6 ms·

Rust in the Linux kernel: part 2

145 points by chmaynard 1y ago

charcircuit 1y ago
>The next article in this series will look at the design of the interface between the C and Rust code in the kernel, as well as the process of adding new bindings when necessary. This is the actual useful one since so little of the kernel has Rust bindings. When I tried to implement a filesystem driver in rust I spent most of my time trying to write bindings instead of trying to write a filesystem.
- Joel_Mckay 1y ago
  There are projects that make more sense: https://arxiv.org/abs/2506.03876 https://arxiv.org/abs/2506.03876 https://github.com/asterinas/asterinas https://github.com/asterinas/asterinas The reasons we encounter pattern issues forcing Linux into a polyglot is not a new phenomena: https://en.wikipedia.org/wiki/Second-system_effect https://en.wikipedia.org/wiki/Second-system_effect Best regards =3
- leoh 1y ago
  Did you try bindgen? Because it’s extremely good and efficient imo.
globalnode 1y ago
[flagged]
- san1927 1y ago
  i didnt know that it had been introduced in colleges when did that happen? i thought it would take a long time for colleges to include rust as it has a high learning curve
  - globalnode 1y ago
    I dont know either, thats what I'm trying to figure out.
    - timeon 1y ago
      I do not even have CS degree or programming background. But Rust seemed easier to learn than C or C++. Well I've learned C syntax in a day but really using it is different story. Rust gave me confidence to contribute to existing (open-source) project pretty early.
  - tialaramex 1y ago
    I have actually been a proponent for Rust as First Language at the university I work for. However today our first year CS students are taught Python as their First Language, with I believe an option to learn Rust among others much later. The two most important/ prestigious universities here, Oxford and Cambridge as I understand it both teach an ML as First Language, teaching Rust would arguably qualify (Rust is basically an ML but with spelling familiar to a C or Java programmer) but with the caveat that one reason they teach an ML first (and indeed so did the place where I got my degree) is that some of the 18 year olds in your class know C or Java or indeed Python, but they almost certainly do not know Ocaml or SML or whatever - whereas they might know Rust. And that sort of gets to where your parent was thinking. On the whole it's not that university (or "college") teaches Rust, but that because Rust is a good first language some people will have just acquired Rust anyway. I came to Rust as somebody with decades of C and Java and some Python, Go, and a long list of languages, but today plenty of learners just pick up Rust themselves.
- prydt 1y ago
  My interest in Rust comes from getting frustrated with C's type system. Rust has such a nice type system and I really enjoy the ownership semantics around concurrency. I think that C++ written "correctly" looks a lot like Rust and libkj [1] encourages this, but it is not enforced by the language. [1] https://github.com/capnproto/capnproto/blob/v2/kjdoc/tour.md https://github.com/capnproto/capnproto/blob/v2/kjdoc/tour.md
- LeFantome 1y ago
  Most of the interest I have seen is in pursuit of security. A few sources have cited that something like 70% of vulnerabilities are rooted in memory safety issues. A language that makes it impossible to introduce 70% of the security bugs is appealing.
  - zx8080 1y ago
    Java does not have memory safety issues. But it's not appealing, apparently. So why Rust then?
    - nullpoint420 1y ago
      Java is not a systems level programming language (at least in its modern OpenJDK form)
      - rjsw 1y ago
        Sun tried out allowing Java in the kernel, it could be used to write device drivers just as Rust is being used now.
        anextio 1y ago
        You can hammer an applications programming language to do systems things, but it will never be a good experience nor have optimal performance.
        WD-42 1y ago
        How would that even work with the JVM?
        zx8080 1y ago
        Probably https://en.m.wikipedia.org/wiki/Jazelle https://en.m.wikipedia.org/wiki/Jazelle or similar would be the answer.
        nolist_policy 1y ago
- dafelst 1y ago
  Rust (without use of `unsafe`) eliminates several entire classes of bugs (including bugs that comprise the majority of security related memory safety issues) while providing performance comparable to C/C++. That is really all there is to it - it is just the better option for systems programming by almost all available metrics, and I say this as someone who has been coding C and C++ professionally for coming up on 25 years.
  - izacus 1y ago
    Cool, but so does Java. So why Rust advertising specifically?
    - kaladin-jasnah 1y ago
      One reason I can think of is its memory management model gives programmers more control than a garbage collector. With the borrow checker, you know when your variables will get dropped/deallocated, but a garbage collector is not necessarily as controllable.
    - armada651 1y ago
      Because adopting a language that utilizes a garbage collector for memory management in the Linux kernel is even less likely than adopting Rust.
    - thayne 1y ago
