Open Sourcing Ferrocene(ferrous-systems.com) |
Open Sourcing Ferrocene(ferrous-systems.com) |
I just wanted to clarify all AdaCore products are open source. Including of course GNAT Pro for Rust.
It's a great step for Rust!
[1]: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
Certification aims to solve a different, but maybe related, problem. Essentially "how do we verify that the compiler does what it's supposed to do." At its very basic level, it could be described as formalized qualitiy management. So certifying the rust compiler first involved deriving a sufficiently complete spec from the existing RFCs, deriving the requirements for the compiler from that and then verifying that the compiler upholds that. It also requires describing the verification process, issue managegment handling, etc. We have another blog post describing the qualification process in a little more detail https://ferrous-systems.com/blog/qualifying-rust-without-for...
Disclosure: I'm one of the founders and managing directors at Ferrous Systems
For every bit in the Ferrocene language specification [2] there's a link to a set of tests that actually confirm the compiler's behavior. Just shows you how much work has been done here.
[1]: https://public-docs.ferrocene.dev/main/qualification/traceab... [2]: https://public-docs.ferrocene.dev/main/specification/index.h...
Disclosure:
My colleagues rock :)
Tracking issue: https://github.com/rust-lang/rust/issues/113527
As part of the certification efforts, we had to write a spec since some description of the language is required. But this spec is a descriptive spec, describing the intended behavior of the language at that point in time - it's mostly distilled from other forms of documenting rustcs behavior, such as the RFCs etc. If there's a divergence between the spec and the compiler, we'll need to investigate whether we uncovered a bug in the spec or in the compiler.
It's not a complete spec, nor does it intend to be. The format it's written is is useful for the certification and documentation effort, but it doesn't cover large chunks that you'd for example need to write second rust compiler implementation. The spec is likely usefor for others, but its Raison d'Être is to serve as a basis for the certification and as such, it will remain limited in scope.
Congrats to everyone involved!
I would have thought the majority of safety critical systems are on bare-metal ARM32.
> For the first iteration we wanted to keep the set of supported targets small and focus on obtaining qualification, so 23.06 will include only support for ARMv8-A. Now that we achieved qualification though, we will work to expand support for other architectures and operative systems (including QNX).
and
> The current target is “bare metal” (aka without libstd) ARMv8-A.
The list of relevant changes to the compiler is the empty set. We wanted to certify the compiler without forking it or restricting the supported language features.
We do build and test some targets to a higher tier level than upstream rust and do have support for custom proprietary targets which the rust project will never support (1), but that makes for a tiny change set. (Measured in literally tens of lines).
Most of Ferrocene is the LTS support and the qualification documentation, both of which upstream has no interest in providing. The documentation also describes our QA process and unless you’ll adopt our procedures, you’ll have to adjust the documentation and then re-certify.
(1) to a large extend because the rust project cannot sign an NDA and support proprietary hardware in its CI.