Aeneas: Rust verification by functional translation
Aeneas: Rust verification by functional translation
复制标题
Aeneas：通过功能翻译进行 Rust 验证
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Jonathan Protzenko
中科院分区：
文献类型：
--
作者：
Son Ho;Jonathan Protzenko
我们提出了基于轻量化功能翻译的生锈程序的新验证工具链不安全的代码LLBC的纯粹，功能性的语义，一种捕获大量Rust程序的借来的计算。这意味着我们通过基于贷款的语义标准而不是通过基于句型的生命周期来借用，我们声称我们的语义捕获了借用机制的本质，而不是其当前的生物汇编埃涅阿斯（Aeneas）是从llbc转换为纯净的lambda-calculus。 - 终止借用的技术难度，我们依靠一种新方法，在这种方法中，我们在函数呼叫的情况下近似借用图我们的主要案例研究是一种低级的哈希表，我们证明我们的评估链是一个低级别的哈希表，我们证明了功能性的正确性，我们的评估表明了对程序员的验证生产率的显着提高。因此，本文在生锈验证工具链的设计空间中建立了一个新的点，旨在简单地验证生锈程序，并且生锈的时间很长。当已经“免费”的时候，记忆推理！
We present Aeneas, a new verification toolchain for Rust programs based on a lightweight functional translation. We leverage Rust’s rich region-based type system to eliminate memory reasoning for a large class of Rust programs, as long as they do not rely on interior mutability or unsafe code. Doing so, we relieve the proof engineer of the burden of memory-based reasoning, allowing them to instead focus on functional properties of their code. The first contribution of Aeneas is a new approach to borrows and controlled aliasing. We propose a pure, functional semantics for LLBC, a Low-Level Borrow Calculus that captures a large subset of Rust programs. Our semantics is value-based, meaning there is no notion of memory, addresses or pointer arithmetic. Our semantics is also ownership-centric, meaning that we enforce soundness of borrows via a semantic criterion based on loans rather than through a syntactic type-based lifetime discipline. We claim that our semantics captures the essence of the borrow mechanism rather than its current implementation in the Rust compiler. The second contribution of Aeneas is a translation from LLBC to a pure lambda-calculus. This allows the user to reason about the original Rust program through the theorem prover of their choice, and fulfills our promise of enabling lightweight verification of Rust programs. To deal with the well-known technical difficulty of terminating a borrow, we rely on a novel approach, in which we approximate the borrow graph in the presence of function calls. This in turn allows us to perform the translation using a new technical device called backward functions. We implement our toolchain in a mixture of Rust and OCaml; our chief case study is a low-level, resizing hash table, for which we prove functional correctness, the first such result in Rust. Our evaluation shows significant gains of verification productivity for the programmer. This paper therefore establishes a new point in the design space of Rust verification toolchains, one that aims to verify Rust programs simply, and at scale. Rust goes to great lengths to enforce static control of aliasing; the proof engineer should not waste any time on memory reasoning when so much already comes “for free”!
用于大规模系统验证的线性类型
影响因子：
--
作者：
Li, Jialin;Lattuada, Andrea;Zhou, Yi;Cameron, Jonathan;Howell, Jon;Parno, Bryan;Hawblitzel, Chris
通讯作者：
Hawblitzel, Chris