一句话：通过类型导向翻译与基于 split tree 的静态分析，把结构化 C 子集编译为不使用 unsafe 的安全 Rust。
许多关键代码仍以 C 编写，但已有的 C 到 Rust 自动翻译工具往往依赖 unsafe 特性，从而丧失 Rust 的内存安全保证。本文主张一种增量式迁移路线：程序员先在原始 C 上逐步重构，使代码更加结构化，直至符合编译到安全 Rust 的条件，这样重写可在既有测试与生产环境中增量评估。为支撑该路线，作者提出四项技术：从 C 子集到安全 Rust 的类型导向翻译；基于“split trees”的新型静态分析，用 Rust 的切片与分割操作表达 C 的指针算术；推断哪些借用需要可变的分析；以及与 Rust 非拥有/拥有分配区分相兼容的 C 指针类型编译策略。作者在真实密码库、二进制解析器与序列化器以及文件压缩库上进行评估，表明只需对原 C 代码做小幅重构即可得到性能相近的 Rust 代码，并在 bzip2 与微软 FrodoKEM 实现中发现并报告了未定义行为。
The popularity of the Rust language continues to explode; yet, many critical codebases remain authored in C. Automatically translating C to Rust is thus an appealing course of action. Several works have gone down this path, handling an ever-increasing subset of C through a variety of Rust features, such as unsafe. While the prospect of automation is appealing, producing code that relies on unsafe negates the memory safety guarantees offered by Rust, and therefore the main advantages of porting existing codebases to memory-safe languages. We instead advocate for a different approach, where the programmer iterates on the original C, gradually making the code more structured until it becomes eligible for compilation to safe Rust. This means that redesigns and rewrites can be evaluated incrementally for performance and correctness against existing test suites and production environments. Compiling structured C to safe Rust relies on the following contributions: a type-directed translation from (a subset of) C to safe Rust; a novel static analysis based on “split trees” which allows expressing C’s pointer arithmetic using Rust’s slices and splitting operations; an analysis that infers which borrows need to be mutable; and a compilation strategy for C pointer types that is compatible with Rust’s distinction between non-owned and owned allocations. We evaluate our approach on real-world cryptographic libraries, binary parsers and serializers, and a file compression library. We show that these can be rewritten to Rust with small refactors of the original C code, and that the resulting Rust code exhibits similar performance characteristics as the original C code. As part of our translation process, we also identify and report undefined behaviors in the bzip2 compression library and in Microsoft’s implementation of the FrodoKEM cryptographic primitive.
@article{paperbot3785,
title = {Scylla: Translating an Applicative Subset of C to Safe Rust},
author = {Aymeric Fromherz and Jonathan Protzenko},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798229}
}