A hybrid approach to semi-automated Rust verification (2403.15122v1)

Abstract: While recent years have been witness to a large body of work on efficient and automated verification of safe Rust code, enabled by the rich guarantees of the Rust type system, much less progress has been made on reasoning about unsafe code due to its unique complexities. We propose a hybrid approach to end-to-end Rust verification in which powerful automated verification of safe Rust is combined with targeted semi-automated verification of unsafe~Rust. To this end, we present Gillian-Rust, a proof-of-concept semi-automated verification tool that is able to reason about type safety and functional correctness of unsafe~code. Built on top of the Gillian parametric compositional verification platform, Gillian-Rust automates a rich separation logic for real-world Rust, embedding the lifetime logic of RustBelt and the parametric propheciees of RustHornBelt. Using the unique extensibility of Gillian, our novel encoding of these features is fine-tuned to maximise automation and exposes a user-friendly API, allowing for low-effort verification of unsafe code. We link Gillian-Rust with Creusot, a state-of-the-art verifier for safe Rust, by providing a systematic encoding of unsafe code specifications that Creusot may use but not verify, demonstrating the feasibility of our hybrid~approach.

• The paper introduces Gillian-Rust, a novel tool that semi-automatically verifies unsafe Rust code using parametric separation logic.
• It integrates Creusot’s verification for safe Rust, aligning specifications to prove assertions in mixed-codebases.
• The approach leverages a hybrid symbolic heap model and automated lifetime tracking to manage mutable borrows and complex memory operations.

A Hybrid Approach to Semi-Automated Rust Verification

The paper "A hybrid approach to semi-automated Rust verification" explores a promising methodology for the verification of Rust programs, particularly focusing on those that include 'unsafe' code segments. Unlike many existing tools that primarily cater to verifying safe Rust, this hybrid approach leverages the unique constructs of the Rust language to facilitate a more thorough and automated verification process for both safe and unsafe code segments.

Rust is increasingly adopted in system programming due to its guarantees of memory safety and performance efficiency, attributes primarily supported by its ownership type system and borrow checker. However, the verification of unsafe Rust code, which is often used for system-level programming and requires careful management due to operations like raw pointer dereferencing and potential undefined behaviors, remains a challenging area that necessitates more robust verification strategies.

Gillian-Rust: A Novel Verification Tool

The paper introduces Gillian-Rust, a semi-automated verification tool built upon the Gillian platform. This tool integrates powerful automated verification technologies, specifically targeting the 'unsafe' segments of Rust code. Gillian-Rust is capable of reasoning about type safety and functional correctness by leveraging a parametric separation logic, which is essential for handling complex unsafe operations. It builds upon the lifetime logic of RustBelt and RustHornBelt's introduction of parametric prophecies, aiming to provide a scalable and user-friendly approach to verifying real-world Rust code.

Through its integration with Creusot, a leading verifier for safe Rust, Gillian-Rust aligns specifications for unsafe code that Creusot may describe but not verify. This connection demonstrates the viability of this hybrid approach, allowing for end-to-end verification of Rust programs.

Key Challenges and Solutions

The paper identifies and addresses critical challenges such as:

1. Alignment of Safe and Unsafe Code Verification: Rust verification tools like Creusot may efficiently handle safe code but often fall short with unsafe code. Gillian-Rust overcomes this by encoding Creusot specifications into its assertion language and proving those assertions using separation logic.
2. Real-World Rust Memory Model: Unlike traditional memory models, Rust's needs were met through a hybrid symbolic heap representation, enabling efficient automated reasoning and supporting pointer arithmetic without locking into particular memory layouts.
3. Combating Lifetimes and Mutable Borrows: Gillian-Rust ingeniously adopts a symbolic execution environment enhanced with lifetime contexts and guarded predicates, facilitating automatic operations on mutable borrows without manual intervention. This automation significantly eases the proof process.

Implications and Future Developments

The Gillian-Rust tool represents a significant move toward scalable verification of Rust programs that use unsafe code blocks. By bridging the gap between the abstract, streamlined verification of safe code and the rigorous, detail-oriented analysis required for unsafe code, it paves the way for more inclusive verification practices in Rust programming.

Future work may focus on extending the current capabilities to encompass more Rust features, sharpening the automation of specification translation, and further integrating concurrency and shared references. Formal verification of these tools ensures foundational accuracy and soundness, especially as Rust's role in critical systems grows.

In conclusion, this hybrid approach to Rust verification embodies a structured, technical methodology, addressing both theoretical and practical challenges faced in the domain. This integration fosters a flexible yet powerful environment for developers to safely and efficiently harness Rust's full potential, particularly in system-level and performance-critical applications.