      - Java's use of GC and a large runtime makes it inappropriate for many use cases - Java had a pretty slow startup time, which makes it a poor fit for many CLI applications and similar - Java has historically had pretty poor support for interoperating with c libraries (although this is improving with project panama) - Rust has a richer, more powerful type system than Java (although scala's is more comparable) - Rust's affine types (lifetimes) actually prevent certain types of bugs that occur in languages like Java as well. Things like using a connection or file handle after it is closed, forgetting to release a lock, not properly synchronizing access to memory between multiple threads, etc.
    - nextaccountic 1y ago
- globalnode 1y ago
  I mean I don't mind learning it if it solves problems and is reasonably enjoyable to program in (which I find C/C++ to be) but the rebel in me doesn't want to conform to what big business/politics wants I guess. I know thats a terrible metric to use in this field.
  - eviks 1y ago
    How does the rebel square itself with the fact of using big business/politics mandated C++?
  - __MatrixMan__ 1y ago
    I think it's the rust folk who are the rebels. Status quo types would never advocate for something so tumultuous as a new systems programming language.
- npalli 1y ago
  The general spike in interest from 2021 onwards (the language has been around for a while so it's not like people just found out) is due to a large hangover from crypto folks who become jobless after the bust. Super savvy in general being online and evangelism. The safety stuff is overblown (small subset of applications primarily OS and browsers) and full rewrite is not possible or advisable.
  - globalnode 1y ago
    This is the sort of thing I suspected without proof. It seems people do find that Rust is useful in terms of specific types of bugs but why cant pre C/C++ 11 just do the same job.
    - dafelst 1y ago
      In safe rust you cannot read uninitialized memory or variables, you cannot dereference a null or freed pointer, you can't concurrently mutate the same variable from multiple threads without locking primitives, you can't accidentally modify a variable after it has been moved out of scope - all of these things are enforced at compile time. If your code compiles, you are safe from all of these classes of bugs (outside the use of unsafe code). In addition, you can't overflow a buffer nor unintentionally read outside the bounds of an array, that will cause a runtime panic and abort the program. Doing this in C or C++ is possible, but the fact that even the best of the best programmers in these languages sometimes still make these mistakes shows the limitations of the paradigm. Even the most novice Rust programmer who stays in the guardrails will produce programs free of these sorts of memory safety bugs. The same cannot be said about C or C++ programs.
      - motorest 1y ago
        > In safe rust you cannot read uninitialized memory or variables, you cannot dereference a null or freed pointer, you can't concurrently mutate the same variable from multiple threads without locking primitives, you can't accidentally modify a variable after it has been moved out of scope - all of these things are enforced at compile time. If your code compiles, you are safe from all of these classes of bugs (outside the use of unsafe code). Aren't most of these issues caught in C++ code by static code analysis tools, and even just flipping switches on C++ compilers? I mean, check out tools like cppcheck and address sanitizer. They exist for ages. Your blend of comments makes it sound like no one knew or cared about these issues other than Rust fanboys.
- jcranmer 1y ago
  Rust is interesting because it's the first language to really try to compete in the same space as C and C++ in quite a long time. Part of being a newer language is that it doesn't have to work around the baggage of horribly bad past decisions (e.g., null-terminated strings, or implicit integer promotion). Part of it is also that it can adopt newer language features (e.g., structured binding or pattern matching) and have it mesh well with the language rather than having some weird workarounds. For many people, the most interesting aspect of Rust is that it builds into its type system a set of rules that makes it much more practical to avoid memory safety issues or concurrency issues--lifetimes and Send/Sync are an absolute godsend for such programming, especially because it means you get the compiler to kick you in the face when you screw it up. Rather famously, Mozilla attempted a couple of parallel layout engines in C++ but their attempts all failed, because it just wasn't feasible to shake out all of the concurrency issues; their first attempt at doing so in Rust had none of those issues. It's not that the rules are complicated or hard to follow, it's that in large codebases, the invariants you need to uphold are described only in comments and can be easy to forget.
  - globalnode 1y ago
    Thanks for that perspective.
- tayo42 1y ago
  Rust has more and nicer language features compared to c++ that you can use to make the code readable. I wish rust had overloading and specialization though. > I personally invested a lot of time and effort into learning C/C++ and the only new language with enough difference to come along that was worth learning was Python imho. Not sure what significant differences Rust brings that warrant throwing all that knowledge away and starting again. Ive written a little c++ professionally along with rust. I really don't think rust is that hard to learn. Especially compared to c++, I'd be embarrassed to tell people i "know" c++ despite using it a bit. there's so much to writing c++. I think you would be a competent rust programmer in a couple weeks, have a pretty good grasp on the language and be able to pretty much contribute to any in progress project. You could spend a weekend going through the rust book and have a good idea of the language. I dont think I could say that to anyone about any c++ book lol
