google.

nicoburns 6y ago
Lots of the userland pieces are in Rust. I don't think Rust gives you much advantage for kernel code (esp. in a microkernel), because most of it is unsafe anyway. And Rust has some missing pieces for this kind of code (for example, using custom allocators on a per-data structure basis is still difficult).
- Iolaum 6y ago
  I wonder if that's true for RedoxOS microkernel [0]? I m not technical enough to make the comparison myself. [0]: https://gitlab.redox-os.org/redox-os/kernel https://gitlab.redox-os.org/redox-os/kernel
  - qchris 6y ago
    I'm not a developer on it, but I've been following the development pretty closely for a while. IIRC, the lead developer Jeremy Soller states that even though the kernel code does require unsafe blocks, it's actually less common than you might think. I can't find the source, but for some reason I have it in my head that the percent of Redox kernel code that is unsafe sits at somewhere around 30%, which especially considering the actual LoC of the microkernel vs. a monolith, means much easier code coverage. Again, the exact number might be wrong, but I do know that the kernel is significantly less that 100% unsafe code.
- zepto 6y ago
  Seems like it would be trivial for them to have extended rust, given the resources they are applying to this.
- modeless 6y ago
  I've heard this kind of argument a lot and it's getting tiresome when we just keep seeing the same old preventable bugs being a problem time and time again. Yes, a kernel written in a safe language will still have security bugs. But it would absolutely have a very large positive impact. And any problems with safe languages can be worked around with a bit of imagination, especially with the level of effort already required to write a whole OS with a large number of hardware drivers.
  - naasking 6y ago
    Rust would help with drivers, not so much with the kernel itself. Drivers run in user space in Fuschia, so you should be able to use any language you want.
    - tbodt 6y ago
      *Fuchsia
  - deleted 6y ago
    [deleted]
  - fragmede 6y ago
    If you turn off all the safety checks, is Rust still safe? It seems a microkernel architecture allows for the kernel to be as small as possible, with the scheduler and drivers and everything written in a safe language in user-space. In that case, it is anything other than vanity that says the kernel is better off being written in a "safe" language with all the safeties turned off, compared to a unsafe language?
    - modeless 6y ago
      1. Fuchsia is not a microkernel, according to themselves. [1] 2. You don't have to turn off safety checks in all of the code. Only having to audit the unsafe code is still a huge win. You're vastly overstating the amount of code that can't be safe. 3. Fuchsia has many components outside of the kernel that should have been written in safe languages but weren't. 4. It's funny that you use the word vanity. I think it perfectly describes the attitude that you're smart enough to write a nontrivial project in C/C++ without any of the many classes of preventable bugs that safe languages fix. Or that a few parts of your code requiring unsafe behavior somehow elevate the whole project into an elite class that doesn't need safety. [1] https://fuchsia.dev/fuchsia-src/concepts https://fuchsia.dev/fuchsia-src/concepts

nicoburns 6y ago

Lots of the userland pieces are in Rust. I don't think Rust gives you much advantage for kernel code (esp. in a microkernel), because most of it is unsafe anyway. And Rust has some missing pieces for this kind of code (for example, using custom allocators on a per-data structure basis is still difficult).

Iolaum 6y ago
I wonder if that's true for RedoxOS microkernel [0]? I m not technical enough to make the comparison myself. [0]: https://gitlab.redox-os.org/redox-os/kernel https://gitlab.redox-os.org/redox-os/kernel
- qchris 6y ago
  I'm not a developer on it, but I've been following the development pretty closely for a while. IIRC, the lead developer Jeremy Soller states that even though the kernel code does require unsafe blocks, it's actually less common than you might think. I can't find the source, but for some reason I have it in my head that the percent of Redox kernel code that is unsafe sits at somewhere around 30%, which especially considering the actual LoC of the microkernel vs. a monolith, means much easier code coverage. Again, the exact number might be wrong, but I do know that the kernel is significantly less that 100% unsafe code.
zepto 6y ago
Seems like it would be trivial for them to have extended rust, given the resources they are applying to this.
modeless 6y ago
I've heard this kind of argument a lot and it's getting tiresome when we just keep seeing the same old preventable bugs being a problem time and time again. Yes, a kernel written in a safe language will still have security bugs. But it would absolutely have a very large positive impact. And any problems with safe languages can be worked around with a bit of imagination, especially with the level of effort already required to write a whole OS with a large number of hardware drivers.
- naasking 6y ago
  Rust would help with drivers, not so much with the kernel itself. Drivers run in user space in Fuschia, so you should be able to use any language you want.
  - tbodt 6y ago
    *Fuchsia
- deleted 6y ago
  [deleted]
- fragmede 6y ago
  If you turn off all the safety checks, is Rust still safe? It seems a microkernel architecture allows for the kernel to be as small as possible, with the scheduler and drivers and everything written in a safe language in user-space. In that case, it is anything other than vanity that says the kernel is better off being written in a "safe" language with all the safeties turned off, compared to a unsafe language?
  - modeless 6y ago
    1. Fuchsia is not a microkernel, according to themselves. [1] 2. You don't have to turn off safety checks in all of the code. Only having to audit the unsafe code is still a huge win. You're vastly overstating the amount of code that can't be safe. 3. Fuchsia has many components outside of the kernel that should have been written in safe languages but weren't. 4. It's funny that you use the word vanity. I think it perfectly describes the attitude that you're smart enough to write a nontrivial project in C/C++ without any of the many classes of preventable bugs that safe languages fix. Or that a few parts of your code requiring unsafe behavior somehow elevate the whole project into an elite class that doesn't need safety. [1] https://fuchsia.dev/fuchsia-src/concepts https://fuchsia.dev/fuchsia-src/concepts