6 ms·

Have their been any large projects that used this as a starting point for a port? I would be curious how it works out in practice.

by detaro 5y ago

billconan 5y ago
But what about borrow checking? Will the transpiled code be runnable.
- deleted 5y ago
  [deleted]
- qw3rty01 5y ago
  it doesn't convert pointers to references, it just uses pointers, so the borrow checker isn't invoked.
  - TheMagicHorsey 5y ago
    For the non-Rust programmers here, does that mean you don't get Rust's memory safety with this transpiler?
    - deleted 5y ago
      [deleted]
    - qw3rty01 5y ago
      Correct, although it looks like converting some parts to safe code may be a future goal
      - steveklabnik 5y ago
        What they've stated previously is that they plan to go with the approach of "compile C to unsafe Rust" and "compile unsafe Rust to safe Rust" as two separate things that could be chained together. I don't remember if it's meant to be literally another tool or just the general approach, but seems very interesting and sensible to me!
    - necubi 5y ago
      That's correct. There's no way to translate arbitrary C to memory safe code.
      - jacquesm 5y ago
        If you could, you wouldn't need Rust in the first place.
        TheMagicHorsey 5y ago
        That's a good point. I feel stupid for asking now :D
      - charcircuit 5y ago
        But can we get 80% there and then have a human help out?
        pizza234 5y ago
        > But can we get 80% there and then have ma human help out? The problem is that for complex enough projects, the architectural redesign is considerably more demanding than a "remaining 20%". I can imagine it also being quite irritanting, due to shortcuts one may take in C taking advantage of implicit application logic (independently of them being warranted or not), that can't be directly translated due to the Rust strictness.
        pshc 5y ago
        I wonder if the brainiacs at OpenAI could train a neural net on human-written C -> Rust translations.
      - amelius 5y ago
        But what if the arbitrary C code was memory-safe to begin with?
        deagle50 5y ago
        Then I assume you'd get safe, "unsafe" Rust code.
    - usrusr 5y ago
      From another non-rust programmer: all bugs you could write in C will still be there in the transpiled code and the parts that happen to not be bugs will still look as indistinguishable from bugs as they did before. Likely even more indistinguishable than before, because chances are you are better at reading idiomatic C than at reading the anti-idiomatic rust created by the transpiler. But there will likely be some low-hanging fruits of code that can subsequently be changed into idiomatic rust that simply cannot encode certain classes of bugs (without becoming as un-idiomatic as the transpiler output).
    - accountofme 5y ago
      The idea here is you get the c code transpiled verbatim into unsafe rust code. It is your job to then make it safe rust code :). Edit: spelling
- estebank 5y ago
  The transpiled code will use pointers, it will not transform C-isms that could map to Rust-isms (like borrowing instead of pointers, or iterators instead of pointer arithmetic). This is meant to be only the first step in a Rust refactor. https://galois.com/blog/2018/08/c2rust/ https://galois.com/blog/2018/08/c2rust/ https://github.com/immunant/c2rust/wiki/Known-Limitations-of-Translation https://github.com/immunant/c2rust/wiki/Known-Limitations-of...
steveklabnik 5y ago
What I am most curious about is the final paragraph of https://github.com/immunant/c2rust#acknowledgements-and-licensing https://github.com/immunant/c2rust#acknowledgements-and-lice... There was a while there where they were trying to test this out on the cvs codebase, IIRC. It's a good candidate: upstream doesn't exactly move quickly, but is very much a real-world codebase, still in use.
- mlindner 5y ago
  Interesting, this paper also mentions the same DARPA contract: https://apps.dtic.mil/sti/pdfs/AD1084807.pdf https://apps.dtic.mil/sti/pdfs/AD1084807.pdf It shows up in this document of contracts: https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20Room/DARPA/16-F-0263%20FY2015%20DARPA%20Funding%20Spreadsheet.pdf https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20... * Contract Number: FA875015C0124 * Performer Name: GALOIS, INC. * Agent Name: AFRL, Information Directorate MR * Program Name: Cyber Fault-tolerant Attack Recovery (CFAR) * Office: I2O * Fiscal Year: 2015 * Obligated ($): 2,099,878
neopallium 5y ago
I just started using c2rust on openjpeg [0] (jpeg 2000 encoder/decoder) today and already have it working as a drop in replacement for the C libopenjp2.so on Linux. Still has a lot of unsafe code, but it does work. Which will be a big help with testing during refactoring to idiomatic safe Rust. c2rust also has a refactor command that helps with refactoring the generated Rust code. [0] https://github.com/Neopallium/openjpeg/tree/c2rust https://github.com/Neopallium/openjpeg/tree/c2rust
pornel 5y ago
I've used my homebrew c2rust converter[1] to translate lodepng and pngquant[2] libraries to Rust. My two key takeaways are: Good test coverage is essential for this. Count how many bugs you've written when you were writing this code for the first time. Even if your bug-rate is 99% better during the rewrite, that may still be a significant number. Fine-grained tests aren't necessary, but end-to-end tests that touch every feature are crucial to catch regressions. Once the rough conversion is done, it is necessary to refactor the code to take advantage of Rust's idioms to get safety benefits. Just 1:1 conversion is underwhelming, and it feels like replacing gcc with rustc. I did not realize just how recklessly pointer-heavy C tends to be until I saw it through Rusty lens. The lodepng conversion was "meh". It's a good C code, but its structure was very different from what you'd do in Rust (e.g. Rust prefers generics over pointer casts, iterators over indexing or pointer arithmetic, has interfaces for steaming processing that C lacks). I don't know how far I can refactor the code to Rusty idioms and still call it lodepng :) OTOH the pngquant codebase was mine, and I'm happy with the results. When converting I took advantage of Rust idioms, and the Rust version is nicer to maintain and even a bit faster. [1]: https://lib.rs/crates/citrus https://lib.rs/crates/citrus [2]: https://pngquant.org/rust.html https://pngquant.org/rust.html
- littlestymaar 5y ago
  Thanks for citrus, I've started experimenting on it after I've read your pngquant blog post[1] the other day, and it's exactly what I was looking for: c2rust does semantically exact conversion, which isn't what I need: I needed a tool to automate the boring syntax conversion, and when doing the idiomatic rustification by hand I can take care about the different semantics of the two languages. Off course there's a different trade-off when bugs are involved: c2rust shouldn't add any bugs during the conversion, while citrus will. [1]: https://pngquant.org/rust.html https://pngquant.org/rust.html
muizelaar 5y ago
I converted https://github.com/FirefoxGraphics/qcms https://github.com/FirefoxGraphics/qcms and then refactored it to mostly safe Rust. I ran into a number of issues https://github.com/immunant/c2rust/issues?q=is%3Aissue+author%3Ajrmuizel https://github.com/immunant/c2rust/issues?q=is%3Aissue+autho... but it generally worked ok. I found refactoring the resulting Rust code somewhat error prone and didn't have great success with the automated tools. I'd recommend having a good test suite and suggest adjusting the C before the conversion to avoid using C features that don't translate well like the C preprocessor.
accountofme 5y ago
Immutant did convert the quake 3 source to rust and hot it to run... They have a blogpost about it kicking around....
bpetersen 5y ago
we used c2rust in 2019 for the Delta Chat core library; we added some more details about that to the blog post that time [1] [1] https://delta.chat/en/2019-05-08-xyiv#the-coming-delta-chat-rustocalypse https://delta.chat/en/2019-05-08-xyiv#the-coming-delta-chat-...

