Rust vs. C — Linux’s Uncivil War – Source: securityboulevard.com

Memory safety: Good. Cheese  motion:  Bad.

The big debate over using Rust in the Linux kernel continues. After one of Linus Torvalds’ ALL CAPS interventions last week, kernel 2IC Greg Kroah-Hartman wades in with a please-and-thank-you follow-up.

In case we were in any doubt, it’s now clear the memory-safe language is really happening in the Linux kernel. In today’s SB  Blogwatch, we walk off sideways.

Your humble blog­watcher curated these bloggy bits for your enter­tain­ment. Not to mention:  2024?

Kernel Panic in the Rust Belt

What’s the craic? Michael Larabel reports: Compelling Case For New Linux Kernel Drivers To Be Written In Rust

“Rust rather than C”
The debate over the Linux kernel’s Rust programming language policy continues. While some kernel maintainers are against it, Linus Torvalds has reportedly said he would override maintainers that may be against honoring Rust.
…
Greg Kroah-Hartman has also been a big proponent of Rust kernel code. He’s crafted another Linux kernel mailing list post … outlining the benefits of Rust and encouraging new kernel code/drivers to be in Rust rather than C.

What’s going on? Thomas Claburn explains: Linux royalty backs adoption of Rust

“Grandstanding”
In case you came in late, Rust was added to the Linux kernel in 2022 because it allows better memory safety than C. … The majority of serious bugs and vulnerabilities in large codebases arise from memory safety errors, which could or should be avoided by using memory-safe languages and tooling. … Rust isn’t a silver bullet that will magically solve all problems. But it will help.
…
Some Linux kernel maintainers remain unconvinced that adding Rust code to the open source project is a good idea. [This is] the latest in a spat which began last month when a proposed patch to allow Rust-written device drivers to call the primarily C-based kernel’s core DMA API was challenged by kernel maintainer Christoph Hellwig, [who] likened maintaining a multi-language codebase to cancer.
…
The ensuing argument prompted Hector Martin, then project lead of Asahi Linux, to demand that Linus Torvalds decide whether the patch would be pulled into the kernel or not. Torvalds eventually responded by … scolding Martin for grandstanding on social media about the issue. Martin later quit.

Boys and their toys? Thorsten Leemhuis is lost in translation: An attempt at analysis

“Big consequences”
Torvalds is not alone in his backing: This is shown by statements from many central Linux developers mentioned by Rust-for-Linux maintainer Miguel Ojeda. … Greg Kroah-Hartman also recently spoke out strongly in favor of Rust and recently included Rust interfaces himself in a new Kernel feature.
…
[But] established kernel developers and maintainers are taking a very close look at what they are bringing into the nest, in their usual way—in small, manageable steps in each area. This takes time and will also lead to disputes. [But] this is quite normal when developing complex software with thousands of developers and modifications with big consequences.

Horse’s mouth? Greg Kroah-Hartman:

The majority of bugs (quantity, not quality/severity) we have are due to the stupid little corner cases in C that are totally gone in Rust.
…
I’m not saying that Rust has no … issues, I’m saying that a huge majority of the stupid things we do in C just don’t happen in the same code implemented in Rust (i.e., memory leaks, error path cleanups, return value checking, etc.) So, … let’s make different types of errors in the future, not continue to make the same ones we should have learned from already, please.

Strong argument. zubspace thinks it’s an interesting discussion:

It’s an interesting discussion. There’s always a divide when you slowly migrate from one thing to another. What makes this interesting is that the difference between C code and Rust code is not something you can just ignore. You will lose developers who simply don’t want or can spend the time to get into the intricacies of a new language. And you will temporarily have a codebase where 2 worlds collide. I wonder how in retrospect they will think about the decisions they made today.

Some C diehards are Luddites. But Taircron just doesn’t get it:

I just don’t get it. I’m an embedded dev. I’m disturbingly fluent in C, and barely fluent in Rust. [But even] I know Rust is the future.
…
It’s just a question of how long until everything … shall be in Rust. There’s no reason any modern dev team should be allowing themselves the risks that Rust protects against. Yes, there’ll be a learning curve, and no, we can’t throw out the existing millions of lines of C. But why would anyone think continuing with C forever is a valid option?

But is Rust the best way to get there from here? jake calls some sort of transition “inevitable:”

There is no doubt … that eventually, C will no longer be used as the language for the Linux kernel. … However, I have many doubts that Rust is the language that will be the one to take the place of C. If Rust is truly better than C for kernel work, Rust will take over as kernel coders spread the news. That’s how it works. The best, most efficient code wins. That’s how it has always worked in the 60ish years I’ve been coding in the free software world.
…
What it’ll take is a major paradigm shift in programming that [the] vast majority of kernel coders can get behind. My gut feeling is that the seeds of this new way of looking at programming haven’t even been planted as yet. … I’ll bet that the bulk of the Linux kernel will probably still be coded in C long after I am gone.

A bad worker blames their tools, though? david.emery thinks there’s more to it than that:

Language counts! … Sure, the expert programmer can produce fault-free C or C++. It takes a lot more than understanding just the language semantics; there’s a lot of experience and “do it this way, don’t do it that way” that programmers need to learn—usually the hard way. … As a profession, I don’t think we learn from our mistakes, in large part because we often won’t admit the mistakes in the first place.

Meanwhile, johnsonwax cuts to the chase:

So many of these arguments seem to boil down to ‘I know every dusty corner of C needed to ensure contributed code is memory safe,’ — knowledge they spent decades accruing and which Rust overnight makes useless. It’s a huge loss of expertise status, and that ultimately becomes the driving motivation. Seen it many times in my career. … I’ve seen entire institutions blocked from moving forward because you had some of these people in key places.

And Finally:

Dude can’t sing, but it is funny

Hat tip: stmw

Previously in And Finally

You have been reading SB Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weird­est web­sites—so you don’t have to. Hate mail may be directed to  @RiCHi, @richij, @[email protected], @richi.bsky.social or [email protected]. Ask your doctor before reading. Your mileage may vary. Past per­formance is no guar­antee of future results. Do not stare into laser with re­maining eye. E&OE. 30.

Image sauce: Chandler Cruttenden (via Unsplash; leveled and cropped)