Canonical is funding a three-year doctoral research project on the automatic conversion of large C codebases to Rust. AI won’t have free rein in this process: generated code must first demonstrably match the original’s behavior.
The research is being conducted at the University of Bristol and is also supported by UK Research and Innovation (UKRI). The goal is to develop a platform that can convert repositories containing hundreds of thousands of lines of C code into safe, maintainable, and functionally equivalent Rust code.
Combining AI with traditional techniques
According to Canonical, existing translation tools can process large amounts of C code but often adopt the original code’s structure too literally. The result may compile as Rust, but still contain many unsafe constructs and typical C patterns.
Large language models face a different problem. They can convert small pieces of C into convincing Rust code, but struggle with the context of entire repositories. Furthermore, code that looks correct does not automatically mean the program behaves the same way. That is why the research project has opted for a neurosymbolic approach, combining AI with program analysis, testing, and formal methods.
The process consists of four steps. First, a repository is divided into smaller parts, while preserving types, dependencies, and behavior. Next, a language model translates these parts into idiomatic Rust code.
Afterward, techniques such as fuzzing and, where possible, formal equivalence checks verify whether the Rust version exhibits the same behavior as the C code. If discrepancies are found, the system locates the suspected error and attempts to fix it using symbolic program repair techniques. Canonical therefore treats the generated code as unreliable until its functionality has been verified.
AppArmor as a real-world test
AppArmor and snap-confine are used to test the approach on real production software. Both are critical to Ubuntu’s security and involve challenges that rarely arise in small-scale benchmarks, such as platform-dependent behavior, complex build systems, pointer-intensive code, and interactions with the operating system.
Canonical emphasizes that it has no plans to automatically replace the existing versions of AppArmor and snap-confine. The projects serve as test cases to determine whether the porting method also works with mature software.
These kinds of codebases make migration difficult. Years of bug fixes, optimizations, and compatibility choices contain knowledge that is not always documented separately. A complete rewrite could unintentionally lose that behavior, while a switch to Rust could prevent certain categories of memory safety issues.
Professor Meng Wang of the University of Bristol is leading the research, with Dr. Cristina David and Canonical’s Jon Seager serving as co-advisors. Ph.D. candidate Alex Wood is conducting the research. The project will begin later this year and run for three years.
Even if a fully automated C-to-Rust converter proves unfeasible, Canonical expects useful results. Among other things, the research may yield better methods for partitioning large codebases, validating translations, and automatically fixing errors.