Have their been any large projects that used this as a starting point for a port? I would be curious how it works out in practice.

by detaro 5y ago

Have their been any large projects that used this as a starting point for a port? I would be curious how it works out in practice.

billconan 5y ago

But what about borrow checking? Will the transpiled code be runnable.

deleted 5y ago
[deleted]
qw3rty01 5y ago
it doesn't convert pointers to references, it just uses pointers, so the borrow checker isn't invoked.
- TheMagicHorsey 5y ago
  For the non-Rust programmers here, does that mean you don't get Rust's memory safety with this transpiler?
  - deleted 5y ago
    [deleted]
  - qw3rty01 5y ago
    Correct, although it looks like converting some parts to safe code may be a future goal
    - steveklabnik 5y ago
      What they've stated previously is that they plan to go with the approach of "compile C to unsafe Rust" and "compile unsafe Rust to safe Rust" as two separate things that could be chained together. I don't remember if it's meant to be literally another tool or just the general approach, but seems very interesting and sensible to me!
  - necubi 5y ago
    That's correct. There's no way to translate arbitrary C to memory safe code.
    - jacquesm 5y ago
      If you could, you wouldn't need Rust in the first place.
      - TheMagicHorsey 5y ago
        That's a good point. I feel stupid for asking now :D
    - charcircuit 5y ago
      But can we get 80% there and then have a human help out?
      - pizza234 5y ago
        > But can we get 80% there and then have ma human help out? The problem is that for complex enough projects, the architectural redesign is considerably more demanding than a "remaining 20%". I can imagine it also being quite irritanting, due to shortcuts one may take in C taking advantage of implicit application logic (independently of them being warranted or not), that can't be directly translated due to the Rust strictness.
      - pshc 5y ago
        I wonder if the brainiacs at OpenAI could train a neural net on human-written C -> Rust translations.
    - amelius 5y ago
      But what if the arbitrary C code was memory-safe to begin with?
      - deagle50 5y ago
        Then I assume you'd get safe, "unsafe" Rust code.
  - usrusr 5y ago
    From another non-rust programmer: all bugs you could write in C will still be there in the transpiled code and the parts that happen to not be bugs will still look as indistinguishable from bugs as they did before. Likely even more indistinguishable than before, because chances are you are better at reading idiomatic C than at reading the anti-idiomatic rust created by the transpiler. But there will likely be some low-hanging fruits of code that can subsequently be changed into idiomatic rust that simply cannot encode certain classes of bugs (without becoming as un-idiomatic as the transpiler output).
  - accountofme 5y ago
    The idea here is you get the c code transpiled verbatim into unsafe rust code. It is your job to then make it safe rust code :). Edit: spelling
estebank 5y ago
The transpiled code will use pointers, it will not transform C-isms that could map to Rust-isms (like borrowing instead of pointers, or iterators instead of pointer arithmetic). This is meant to be only the first step in a Rust refactor. https://galois.com/blog/2018/08/c2rust/ https://galois.com/blog/2018/08/c2rust/ https://github.com/immunant/c2rust/wiki/Known-Limitations-of-Translation https://github.com/immunant/c2rust/wiki/Known-Limitations-of...