- bowsamic 1y ago
  > Not sure what significant differences Rust brings that warrant throwing all that knowledge away and starting again This is not how learning programming languages works
  - globalnode 1y ago
    You are correct, but its still a fair bit of effort and muscle memory that needs to be developed, I'm trying to figure out if the payoff is worth it.
- NewJazz 1y ago
  I think it aims to have the features of C++ that are required for modern safe systems programming, but not all the baggage that comes with such a large and historied language.
- seangrogg 1y ago
  As a person that occasionally daytrips into Rust and Zig, I'd imagine some number of us are coming from higher level languages (JS/TS, Python, etc) as our daily drivers and interested in what performance we could get closer to the metal. In those cases we don't have a particular investment in C/C++, we don't know the differences between gcc or clang, we are used to package managers, don't manage header files, and things like comfy error messages and "if it compiles it's reasonably safe tm" are better than... Not having those things. Meanwhile, outside of things like CUDA interop I don't know what the compelling case for C/C++ even is for someone who isn't invested.
- high_na_euv 1y ago
  Majority of cpp knowledge is not universal computer science, but cpp's quirks, issues, tricks, hacks and wasted life fighting lack of coherent building system and package manager alongside of long compile times
  - callc 1y ago
    > quirks, issues, tricks, hacks and wasted life This is a very important point if the tool is used by millions of people. All you need to do is waste a few 10s of seconds with some weird quirk that doesn’t act as expected, and BAM, collectively easily a year of human life was wasted. Avoid surprising behavior.
san1927 1y ago
[flagged]
WD-42 1y ago
The rust driver does read better. I like that the functions are organized as methods under a member less struct, as opposed to the C version where they are top level with_really_long_function_names that take a struct parameter.
- callc 1y ago
  Absolutely! Organization is extremely important!
wadewallane 1y ago
Some drivers written in Rust instead of C would need to be littered with unsafes, raw pointers, pointer arithmetic, manual memory management, manual layout control, and manual resource management to retain similar behaviors. I’m assuming someone’s ideal would be for the entire kernel to be rewritten in Rust? When all that is said and done, will it be worth the effort? It’d seem as though you’d have a lot of the same problems, and new ones around timing and performance if you start handling memory differently, like jitteriness, lags, OOM (letting resource usage get out-of-hand), lock-ups, or worse, unless it’s well-tested. I have nothing against Rust, and writing new drivers in Rust selectively would be fine, but I could see it going this way and am curious. To be absolutely clear, Rust is not bad; I just wonder about introducing complexity in maintenance of the kernel by having variation in memory management, because I’d almost rather have a diagnosable memory leak that’s well-tested for than “I have no idea what’s going on.”
- sophacles 1y ago
  > Some drivers written in Rust instead of C would need to be littered with unsafes, raw pointers, pointer arithmetic, manual memory management, manual layout control, and manual resource management to retain similar behaviors. Some might, the extent remains to be seen. Of course there needs to be code that has unsafe memory management, but a small amount of very well checked code that creates safe wrappers can eliminate the possibility of bad memory handling in huge chunks of the remaining logic. It doesn't eliminate the errors 100% of course, and that's OK - reducing the quantity, search space, and even possibility of a lot of bugs is still a good thing, as it means correctness can be acheived with less time and effort. > I’m assuming the goal is to have the entire kernel rewritten in Rust. Who's goal? Some people may want to see that sure. Plenty of others are happy just because this experiment is allowing Rust itself to improve as the r4l people are effectively pushing rust into territory it hasn't been used in previously. Some people just want to see rust in drivers since they are often a pain to keep porting around as internal kernel apis change, and having safe rust abstractions around the tricky bits makes that porting effort much easier. > Because you’ll have a lot of the same problems, and it seems you could introduce new ones around timing and performance if you start handling memory differently. If you have a driver so sensitive to timing and performance that a small amount of memory handling change can break it - you'll have these issues whenever the C code around memory management changes as well. There are regularly changes to memory allocation, scheduling, etc within the kernel anyway, so I think this concept is a bit of a moot concern.

