Gillian: A Multi-Language Platform for Unified Symbolic Analysis

Abstract

This is an evolving document describing the meta-theory, the implementation, and the instantiations of Gillian, a multi-language symbolic analysis platform.The set of GIL values, ∈ Val, contains numbers, strings, booleans, uninterpreted symbols 1 , simple types (e.g. types for numbers, strings, booleans and lists), function identifiers, and lists of values. The set of GIL expressions, ∈ Expr, contains values, program variables, and various unary and binary operators such as those used for number, string, boolean, and list manipulation. The set of GIL symbolic expressions, ˆ ∈ Êxpr, is constructed in the same way as for GIL expressions, except that it is built from symbolic variables, ˆ ∈ X, instead of program variables, and we assume it contains the standard set of symbolic Boolean expressions.GIL commands, ∈ Cmd , contain variable assignment, conditional goto, procedure call, memory actions, commands for allocation of uninterpreted and interpreted symbols, function return, error termination and path cutting. Their semantics will be explained in more detail in §2.5. A GIL procedure, ( ){ }, comprises an identifier ∈ F , a formal parameter 2 , and a body given by a list of commands . A GIL program is a set of GIL procedures. Execution Memory ModelsThe execution memory models defined below are designed for whole-program execution. They differ from those introduced in [4] in that they unify the concrete and symbolic memory models of [4] and also introduce memory well-formedness. An execution memory model is parametric on a value set, V ∈ v, and an action set, ∈ . The value set must contain the GIL values: that is, Val ⊆ V. We distinguish the Boolean value set, Π ⊂ V, and refer to ∈ Π as a context. For example, for concrete execution, the contexts are the Booleans true and false whereas, for symbolic execution, they are Boolean symbolic expressions such as ˆ ∧ ˆ .1 Uninterpreted symbols can be used to represent, for example, memory locations, given by a dedicated subset L ⊂ US , or TL-specific constants. 2 Without loss of generality, we describe one-parameter procedures for convenience in the Gillian theory, using multiple parameters in the Gillian implementation.

A Formal CHERI-C Semantics for Verification

“…Then we observe that (H, W C f , ea C ) forms an execution memory model. We note that Properties 3.1 and 3.2 in [29] are satisfied, and Property 3.6 is trivial in that operations that return errors do not return an updated heap. We also note that the memory model also conforms to a compositional memory model, as we have the PCM (H, ⊎, µ 0 ) along with the well-formedness property being compositioncompatible.…”

“…So far, CompCert C and JavaScript have both been instantiated for Gillian, giving birth to Gillian-C and Gillian-JS. The underlying theoretical foundation of Gillian has its essential correctness properties like soundness and completeness already proven [20,29]. Thus, users who instantiate the tool only need to prove the correctness of the implementation of their compiler and memory models to ensure the correctness of the entire tool.…”

“…The executional memory model states properties a memory model must have for whole-program execution, and the compositional memory model states properties a memory model must have for separation logic based symbolic verification. Each paper in the Gillian literature states slightly different definitions for the memory models [20,28,29,37]-in Definitions 1 and 2 below, we present unified, consistent definitions for each of the memory model properties. We ignore contexts, as there exists only one context in concrete memories, which is the GIL boolean value true.…”

“…First, we note that for concrete execution, Gillian also uses the return type R in the action execution function ea. 4 For W f defined in Definition 1, the main properties that must be satisfied are Properties 3.1, 3.2, and 3.6 in [29].…”

Low-Level Bi-Abduction

“…Finally, we mention the Gillian project, a language-independent framework based on separation logic for the development of compositional symbolic analysis tools, including tools for whole-program symbolic execution, verification of annotated code, as well as bi-abduction [35,34,29,28]. The works on Gillian concentrate on the generic framework it develops, and the published description of the supported bi-abductive analysis, perhaps most discussed in [34], is unfortunately not very detailed.…”