Linux kernel 6.1: Rusty release could be a game-changer
- Reference: 1670589014
- News link: https://www.theregister.co.uk/2022/12/09/linux_kernel_61_column/
- Source link:
As the Linux supremo said of the 6.0 release: "Despite the major number change, there's [1]nothing fundamentally different about this release – I've long eschewed the notion that major numbers are meaningful, and the only reason for a 'hierarchical' numbering system is to make the numbers easier to remember and distinguish."
With 6.1, however, there is something fundamentally different. For the first time in Linux's history, in addition to C, you'll be able to use another language, Rust, for kernel development.
[2]
Why? As Wedson Almeida Filho of Google's Android Team said, "We feel that [3]Rust is now ready to join C as a practical language for implementing the kernel. It can help us reduce the number of potential bugs and security vulnerabilities in privileged code while playing nicely with the core kernel and preserving its performance characteristics."
[4]
[5]
Specifically, as Alex Gaynor and Geoffrey Thomas explained at the 2019 Linux Security Summit, almost two-thirds of Linux kernel security holes
[6]PDF
come from memory safety issues. And where do they originate? Inherent weaknesses in C and C++. Rust, on the other hand, dodges these issues by using [7]far safer application programming interfaces (APIs). Rust is simply safer than C.Recently, the US National Security Agency (NSA), which is in charge of securing code as well as breaking it, suggested that one of the best things you can do for your [8]program's security is to use memory-safe languages such as Rust instead of C. Of course, there are other such languages, such as Swift, Go, or C#, but they don't lend themselves for the kind of low-level programming needed for an operating system.
[9]
This isn't just a theory. It works. Google, for example, is now using Rust extensively in Android. There the "goal is not to convert existing C/C++ to Rust, but rather to [10]shift development of new code to memory-safe languages over time"
[11]How do you solve the problem that is Twitter?
[12]GitHub's Copilot flies into its first open source copyright lawsuit
[13]Is it time to retire C and C++ for Rust in new programs?
[14]Why the Linux desktop is the best desktop
The result? "As the amount of new memory-unsafe code entering Android has decreased, so too has the number of memory safety vulnerabilities. From 2019 to 2022 it has dropped from 76 percent down to 35 percent of Android's total vulnerabilities. 2022 is the first year where memory safety vulnerabilities do not represent a majority of Android's vulnerabilities." That's not too shabby.
Of course, just because something is safer didn't mean that everyone wanted to adopt it. After all, developers have spent almost 30 years working on Linux in C. Developers were all concerned about the sheer amount of work needed to bring Rust into Linux. For example, to get the [15]Rust Linux NVMe driver to work, 70 non-standard Rust extensions were needed.
But, as Torvalds told me earlier this year, " [16]We've been using exceptions to standard C for decades ."
If you've cut your programming teeth on C and sleep with a copy of [17]K&R under your pillow, don't worry. Rust will not be replacing C in the kernel anytime this decade.
[18]
As Torvalds has explained, Rust will "just have the core infrastructure (i.e. no serious use case yet)." Specifically, you can expect to see Rust make its first appearance in Linux drivers.
[19]Miguel Ojeda, a Linux kernel developer who spearheaded efforts to bring Rust into the kernel, added: "The kernel is a huge project with a lot of stakeholders. Since the beginning, it was clear that adding a second 'main' language to the kernel would have both technical and management challenges."
So, Ojeda explained, the first Rust work you'll see in the Linux kernels will be " [20]Rust abstractions for subsystems and write drivers and other modules ."
[21]Google says Android runs better when covered in Rust
[22]GitHub's Copilot flies into its first open source copyright lawsuit
[23]Why I love my Chromebook: Reason 1, it's a Linux desktop
[24]Linus Torvalds to kernel devs: Grow up and stop pulling all-nighters just before deadline
What does that mean for old-school developers? In Ojeda's introduction to his latest patch set, he said, "the [25]facilities introduced are part of the 'Rust core.' They do not interact with the C side in new major ways (no new C types used; only strlen , memchr , additional error codes, and some more printk format strings)."
Ojeda also added, "Virtually all the code has been in linux-next for months."
In other words, Rust is being slowly and steadily introduced into the kernel. There are no quick changes being shoved down kernel developers' throats. Indeed, most of these most recent changes won't even be making it into the 6.1 kernel. They're much more likely to make their first appearance in the 6.2 kernel.