145 points by chmaynard 1y ago

>The next article in this series will look at the design of the interface between the C and Rust code in the kernel, as well as the process of adding new bindings when necessary. This is the actual useful one since so little of the kernel has Rust bindings. When I tried to implement a filesystem driver in rust I spent most of my time trying to write bindings instead of trying to write a filesystem.

Joel_Mckay 1y ago
There are projects that make more sense: https://arxiv.org/abs/2506.03876 https://arxiv.org/abs/2506.03876 https://github.com/asterinas/asterinas https://github.com/asterinas/asterinas The reasons we encounter pattern issues forcing Linux into a polyglot is not a new phenomena: https://en.wikipedia.org/wiki/Second-system_effect https://en.wikipedia.org/wiki/Second-system_effect Best regards =3
leoh 1y ago
Did you try bindgen? Because it’s extremely good and efficient imo.

globalnode 1y ago

[flagged]

san1927 1y ago
i didnt know that it had been introduced in colleges when did that happen? i thought it would take a long time for colleges to include rust as it has a high learning curve
- globalnode 1y ago
  I dont know either, thats what I'm trying to figure out.
  - timeon 1y ago
    I do not even have CS degree or programming background. But Rust seemed easier to learn than C or C++. Well I've learned C syntax in a day but really using it is different story. Rust gave me confidence to contribute to existing (open-source) project pretty early.
- tialaramex 1y ago
  I have actually been a proponent for Rust as First Language at the university I work for. However today our first year CS students are taught Python as their First Language, with I believe an option to learn Rust among others much later. The two most important/ prestigious universities here, Oxford and Cambridge as I understand it both teach an ML as First Language, teaching Rust would arguably qualify (Rust is basically an ML but with spelling familiar to a C or Java programmer) but with the caveat that one reason they teach an ML first (and indeed so did the place where I got my degree) is that some of the 18 year olds in your class know C or Java or indeed Python, but they almost certainly do not know Ocaml or SML or whatever - whereas they might know Rust. And that sort of gets to where your parent was thinking. On the whole it's not that university (or "college") teaches Rust, but that because Rust is a good first language some people will have just acquired Rust anyway. I came to Rust as somebody with decades of C and Java and some Python, Go, and a long list of languages, but today plenty of learners just pick up Rust themselves.
prydt 1y ago
My interest in Rust comes from getting frustrated with C's type system. Rust has such a nice type system and I really enjoy the ownership semantics around concurrency. I think that C++ written "correctly" looks a lot like Rust and libkj [1] encourages this, but it is not enforced by the language. [1] https://github.com/capnproto/capnproto/blob/v2/kjdoc/tour.md https://github.com/capnproto/capnproto/blob/v2/kjdoc/tour.md
LeFantome 1y ago
Most of the interest I have seen is in pursuit of security. A few sources have cited that something like 70% of vulnerabilities are rooted in memory safety issues. A language that makes it impossible to introduce 70% of the security bugs is appealing.
- zx8080 1y ago
  Java does not have memory safety issues. But it's not appealing, apparently. So why Rust then?
  - nullpoint420 1y ago
    Java is not a systems level programming language (at least in its modern OpenJDK form)
    - rjsw 1y ago
      Sun tried out allowing Java in the kernel, it could be used to write device drivers just as Rust is being used now.
      - anextio 1y ago
        You can hammer an applications programming language to do systems things, but it will never be a good experience nor have optimal performance.
      - WD-42 1y ago
        How would that even work with the JVM?
        zx8080 1y ago
        Probably https://en.m.wikipedia.org/wiki/Jazelle https://en.m.wikipedia.org/wiki/Jazelle or similar would be the answer.
      - nolist_policy 1y ago
dafelst 1y ago
Rust (without use of `unsafe`) eliminates several entire classes of bugs (including bugs that comprise the majority of security related memory safety issues) while providing performance comparable to C/C++. That is really all there is to it - it is just the better option for systems programming by almost all available metrics, and I say this as someone who has been coding C and C++ professionally for coming up on 25 years.
- izacus 1y ago
  Cool, but so does Java. So why Rust advertising specifically?
  - kaladin-jasnah 1y ago
    One reason I can think of is its memory management model gives programmers more control than a garbage collector. With the borrow checker, you know when your variables will get dropped/deallocated, but a garbage collector is not necessarily as controllable.
  - armada651 1y ago
    Because adopting a language that utilizes a garbage collector for memory management in the Linux kernel is even less likely than adopting Rust.
  - thayne 1y ago
    - Java's use of GC and a large runtime makes it inappropriate for many use cases - Java had a pretty slow startup time, which makes it a poor fit for many CLI applications and similar - Java has historically had pretty poor support for interoperating with c libraries (although this is improving with project panama) - Rust has a richer, more powerful type system than Java (although scala's is more comparable) - Rust's affine types (lifetimes) actually prevent certain types of bugs that occur in languages like Java as well. Things like using a connection or file handle after it is closed, forgetting to release a lock, not properly synchronizing access to memory between multiple threads, etc.
  - nextaccountic 1y ago
globalnode 1y ago
I mean I don't mind learning it if it solves problems and is reasonably enjoyable to program in (which I find C/C++ to be) but the rebel in me doesn't want to conform to what big business/politics wants I guess. I know thats a terrible metric to use in this field.
- eviks 1y ago
  How does the rebel square itself with the fact of using big business/politics mandated C++?
- __MatrixMan__ 1y ago
  I think it's the rust folk who are the rebels. Status quo types would never advocate for something so tumultuous as a new systems programming language.
npalli 1y ago