steveklabnik 5y ago

What I am most curious about is the final paragraph of https://github.com/immunant/c2rust#acknowledgements-and-licensing https://github.com/immunant/c2rust#acknowledgements-and-lice... There was a while there where they were trying to test this out on the cvs codebase, IIRC. It's a good candidate: upstream doesn't exactly move quickly, but is very much a real-world codebase, still in use.

mlindner 5y ago
Interesting, this paper also mentions the same DARPA contract: https://apps.dtic.mil/sti/pdfs/AD1084807.pdf https://apps.dtic.mil/sti/pdfs/AD1084807.pdf It shows up in this document of contracts: https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20Room/DARPA/16-F-0263%20FY2015%20DARPA%20Funding%20Spreadsheet.pdf https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20... * Contract Number: FA875015C0124 * Performer Name: GALOIS, INC. * Agent Name: AFRL, Information Directorate MR * Program Name: Cyber Fault-tolerant Attack Recovery (CFAR) * Office: I2O * Fiscal Year: 2015 * Obligated ($): 2,099,878

neopallium 5y ago

I just started using c2rust on openjpeg [0] (jpeg 2000 encoder/decoder) today and already have it working as a drop in replacement for the C libopenjp2.so on Linux. Still has a lot of unsafe code, but it does work. Which will be a big help with testing during refactoring to idiomatic safe Rust. c2rust also has a refactor command that helps with refactoring the generated Rust code. [0] https://github.com/Neopallium/openjpeg/tree/c2rust https://github.com/Neopallium/openjpeg/tree/c2rust

pornel 5y ago

I've used my homebrew c2rust converter[1] to translate lodepng and pngquant[2] libraries to Rust. My two key takeaways are: Good test coverage is essential for this. Count how many bugs you've written when you were writing this code for the first time. Even if your bug-rate is 99% better during the rewrite, that may still be a significant number. Fine-grained tests aren't necessary, but end-to-end tests that touch every feature are crucial to catch regressions. Once the rough conversion is done, it is necessary to refactor the code to take advantage of Rust's idioms to get safety benefits. Just 1:1 conversion is underwhelming, and it feels like replacing gcc with rustc. I did not realize just how recklessly pointer-heavy C tends to be until I saw it through Rusty lens. The lodepng conversion was "meh". It's a good C code, but its structure was very different from what you'd do in Rust (e.g. Rust prefers generics over pointer casts, iterators over indexing or pointer arithmetic, has interfaces for steaming processing that C lacks). I don't know how far I can refactor the code to Rusty idioms and still call it lodepng :) OTOH the pngquant codebase was mine, and I'm happy with the results. When converting I took advantage of Rust idioms, and the Rust version is nicer to maintain and even a bit faster. [1]: https://lib.rs/crates/citrus https://lib.rs/crates/citrus [2]: https://pngquant.org/rust.html https://pngquant.org/rust.html

littlestymaar 5y ago
Thanks for citrus, I've started experimenting on it after I've read your pngquant blog post[1] the other day, and it's exactly what I was looking for: c2rust does semantically exact conversion, which isn't what I need: I needed a tool to automate the boring syntax conversion, and when doing the idiomatic rustification by hand I can take care about the different semantics of the two languages. Off course there's a different trade-off when bugs are involved: c2rust shouldn't add any bugs during the conversion, while citrus will. [1]: https://pngquant.org/rust.html https://pngquant.org/rust.html

muizelaar 5y ago

I converted https://github.com/FirefoxGraphics/qcms https://github.com/FirefoxGraphics/qcms and then refactored it to mostly safe Rust. I ran into a number of issues https://github.com/immunant/c2rust/issues?q=is%3Aissue+author%3Ajrmuizel https://github.com/immunant/c2rust/issues?q=is%3Aissue+autho... but it generally worked ok. I found refactoring the resulting Rust code somewhat error prone and didn't have great success with the automated tools. I'd recommend having a good test suite and suggest adjusting the C before the conversion to avoid using C features that don't translate well like the C preprocessor.

accountofme 5y ago

Immutant did convert the quake 3 source to rust and hot it to run... They have a blogpost about it kicking around....

bpetersen 5y ago

we used c2rust in 2019 for the Delta Chat core library; we added some more details about that to the blog post that time [1] [1] https://delta.chat/en/2019-05-08-xyiv#the-coming-delta-chat-rustocalypse https://delta.chat/en/2019-05-08-xyiv#the-coming-delta-chat-...