Rust in the Linux Kernel: 3 Years Later

In 2022, Rust became an official Linux kernel language alongside C. Three years later, let’s assess: Was it worth it? What’s been built? What’s the future?

The Journey

Timeline

Initial Skepticism

Linus Torvalds in 2022:

“I’m interested in the project but not convinced it’s practical.”

Linus Torvalds in 2025:

“The Asahi GPU driver is impressive work.”

The proof is in the drivers.

What’s Been Built

Asahi Linux GPU Driver

The flagship Rust kernel project:

• Full Apple M1/M2/M3 GPU support
• ~15,000 lines of Rust
• Reverse-engineered hardware
• Production quality

// Conceptual Asahi driver structure
impl gpu::Driver for AsahiDriver {
    fn probe(&self, dev: &mut Device) -> Result {
        let firmware = self.load_firmware(dev)?;
        let hw = GpuHardware::init(dev, firmware)?;
        self.register_drm(hw)?;
        Ok(())
    }
}

Android Binder

Google rewrote the Binder IPC driver in Rust:

• Core Android communication
• Security-critical code
• Fewer vulnerabilities expected

Additional Drivers

• NVMe driver experiments
• Null block driver
• PHY drivers
• Various subsystems work

The Technical Reality

Safe Abstractions

Rust wraps unsafe kernel C:

// Safe Rust wrapper around kernel mutex
pub struct Mutex<T> {
    inner: bindings::mutex,
    data: UnsafeCell<T>,
}

impl<T> Mutex<T> {
    pub fn lock(&self) -> Guard<'_, T> {
        // Safe wrapper around unsafe C function
        unsafe { bindings::mutex_lock(&self.inner as *const _ as *mut _) };
        Guard { mutex: self }
    }
}

impl<T> Drop for Guard<'_, T> {
    fn drop(&mut self) {
        unsafe { bindings::mutex_unlock(&self.mutex.inner as *const _ as *mut _) };
    }
}

Memory Safety Benefits

Traditional kernel bugs prevented by Rust:

• Use-after-free (borrow checker)
• Double-free (ownership)
• Buffer overflows (bounds checking)
• Data races (Send/Sync traits)

Real-World Impact

Challenges Encountered

Toolchain Maintenance

Keeping Rust toolchain synchronized:

• Kernel Rust version requirements
• Build system integration
• Cross-compilation complexity

# Kernel Makefile Rust integration
RUSTC = rustc
RUST_FLAGS = --edition 2021 -C opt-level=2

C Interop Friction

Calling between languages has overhead:

// Every C function call requires unsafe
unsafe fn raw_c_call() {
    bindings::some_c_function();
}

// Safe wrappers add some overhead
fn safe_wrapper() -> Result<()> {
    // Validation
    // Call unsafe
    // Error conversion
}

Cultural Resistance

Some kernel maintainers remain skeptical:

• New language learning curve
• Review burden
• “C works fine”

Most criticism has softened as working code lands.

Limited Unsafe Audit Tooling

// Auditing unsafe blocks still manual
unsafe {
    // Is this actually safe?
    // Tooling still maturing
    ptr::write(dest, value);
}

Adoption Status

Subsystems with Rust

Lines of Rust Code

2022: ~1,000 LOC (infrastructure)
2023: ~10,000 LOC 
2024: ~30,000 LOC
2025: ~50,000 LOC (and growing)

Still tiny compared to ~30 million lines of C.

Developer Experience

Getting Started

# Build kernel with Rust support
make LLVM=1 rustavailable
make LLVM=1 -j$(nproc)

Writing a Module

//! Simple Rust kernel module

use kernel::prelude::*;

module! {
    type: HelloWorld,
    name: "hello_rust",
    license: "GPL",
}

struct HelloWorld;

impl kernel::Module for HelloWorld {
    fn init(_name: &'static CStr, _module: &'static ThisModule) -> Result<Self> {
        pr_info!("Hello from Rust!\n");
        Ok(HelloWorld)
    }
}

impl Drop for HelloWorld {
    fn drop(&mut self) {
        pr_info!("Goodbye from Rust!\n");
    }
}

Documentation

# Generate Rust kernel docs
make LLVM=1 rustdoc

Documentation is required for public APIs—a cultural improvement from C.

What This Means

For System Developers

Learn Rust. Kernel contributions are increasingly Rust-friendly:

• New drivers can be Rust
• Existing drivers being rewritten
• Tooling improving

For Security

Fewer CVEs from memory bugs:

• Compile-time prevention
• Reduced attack surface
• Easier auditing

For the Industry

Rust is legitimized for systems programming:

• Microsoft (Windows)
• Google (Android)
• Linux kernel
• Cloud infrastructure

Future Outlook

Near Term (2025-2026)

• More GPU drivers (NVIDIA collaboration)
• Filesystem experiments
• Networking subsystem work
• Toolchain stabilization

Medium Term (2027+)

• Critical subsystems in Rust
• Mixed C/Rust maintenance standard
• New kernel developers learn Rust first

Long Term

Will C eventually be replaced? Probably not entirely:

• 30M lines of working C
• Gradual replacement impractical
• Coexistence is the model

Final Thoughts

Rust in the Linux kernel is working. The Asahi GPU driver alone justifies the experiment—complex hardware support with better safety guarantees.

The skeptics still exist, but the code speaks louder. Three years in, Rust is here to stay.

Memory safety isn’t just for userspace anymore.