A System-Level Game Semantics

Abstract

Game semantics is a trace-like denotational semantics for programming languages where the notion of legal observable behaviour of a term is defined combinatorially, by means of rules of a game between the term (the Proponent) and its context (the Opponent). In general, the richer the computational features a language has the less constrained the rules of the semantic game. In this paper we consider the consequences of taking this relaxation of rules to the limit, by granting the Opponent omnipotence, that is, permission to play any move without combinatorial restrictions. However, we impose an epistemic restriction by not granting Opponent omniscience, so that Proponent can have undisclosed secret moves. We introduce a basic C-like programming language and we define such a semantic model for it. We argue that the resulting semantics is an appealingly simple combination of operational and game semantics and we show how certain traces explain system-level attacks, i.e. plausible attacks that are realisable outside of the programming language itself. We also show how allowing Proponent to have secrets ensures that some desirable equivalences in the programming language are preserved.

Compositional CompCert

“…Interestingly, this leakage protocol bears much in common with the system-level semantics of Ghica and Tzevelekos (Ghica and Tzevelekos 2012). There, Ghica and Tzevelekos define a game semantics for a C-like language that avoids imposing so-called combinatorial (i.e., syntactic) restrictions on the moves of the environment, by applying what they call "epistemic" restrictions instead.…”

A Compositional Semantics for Verified Separate Compilation and Linking

“…Then, the pointer pa contains an address which is, in CompCert, not a plain integer, but a pair Vptr(b, o) of the block identifier b and the byte offset o within this block. So, the value of pa is actually Vptr (2,8) whereas pb is Vptr (3, 0). So, the two pointers are not equal, and in fact, pa is not a valid pointer to store to, because the size of the block identifier corresponding to a is 8.…”

“…Ghica and Tzevelekos [8] developed a system-level semantics for composing C-like program modules. They also used external call and return events and used them to model open C-like modules and their environments.…”

On the Learnability of Programming Language Semantics

“…This is not as strange as it seems, because the more features a language has the more unrestricted its interaction with the context can be. In fact it is possible to think of "omnipotent" contexts in which the interactions are not constrained combinatorially [22]. When sequential IA is enriched with parallelism, the alternation constraint disappears and bracketing and visibility are relaxed to the following, more general constraints:…”