Re: Rust kernel policy

[James Bottomley]

On Tue, 2025-02-18 at 08:08 -0800, Christoph Hellwig wrote:
> Where Rust code doesn't just mean Rust code [1] - the bindings look
> nothing like idiomatic Rust code, they are very different kind of
> beast trying to bridge a huge semantic gap.  And they aren't doing
> that in a few places, because they are showed into every little
> subsystem and library right now.

If you'll permit me to paraphrase: the core of the gripe seems to be
that the contracts that underlie our C API in the kernel are encoded
into the rust pieces in a way that needs updating if the C API changes.
Thus, since internal kernel API agility is one of the core features we
value, people may break rust simply by making a usual API change, and
possibly without even knowing it (and thus unknowingly break the rust
build).

So here's a proposal to fix this: could we not annotate the C headers
with the API information in such a way that a much improved rust
bindgen can simply generate the whole cloth API binding from the C
code?  We would also need an enhanced sparse like tool for C that
checked the annotations and made sure they got updated.  Something like
this wouldn't solve every unintentional rust build break, but it would
fix quite a few of them.  And more to the point, it would allow non-
rust developers to update the kernel API with much less fear of
breaking rust.

Regards,

James