After many years of debate, the infrastructure enabling Rust code to be written in the Linux kernel has been merged, and drivers written in Rust are beginning to appear. This marks the first time a second language has been accepted in a project that has used only C for thirty years.
Technical reasons
Statistics from numerous large-scale projects written in C and C++ all show similar results: about two-thirds of critical security vulnerabilities stem from memory errors—out-of-bounds access, use of freed memory, and double-free.
This isn't a matter of the programmers' skill level. These projects bring together the best talent and still run into problems, simply because it's impossible for humans to track the memory lifecycle across millions of lines of code.
Why a driver?
Drivers account for the bulk of the kernel’s code; they are written by various parties, vary in quality, and run with full privileges. In other words: they pose the highest risk, and they are also where new code is constantly being generated—making them a logical place to experiment with new languages.
The Real Challenges
- Since it has its own memory model and conventions, it must be rewrapped into a safe class for Rust—a very labor-intensive task
- Maintainers must be able to understand both languages
- The kernel’s internal interface changes constantly, and every time it changes, the wrapper class must be updated
Realistic expectations: Rust will not replace C in the kernel. It will gradually take over newly written code—where the benefits are greatest and the transition costs are lowest.
Thảo luận