A Hybrid Approach to Semi-automated Rust Verification (2403.15122v3)

Abstract: We propose a hybrid approach to end-to-end Rust verification where the proof effort is split into powerful automated verification of safe Rust and targeted semi-automated verification of unsafe Rust. To this end, we present Gillian-Rust, a proof-of-concept semi-automated verification tool built on top of the Gillian platform that can reason about type safety and functional correctness of unsafe code. Gillian-Rust automates a rich separation logic for real-world Rust, embedding the lifetime logic of RustBelt and the parametric prophecies of RustHornBelt, and is able to verify real-world Rust standard library code with only minor annotations and with verification times orders of magnitude faster than those of comparable tools. We link Gillian-Rust with Creusot, a state-of-the-art verifier for safe Rust, by providing a systematic encoding of unsafe code specifications that Creusot can use but cannot verify, demonstrating the feasibility of our hybrid approach.

• The paper introduces Gillian-Rust, a novel tool that semi-automatically verifies unsafe Rust code using parametric separation logic.
• It integrates Creusot’s verification for safe Rust, aligning specifications to prove assertions in mixed-codebases.
• The approach leverages a hybrid symbolic heap model and automated lifetime tracking to manage mutable borrows and complex memory operations.

A Hybrid Approach to Semi-Automated Rust Verification

The paper "A hybrid approach to semi-automated Rust verification" explores a promising methodology for the verification of Rust programs, particularly focusing on those that include 'unsafe' code segments. Unlike many existing tools that primarily cater to verifying safe Rust, this hybrid approach leverages the unique constructs of the Rust language to facilitate a more thorough and automated verification process for both safe and unsafe code segments.

Rust is increasingly adopted in system programming due to its guarantees of memory safety and performance efficiency, attributes primarily supported by its ownership type system and borrow checker. However, the verification of unsafe Rust code, which is often used for system-level programming and requires careful management due to operations like raw pointer dereferencing and potential undefined behaviors, remains a challenging area that necessitates more robust verification strategies.

Gillian-Rust: A Novel Verification Tool

The paper introduces Gillian-Rust, a semi-automated verification tool built upon the Gillian platform. This tool integrates powerful automated verification technologies, specifically targeting the 'unsafe' segments of Rust code. Gillian-Rust is capable of reasoning about type safety and functional correctness by leveraging a parametric separation logic, which is essential for handling complex unsafe operations. It builds upon the lifetime logic of RustBelt and RustHornBelt's introduction of parametric prophecies, aiming to provide a scalable and user-friendly approach to verifying real-world Rust code.

Through its integration with Creusot, a leading verifier for safe Rust, Gillian-Rust aligns specifications for unsafe code that Creusot may describe but not verify. This connection demonstrates the viability of this hybrid approach, allowing for end-to-end verification of Rust programs.

Key Challenges and Solutions

The paper identifies and addresses critical challenges such as:

1. Alignment of Safe and Unsafe Code Verification: Rust verification tools like Creusot may efficiently handle safe code but often fall short with unsafe code. Gillian-Rust overcomes this by encoding Creusot specifications into its assertion language and proving those assertions using separation logic.
2. Real-World Rust Memory Model: Unlike traditional memory models, Rust's needs were met through a hybrid symbolic heap representation, enabling efficient automated reasoning and supporting pointer arithmetic without locking into particular memory layouts.
3. Combating Lifetimes and Mutable Borrows: Gillian-Rust ingeniously adopts a symbolic execution environment enhanced with lifetime contexts and guarded predicates, facilitating automatic operations on mutable borrows without manual intervention. This automation significantly eases the proof process.

Implications and Future Developments

The Gillian-Rust tool represents a significant move toward scalable verification of Rust programs that use unsafe code blocks. By bridging the gap between the abstract, streamlined verification of safe code and the rigorous, detail-oriented analysis required for unsafe code, it paves the way for more inclusive verification practices in Rust programming.

Future work may focus on extending the current capabilities to encompass more Rust features, sharpening the automation of specification translation, and further integrating concurrency and shared references. Formal verification of these tools ensures foundational accuracy and soundness, especially as Rust's role in critical systems grows.

In conclusion, this hybrid approach to Rust verification embodies a structured, technical methodology, addressing both theoretical and practical challenges faced in the domain. This integration fosters a flexible yet powerful environment for developers to safely and efficiently harness Rust's full potential, particularly in system-level and performance-critical applications.