Live data from Hacker News

Supporting Linux kernel development in Rust

lwn.net

301–310 of 365 posts

Re: Supporting Linux kernel development in Rust

#301
post #188

Earlier quoted context omitted.

> C++ hasn't seemed to have changed that, either. C++ is not like C. Putting some C++ objects in a C codebase would, indeed, not change it much, but if you write in modern C++, some memory errors will literally disappear, and some become less likely. Caveat: This is based on language mechanics, standard library facilities and recommended idioms; of course people can write unsafe C++ if they want to.

And modern C++ features makes some memory errors more likely, e.g. dangling references from lambda captures and string_view/span. I'm not optimistic about the safety of modern C++. Most people who really care about safety long ago left the C++ building.

No, they do not:

* Dangling references from lambda captures are no different than dangling references or pointers passed without lambdas, and not more likely to be used. * spans are no worse, and usually better, than using a raw pointer and a size; they don't make memory errors more likely. * string_view - indeed, it potentially introduces a dangling pointer. But - that only happens if you store it. Which is why I qualified my claim to "using recommended idioms". If you replace your `const char*` or `const std::string&` with `std::string_view` you have not introduced a potential memory error.

More generally - new language/library construct which do not manage their own memory can introduce memory errors. But, luckily, C++ now has a better "harness" of protecting you from many of these without costing you and performance nor introducing now memory issues.

So I stand by my claim. Having said that - C++ is not a safety-guaranteed language, and if that's what you need then it is indeed not the language to use.

Re: Supporting Linux kernel development in Rust

#302

I'm concerned about the gradual move from GCC to LLVM. The lack of copyleft protections on LLVM means that it's much more dependent on corporate sponsorship, and means that there's a risk that major improvements to LLVM compilers will only become available as proprietary products. People underestimate the role of copyleft licenses in preserving long-running FOSS products like GCC, Linux, etc.

That makes me sad as well, but I also think it was largely self-inflicted. GCC took much too long to realize that people needed a common code-generation framework, and be willing to support that and work towards it. LLVM was designed from the start to be such a framework.

This seems all too common in the software industry. A company creates a product, but after a while, ignores the changing needs of the market until it’s too late.

Re: Supporting Linux kernel development in Rust

#303

Earlier quoted context omitted.

That is a weird way to say "your concerns were entirely correct". Every single proprietary mobile graphics driver uses LLVM for its shader compiler and the lack of copyleft has severely curtailed progress on open-source drivers. Of course none of it goes back to LLVM because updating your production copy of LLVM is just as messy and broken as the non-stable GCC IR you complain about and the fact that OSS development…

> Every single proprietary mobile graphics driver uses LLVM for its shader compiler and the lack of copyleft has severely curtailed progress on open-source drivers. And you think if they didn't have the option of using LLVM they would have released an open source driver instead? That makes no sense to me.

Yes. Developing a state of the art optimizing compiler is hard. If their only choices are developing their own compiler or basing off of gcc and releasing their work, they'd choose gcc.

Re: Supporting Linux kernel development in Rust

#304
post #198

Earlier quoted context omitted.

> they are implemented once in a crate on crates.io and similarly re-used. this doesn't automatically prevent the code from containing CVE, does it? > As it turns out most code isn't datastructures with unique memory requirements most code that has been written in Rust so far. But when you enter a territory of OS kernels, unique memory requirements and data structures such as ring buffers and dynamic mutable trees ar…

> this doesn't automatically prevent the code from containing CVE, does it? There are certainly tools to detect any known CVEs, and tools to help you audit the unsafe code that you are using. They don't provide rigorous proofs automatically of course, the same way the standard library is generally not rigorously proved to be correct. > But when you enter a territory of OS kernels, Nothing really changes, see redox as…

> There are certainly tools to detect any known CVEs, and tools to help you audit the unsafe code that you are using.

so they don't automatically prevent the code from containing new CVEs.

> That's a tool not a problem - you have yet to provide an argument that they are necessary and real world experience says that Rust achieves a meaningful amount of safety and convenience without them.

I can argue along the same line that Rust is a tool not a problem, and that you need to prove that Rust has a "meaningful" amount of safety. When you say that something has "meaningful amount of sth" you should add to whom it is meaningful and based on what criteria. Or, alternatively, you can stay on a pure technical aspect of the matter and conclude that the safety part of the language is not complete.

> That's also a tool not a problem, and you could argue that rust's ADTs (enums) give you a weak version of it.

totality checking is not exhaustiveness checking, there are two more properties that enums are unable to express in any "weak" form - termination and productiveness.

Re: Supporting Linux kernel development in Rust

#305
post #148

Earlier quoted context omitted.

> C++ hasn't seemed to have changed that, either. C++ is not like C. Putting some C++ objects in a C codebase would, indeed, not change it much, but if you write in modern C++, some memory errors will literally disappear, and some become less likely. Caveat: This is based on language mechanics, standard library facilities and recommended idioms; of course people can write unsafe C++ if they want to.

> of course people can write unsafe C++ if they want to. The problem is knowing the safe subset of the language requires continuous study and deep understanding. It also has changed with time. I used to have a bookshelf in order to understand C++. I suspect that has not changed. I do not need a bookshelf to understand the "safe" subset of Rust.

You are partially correct but mostly incorrect, I would say.

It's true that writing safe code requires some study and some understanding. But you don't need to "know what's safe". That _is_ complicated - there are a lot of complex depths to the language. The thing is, the non-expert user can avoid them.

