6 ms·

Rust makes sense for replacing C++ user space programs. I don’t see how it’s relevant to the Linux kernel at this point.

arcticbull 6y ago
Due to its strong and simple C bindings, there's no reason new kernel modules can't default to being written in Rust, and allow Rust to spread from the "outside in" to the heart of the kernel. I don't advocate wide-scale rewriting of the kernel, but I do think default-to-rust for new kernel components and modules is rational and improves the system.
- phkahler 6y ago
  What about a Rust to C translator? It would produce "safe" C right?
  - zozbot234 6y ago
    You would also need to comprehensively annotate the Linux C headers in order to provide the information that Rust expects (e.g. for each ptr instance whether it's a "raw" pointer, a shared/exclusive reference or a piece of "owned" data, whether it can be NULL etc. etc.). This might actually get accepted upstream though. Having the kernel-build itself depend on Rust could be far more problematic, given e.g. the variety of hardware that Linux must support.
    - TheDesolate0 6y ago
      Not only that, but Rust depends on LLVM.
      - saagarjha 6y ago
        It doesn't have to, but yes, it currently pretty much requires LLVM.
      - dijit 6y ago
        Last time I looked at this comment it was flagged [dead]; I'm glad someone was able to remedy that as I was unable to upvote. I think this is a good criticism, but might not be true forever and is certainly something to keep in mind. As I said in the GP, Rust will not be upstreamed into the kernel- this is one of the reasons why.
        kbenson 6y ago
        If a comment is dead that you think is worthwhile, you can follow the permalink to it and vouch for it. I imagine that feature is gated behind some point threshold, but my guess is whatever that threshold is you're past it.
        dijit 6y ago
        Oh, nice, thanks for that. :)
    - ufmace 6y ago
      I would think such a thing would be more like "compiling" rust to C. As in the C code would have no means to maintain most of the safety guarantees, rather they would be verified at compile time, and the produced C would be meant to be used unchanged. So as long as nobody ever edits the C manually, it would still presumably be safe.
      - phkahler 6y ago
        That's what I really meant. Write it in Rust but then output C instead of ASM. The parent is right though. A component/driver would need to use the C headers from the Rust side.
  - arcticbull 6y ago
    The output of the translator would be right, but messy, and someone would have to go back and clean it up. Doing that work would almost certainly introduce bugs. How many, and whether it outweighs is the question.
  - 6c696e7578 6y ago
    https://lwn.net/Articles/797828/ https://lwn.net/Articles/797828/ Perhaps the way to do it is to rewrite common bits that get CVEs, just so it doesn't happen again.
  - gfs 6y ago
    There is a lot of work being done on a translator now [0]. However, the goal is to translate C to equivalent Rust and then allow developers to intervene to migrate to safe Rust. [0]: https://c2rust.com https://c2rust.com EDIT: Oops, read the parent comment backwards.
    - zozbot234 6y ago
      That's C to Rust, not Rust to C. (mrustc provides something like the latter, but it doesn't actually support full Rust.)
- simion314 6y ago
