Re: [Ksummit-discuss] [TECH TOPIC] Rust

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Sat, 2022-06-25 at 12:45 +0100, Mauro Carvalho Chehab wrote:
[...]
> Assuming that we get into a point were all the above happens for
> subsystem XXX, at the Rust experiment validation point you mentioned
> above, there will be some possible outcomes:
> 
> 1) Rust experiment fails. On such case, the efforts to make the
> subsystem C code ready to run safe Rust code will be welcomed,
> as Linux should be safer. The work on providing Rust bindings will 
> be wasted on such case. 

Not entirely ... we'll still have gone through the learning exercise of
how do you do this.  If another language promising additional safety
features comes along we'll be better at it next time.

> I can't measure how much would be spent on making C code safer and 
> how much would be on writing Rust bindings though. If such efforts 
> would be 80%-90% for making subsystems code safer, it should 
> worth the efforts even if Rust code ends being removed.
> 
> 2) Rust experiment succeeds. In long term it would mean that
> subsystems should, at some point, stop accepting C code and start
> using only Rust for new code, and several drivers in C would require
> conversion to Rust or moved to staging in order to be deprecated.

I don't think that's what success looks like.  I think we'd continue in
dual C/Rust mode almost indefinitely.  Look how long it took the kernel
to add enough flexibility just to compile the existing C with clang.

There may be a point where we ask should we deprecate C, but that's
independent of and probably way beyond the point where Rust is a
success.

> 3) Some maintainers would consider it a success while others would
> consider it a failure. That's the worse case scenario. If we reach
> that, some Kernel/Maintainers Summit hard discussions would likely 
> be needed, in order to avoid subsystem's fragmentation with regards 
> to accepting or not C and/or Rust code subsystem-wide.

So this is where we have to ask hard questions about what does success
(or failure) actually look like. I think success is really at least one
subsystem demonstrates support and enthusiasm for the Rust conversion
and it doesn't cause a huge drain on those who don't embrace it.  That
leaves open the door for more converts but doesn't force them.  We can
continually evaluate the maintenance burden in this mode and debate
whether it's too great or is acceptable.  I think failure is definitely
no subsystem wants to embrace rust.  The problem case is where a
subsystem embraces rust has issues but doesn't want to admit failure
because it would lead to the failure of the rust project ... this one
we'll need to examine in detail.

James