Immunant Blog

Immunant | [Senior] Software Engineer | REMOTE | Full-time | https://www.immunant.com The team at Immunant is working tirelessly to make the lower levels of the modern software stack more secure. We are looking for a fellow systems programming expert to help us harden components used by hundreds of millions of users each day. If you have substantial experience with C/C++/Rust, an eye for detail, and a high degree of self-motivation, we'd love to talk. We are located in Southern California but are also considering strong candidates who wish to work remotely in the US. More details here: https://www.immunant.com/jobs Send questions or your application to [email protected]; please mention HN in subject line. We look forward to hearing from you!

Past work in the area by the folks at Immunant (https://immunant.com/) that appears to be on-going https://github.com/immunant/c2rust. I think the project was also DARPA funded for a time.

Bitfields are hard! They are potentially unaligned, thus interact poorly with some language features, like pointers and references. And their size isn't a multiple of bytes, unlike any other value, which causes problems as well. They interact poorly with padding and the general idea of Rust ABIs that enables optimizations like reordering fields and using "niches" (invalid values) to find a more compact layout for structs and enums. I agree Rust should eventually have some native support for bitfields, but only if it's a high quality spec that addresses the outstanding concerns - Rust should specifically avoid the C mess, which isn't usable for most projects. But this doesn't mean bitfields can't be done in Rust; it's just not in the stdlib (yet). See this post[0] which contains a survey of various libraries (and their respective limitations), and this slightly older article [1]. Those articles somehow missed the modular-bitfield crate [2], which is perhaps the nicest to use, and is what I would recommend you. If you don't care about the specifics you can get any crate discussed in the above articles and use them. About interoperability with C (and C++), I really like bindgen, cbindgen and cxx. The bindgen book [3] is straighforward. This section of cxx documentation [4] also describes the tradeoffs between the different FFI approaches. I don't know Ada though, so I must ask: what does Ada do? About this, > I just don't see what Rust has to offer that Ada didn't already…

If you're going to use tools to transpile, don't use something that hallucinates. You want it to be precise. https://github.com/immunant/c2rust reportedly works pretty well. Blog post from a few years ago of them transpiling quake3 to rust: https://immunant.com/blog/2020/01/quake3/. The rust produced ain't pretty, but you can then start cleaning it up and making it more "rusty"

A recent practical example of the former: the fish shell re-wrote incrementally from C++ to Rust, and is almost finished https://github.com/fish-shell/fish-shell/discussions/10123 An example of the latter: c2rust, which is a work in progress but is very impressive https://github.com/immunant/c2rust It currently translates into unsafe Rust, but the strategy is to separate the "compile C to unsafe Rust" steps and the "compile unsafe Rust to safe Rust" steps. As I see it, as it makes the overall task simpler, allows for more user freedom, and makes the latter potentially useful even for non-transpiled code. https://immunant.com/blog/2023/03/lifting/

Their blogpost about translating Quake 3 was interesting: https://immunant.com/blog/2020/01/quake3/

Quake III already has been ;) https://immunant.com/blog/2020/01/quake3/

This is a good list of positives. I'm surprised there's no mention of bitfields though. I like the u32::from_le_bytes and into() and so on, but I feel like Rust would be a perfect match for explicit "u3" types when dealing with low-level protocols. https://immunant.com/blog/2020/01/bitfields/ and similar articles show some options, but none of them feel as natural (ergonomics wise) or even as "safe" as a C bitfield checked by clang. bcantrill (or others): am I just missing something here?

Immunant folks wrote a blog post [1] about automating conversion of Linux kernel drivers from C to Rust by using their tool c2rust[2]. [1] https://immunant.com/blog/2020/06/kernel_modules/ [2] https://github.com/immunant/c2rust

> That's where the effort comes in. Those false positives are removed by adding annotations or changing code. With the former you lose all guarantees and fall back to a safe/unsafe duality, with the latter you need to rethink how your code works to comply yo the analyzer's mindset: in the end it's pretty much like Rust, but in an ad-hoc way, much less ergonomic. > I said they require relatively little effort, because it's definitely less effort than a rewrite in Rust. This is a ridiculous way to save your argument. You are well aware that this is not what “relatively easy” means. It is comparatively easier to deploy such tools than to rewrite a whole project in Rust, but the payoff is also lower in the long run (Rust offers more than zero-UB), so we might get to a point (when tooling[1] and hiring pool have reached a point where it becomes sustainable) where the latter option makes more sense for most people (unless C is mandatory, for portability reasons for instance). [1]: I'm especially thinking about C2Rust here https://immunant.com/blog/2020/01/quake3/