Rust Binder prepares to retire its C twin as kernel rewrites move past experiment status

The proposal is blunt. After more than fifteen years in tree, the C Binder IPC driver would be removed once its Rust counterpart is the deployed path, and the people driving that change no longer treat the rewrite as provisional. Carlos Llamas opened the removal series without soft language: "The day has finally come. We are dropping the legacy C implementation of the Binder IPC driver in favor of its Rust version." In parallel, Alistair Francis posted a Rust SPDM requester as new library code aimed at untrusted device authentication, with no C twin presented as the long term plan. Between those poles sits memory management work that makes per VMA locks unconditional so Binder and networking can drop fallback paths. The through line is a change in posture. Rust is no longer only an opt in experiment that coexists with C. In concrete subsystems it is becoming the implementation that wins, with real stakes for maintainership, driver ABI expectations, and how far memory safety rewrites should go inside an established C tree.

Binder is the sharp case because it is mature, widely deployed, and historically painful. Llamas described a driver that for "15+ years" had "grown increasingly complex, making it incredibly painful to maintain and land new features without tripping over vulnerabilities." Alice Ryhl spent years bringing the Rust Binder to full feature parity and, in the removal rationale, to performance that can "match and often beat" the C counterpart, with production Android use already behind it. "Having run successfully on Android devices for some time now, we can no longer call this an "experiment"," Llamas wrote. The series yanks the legacy C sources so that new features and optimizations concentrate on the Rust driver. Ryhl's Acked-by sits on the change. The pitch is maintainability and reduced vulnerability surface first, with measured speed as corroboration rather than the sole justification. Greg Kroah-Hartman is on the thread as the change lands in the broader driver maintainer orbit. Deleting a long standing C IPC path is not a tutorial exercise. It is a claim that the Rust version has absorbed the operational load.

That claim rides on infrastructure that is itself being simplified. Suren Baghdasaryan's series, taking over earlier work from Dave Hansen, makes per VMA locks available in all configs rather than only selected SMP and MMU builds. The primitives underneath (RCU, maple trees, refcounts) already work more widely. The cost is a modestly larger VMA on some !SMP and !MMU builds. The gain is less conditional code in generic callers. "Binder and networking folks: Your code is the target of the cleanups," Baghdasaryan wrote while seeking acks. Andrew Morton pulled the pile in for testing. Discussion quickly touched Binder page lifetime when automated review flagged possible bugs around free and mremap. Ryhl argued the reported use after free was not real: with VM_MIXEDMAP and vm_insert_page the VMA takes a refcount on the page. Llamas agreed the refcount prevents the UAF yet still wanted mremap rejected so pages are not left in limbo outside the shrinker and unusable to Binder. Liam R. Howlett accepted the no UAF reading but stressed that the page is not truly pinned; mremap can relocate it into another VMA. The exchange is ordinary mm rigor, yet it shows the entanglement. C locking generalizations now enable cleaner Binder paths, including Rust ones, and Binder edge cases are being reasoned about across both languages at once.

SPDM illustrates the opposite starting point: new code that begins in Rust because the threat model fits. Francis's series implements a requester for authentication and attestation over transports such as PCIe. Devices are untrusted until verified. The specification is long and complex. "As such we have the kernel parsing untrusted responses from a complex specification, which sounds like a possible exploit vector. This is the type of place where Rust excels!" he wrote. The explicit goal is "the smallest possible SPDM implementation upstream" as building blocks: enough to negotiate, challenge, and report authenticated status, without yet handing full evidence to userspace or adding post quantum options. Some C support pieces travel with the series where required, but the requester is Rust first.

Review has been domain careful rather than language tribal. Jonathan Cameron supplied Reviewed-by tags under the standing caveat "as a non rust person," then paused on the CHALLENGE path: "I probably need to come at this with fresh eyes as I struggled to align the generation of what was being signed with the spec." Francis welcomed the protocol scrutiny, added crypto commentary, and kept seeking Rust reviewers for lifetime and interop details while C callbacks for certificate validation and signature checking remain in the unsafe boundary. The practical tension is clear. Subsystem owners must still vouch for specification correctness when they are not fluent in Rust idioms, and authors must keep the C facing edges auditable.

What unites the threads is a redefinition of success. Parity is no longer the finish line. Deleting the C predecessor, or never shipping one, is. That surfaces questions the experiment phase deferred. Who maintains a Rust only Binder when historical Android C expertise rotates? What does the driver facing contract mean for trees and users that still expected a C module? How much untrusted parsing surface should move to Rust before social and tooling assumptions of a C centric tree strain? The per VMA lock work offers one constructive pattern: shared C infrastructure generalized so every caller gets simpler APIs. Binder removal and the SPDM library offer another: once a Rust path carries production load or matches an exploit shaped threat model, keeping the C twin looks like liability more than insurance.

None of it is fully closed. The Binder deletion is a strongly backed proposal, not a universal merged fact across every config and downstream. The SPDM series is still under iteration for protocol alignment and deeper Rust review. Unconditional VMA locks are in testing, with size tradeoffs on niche builds left for later optimization. The larger argument is only opening: whether memory safety rewrites stay confined to new drivers and isolated libraries, or continue until mature C components with painful vulnerability histories are retired when a Rust replacement reaches parity. For the moment the kernel is deciding case by case. Binder is the first high profile deletion candidate. SPDM is a template for Rust first parsing of untrusted device data. The experiment label is fading. What replaces it will be written in the remaining merge and maintenance debates.