you are viewing a single comment's thread
view the rest of the comments
[–] 14 points 10 months ago (28 children)

What's the point of rewriting parts of the kernel in unsafe rust?

  • source
  • hideshow 28 child comments
  • [–] 79 points 10 months ago (14 children)

    Because Rust lets you choose when something is unsafe vs writing all unsafe in code all the time:

    Note the other 159 kernel CVEs issued today for fixes in the C portion of the codebase

  • source
  • parent
  • hideshow 14 child comments
  • [–] 3 points 10 months ago (3 children)

    I wonder if this can be adjusted for LoC count in each language

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 10 months ago (2 children)

    Not sure if that's a fair metric yet.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 10 months ago (9 children)

    Yes same concept as other languages like C#

  • source
  • parent
  • hideshow 9 child comments
  • [–] 8 points 10 months ago (8 children)

    You go ahead and write an OS kernel in C# then.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 9 points 10 months ago (6 children)

    Why the hell would you do that

  • source
  • parent
  • hideshow 6 child comments
  • [–] 4 points 10 months ago (5 children)

    Why would you bring up C# in a thread about kernel programming?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 10 months ago* (4 children)

    Talking about how unsafe is not some new fancy rust feature and exists in other languages. Your comment makes it sound like the choice is some new wild computing concept.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 10 months ago

    Memory safe languages that are not garbage collected are not all that common. Ada and Rust are two examples.

    With great care C++ and zig can be.

    I'm sure there's a good reason a lot of the big players and the community at large have picked up rust though. Docs, error messages, cargo community etc.

    I would argue that Rust does bring a lot to the table. I certainly would never code in C for work but I'll happily reach for Rust.

  • source
  • parent
  • [–] 1 point 10 months ago (2 children)

    Bruh do you actually not get it. The point of rust is that its memory safe(with a huge grain of salt in the case of low level programming) and is a language you can write kernels in. Youre not gonna write a kernel in C# so it doesnt really matter for a discussion about kernels.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 4 points 10 months ago (10 children)

    Because Rust is the popular thing in FOSS/Linux at the moment.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 18 points 10 months ago (9 children)

    For memory safety, which is not unsafe rust

  • source
  • parent
  • hideshow 9 child comments
  • [–] [S] 9 points 10 months ago (8 children)

    You say that. But the CVE is a memory corruption bug.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 48 points 10 months ago (1 child)

    Which is worse?

    • Entire driver written in a non memory safe language?
    • The interface to the rest of the kernel is marked as unsafe and then the other X percent is safe from memory corruption?

    Surely if X > 0 then this is still a net improvement?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 10 months ago (4 children)

    You don't understand what unsafe means

  • source
  • parent
  • hideshow 4 child comments
  • [–] 8 points 10 months ago* (last edited 10 months ago) (3 children)

    Rust by default will not allow you to make certain kinds of errora, which is great. But if you are doing something advanced, down at the hardware level [see below], you might need to disable those defaults in order to write the code you need. This is what people mean by "unsafe" -- lacking the normal memory safeguards.

    With careful coding, "unsafe rust" or normal C, for that matter, can be free of bugs and safe. But if programmers make a mistake, vulnerabilities can creep in more easily in the unsafe sections.

    Is that basically it?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 10 months ago (2 children)

    But if you are doing something advanced, down at the hardware level

    This part is wrong. Otherwise yes correct.

    The “unsafe” code in rust is allowed to access memory locations in ways that skip the compiler’s check and guarantee that that memory location has valid data. They programmer is on their own to ensure that.

    Which as you say is just the normal state of affairs for all C code.

    This is needed not because of hardware access but just because sometimes the proof that the access is safe is beyond what the compiler is able to represent.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 10 months ago (1 child)

    Thank you for the correction, I'll edit my comment.

    sometimes the proof that the access is

    safe is bevond what the compiler is able to represent

    Could you say a few more words about this? In what situations do you have to write 'unsafe-tagged' code blocks? Could this be changed by improvements to the compiler? Or is it necessitated by the type of task being done by the code?

  • source
  • parent
  • hideshow 1 child comment