Tracking Heaps that Hop with Heap-Hop Jules Villard 1 , 3 tienne - PowerPoint PPT Presentation

Tracking Heaps that Hop with Heap-Hop Jules Villard 1 , 3 Étienne Lozes 2 , 3 Cristiano Calcagno 4 , 5 1 Queen Mary, University of London 2 RWTH Aachen, Germany 3 LSV, ENS Cachan, CNRS 4 Monoidics, Inc. 5 Imperial College, London

Message Passing in Multicore Systems ● Hard to write sequential programs that are both correct and efficient Introduction ● Concurrency  / 

Message Passing in Multicore Systems ● Hard to write sequential programs that are both correct and efficient ● Hard to write concurrent programs that are both/either correct and/or efficient Introduction ● Concurrency  / 

Message Passing in Multicore Systems ● Hard to write sequential programs that are both correct and efficient ● Hard to write concurrent programs that are both/either correct and/or efficient ● Paradigm: message passing over a shared memory ● Leads to efficient , copyless message passing ● May be more error-prone (than message passing with copies) Introduction ● Concurrency  / 

To Copy or not to Copy? Copyful data d send(struct,e,data); d = receive(struct,f); ● ( e , f ) : channel ● data points to a big struct ● struct : type of message Introduction ● Concurrency  / 

To Copy or not to Copy? Copyful data d send(struct,e,data); d = receive(struct,f); ● ( e , f ) : channel ● data points to a big struct ● struct : type of message Introduction ● Concurrency  / 

To Copy or not to Copy? Copyful data d send(struct,e,data); d = receive(struct,f); Copyless data d send(pointer,e,data); d = receive(pointer,f); Introduction ● Concurrency  / 

To Copy or not to Copy? Copyful data d send(struct,e,data); d = receive(struct,f); Copyless data d send(pointer,e,data); d = receive(pointer,f); Introduction ● Concurrency  / 

To Copy or not to Copy? Copyful data d send(struct,e,data); d = receive(struct,f); Copyless Race! data d send(pointer,e,data); d = receive(pointer,f); dispose(data); dispose(d); Introduction ● Concurrency  / 

To Copy or not to Copy? Copyful data d send(struct,e,data); d = receive(struct,f); Copyless Race! data d send(pointer,e,data); d = receive(pointer,f); dispose(data); dispose(d); Introduction ● Concurrency  / 

To Copy or not to Copy? Copyful data d send(struct,e,data); d = receive(struct,f); Copyless No race data d send(pointer,e,data); d = receive(pointer,f); dispose(d); Introduction ● Concurrency  / 

Singularity OS Singularity: a research project and an operating system. ● No hardware memory protection p 1 ● Sing ♯ language ● Isolation is verified at compile time ● Invariant: each memory cell is owned p 2 p 3 by at most one thread ● No shared resources memory ● Copyless message passing Introduction ● Concurrency  / 

Singularity OS Singularity: a research project and an operating system. ● No hardware memory protection p 1 ● Sing ♯ language ● Isolation is verified at compile time ● Invariant: each memory cell is owned p 2 p 3 by at most one thread ● No shared resources memory ● Copyless message passing Introduction ● Concurrency  / 

Singularity Channels [Fähndrich et al. ’06] ● Channels are bidirectional and asynchronous channel = pair of FIFO queues ● Channels are made of two endpoints similar to the socket model ● Endpoints can be allocated, disposed of, and communicated through channels similar to the π -calculus ● Communications are ruled by user-defined contracts similar to session types ⊖ No formalisation How to ensure the absence of bugs? Introduction ● Concurrency  / 

Analysis [V., Lozes & Calcagno A PLAS ’09,V. PhD’11] Specify Model Prove Program Proof SL+MP + Contracts Prop. Contracts = Program Prop. Heap-Hop Introduction ● Formal Verification  / 

Program Proof SL+MP + ● message passing primitives Contracts Prop. Contracts = Program Prop. Heap-Hop