But, with the release of 6.1, which, fingers crossed, should appear on December 12, Rust will officially make Linux a two-language operating system. And, that, my friends, is big news indeed. ®
Get our [26]Tech Resources
[1] https://lkml.iu.edu/hypermail/linux/kernel/2208.1/06638.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y5NpsQs1ILMV-xIhn1WdRwAAAAw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://security.googleblog.com/2021/04/rust-in-linux-kernel.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5NpsQs1ILMV-xIhn1WdRwAAAAw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5NpsQs1ILMV-xIhn1WdRwAAAAw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://static.sched.com/hosted_files/lssna19/d6/kernel-modules-in-rust-lssna2019.pdf
[7] https://www.youtube.com/watch?v=RyY01fRyGhM
[8] https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5NpsQs1ILMV-xIhn1WdRwAAAAw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html
[11] https://www.theregister.com/2022/12/06/twitter_opinon_column/
[12] https://www.theregister.com/2022/11/11/githubs_copilot_opinion/
[13] https://www.theregister.com/2022/09/28/is_it_time_to_retire_c/
[14] https://www.theregister.com/2022/04/13/linux_column/
[15] https://www.phoronix.com/news/LPC-2022-Rust-Linux
[16] https://www.zdnet.com/article/linus-torvalds-talks-rust-on-linux-his-work-schedule-and-life-with-his-m2-macbook-air/
[17] https://www.cprogramming.com/books/ritchie.html
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5NpsQs1ILMV-xIhn1WdRwAAAAw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://www.memorysafety.org/blog/memory-safety-in-linux-kernel/
[20] https://lkml.org/lkml/2022/9/27/672
[21] https://www.theregister.com/2022/12/02/android_google_rust/
[22] https://www.theregister.com/2022/11/11/githubs_copilot_opinion/
[23] https://www.theregister.com/2022/10/28/column/
[24] https://www.theregister.com/2022/10/17/linux_6_1_rc1/
[25] https://lore.kernel.org/lkml/20221110164152.26136-1-ojeda@kernel.org/
[26] https://whitepapers.theregister.com/
Particularly impressive and beneficial is how much code Rust can save you writing in the first place, especially in drivers with complex memory interactions (nearly all of them). For complex memory interactions in C / C++ you either have to personally identify the memory interactions as safe, or write code to do memory isolation around them. In the case of Rust you often don't have to write any of that, as the compiler will guarantee correctness. It also reduces the maintenance burden by automatically accommodating memory management for new patches over time, and it can bring speed boosts as the original locking scheme can be too conservative and fail to keep up with patches and updates.
Sensible, Progressive, Successful
Well done to all those involved. Thank you for your time and skills.
Better Security, nearly always makes things a bit more complex.
Requiring two compilers when porting Linux to a new CPU architecture at some future date will definitely make things interesting.
e.g.
[1]Ascenium Inc. with it's Aptos general-purpose processor without an instruction set.
[2]Mill Computing Inc. 's Belt Architecture. (search for "Ivan Godard" on youtube).
But at the end of the day better security, can only be a good thing.
[1] https://www.ascenium.com/
[2] https://millcomputing.com/
Re: Better Security, nearly always makes things a bit more complex.
True, but if this is mostly for new drivers then there is less chance of needing the rust compiler on obscure platforms.
Re: Better Security, nearly always makes things a bit more complex.
For now it is, by the time these things are being sold as actual products, I'm sure rust will be in some of the drivers that you "need" to bring the OS up. The hardware will end up using the same RAM and storage as everything else, and the high end, bleeding edge ones will be written in rust by then.
RISC-V was an obscure platform 10 years ago, and that is just starting to be more mainstream now. With the Likes of Star64/VisionFive 2/...
Re: Better Security, nearly always makes things a bit more complex.
With all due respect I have been hearing about the Mill/Belt thing for /decades/ now and nothing has ever been released. Maybe let's worry about it when it's more than posts on Usenet?
Re: Better Security, nearly always makes things a bit more complex.
It is still being worked on, they are a small team and they can either put their heads down and do the work, or do PR, they do not have enough VC (yet) to do both. They have goals to meet to keep the funding flowing.
Seems sensible, less high-risk bugs in new code, and hopefully effort on old code is more about bug-fixing and not introducing huge new features (with related percentage of bugs).