So You Want to Rust the Linux Kernel?
&gt;  Given that DEC Alpha famously had difficulty with RCU, it is only reasonable to ask how Rust will do with it.<p>&gt; Including some wild speculation about how Rust&#x27;s ownership model might be generalized<p>I recommend starting with the latests post in the series and the conclusions(<a href="https:&#x2F;&#x2F;paulmck.livejournal.com&#x2F;64209.html" rel="nofollow">https:&#x2F;&#x2F;paulmck.livejournal.com&#x2F;64209.html</a> and <a href="https:&#x2F;&#x2F;paulmck.livejournal.com&#x2F;65056.html" rel="nofollow">https:&#x2F;&#x2F;paulmck.livejournal.com&#x2F;65056.html</a>).<p>From the snippets at the beginning, it looks like the author documented how they started learning about how to solve these problems in Rust, and it does not take too long until the comment section starts pointing the author at crossbeam-rs, GhostCell, etc. which only start appearing in the series in the last couple of sections.<p>Learning Rust by implementing a linked-list is pretty hard, but &quot;Learning Rust by implementing RCU&quot; has to be, by far, the hardest way to learn Rust that I know of. Kudos to the author for pushing through this so quickly and thoroguly. The posts are all excellent.<p>I wish the author would go a little bit more into crossbeam-rs. One thing the author does not consider, is that a safe Rust interface to RCU is essentially a &quot;proof of correctness&quot; for RCU, i.e., it proves that using RCU via that interface cannot introduce undefined behavior. (Or maybe more technically, the contracts on the correctness of unsafe code within the safe wrapper provide a potentially incorrect &quot;proof&quot; of this).<p>AFAIK no such correctness proof for the C APIs exists (there are a couple of linters that catch some issues, but there is no proof that say that if you stick by those warnings your code is UB free).<p>The author seems to be assuming that the C APIs to RCU have been proved correct, which AFAIK is incorrect, and by ignoring the safe Rust APIs to RCU, the author is missing out on potentially finding issues on the correctness of the C APIs that Rust would discover.<p>Basically, the question: &quot;Can we expose Linux RCU apis to Rust?&quot; is definetly worth asking, but the question &quot;Can Rust prove Linux RCU APIs correct?&quot; is much more interesting. If it can&#x27;t, then why not? The fact that we have such proofs for other RCU and hazard pointers APIs in Rust shows that this is at least possible in general. And if Linux RCU can&#x27;t be exposed in safe Rust, precisely understanding why would definitely be illuminating (Can Linux RCU be proven correct outside Rust, but not in Rust? Or maybe does Linux RCU APIs can actually be proven incorrect by Rust?).