The Case for Rust (in the base system)

If Rust gets added and it works out well, then the C people will get pressure to write new code in Rust and who wants that. Best crush it before it starts.
I think it should be crushed before the bindings creep in and litter up the codebase.

Keeping a close eye on how Linux is approaching it and it is just layer after layer of bindings. I feel this will make future refactors very fragile and put serious maintenance pressure on a relatively smaller project.
 
I think it should be crushed before the bindings creep in and litter up the codebase.

Keeping a close eye on how Linux is approaching it and it is just layer after layer of bindings. I feel this will make future refactors very fragile and put serious maintenance pressure on a relatively smaller project.
That is indeed another matter. Rust seens very keen on refactoring, and it may happen that this will add push to the rest of the system to do it "their way". That could become a problem.
 
I'm really not.

Below is an example patch for the rust bindings required for a small fragment of Linux kernel (cpufreq).

https://lore.kernel.org/rust-for-linux/cover.1712314032.git.viresh.kumar@linaro.org/

This clutter for every subsystem will be hundreds of thousands of lines.

The referenced docs and cbindgen is so incredibly naïve to the challenges of bindings. Its like it was written by someone who has never actually done this professionally. What about structs, MACROS, callbacks, non-opaque pointers, void * userdata? Even SWIG can't properly handle these and that is far more mature than Rust's bindgen.

but clearly understanding that Rust can replace C and working other angles.
Just like any random language. Rust would *need* to replace C (atomically). Because it sure as hell can't interoperate with it as part of a natural evolution. Which is why it is another dead end (at least for our lifespan).

Rust can replace C. You are right. Redox OS is promising as an approach. Shoveling Rust into existing kernels is less so IMO. Rust cannot replace C using this approach.
 
Ah, you mean the other direction. Well, that's for Rust people to deal with? If the underlying subsystem goes to Rust though, that all disappears?
 
Well, that's for Rust people to deal with?
If someone craps on your front lawn; it is kind of your problem to avoid standing in it each morning on the way to work, regardless of if the person who did it is still pokeing it with a stick or not.
Likewise, if a Rust developer pollutes the kernel code with bindings; it is still up to the kernel developers to tiptoe around it each time they want to make a change to the codebase or build system.

If the underlying subsystem goes to Rust though, that all disappears?
Absolutely. Though, like any language, a ground up rewrite (aka Redox OS, Singularity, etc) is likely the quicker process than many, many refactors, writing temporary binding layers in between stages to get to the same point. And in the meantime, it doesn't break or pollute existing projects.

Question:
Is Rust mature enough to do so? I read and understand the promises/goals of Rust, has Rust achieved those goals, have they verified/tested/proven?
Sure, I feel that Rust is immature and potentially unproven for very large projects, but these concerns shouldn't hold it back at all. Admittedly it is still *much* more mature than C was when it was used to implement classic UNIX.

The fun thing I suppose is that when you make an OS, you also make all the rules. That means the language doesn't need to be standardized or even complete, it just needs to emit machine code.
 
  • Like
Reactions: mer
tiptoe around it each time they want to make a change
Right. Pressure to write new code in Rust ("easy") instead of tiptoeing around it ("hard").

break or pollute existing projects
Of course, nobody wants drywall dust everywhere. Do your Rust elsewhere... don't bother the C people.

This line of thought really isn't disabusing me of my view that the proposal is clearly viewed by opponents as a stepping stone to replacing C and they just don't want that to happen, never mind any benefits it may confer. I mean, if this process actually works on Linux, there's no way FreeBSD will withstand being known as the "kernel with the memory-unsafe language."
 
Right. Pressure to write new code in Rust ("easy") instead of tiptoeing around it ("hard").
Indeed. Writing new code is easy. Working with and around existing large systems is hard. This is the developers motto.

the proposal is clearly viewed by opponents as a stepping stone to replacing C and they just don't want that to happen, never mind any benefits it may confer.
I think this kind of "chip on the proverbial shoulder" of Rust developers (almost exclusively) is why they don't tend to be viewed too favorably by existing developers and come against quite a few road-blocks. Contrast this to the Go-lang community who are not nearly as inflammatory and yet also "memory safe and modern".

In any project. We do want Rust or we do want C. What we don't want is a load of C *and* Rust *and* more C/Rust to glue it all together.

I mean, if this process actually works on Linux, there's no way FreeBSD will withstand being known as the "kernel with the memory-unsafe language."
Heh yes. But certainly it makes sense to wait and see if Linux is damaged rather than "purified" first rather than FreeBSD to also take the risk and jump off that same cliff in parallel.

In other words, I am quite certain Linux will abort its Rust experiment in future. What will be sad to see is FreeBSD also lumped with lots of mess to be cleaned up too. I would rather that we wait.
 
I think this kind of "chip on the proverbial shoulder" of Rust developers
I think you either have this flipped or you're reading into something I didn't say.

Apple is doing the unsafe/safe dual language approach and it is working out. ?‍♀️ I wouldn't bet on Linux's Rust experiment not working. People really don't like the memory bugs.
 
I personally think that Rust is the second coming of Java - yep, it improved on existing issues of performance and memory safety, at the expense of being pretty bloated anyway. ?
 
