linux VS Rust-for-Linux

You're missing on a lot of things Rust (or any language with non-toy types) can provide. Lock ordering, better accessible complex structures, enforcement of enumerated options, rich description of APIs, and many others. Atomic values are usable transparently https://github.com/AsahiLinux/linux/blob/97c628055904a7f2ef1... and multithreaded reference counting is easily enforced https://github.com/AsahiLinux/linux/blob/bd0a1a7d465fcb60685... also issues like type confusion https://www.vicarius.io/vsociety/posts/a-type-confusion-bug-... are less likely if you can easily use tagged unions checked by the compiler.

From the gpu issue tracker[0]:

> For a bit of context -- Google Maps loads images to the GPU at.. inopportune times. While games would typically load their images during a load screen (so slow image loading just means longer loading screens), Google Maps loads when scrolling around I think (so slow image loading means the whole map stutters). I don't think there's a fundamental driver bug we can fix here, but we can make image loading a lot faster which makes the symptoms go away.

[0]: https://github.com/AsahiLinux/linux/issues/72#issuecomment-1...

> Is this mostly just a thing to get more young people interested in kernel development...allowing them to start out in less important areas and in a language they are passionate about?

Not likely. At the moment you need to do extra work to get Rust working well. It's not exactly beginner friendly and doing work in the kernel, you'll need to dig into C anyway.

> Or is this a serious proposal about the future of operating systems and other low level infrastructure code?

Serious code already exists, so... Yes?

> Do you just program everything in unsafe mode? What about runtimes?

Why would you? You need that only when interfacing with something that can't hold the Rust compiler assumptions. See for example https://github.com/AsahiLinux/linux/blob/gpu/rebase-6.4/driv...

The few places that need direct access / unsafe are almost all single-line areas with an explanation.

I think the idea with the M-series laptops in particular is that you can drive the speakers at volumes that actually damage them very quickly ( see https://github.com/AsahiLinux/linux/issues/53 ). The idea AIUI is that you can use a DSP along with a physical model of the voice coil to get better sound than you would if the speakers were volume-limited.

I am using Asahi Linux and the GPU driver works great, it even supports OpenGL 3.1 (https://asahilinux.org/2023/06/opengl-3-1-on-asahi-linux/). Definitely not alpha, I would say it's close to a "release candidate". Many bugs got resolved, nothing much left (besides newer OpenGL and Vulkan of course, but current state is very stable): https://github.com/AsahiLinux/linux/issues/72

There aren't really any non-trivial mainline modules, since the Rust support is so new. There's the non-mainline Asahi M1 GPU driver though! It will eventually be mainlined, but IIRC some more Rust support code needs to be mainlined first.

https://github.com/AsahiLinux/linux/tree/asahi/drivers/gpu/d...

You can follow the progress here: https://github.com/AsahiLinux/linux/issues/91

Rust is backwards compatible when you stick to stable features, but the kernel uses unstable features that can and do incur breaking changes.

https://github.com/Rust-for-Linux/linux/issues/2

> How would this work?

Don't know exactly what you're asking.

> And why would it be a better idea?

Poorly written device drivers are a significant attack vector. It's one of the reasons Linux is now exploring using Rust for its own device drivers.[0] You may be asking -- why Rust and not some other language? Rust has many of the performance and interoperability advantages of C and C++, but as noted, makes certain classes of memory safety issues impossible. Rust also has significant mindshare among systems programming communities.

[0]: https://rust-for-linux.com

Ctrl-F "rust"

https://rust-for-linux.com/ links to LWN articles at https://lwn.net/Kernel/Index/#Development_tools-Rust that suggest that only basic modules are yet possible with the rust support in Linux kernels 6.2 and 6.3.

Rust-for-linux links to the Android binder module though:

> Android Binder Driver: This project is an effort to rewrite Android's Binder kernel driver in Rust.

> Motivation: Binder is one of the most security and performance critical components of Android. Android isolates apps from each other and the system by assigning each app a unique user ID (UID). This is called "application sandboxing", and is a fundamental tenet of the Android Platform Security Model.

> The majority of inter-process communication (IPC) on Android goes through Binder. Thus, memory unsafety vulnerabilities are especially critical when they happen in the Binder driver

... "Rust in the Linux kernel" (2021) https://security.googleblog.com/2021/04/rust-in-linux-kernel... :

> [...] We also need designs that allow code in the two languages to interact with each other: we're particularly interested in safe, zero-cost abstractions that allow Rust code to use kernel functionality written in C, and how to implement functionality in idiomatic Rust that can be called seamlessly from the C portions of the kernel.

> Since Rust is a new language for the kernel, we also have the opportunity to enforce best practices in terms of documentation and uniformity. For example, we have specific machine-checked requirements around the usage of unsafe code: for every unsafe function, the developer must document the requirements that need to be satisfied by callers to ensure that its usage is safe; additionally, for every call to unsafe functions (or usage of unsafe constructs like dereferencing a raw pointer), the developer must document the justification for why it is safe to do so.

> We'll now show how such a driver would be implemented in Rust, contrasting it with a C implementation. [...]

This guide with unsafe rust that calls into the C, and then with next gen much safer rust right next to it would be a helpful resource too.

What of the post-docker container support (with userspaces also written in go) should be cloned to rust first?

Rust-for-Linux issue tracker

Yes, I definitely agree that it's a problem that pr_info implicitly wraps its arguments in unsafe {}. I wrote my own Pull Request with a trival fix.

Note that this template won't work with Linux 6.1, which has very minimal Rust support. You'll want the RustForLinux tree, or maybe Linux 6.2.

You can join Rust for Linux zulip chat by requesting invite using the link in https://github.com/Rust-for-Linux/linux 's README.