The general spike in interest from 2021 onwards (the language has been around for a while so it's not like people just found out) is due to a large hangover from crypto folks who become jobless after the bust. Super savvy in general being online and evangelism. The safety stuff is overblown (small subset of applications primarily OS and browsers) and full rewrite is not possible or advisable.
- globalnode 1y ago
  This is the sort of thing I suspected without proof. It seems people do find that Rust is useful in terms of specific types of bugs but why cant pre C/C++ 11 just do the same job.
  - dafelst 1y ago
    In safe rust you cannot read uninitialized memory or variables, you cannot dereference a null or freed pointer, you can't concurrently mutate the same variable from multiple threads without locking primitives, you can't accidentally modify a variable after it has been moved out of scope - all of these things are enforced at compile time. If your code compiles, you are safe from all of these classes of bugs (outside the use of unsafe code). In addition, you can't overflow a buffer nor unintentionally read outside the bounds of an array, that will cause a runtime panic and abort the program. Doing this in C or C++ is possible, but the fact that even the best of the best programmers in these languages sometimes still make these mistakes shows the limitations of the paradigm. Even the most novice Rust programmer who stays in the guardrails will produce programs free of these sorts of memory safety bugs. The same cannot be said about C or C++ programs.
    - motorest 1y ago
      > In safe rust you cannot read uninitialized memory or variables, you cannot dereference a null or freed pointer, you can't concurrently mutate the same variable from multiple threads without locking primitives, you can't accidentally modify a variable after it has been moved out of scope - all of these things are enforced at compile time. If your code compiles, you are safe from all of these classes of bugs (outside the use of unsafe code). Aren't most of these issues caught in C++ code by static code analysis tools, and even just flipping switches on C++ compilers? I mean, check out tools like cppcheck and address sanitizer. They exist for ages. Your blend of comments makes it sound like no one knew or cared about these issues other than Rust fanboys.
jcranmer 1y ago
Rust is interesting because it's the first language to really try to compete in the same space as C and C++ in quite a long time. Part of being a newer language is that it doesn't have to work around the baggage of horribly bad past decisions (e.g., null-terminated strings, or implicit integer promotion). Part of it is also that it can adopt newer language features (e.g., structured binding or pattern matching) and have it mesh well with the language rather than having some weird workarounds. For many people, the most interesting aspect of Rust is that it builds into its type system a set of rules that makes it much more practical to avoid memory safety issues or concurrency issues--lifetimes and Send/Sync are an absolute godsend for such programming, especially because it means you get the compiler to kick you in the face when you screw it up. Rather famously, Mozilla attempted a couple of parallel layout engines in C++ but their attempts all failed, because it just wasn't feasible to shake out all of the concurrency issues; their first attempt at doing so in Rust had none of those issues. It's not that the rules are complicated or hard to follow, it's that in large codebases, the invariants you need to uphold are described only in comments and can be easy to forget.
- globalnode 1y ago
  Thanks for that perspective.
tayo42 1y ago
Rust has more and nicer language features compared to c++ that you can use to make the code readable. I wish rust had overloading and specialization though. > I personally invested a lot of time and effort into learning C/C++ and the only new language with enough difference to come along that was worth learning was Python imho. Not sure what significant differences Rust brings that warrant throwing all that knowledge away and starting again. Ive written a little c++ professionally along with rust. I really don't think rust is that hard to learn. Especially compared to c++, I'd be embarrassed to tell people i "know" c++ despite using it a bit. there's so much to writing c++. I think you would be a competent rust programmer in a couple weeks, have a pretty good grasp on the language and be able to pretty much contribute to any in progress project. You could spend a weekend going through the rust book and have a good idea of the language. I dont think I could say that to anyone about any c++ book lol
bowsamic 1y ago
> Not sure what significant differences Rust brings that warrant throwing all that knowledge away and starting again This is not how learning programming languages works
- globalnode 1y ago
  You are correct, but its still a fair bit of effort and muscle memory that needs to be developed, I'm trying to figure out if the payoff is worth it.
NewJazz 1y ago
I think it aims to have the features of C++ that are required for modern safe systems programming, but not all the baggage that comes with such a large and historied language.
seangrogg 1y ago
As a person that occasionally daytrips into Rust and Zig, I'd imagine some number of us are coming from higher level languages (JS/TS, Python, etc) as our daily drivers and interested in what performance we could get closer to the metal. In those cases we don't have a particular investment in C/C++, we don't know the differences between gcc or clang, we are used to package managers, don't manage header files, and things like comfy error messages and "if it compiles it's reasonably safe tm" are better than... Not having those things. Meanwhile, outside of things like CUDA interop I don't know what the compelling case for C/C++ even is for someone who isn't invested.
high_na_euv 1y ago
Majority of cpp knowledge is not universal computer science, but cpp's quirks, issues, tricks, hacks and wasted life fighting lack of coherent building system and package manager alongside of long compile times
- callc 1y ago
  > quirks, issues, tricks, hacks and wasted life This is a very important point if the tool is used by millions of people. All you need to do is waste a few 10s of seconds with some weird quirk that doesn’t act as expected, and BAM, collectively easily a year of human life was wasted. Avoid surprising behavior.