  We just seen a news that Firefox is reusing Chromes regex c++ code, so from my point of view Firefox is barley pushing for Rust components but Rust fans expect the kernel to push harder. IMO when Firefox and all it's componetns/dependencies are Rustifed then I think we can ask for the kernel to attempt the same.
  - cma 6y ago
    If Firefox wrote a new regex module and didn't use Rust that would contradict the poster's advice, but them using an existing mature bit of coded doesn't seem to prove much.
    - simion314 6y ago
      What Firefox done makes sense, but it does not look good to the idea you can just rewrite in Rust function by function. A regex engine seems to me a thing that is easy to TDD, so I would expect if rewriting in Rust is that easy Firefox would rewrite the most dangerous parts in Rust already (I assume regex is used with untrusted input but I am clueless so i could be wrong). IMO the giant army of Rust fans should put their energy working on Firefox or donating to have Firefox rewriten before 2030, because the story that is heavily promoted is that you can rewrite shit in Rust super easy, function by function, etc but the reality is different.
      - zozbot234 6y ago
        C code can be rewritten function-by-function, even programmatically via c2rust. C++ is a bit messier and even the FFI interoperability story wrt. Rust is not quite complete.
      - frenchy 6y ago
        Firefox didn't choose the C++ regex implementation because rewriting pieces of code with well defined interfaces is hard. It was for a few reasons: 1) at the time they made the decision, there was no existing rust regex library that matched the way that JavaScript worked, 2) they didn't want to write their own/rewrite existing code because regex libraries are complicated beasts, 3) the C++ code is mature and well tested, so the primary benefit of a rust implementation would be more speed (because it's easier to safetly reason about shared data) they didn't think that optimizing the regex engine was a priority.
- uluyol 6y ago
  A mixed-language codebase will always be more complex than a single language one. So it's not just a matter of Rust integrating well-enough with the rest of the kernel, but it has to offer enough improvement for the cost to be worthwhile. So to evaluate whether it's worth introducing rust, you'd ideally want to find a self-contained part of the kernel that is responsible for many CVEs and you'd want to show a substantial reduction of CVEs with the rewrite of just that component. Not impossible, but also not so easy.
- jfkebwjsbx 6y ago
  The kernel is required to be compilable with very old versions of GCC. So unless all users/companies agree on lifting that restriction, there is not much to do. rustc is not stable nor old enough.
  - ndesaulniers 6y ago
    So it's currently GCC 4.6+, with patches queued to bump that to 4.8+. Also, you can use Clang. So I'm not sure how rustc being used for some parts of the kernel has anything to do with developers "restriction?"
    - ndesaulniers 6y ago
      Via LWN, looks like the GCC 4.8+ patches got merged into the kernel's 5.8 merge window recently, with a footnote suggesting this be bumped to GCC 4.9+. https://lwn.net/Articles/822527/ https://lwn.net/Articles/822527/ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4152d146ee21 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

