4 ms·
> The difference is that it's limited in scope, and auditable. Even in a kernel, if you do it right, unsafe is the vast, vast minority of code. That’s true but
by CyberRabbi 6y ago
> The difference is that it's limited in scope, and auditable. Even in a kernel, if you do it right, unsafe is the vast, vast minority of code.
That’s true but it’s also slightly misleading. Any code that uses the unsafe wrappers technically must be checked and all code that uses that code must checked in turn, ad Infinitum. Misuse of the Unsafe wrapper can occur at any level. For instance, if you misuse a DMA command that corrupts memory, it’s not simply the DMA command wrapper that must be checked, the entire sequence of logic that led to the bad command being executed must also be checked.
- TheCoelacanth 6y ago> Any code that uses the unsafe wrappers technically must be checked If that is the case, then your unsafe wrappers are unsound. Safe functions need to be impossible to use in an unsafe way or else they should marked as unsafe. That could take the form of a runtime check that the function's invariants are maintained or a proof that the function's invariants are always maintained.
- steveklabnik 6y agoIf an unsafe wrapper can be mis-used, it's not actually safe, and so the bug still lies inside the wrapper.
- CyberRabbi 6y agoThat’s true, so now I see where the issue of unavoidable unsafe usage comes in. It’s not always possible to create a safe and general wrapper for all driver functionality, though in special cases maybe. I agree now that using Rust still offers something even if it can’t be guaranteed that the code is 100%. Thanks for explaining.