san1927 1y ago

[flagged]

WD-42 1y ago

The rust driver does read better. I like that the functions are organized as methods under a member less struct, as opposed to the C version where they are top level with_really_long_function_names that take a struct parameter.

callc 1y ago
Absolutely! Organization is extremely important!

wadewallane 1y ago

Some drivers written in Rust instead of C would need to be littered with unsafes, raw pointers, pointer arithmetic, manual memory management, manual layout control, and manual resource management to retain similar behaviors. I’m assuming someone’s ideal would be for the entire kernel to be rewritten in Rust? When all that is said and done, will it be worth the effort? It’d seem as though you’d have a lot of the same problems, and new ones around timing and performance if you start handling memory differently, like jitteriness, lags, OOM (letting resource usage get out-of-hand), lock-ups, or worse, unless it’s well-tested. I have nothing against Rust, and writing new drivers in Rust selectively would be fine, but I could see it going this way and am curious. To be absolutely clear, Rust is not bad; I just wonder about introducing complexity in maintenance of the kernel by having variation in memory management, because I’d almost rather have a diagnosable memory leak that’s well-tested for than “I have no idea what’s going on.”

sophacles 1y ago
> Some drivers written in Rust instead of C would need to be littered with unsafes, raw pointers, pointer arithmetic, manual memory management, manual layout control, and manual resource management to retain similar behaviors. Some might, the extent remains to be seen. Of course there needs to be code that has unsafe memory management, but a small amount of very well checked code that creates safe wrappers can eliminate the possibility of bad memory handling in huge chunks of the remaining logic. It doesn't eliminate the errors 100% of course, and that's OK - reducing the quantity, search space, and even possibility of a lot of bugs is still a good thing, as it means correctness can be acheived with less time and effort. > I’m assuming the goal is to have the entire kernel rewritten in Rust. Who's goal? Some people may want to see that sure. Plenty of others are happy just because this experiment is allowing Rust itself to improve as the r4l people are effectively pushing rust into territory it hasn't been used in previously. Some people just want to see rust in drivers since they are often a pain to keep porting around as internal kernel apis change, and having safe rust abstractions around the tricky bits makes that porting effort much easier. > Because you’ll have a lot of the same problems, and it seems you could introduce new ones around timing and performance if you start handling memory differently. If you have a driver so sensitive to timing and performance that a small amount of memory handling change can break it - you'll have these issues whenever the C code around memory management changes as well. There are regularly changes to memory allocation, scheduling, etc within the kernel anyway, so I think this concept is a bit of a moot concern.