Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Challenge 2: Verify the memory safery of core intrinsics using raw pointers #14

Merged
merged 9 commits into from
Jun 12, 2024
Merged
1 change: 1 addition & 0 deletions doc/src/SUMMARY.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,4 @@

# Challenges
- [Coming soon](./todo.md)
jaisnan marked this conversation as resolved.
Show resolved Hide resolved
- [Memory safety of core intrinsics](./intrinsics-memory.md)
92 changes: 92 additions & 0 deletions doc/src/intrinsics-memory.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
# Challenge 2: Verify the memory safery of core intrinsics using raw pointers

- **Status:** Open
- **Tracking Issue:** *Link to issue*
jaisnan marked this conversation as resolved.
Show resolved Hide resolved
- **Start date:** *YY/MM/DD*
jaisnan marked this conversation as resolved.
Show resolved Hide resolved
- **End date:** *YY/MM/DD*
jaisnan marked this conversation as resolved.
Show resolved Hide resolved

-------------------


## Goal

Annotate Rust core::intrinsics functions that manipulate raw pointers with their safety contract. Verify their usage in the standard library is in fact safe.

jaisnan marked this conversation as resolved.
Show resolved Hide resolved
### Success Criteria

1. All the following intrinsic functions must be annotated with safety contracts.
2. Any fallback intrinsic implementation must be verified.
3. For intrinsics modeled in the tool of choice, explain how their implementation matches the intrinsics definition. This can either be done in the PR description or as an entry to the contest book as part of the “Tools” chapter.
4. For each function, contestants must state clearly the list of assumptions for each proof, how the proofs can be audited, and the list of (implicit and explicit) properties that are guaranteed.
5. The verification of each intrinsic should ensure all the documented safety conditions are met, and that meeting them is enough to guarantee safe usage.


### Functions for verification
jaisnan marked this conversation as resolved.
Show resolved Hide resolved

|Function |Location |
|--- |--- |
|typed_swap | core::intrisics |
|vtable_size| core::intrisics |
|vtable_align| core::intrisics |
|copy_nonoverlapping| core::intrisics |
|copy| core::intrisics |
|write_bytes| core::intrisics |
|size_of_val| core::intrisics |
|arith_offset| core::intrisics |
|volatile_copy_nonoverlapping_memory| core::intrisics |
|volatile_copy_memory| core::intrisics |
|volatile_set_memory| core::intrisics |
|volatile_load| core::intrisics |
|volatile_store| core::intrisics |
|unaligned_volatile_load| core::intrisics |
|unaligned_volatile_store| core::intrisics |
|compare_bytes| core::intrisics |
|min_align_of_val| core::intrisics |
|ptr_offset_from| core::intrisics |
|ptr_offset_from_unsigned| core::intrisics |
|read_via_copy| core::intrisics |
|write_via_move| core::intrisics |
| | |
feliperodri marked this conversation as resolved.
Show resolved Hide resolved



**At least 10 of the following usages of intrinsics were proven safe:**
jaisnan marked this conversation as resolved.
Show resolved Hide resolved

|Function |Location |
|--- |--- |
|copy_from_slice | core::slice |
|parse_u64_into | std::fmt |
|swap | core::mem |
|align_of_val | core::mem |
|zeroed | core::mem::maybe_uninit |
| | |
jaisnan marked this conversation as resolved.
Show resolved Hide resolved
jaisnan marked this conversation as resolved.
Show resolved Hide resolved



**At least 5 unsafe functions that expose those intrinsics are also annotated with safety contracts, and those contracts are verified:**
jaisnan marked this conversation as resolved.
Show resolved Hide resolved

|Function |Location |
|--- |--- |
|copy_from_slice | std::ptr |
|parse_u64_into | std::ptr |
|swap | std::ptr |
|align_of_val | std::ptr |
|zeroed | std::ptr |
| | |
jaisnan marked this conversation as resolved.
Show resolved Hide resolved
jaisnan marked this conversation as resolved.
Show resolved Hide resolved




### List of UBs

All proofs must automatically ensure the absence of the following undefined behaviors [[ref]](https://github.com/rust-lang/reference/blob/142b2ed77d33f37a9973772bd95e6144ed9dce43/src/behavior-considered-undefined.md):

* Invoking undefined behavior via compiler intrinsics.
* Accessing (loading from or storing to) a place that is dangling or based on a misaligned pointer.
* Uninitialized memory
jaisnan marked this conversation as resolved.
Show resolved Hide resolved
* Mutating immutable bytes.
* Producing an invalid value


Note: All solutions to verification challenges need to satisfy the criteria established in the [challenge book](general-rules.md)
in addition to the ones listed above.