Message Passing Primitives ● (e,f) = open() Creates a bidirectional channel between endpoints e and f ● close(e,f) Closes the channel (e,f) ● send(a,e,x) Sends message starting with value x on endpoint e . The message has type/tag a ● x = receive(a,e) Receives message of type a on endpoint e and stores its value in x 1 set_to_ten(x) { local e,f; 2 (e,f) = open (); 3 send(integer ,e ,10); 4 x = receive(integer ,f); 5 close(e,f); 6 7 } Copyless Message Passing ● Language Model  / 

Switch Receive ● switch receive selects a receive branch depending on availability of messages if( x ) { switch receive { send(cell ,e,x); y = receive(cell ,f): {dispose(y);} } else { z = receive(integer ,f): {} send(integer ,e ,0); } } Copyless Message Passing ● Language Model  / 

Program Proof SL+MP + Contracts Prop. Contracts = Program Prop. ● Race freedom Heap-Hop ● Reception fault freedom ● Leak freedom

Safety Properties Separation property At each point in the execution, the state can be partitioned into what is owned by each program and each message in transit. ● Programs access only what they own ● Prevents races ● Linear usage of channels memory Copyless Message Passing ● Properties of Interest  / 

Safety Properties Separation property At each point in the execution, the state can be partitioned into what is owned by each program and each message in transit. ● Programs access only what they own m 1 m 3 ● Prevents races ● Linear usage of m 2 channels p 1 p 2 memory Copyless Message Passing ● Properties of Interest  / 

Safety Properties Separation property At each point in the execution, the state can be partitioned into what is owned by each program and each message in transit. ● Programs access only what they own m 1 m 3 ● Prevents races ● Linear usage of m 2 channels p 1 p 2 cell memory Copyless Message Passing ● Properties of Interest  / 

Safety Properties Separation property At each point in the execution, the state can be partitioned into what is owned by each program and each message in transit. ● Programs access only what they own m 1 m 3 ● Prevents races ● Linear usage of m 2 channels p 1 p 2 memory Copyless Message Passing ● Properties of Interest  / 

Safety Properties Separation property Invalid receptions freedom switch receive are exhaustive. ... ... switch receive { send(c,e,x); y = receive(a,f): { ... } ... z = receive(b,f): { ... } } ... Copyless Message Passing ● Properties of Interest  / 

Safety Properties Separation property Invalid receptions freedom Leak freedom The program does not leak memory. 1 main () { local x,e,f; 2 3 4 x = new (); 5 (e,f) = open (); 6 send(cell ,e,x); 7 close(e,f); 8 } Copyless Message Passing ● Properties of Interest  / 

Program Proof SL+MP + Contracts Prop. Contracts = ● Communicating automata Program Prop. Heap-Hop

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ● Sending transitions: ! a ● Receiving transitions: ? a ● Two buffers: one in each direction ● Configuration: ⟨ q , q ′ , w , w ′ ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q , q 0 ,ε,ε ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q , q 1 , a ,ε ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q , q 2 , ab ,ε ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q a , q 2 , b ,ε ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q , q 2 , b , a ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q , q 3 , b ,ε ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q b , q 3 ,ε,ε ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q , q 3 ,ε, b ⟩ Channel Contracts ● Communicating Automata  / 

A Dialogue System ? a ? b q a q q b ! a ! b ! a ! b ? a ? b q 0 q 1 q 2 q 3 q 4 ⟨ q , q 4 ,ε,ε ⟩ Channel Contracts ● Communicating Automata  / 

Contracts Describe dual communicating finite state machines ! pointer C init end Channel Contracts ● Communicating Automata  / 

Contracts Describe dual communicating finite state machines ! pointer ? pointer ˜ C C init end init end Channel Contracts ● Communicating Automata  / 

Contracts Describe dual communicating finite state machines ! pointer ? pointer ˜ C C init end init end q ′ q ′ ! cell ? ack ? cell ! ack ! fin ? fin C ′ ˜ C end end q q Channel Contracts ● Communicating Automata  / 