Gillian, part i: a multi-language platform for symbolic execution

Abstract

We introduce Gillian, a platform for developing symbolic analysis tools for programming languages. Here, we focus on the symbolic execution engine at the heart of Gillian, which is parametric on the memory model of the target language. We give a formal description of the symbolic analysis and a modular implementation that closely follows this description. We prove a parametric soundness result, introducing restriction on abstract states, which generalises path conditions used in classical symbolic execution. We instantiate Gillian to obtain trusted symbolic testing tools for JavaScript and C, and use these tools to find bugs in real-world code, thus demonstrating the viability of our parametric approach. CCS Concepts: • Theory of computation → Program analysis; Program semantics; • Software and its engineering → Formal language definitions.

A Formal CHERI-C Semantics for Verification

“…In this section, we explain how we use the theory provided above to create a verified, executable instance of the memory model. We then explain how this executable model can be used to instantiate a tool called Gillian [20]. Using the instantiated tool, we demonstrate the concrete execution of CHERI-C programs with the desired behaviour.…”

“…So far, CompCert C and JavaScript have both been instantiated for Gillian, giving birth to Gillian-C and Gillian-JS. The underlying theoretical foundation of Gillian has its essential correctness properties like soundness and completeness already proven [20,29]. Thus, users who instantiate the tool only need to prove the correctness of the implementation of their compiler and memory models to ensure the correctness of the entire tool.…”

“…The executional memory model states properties a memory model must have for whole-program execution, and the compositional memory model states properties a memory model must have for separation logic based symbolic verification. Each paper in the Gillian literature states slightly different definitions for the memory models [20,28,29,37]-in Definitions 1 and 2 below, we present unified, consistent definitions for each of the memory model properties. We ignore contexts, as there exists only one context in concrete memories, which is the GIL boolean value true.…”

“…We then show, in Sect. 4.2, the practical aspects of this work by providing the memory model to, and thereby instantiating, Gillian [20], a general, parametric verifica-tion framework that supports concrete and symbolic execution and verification based on separation logic, backed by rich correctness properties. In Sect.…”

Deductive Verification via the Debug Adapter Protocol

“…The simple, semi-formal model below omits inessential details of realistic languages (e.g., memory, see [2,5,8,11] here for details). The key point is that the ideas presented here translate to any formal system that can be described by a symbolic structural operational semantics [15].…”