Danilo Krummrich on Rust in the Linux Kernel

The podcast discusses the integration of Rust into the Linux kernel, focusing on the development of Nova, a modern GPU driver for Nvidia GPUs based on the Turing architecture and later. Nova is part of the DRM (Direct Rendering Manager) subsystem, which manages GPUs within the kernel, and is being written in Rust to address limitations in the older C-based Novo driver. These limitations include architectural complexity, difficulties in supporting modern APIs like Vulkan, and challenges related to firmware instability and scalability due to Nvidia's proprietary GSP (GPU System Processor) firmware model.

A key motivation for using Rust is improving memory safety, as a significant portion of kernel vulnerabilities stem from memory-related bugs in C code. Rust's ownership model, borrow checker, and compile-time guarantees help prevent issues like use-after-free and data races, reducing the risk of CVEs. While some unsafe code is still required - particularly when interfacing with firmware - Nova is largely written in safe Rust, with careful management of lifetimes, resource initialization, and dependencies. The project is being developed incrementally, with core infrastructure and driver components upstreamed in small pieces to improve code quality and collaboration, potentially setting a new precedent for future kernel development.

• What if you rewrote a critical component of your software in Rust to eliminate memory safety bugs and improve long-term maintainability?

  • Move: Identify a high-risk, C/C++-based module in your solo project (e.g., a parser, network handler, or data processing engine) and rewrite it in Rust using safe abstractions, integrating it via FFI.
  • Why Now?: Rust's tooling for C interop is mature, and the cost of memory bugs in production (crashes, security issues) is high - especially for solo devs without QA teams. The Linux kernel's success with Rust proves its viability in low-level, high-stakes environments.
  • Expected Upside: Reduced debugging time, fewer CVEs, and easier future extensions due to Rust's compile-time guarantees and expressive type system - freeing you to focus on feature development.

• What if you adopted incremental, user-driven development for your next major feature, mirroring Nova's upstreaming strategy?

  • Move: Break your next big feature into small, reviewable units that each deliver partial functionality, and release them publicly (e.g., via GitHub) for feedback before full completion.
  • Why Now?: Solo developers risk building in isolation and shipping features that miss the mark. Nova's iterative approach - building infrastructure alongside its user - proves that early, small merges improve quality and reduce rework.
  • Expected Upside: Faster validation, better code quality through public scrutiny, and reduced burnout by shipping progress incrementally instead of betting on a single big launch.

• What if you enforced strict lifecycle and resource management in your app using Rust-style ownership and compile-time checks?

  • Move: Model critical resources (e.g., database connections, file handles, API clients) with explicit ownership and cleanup logic - either by using Rust or emulating its patterns (e.g., RAII in TypeScript/Python with context managers).
  • Why Now?: Resource leaks and race conditions are common in solo projects due to ad-hoc cleanup. The Nova driver's use of Rust lifetimes to tie resource validity to driver lifecycle shows how structure prevents bugs.
  • Expected Upside: Fewer runtime crashes, predictable cleanup, and easier debugging - especially in async or long-running processes - leading to more reliable software with less manual tracking.

• Adopt Rust for new driver or systems-level modules in your projects to leverage compile-time memory safety and reduce common CVEs related to memory bugs.
• Structure your kernel or low-level software projects to incrementally upstream small, reviewable code chunks instead of large monolithic submissions to improve collaboration and code quality.
• Design driver architectures with clear lifecycle management (probe/remove) and use language-enforced initialization (like Rust's lifetimes) to prevent partial or incorrect setup states.
• Minimize unsafe code by isolating it to well-defined interfaces (e.g., firmware or hardware boundaries) and rely on safe abstractions for the majority of logic to improve maintainability.
• Use the Linux kernel's existing Rust tooling (rustfmt, Clippy, KUnit) via make targets to ensure code consistency, catch bugs early, and test in the actual kernel environment.