For example, a green developer can start with "Avoid using new and delete directly; use vectors, other containers, or unique_ptr's instead. Maybe shared_ptr's in some cases." If at some point they really need to write their own allocating class, they'll be told to be very careful with the allocation, and take into account the possibility of exceptions, concurrent execution by other threads etc.

Also, when you're not sure of yourself, there's a good enough reference in the form of the C++ Core Guidelines [1]. (That's a long document, but you don't need to read through it.)

Finally, a whole lot of memory error hazards / unsafe code can be statically identified and discouraged. Gradually, IDEs and other tools have started doing so.

[1] - isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines

Re: Supporting Linux kernel development in Rust

#306
post #298
post #294

Earlier quoted context omitted.

No, something like the PS4 CPU features that don't get upstreamed because they might provide clues how to bipass PS 4 security. There are some talks from Sony at LLVM meetings regarding those. That PR from Apple has nothing to do with the bitcode reference I made.

Why do i want a PS4 specific cpu-drm feature in a generic Compiler?

I did not said it was a cpu-drm feature, rather optimizations that could reveal hints about it.

I don't know, maybe other AMD users would like to get them?

Re: Supporting Linux kernel development in Rust

#307

Earlier quoted context omitted.

Developing a GCC frontend is a massive PITA, and the worst of all it was made purposefully so complicated because of RMS' concerns about closed compilers. He actually brought LLVM's existence onto himself, because it was somewhat clear no one would have bothered writing a new compiler if it had been possible to use it's frontend for other things (even from free software it's hard) and they kept the license as "GPLv2…

The fear of GPLv3 is just an excuse to pull things into proprietary. They became aware of the success of GPL and started to actively lobby against it with what they were able to come up with.

The change also means libgcc is now GPLv3 as well, making licensing for anything embedded that uses glibc (which has a hard dependency on libgcc_s) a royal PITA to figure out since GCC’s linking exception. Okay, so a proprietary program can link against libgcc without coming afoul of the GPL, but do we still have to make libgcc_s itself replaceable according the the anti-tivo clause?

The FSF is shooting themselves in the foot with the way they handle many of their projects today, GCC is no exception. Free software purity is a great goal and all, but what use is it when nobody uses it or it falls behind more permissively licenses projects.

Re: Supporting Linux kernel development in Rust

#308

Earlier quoted context omitted.

> I'm concerned about the gradual move from GCC to LLVM. The lack of copyleft protections on LLVM means that it's much more dependent on corporate sponsorship, and means that there's a risk that major improvements to LLVM compilers will only become available as proprietary products. As someone who works within LLVM professionally, I don't think this is particularly likely -- compilers are massive and complicated beas…

> or they're sufficiently general and easiest to maintain by releasing back upstream Exactly; maintaining a fork is a big pain. The ongoing cost of keeping it up-to-date is a pretty big incentive to merge it, even if there's not a legal requirement.

many argue that a legal requirement is detrimental in practice, as in that case the company cannot independently decide how much to upstream.

with GPL you need a legal team to decide and plan how much to use, with BSD/MIT it can be an afterthought.

Re: Supporting Linux kernel development in Rust

#309

Earlier quoted context omitted.

> Every single proprietary mobile graphics driver uses LLVM for its shader compiler and the lack of copyleft has severely curtailed progress on open-source drivers. And you think if they didn't have the option of using LLVM they would have released an open source driver instead? That makes no sense to me.

Yes. Developing a state of the art optimizing compiler is hard . If their only choices are developing their own compiler or basing off of gcc and releasing their work, they'd choose gcc.

> If their only choices are developing their own compiler or basing off of gcc and releasing their work, they'd choose gcc.

But that's the exact choice Apple faced in 2005 and they did not choose gcc. They paid Chris Lattner and his team to develop an alternative compiler. Excerpt from wikipedia[1]:

>"Finally, GCC is licensed under the terms of GNU General Public License (GPL) version 3, which requires developers who distribute extensions for, or modified versions of, GCC to make their source code available, whereas LLVM has a BSD-like license which does not have such a requirement.

>Apple chose to develop a new compiler front end from scratch, supporting C, Objective-C and C++. This "clang" project was open-sourced in July 2007."

For some reason, the enthusiastic focus on the benefits of GPL principles seems to ignore the actual game theoretic behavior of actors in the real world to not choose GPL at all.

[1] https://en.wikipedia.org/wiki/Clang#Background

Re: Supporting Linux kernel development in Rust

#310
post #27

One of the challenges to building an entirely new kernel is the vast amount of hardware support in the form of drivers and the features the existing kernel exports to userland in the form of syscalls. Would it be possible for a hypothetical new kernel, presumably written in Rust, to run an existing kernel such as Linux in a VM, just to tap into its drivers and emulate its syscalls? As more drivers are ported to the b…

I was thinking about something similar recently - if the hardware drivers could somehow be abstracted from the rest of the linux kernel (as if...), then suddenly a ton of experimental kernels could have widespread hardware availability. It would probably shake up the OS ecosystem to no small degree, but I imagine the fresh ideas that could be experimented with by non-experts would be hugely beneficial. Isn't that the…

Complete layperson here, so don't take my word, but isn't this sort of the idea behind microkernels such as GNU Hurd?

https://www.gnu.org/software/hurd/microkernel.html

Post reply on HN