Rust is a systems programming language that runs blazingly fast, - - PowerPoint PPT Presentation

▶
rust is a systems programming language that runs
SMART_READER_LITE
LIVE PREVIEW

Rust is a systems programming language that runs blazingly fast, - - PowerPoint PPT Presentation

Oct 30, 2023 133 likes •1.06k views

slide-1
SLIDE 1

RUST DISTILLED:

AN EXPRESSIVE TOWER OF LANGUAGES

Aaron Weiss, Daniel Patterson, Amal Ahmed Northeastern University and Inria Paris

slide-2
SLIDE 2

“

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. – the official Rust website

slide-3
SLIDE 3

“

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. – the official Rust website systems programming

slide-4
SLIDE 4

“

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. – the official Rust website blazingly fast

slide-5
SLIDE 5

“

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. – the official Rust website prevents segfaults, guarantees thread safety.

slide-6
SLIDE 6

Memory safety without garbage collection Abstraction without overhead Concurrency without data races Stability without stagnation

Hack without fear.

slide-7
SLIDE 7

WE HAVE CUTE CRABS

slide-8
SLIDE 8

... BUT HOW?

slide-9
SLIDE 9

... BUT HOW? Ownership x y z

identifiers "own" values

slide-10
SLIDE 10

... BUT HOW? Borrowing x y z &x

references "borrow" values

Ownership x y z

identifiers "own" values

slide-11
SLIDE 11

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; }

slide-12
SLIDE 12

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; }

slide-13
SLIDE 13

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; }

slide-14
SLIDE 14

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; }

slide-15
SLIDE 15

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; }

slide-16
SLIDE 16

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; }

slide-17
SLIDE 17

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; } &config

slide-18
SLIDE 18

A PROGRAM IN RUST

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; } client

slide-19
SLIDE 19
slide-20
SLIDE 20

ελλάδα

⊢

γεια

⊢

slide-21
SLIDE 21

THE CURRENT STATE OF AFFAIRS

slide-22
SLIDE 22

THE CURRENT STATE OF AFFAIRS

interprocedural static analysis with ad-hoc constraint solving

RUST

slide-23
SLIDE 23

THE CURRENT STATE OF AFFAIRS

interprocedural static analysis with ad-hoc constraint solving

RUST RUSTBELT (JUNG, JOURDAN, KREBBERS, AND DREYER, POPL '18)

formal language specified in Iris but low-level, in a CPS-style.

slide-24
SLIDE 24

BUT WE WANT TO DO BETTER

slide-25
SLIDE 25

BUT WE WANT TO DO BETTER

slide-26
SLIDE 26

CAPABILITIES FOR OWNERSHIP x y z

slide-27
SLIDE 27

CAPABILITIES FOR OWNERSHIP x y z capabilities guard the use of identifiers

slide-28
SLIDE 28

BORROWS BREAK CAPABILITIES INTO FRACTIONS x y z

slide-29
SLIDE 29

BORROWS BREAK CAPABILITIES INTO FRACTIONS x y z &x

slide-30
SLIDE 30

BORROWS BREAK CAPABILITIES INTO FRACTIONS x y z &x

slide-31
SLIDE 31

BORROWS BREAK CAPABILITIES INTO FRACTIONS x y z &x

&mut z

slide-32
SLIDE 32

BORROWS BREAK CAPABILITIES INTO FRACTIONS x y z &x

&mut z

slide-33
SLIDE 33

MOVES TAKE THE CAPABILITY AND THE HOLE x y z &x

&mut z

slide-34
SLIDE 34

MOVES TAKE THE CAPABILITY AND THE HOLE x y z &x

&mut z

w

slide-35
SLIDE 35

WE CALL REFERENCE SITES LOANS

extern crate irc; use irc:;client:;prelude:;*; fn main() -? irc:;error:;Result<()> { let config = Config {../}; let mut reactor = IrcReactor:;new()?; let client = reactor.prepare_client_and_connect(&config)?; client.identify()?; reactor.register_client_with_handler(client, |client, message| { print!("{}", message); Ok(()) }); reactor.run()?; } &config

a loan

slide-36
SLIDE 36

WHAT ABOUT LIFETIMES?

slide-37
SLIDE 37

WHAT ABOUT LIFETIMES? x : u32

slide-38
SLIDE 38

WHAT ABOUT LIFETIMES? x : u32 &x : &'x u32

slide-39
SLIDE 39

WHAT ABOUT LIFETIMES?