arcticbull 6y ago

Due to its strong and simple C bindings, there's no reason new kernel modules can't default to being written in Rust, and allow Rust to spread from the "outside in" to the heart of the kernel. I don't advocate wide-scale rewriting of the kernel, but I do think default-to-rust for new kernel components and modules is rational and improves the system.

phkahler 6y ago
What about a Rust to C translator? It would produce "safe" C right?
- zozbot234 6y ago
  You would also need to comprehensively annotate the Linux C headers in order to provide the information that Rust expects (e.g. for each ptr instance whether it's a "raw" pointer, a shared/exclusive reference or a piece of "owned" data, whether it can be NULL etc. etc.). This might actually get accepted upstream though. Having the kernel-build itself depend on Rust could be far more problematic, given e.g. the variety of hardware that Linux must support.
  - TheDesolate0 6y ago
    Not only that, but Rust depends on LLVM.
    - saagarjha 6y ago
      It doesn't have to, but yes, it currently pretty much requires LLVM.
    - dijit 6y ago
      Last time I looked at this comment it was flagged [dead]; I'm glad someone was able to remedy that as I was unable to upvote. I think this is a good criticism, but might not be true forever and is certainly something to keep in mind. As I said in the GP, Rust will not be upstreamed into the kernel- this is one of the reasons why.
      - kbenson 6y ago
        If a comment is dead that you think is worthwhile, you can follow the permalink to it and vouch for it. I imagine that feature is gated behind some point threshold, but my guess is whatever that threshold is you're past it.
        dijit 6y ago
        Oh, nice, thanks for that. :)
  - ufmace 6y ago
    I would think such a thing would be more like "compiling" rust to C. As in the C code would have no means to maintain most of the safety guarantees, rather they would be verified at compile time, and the produced C would be meant to be used unchanged. So as long as nobody ever edits the C manually, it would still presumably be safe.
    - phkahler 6y ago
      That's what I really meant. Write it in Rust but then output C instead of ASM. The parent is right though. A component/driver would need to use the C headers from the Rust side.
- arcticbull 6y ago
  The output of the translator would be right, but messy, and someone would have to go back and clean it up. Doing that work would almost certainly introduce bugs. How many, and whether it outweighs is the question.
- 6c696e7578 6y ago
  https://lwn.net/Articles/797828/ https://lwn.net/Articles/797828/ Perhaps the way to do it is to rewrite common bits that get CVEs, just so it doesn't happen again.
- gfs 6y ago
  There is a lot of work being done on a translator now [0]. However, the goal is to translate C to equivalent Rust and then allow developers to intervene to migrate to safe Rust. [0]: https://c2rust.com https://c2rust.com EDIT: Oops, read the parent comment backwards.
  - zozbot234 6y ago
    That's C to Rust, not Rust to C. (mrustc provides something like the latter, but it doesn't actually support full Rust.)
simion314 6y ago
We just seen a news that Firefox is reusing Chromes regex c++ code, so from my point of view Firefox is barley pushing for Rust components but Rust fans expect the kernel to push harder. IMO when Firefox and all it's componetns/dependencies are Rustifed then I think we can ask for the kernel to attempt the same.
- cma 6y ago
  If Firefox wrote a new regex module and didn't use Rust that would contradict the poster's advice, but them using an existing mature bit of coded doesn't seem to prove much.
  - simion314 6y ago
    What Firefox done makes sense, but it does not look good to the idea you can just rewrite in Rust function by function. A regex engine seems to me a thing that is easy to TDD, so I would expect if rewriting in Rust is that easy Firefox would rewrite the most dangerous parts in Rust already (I assume regex is used with untrusted input but I am clueless so i could be wrong). IMO the giant army of Rust fans should put their energy working on Firefox or donating to have Firefox rewriten before 2030, because the story that is heavily promoted is that you can rewrite shit in Rust super easy, function by function, etc but the reality is different.
    - zozbot234 6y ago
      C code can be rewritten function-by-function, even programmatically via c2rust. C++ is a bit messier and even the FFI interoperability story wrt. Rust is not quite complete.
    - frenchy 6y ago
      Firefox didn't choose the C++ regex implementation because rewriting pieces of code with well defined interfaces is hard. It was for a few reasons: 1) at the time they made the decision, there was no existing rust regex library that matched the way that JavaScript worked, 2) they didn't want to write their own/rewrite existing code because regex libraries are complicated beasts, 3) the C++ code is mature and well tested, so the primary benefit of a rust implementation would be more speed (because it's easier to safetly reason about shared data) they didn't think that optimizing the regex engine was a priority.
uluyol 6y ago
A mixed-language codebase will always be more complex than a single language one. So it's not just a matter of Rust integrating well-enough with the rest of the kernel, but it has to offer enough improvement for the cost to be worthwhile. So to evaluate whether it's worth introducing rust, you'd ideally want to find a self-contained part of the kernel that is responsible for many CVEs and you'd want to show a substantial reduction of CVEs with the rewrite of just that component. Not impossible, but also not so easy.
jfkebwjsbx 6y ago
The kernel is required to be compilable with very old versions of GCC. So unless all users/companies agree on lifting that restriction, there is not much to do. rustc is not stable nor old enough.
- ndesaulniers 6y ago
  So it's currently GCC 4.6+, with patches queued to bump that to 4.8+. Also, you can use Clang. So I'm not sure how rustc being used for some parts of the kernel has anything to do with developers "restriction?"
  - ndesaulniers 6y ago
    Via LWN, looks like the GCC 4.8+ patches got merged into the kernel's 5.8 merge window recently, with a footnote suggesting this be bumped to GCC 4.9+. https://lwn.net/Articles/822527/ https://lwn.net/Articles/822527/ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4152d146ee21 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...