Rust needs to stay out of base, if anyone wants programs in Rust, they need to make a separate ports tree which is in Rust, and uses FreeBSD as the base system. Or they can use Redox or another operating system, then use existing C programs outside of their base system to make up for what they don't have.

If anything goes into the base, it needs to be a C based modern safe language, and able to compile C. Zig or a successor is an acceptable candidate to go into base. This way, there will be one compiler, which compiles all needed in base that's both C and Zig. It's time for a programming language based on C, which is safe and replaces the functions of both C and C++, and can also use C libraries as is and perhaps C++ libraries. A fork would be a safer option.

As long as C is around, FreeBSD will survive. Then, it would still survive in maintenance mode after C is replaced, which would be after a long time. The successor form of FreeBSD built directly off of it will be around for a long time as long as that next language stays around. I think it won't be Zig, but will be something based off of Zig with its lessons and will include Zig founders into a newer language.
 
I personally think that Rust is the second coming of Java - yep, it improved on existing issues of performance and memory safety, at the expense of being pretty bloated anyway. ?

The size of executables right now compares badly, that is true.

But actual RAM consumption in data (if not code) should be comparable to C++ code using STL containers (not C arrays).

It also lacks the GC. GC seems to mix badly with object-oriented programming (since they interweave memory between generations so that the optimizations for generational GC don't kick in effectively).
 
To clearify: I would not really mind seeing rust in base, for some tools, that NEED this. Like network daemons, for example. Crossing the blood-brain barrier is to be avoided. So, putting rust into the kernel or anywhere a process space is crossed is a no-no. The sticky brown stuff will hit the whirly rotating thing when parts of the low level parts need to be refactor es in different ways when more than one use case comes along and no way to have both be happy exists. So having this border in kernel space will be like having free ranging cancer.
 
People really don't like the memory bugs.
People haven't liked memory bugs for multiple decades. And yet here we are ;)

Apple is doing the unsafe/safe dual language approach and it is working out.
As far as I can tell Apple's macOS, iOS is C in the kernel (not even Obj-C) with a fair amount of C++ for the kernel modules and daemons.
Is Swift used for anything other than userland? Due to legacy, from what I can see, there isn't much Swift at all, even there.
 
The size of executables right now compares badly, that is true.

But actual RAM consumption in data (if not code) should be comparable to C++ code using STL containers (not C arrays).

It also lacks the GC. GC seems to mix badly with object-oriented programming (since they interweave memory between generations so that the optimizations for generational GC don't kick in effectively).
Yeah, and Java does have garbage collection... seems like Rust still has a lot to learn from its predecessor... ?
 
It also lacks the GC. GC seems to mix badly with object-oriented programming (since they interweave memory between generations so that the optimizations for generational GC don't kick in effectively).
Simula 67, the granddady of all O-O languages was garbage collected. So was SmallTalk. So is Java. And of course Lisp. I think C++ is the outlier -- some people don't even consider O-O! Something Alan Kay said:
Many of Carl Hewitt’s Actors ideas which got sparked by the original Smalltalk were more in the spirit of OOP than the subsequent Smalltalks. Significant parts of Erlang are more like a real OOP language the the current Smalltalk, and certainly the C based languages that have been painted with “OOP paint”.
:cool:

Also recall that generational GC was a later invention (Lieberman & Hewitt,1983). By then
 
Agree with everything you said, except want to elaborate:

Crossing the blood-brain barrier is to be avoided. So, putting rust into the kernel or anywhere a process space is crossed is a no-no.
I've helped write Linux kernel modules in C++, which requires a blood-brain barrier (and before you even ask, the module is to my knowledge never been open sourced, nor does it need to be). It is possible to change languages at the module boundary. It requires a little bit of care, but then all kernel programming requires a lot of care. In an environment with really good software engineers (meaning: they are all experienced professionals, and all get paid to do this job, in a big company), we can except that level of professionalism; and large organizations tend to have functioning software processes.

From this experience, I would not have a problem with a set of skilled people under good supervision implementing part of an existing kernel (whether it be BSD or Linux or any other) in Rust. Now, are those requirements (skill and management) met in either project? Does the risk of having it done badly outweigh the potential benefits? Those are tough questions, and I'm not knowledgeable enough to opine on it.
 
C and C++ are close enough as not to cause too severe an alergic reaction. You can work with C data structures without the need to mess with their layout, you can call each other with very little problems. You can even compile the kernel with C++ mode (they did that).

In case Rust enters the kernel at a larger degree, I'll start watching the LKLM again, waiting for the refactoring wars and the sure to come statements from linus.
 
Got better tools to solve that problem, now. ?‍♀️
Do we? I think they said the same thing about Java.

Arguably I would say we have better tools to debug and sanitize C though. ASan is something that really should have been developed back in the 90's IMO. Valgrind and Purify were the dark ages.

The distance between Rust and C is indeed larger than the distance between C++ and C, as ALL data structures have to be redefined when using Rust. With a C++ module in an otherwise C kernel, you only have to worry about the C++ things (like vtable pointers) never leaking out.
Indeed. That is a succinct way of putting it.

Bindings generators like SWIG/bindgen can't quite compete with a (close to) superset of a language in terms of ability to interop.

And C aside, it looks like Rust developers know that even C++ is going to be a difficult battle. I.e: Google throws $1M at Rust Foundation to build C++ bridges
 
Back
Top