To keep type-checking tractable, regions correspond to sets of loans.

x : u32 &x : &'x u32

slide-40
SLIDE 40

TYPE CHECKING

slide-41
SLIDE 41

TYPE CHECKING

Σ

global context

slide-42
SLIDE 42

TYPE CHECKING

Σ; Δ

global context type variable context

slide-43
SLIDE 43

TYPE CHECKING

Σ; Δ; Γ

global context type variable context variable context

slide-44
SLIDE 44

TYPE CHECKING

Σ; Δ; Γ; L

global context type variable context variable context loan context

slide-45
SLIDE 45

TYPE CHECKING

Σ; Δ; Γ; L; P

global context type variable context variable context loan context region context

slide-46
SLIDE 46

TYPE CHECKING

Σ; Δ; Γ; L; P ⊢ e

global context type variable context variable context loan context region context

slide-47
SLIDE 47

TYPE CHECKING

Σ; Δ; Γ; L; P ⊢ e: τ

global context type variable context variable context loan context region context

slide-48
SLIDE 48

TYPE CHECKING

Σ; Δ; Γ; L; P ⊢ e: τ ⇒ ε

global context type variable context variable context loan context region context

  • wnership effects
slide-49
SLIDE 49

TYPING BORROWS Γ, x :f τ; L; P ⊢ &'

a x :

Σ; Δ;

slide-50
SLIDE 50

TYPING BORROWS f ≠ 0 Γ, x :f τ; L; P ⊢ &'

a x :

Σ; Δ;

slide-51
SLIDE 51

TYPING BORROWS f ≠ 0 Γ, x :f τ; L; P ⊢ &'

a x : &{ ' a } τ

Σ; Δ;

slide-52
SLIDE 52

TYPING BORROWS f ≠ 0 Γ, x :f τ; L; P ⊢ &'

a x :

⇒ borrow imm x as '

a

&{ ' a } τ

Σ; Δ;

slide-53
SLIDE 53

TYPING BRANCHING Σ; Δ; Γ; L; P ⊢ if { } else { } e1 e2 e3 : Σ; Δ;

slide-54
SLIDE 54

TYPING BRANCHING Σ; Δ; Γ; L; P ⊢ if { } else { } e1 e2 e3 : Σ; Δ; Σ; Δ; Γ; L; P ⊢ e1 : bool ⇒ ε1 Σ; Δ;

slide-55
SLIDE 55

TYPING BRANCHING Σ; Δ; Γ; L; P ⊢ if { } else { } e1 e2 e3 : Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e2 : τ2 ⇒ ε2 Σ; Δ; Σ; Δ; Γ; L; P ⊢ e1 : bool ⇒ ε1 Σ; Δ;

slide-56
SLIDE 56

TYPING BRANCHING Σ; Δ; Γ; L; P ⊢ if { } else { } e1 e2 e3 : Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e2 : τ2 ⇒ ε2 Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e3 : τ3 ⇒ ε3 Σ; Δ; Σ; Δ; Γ; L; P ⊢ e1 : bool ⇒ ε1 Σ; Δ;

slide-57
SLIDE 57

TYPING BRANCHING Σ; Δ; Γ; L; P ⊢ if { } else { } e1 e2 e3 : τ2 ∼ τ3 ⇒ τ Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e2 : τ2 ⇒ ε2 Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e3 : τ3 ⇒ ε3 Σ; Δ; Σ; Δ; Γ; L; P ⊢ e1 : bool ⇒ ε1 Σ; Δ;

slide-58
SLIDE 58

TYPING BRANCHING Σ; Δ; Γ; L; P ⊢ if { } else { } e1 e2 e3 : τ2 ∼ τ3 ⇒ τ τ Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e2 : τ2 ⇒ ε2 Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e3 : τ3 ⇒ ε3 Σ; Δ; Σ; Δ; Γ; L; P ⊢ e1 : bool ⇒ ε1 Σ; Δ;

slide-59
SLIDE 59

TYPING BRANCHING Σ; Δ; Γ; L; P ⊢ if { } else { } e1 e2 e3 : τ2 ∼ τ3 ⇒ τ τ ⇒ ε1, ε2, ε3 Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e2 : τ2 ⇒ ε2 Σ; Δ; Σ; Δ; ε1(Γ); ε1(L); ε1(P) ⊢ e3 : τ3 ⇒ ε3 Σ; Δ; Σ; Δ; Γ; L; P ⊢ e1 : bool ⇒ ε1 Σ; Δ;

slide-60
SLIDE 60

WE MODEL...

slide-61
SLIDE 61

WE MODEL...

struct Point { x: u32, y: u32 }

slide-62
SLIDE 62

WE MODEL...

struct Point { x: u32, y: u32 } enum Option<T> { Some(T), None }

slide-63
SLIDE 63

WE MODEL...

struct Point { x: u32, y: u32 } enum Option<T> { Some(T), None } if { } else { }

e1 e2 e3

slide-64
SLIDE 64

WE MODEL...

struct Point { x: u32, y: u32 } enum Option<T> { Some(T), None } if { } else { }

e1 e2 e3

|x: u32| { x + x }

slide-65
SLIDE 65

WE MODEL...

