4 ms·

For most driver or subsystem, maybe you don't need to know how mm works. Rust is different. The kernel Rust teams are trying to encode some safety invariant. I

For most driver or subsystem, maybe you don't need to know how mm works. Rust is different. The kernel Rust teams are trying to encode some safety invariant. If any of those mismatch with the C side, it breaks. Those invariant need some non trivial knowledge of rust to understand

nine_k 2y ago
Is there an example of what you're describing?
- steveklabnik 2y ago
  There’s a recent drama where the Rust folks asked some people to clarify some of the semantics of some of the filesystem APIs, and this request wasn’t taken well. There’s been a bunch of hn threads about it.
  - asne11 2y ago
    like which?
    - steveklabnik 2y ago
      I apologize, I am on my phone, so rather than curating links, check out https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=rust%20linux&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu..., most of which are about this situation.
    - xgstation 2y ago
      not sure if this is what the op referred but like this one https://news.ycombinator.com/item?id=41450347 https://news.ycombinator.com/item?id=41450347 didn't find threads that regarding "clarify APIs semantics", but kernel docs are indeed not in a very good condition. Since C does not provide same level of soundness that Rust does, there are many hidden traps. asahi developer had a good discuss about this https://threadreaderapp.com/thread/1829852697107055047.html https://threadreaderapp.com/thread/1829852697107055047.html
      - steveklabnik 2y ago
        This overall situation is, yes. And the stuff from Lina is related, thanks for also pointing that out.
- pornel 2y ago
  About invariants generally: Rust wants to know when memory behind each pointer is immutable, or mutable by Rust only, or could be mutated by something else while Rust has a pointer to it. Rust also encodes which types can't be moved to another thread, and which pointers own their memory and need to be freed by Rust. These are part of the type system, so they need to be defined precisely. The answer to these questions can't be just "it depends". If there are run-time or config-dependent conditions when the same data is owned or not or immutable or not, Rust has enums, unions and unsafe escape hatches to guard access to it.
dangitman 2y ago
[dead]
- vlovich123 2y ago
  By definition the undefined memory behavior is only in the undefined parts of the spec modulo bugs. The spec is written against an abstract virtual machine and C was one of the first to pioneer such a concept and why it was so successful at getting ported everywhere.
  - dangitman 2y ago
    [dead]
    - steveklabnik 2y ago
      > I was under the impression most of how c interacts with memory is part of the undefined part of the spec For a long time, the memory model, formally speaking, was underspecified. Both C and C++ agreed on and added a memory model in C11 and C++11. > fencing You can add a fence via this API: https://en.cppreference.com/w/c/atomic/atomic_thread_fence https://en.cppreference.com/w/c/atomic/atomic_thread_fence > This varies per arch Right, so what assembly this API will emit depends on the underlying architecture details. Notably, the Linux kernel does not use the standard C memory model, it uses its own.
      - dangitman 2y ago
        [dead]
      - vlovich123 2y ago
        To be clear, that’s the definition of the memory model under concurrent execution. I’m pretty sure the single threaded version was well defined
        steveklabnik 2y ago

nine_k 2y ago

Is there an example of what you're describing?

steveklabnik 2y ago
There’s a recent drama where the Rust folks asked some people to clarify some of the semantics of some of the filesystem APIs, and this request wasn’t taken well. There’s been a bunch of hn threads about it.
- asne11 2y ago
  like which?
  - steveklabnik 2y ago
    I apologize, I am on my phone, so rather than curating links, check out https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=rust%20linux&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu..., most of which are about this situation.
  - xgstation 2y ago
    not sure if this is what the op referred but like this one https://news.ycombinator.com/item?id=41450347 https://news.ycombinator.com/item?id=41450347 didn't find threads that regarding "clarify APIs semantics", but kernel docs are indeed not in a very good condition. Since C does not provide same level of soundness that Rust does, there are many hidden traps. asahi developer had a good discuss about this https://threadreaderapp.com/thread/1829852697107055047.html https://threadreaderapp.com/thread/1829852697107055047.html
    - steveklabnik 2y ago
      This overall situation is, yes. And the stuff from Lina is related, thanks for also pointing that out.
pornel 2y ago
About invariants generally: Rust wants to know when memory behind each pointer is immutable, or mutable by Rust only, or could be mutated by something else while Rust has a pointer to it. Rust also encodes which types can't be moved to another thread, and which pointers own their memory and need to be freed by Rust. These are part of the type system, so they need to be defined precisely. The answer to these questions can't be just "it depends". If there are run-time or config-dependent conditions when the same data is owned or not or immutable or not, Rust has enums, unions and unsafe escape hatches to guard access to it.

dangitman 2y ago

[dead]

vlovich123 2y ago
By definition the undefined memory behavior is only in the undefined parts of the spec modulo bugs. The spec is written against an abstract virtual machine and C was one of the first to pioneer such a concept and why it was so successful at getting ported everywhere.
- dangitman 2y ago
  [dead]
  - steveklabnik 2y ago
    > I was under the impression most of how c interacts with memory is part of the undefined part of the spec For a long time, the memory model, formally speaking, was underspecified. Both C and C++ agreed on and added a memory model in C11 and C++11. > fencing You can add a fence via this API: https://en.cppreference.com/w/c/atomic/atomic_thread_fence https://en.cppreference.com/w/c/atomic/atomic_thread_fence > This varies per arch Right, so what assembly this API will emit depends on the underlying architecture details. Notably, the Linux kernel does not use the standard C memory model, it uses its own.
    - dangitman 2y ago
      [dead]
    - vlovich123 2y ago
      To be clear, that’s the definition of the memory model under concurrent execution. I’m pretty sure the single threaded version was well defined
      - steveklabnik 2y ago