Rust

Lifetimes: references that outlive their data

The borrow checker prevents dangling references — references to data that has already been freed. When a function takes and returns references, the compiler needs to know how the reference lifetimes relate. Lifetime annotations ('a, 'b) make these relationships explicit. The compiler often infers lifetimes (lifetime elision), but complex cases require explicit annotations.

// The return reference must live at least as long as both inputs
// 'a says: the output lifetime is tied to the shorter of x and y
fn longest<'a>(x: &'a str, y: &'a str) -> &'a str {
    if x.len() > y.len() { x } else { y }
}

// Struct holding a reference — must annotate lifetime
struct Important<'a> {
    content: &'a str,   // content must outlive Important
}

fn main() {
    let s1 = String::from("long string");
    let result;
    {
        let s2 = String::from("xyz");
        result = longest(s1.as_str(), s2.as_str());
        println!("{}", result);   // OK — s2 still alive here
    }
    // println!("{}", result);    // ERROR — s2 dropped; result would dangle
}

Traits: Rust's interface system

A trait defines shared behaviour — like an interface in Java or a typeclass in Haskell. Types implement traits. Trait bounds constrain generics (T: Display + Clone). Rust's standard library is built on traits: Iterator, Display, Clone, Copy, Send, Sync.

use std::fmt;

trait Animal {
    fn name(&self) -> &str;
    fn speak(&self) -> String;
    // Default implementation
    fn description(&self) -> String {
        format!("{} says: {}", self.name(), self.speak())
    }
}

struct Dog { name: String }
struct Cat { name: String }

impl Animal for Dog {
    fn name(&self) -> &str { &self.name }
    fn speak(&self) -> String { String::from("Woof!") }
}

impl Animal for Cat {
    fn name(&self) -> &str { &self.name }
    fn speak(&self) -> String { String::from("Meow!") }
}

// Trait bound: T must implement Animal
fn print_animal<T: Animal>(animal: &T) {
    println!("{}", animal.description());
}

// Dynamic dispatch: dyn Animal — runtime polymorphism
fn make_sound(animals: &[Box<dyn Animal>]) {
    for a in animals { println!("{}", a.speak()); }
}

Fearless concurrency

Rust's ownership and type system prevent data races at compile time. The Send trait marks types safe to transfer between threads. The Sync trait marks types safe to share between threads via references. The compiler enforces these — if a type is not Send, you cannot send it to another thread. This is "fearless concurrency": concurrency bugs become compile errors.

use std::thread;
use std::sync::{Arc, Mutex};

fn main() {
    // Arc = Atomically Reference Counted (thread-safe Rc)
    // Mutex = mutual exclusion for shared mutation
    let counter = Arc::new(Mutex::new(0));
    let mut handles = vec![];

    for _ in 0..10 {
        let counter = Arc::clone(&counter);
        let handle = thread::spawn(move || {
            let mut num = counter.lock().unwrap();
            *num += 1;
        });
        handles.push(handle);
    }

    for handle in handles { handle.join().unwrap(); }
    println!("Result: {}", *counter.lock().unwrap());  // 10

    // Channels: message passing (like Go goroutines)
    let (tx, rx) = std::sync::mpsc::channel();
    thread::spawn(move || { tx.send(42).unwrap(); });
    println!("Received: {}", rx.recv().unwrap());
}

Cargo: Rust's build system and package manager

Cargo is Rust's official build tool, package manager, and project scaffolder. cargo new project_name creates a new project. cargo build compiles. cargo run compiles and runs. cargo test runs tests. cargo doc generates documentation. Dependencies are declared in Cargo.toml; exact versions are locked in Cargo.lock. The package registry is crates.io — over 150,000 crates published.

The ownership system: formal foundations

Rust's ownership system is formalized in RustBelt (Jung et al., 2017), a mechanized semantic model of the Rust type system built in Iris/Coq. RustBelt proved that Rust's core type system is sound — if the compiler accepts a program, it is memory-safe and data-race-free (assuming no unsafe blocks). The key insight: Rust's type system encodes a linear type discipline where values are consumed exactly once, combined with a region-based memory model where borrows are valid for exactly their declared lifetime. The proof covers the entire Rust standard library's use of unsafe, verifying that all unsafe abstractions maintain the safety invariants expected by safe code.

unsafe Rust and the safety boundary

Rust has an unsafe keyword that unlocks five additional capabilities: dereferencing raw pointers, calling unsafe functions, accessing mutable static variables, implementing unsafe traits, and accessing union fields. The programmer asserts these operations are correct; the compiler stops verifying them. unsafe does not disable the borrow checker or type system generally — it only permits those five operations within the unsafe block. The fundamental contract: safe Rust code may call into unsafe abstractions; those abstractions are responsible for maintaining the invariants that make the rest of the code safe. The Rust standard library itself uses unsafe internally for performance-critical operations (e.g. Vec::push) while presenting a safe public API.

Rust in the Linux kernel and Windows

Rust was accepted into the Linux kernel in version 6.1 (December 2022) as a second implementation language alongside C (Linus Torvalds merged the initial support; Miguel Ojeda leads the effort). Rust code in the kernel must be no_std (no standard library) and operate within the kernel's custom allocator. Microsoft has been rewriting portions of the Windows NT kernel in Rust since 2023, starting with the kernel-mode driver infrastructure. Both efforts cite the same motivation: eliminating the memory safety vulnerabilities (use-after-free, buffer overflows) that account for the majority of CVEs in both kernels.