Re:An RFC that adds support for Rust to the Linux kernel
by TheCoelacanth on Wednesday April 14, 2021 @08:11PM
(#26814730)
> Any code that uses the unsafe wrappers technically must be checked
If that is the case, then your unsafe wrappers are unsound.
Safe functions need to be impossible to use in an unsafe way or else they should marked as unsafe.
That could take the form of a runtime check that the function's invariants are maintained or a proof that the function's invariants are always maintained.
Re:An RFC that adds support for Rust to the Linux kernel
by steveklabnik on Wednesday April 14, 2021 @08:13PM
(#26814750)
If an unsafe wrapper can be mis-used, it's not actually safe, and so the bug still lies inside the wrapper.
Re:An RFC that adds support for Rust to the Linux kernel
by CyberRabbi on Wednesday April 14, 2021 @09:30PM
(#26815210)
That’s true, so now I see where the issue of unavoidable unsafe usage comes in. It’s not always possible to create a safe and general wrapper for all driver functionality, though in special cases maybe. I agree now that using Rust still offers something even if it can’t be guaranteed that the code is 100%. Thanks for explaining.
That’s true but it’s also slightly misleading. Any code that uses the unsafe wrappers technically must be checked and all code that uses that code must checked in turn, ad Infinitum. Misuse of the Unsafe wrapper can occur at any level. For instance, if you misuse a DMA command that corrupts memory, it’s not simply the DMA command wrapper that must be checked, the entire sequence of logic that led to the bad command being executed must also be checked.