struct Point { x: u32, y: u32 } enum Option<T> { Some(T), None } if { } else { }

e1 e2 e3

|x: u32| { x + x } match opt { Some(x) =? x, None =? 42, }

slide-66
SLIDE 66

WE DO NOT MODEL...

slide-67
SLIDE 67

WE DO NOT MODEL...

trait Read { ../ }

slide-68
SLIDE 68

WE DO NOT MODEL...

trait Read { ../ } Box:;new(Counter:;new()).count()⇝ Box:;new(Counter:;new()).deref().count()

slide-69
SLIDE 69

WE DO NOT MODEL...

trait Read { ../ } Box:;new(Counter:;new()).count()⇝ Box:;new(Counter:;new()).deref().count() (&foo).frobnicate() ⇝ let tmp = &foo; tmp.frobnicate()

slide-70
SLIDE 70

A TOWER OF LANGUAGES

slide-71
SLIDE 71

A TOWER OF LANGUAGES

Oxide0

"safe" Rust

slide-72
SLIDE 72

A TOWER OF LANGUAGES

Oxide0 Oxide1

Heap Allocation "safe" Rust

slide-73
SLIDE 73

A TOWER OF LANGUAGES

Oxide0 Oxide1 Oxide2

Shared Memory Heap Allocation "safe" Rust

slide-74
SLIDE 74

A TOWER OF LANGUAGES

Oxide0 Oxide1 Oxide2 Oxide3

Interior Mutability Shared Memory Heap Allocation "safe" Rust

slide-75
SLIDE 75

A TOWER OF LANGUAGES

Oxide0 Oxide1 Oxide2 Oxide3

Interior Mutability Shared Memory Heap Allocation "safe" Rust

slide-76
SLIDE 76

AN EXPRESSIVE TOWER OF EXPRESSIVE POWER

Expressive power is rooted in observational equivalence.

e1 e2

(Felleisen '90)

slide-77
SLIDE 77

AN EXPRESSIVE TOWER OF EXPRESSIVE POWER

Each new abstraction raises the expressive power by adding functionality that cannot be observed in lower levels

Expressive power is rooted in observational equivalence.

e1 e2

(Felleisen '90)

slide-78
SLIDE 78

AN EXPRESSIVE TOWER OF EXPRESSIVE POWER

Each new abstraction raises the expressive power by adding functionality that cannot be observed in lower levels

Expressive power is rooted in observational equivalence.

e1 e2

∀

C

,

(Felleisen '90)

slide-79
SLIDE 79

C C

AN EXPRESSIVE TOWER OF EXPRESSIVE POWER

Each new abstraction raises the expressive power by adding functionality that cannot be observed in lower levels

Expressive power is rooted in observational equivalence.

e1 e2

∀

C

,

(Felleisen '90)

slide-80
SLIDE 80

C C

AN EXPRESSIVE TOWER OF EXPRESSIVE POWER

Each new abstraction raises the expressive power by adding functionality that cannot be observed in lower levels

Expressive power is rooted in observational equivalence.

e1 e2

⇓ ⇓

∀

C

,

(Felleisen '90)

slide-81
SLIDE 81

v C C

AN EXPRESSIVE TOWER OF EXPRESSIVE POWER

Each new abstraction raises the expressive power by adding functionality that cannot be observed in lower levels

Expressive power is rooted in observational equivalence.

e1 e2

⇓ ⇓

v

∀

C

,

=

(Felleisen '90)

slide-82
SLIDE 82

NEXT STEPS

slide-83
SLIDE 83

NEXT STEPS

ελλάδα

⊢

γεια

⊢

More formalization...

slide-84
SLIDE 84

NEXT STEPS

ελλάδα

⊢

γεια

⊢

More formalization...

Rust-to-Oxide Compiler

Rust Oxide

⇝

slide-85
SLIDE 85

A RUSTY FUTURE

slide-86
SLIDE 86

A RUSTY FUTURE

Π Σ

Language Extensions

slide-87
SLIDE 87

A RUSTY FUTURE

Π Σ

Language Extensions

Rust OCaml

Safe Interoperability

Gallina

slide-88
SLIDE 88

A RUSTY FUTURE

Π Σ

Language Extensions

Rust OCaml

Safe Interoperability

Gallina

U n s a f e C

  • d

e G u i d e l i n e s

What unsafe code is safe to write?

slide-89
SLIDE 89

TAKEAWAYS x y z &x

&mut z

w

slide-90
SLIDE 90

TAKEAWAYS x y z &x

&mut z

w

Ownership with fractional capabilities

slide-91
SLIDE 91

TAKEAWAYS x y z &x

&mut z

w

Moves never return their capability Ownership with fractional capabilities

slide-92
SLIDE 92

TAKEAWAYS x y z &x

&mut z

w

Moves never return their capability Ownership with fractional capabilities 'x R e g i

  • n

s a r e s e t s

  • f

l

  • a

n s