Typing Copyless Message Passing Viviana Bono Chiara Messa Luca - - PowerPoint PPT Presentation

▶
typing copyless message passing
SMART_READER_LITE
LIVE PREVIEW

Typing Copyless Message Passing Viviana Bono Chiara Messa Luca - - PowerPoint PPT Presentation

Aug 21, 2022 339 likes •807 views

Typing Copyless Message Passing Viviana Bono Chiara Messa Luca Padovani Dipartimento di Informatica, Universit` a di Torino BTW 2011 Typing Copyless Message Passing (V. Bono) BTW 2011 1 / 25 Singularity OS: architecture Processes (SIPs)

slide-1
SLIDE 1

Typing Copyless Message Passing

Viviana Bono Chiara Messa Luca Padovani

Dipartimento di Informatica, Universit` a di Torino

BTW 2011

Typing Copyless Message Passing (V. Bono) BTW 2011 1 / 25

slide-2
SLIDE 2

Singularity OS: architecture

msg queue Exchange heap (µ) Processes (SIPs)

Typing Copyless Message Passing (V. Bono) BTW 2011 2 / 25

slide-3
SLIDE 3

Sing# examples

void CLIENT() { (e, f) = open(); spawn { SERVER(f) } send(e, v1); send(e, v2); res = receive(e); close(e); } void SERVER(f) { a1 = receive(f); a2 = receive(f); ... send(f, OP(a1, a2)); close(f); }

Typing Copyless Message Passing (V. Bono) BTW 2011 3 / 25

slide-4
SLIDE 4

Safety properties

1 no communication errors 2 no memory faults 3 no memory leaks 4 process isolation guaranteed by ownership

Typing Copyless Message Passing (V. Bono) BTW 2011 4 / 25

slide-5
SLIDE 5

Contracts

contract OP_Service { initial state START { Arg! → WAIT_ARG_2 } state WAIT_ARG_2 { Arg! → WAIT_RES } state WAIT_RES { Res? → END } final state END { } } + recursion + branching

Typing Copyless Message Passing (V. Bono) BTW 2011 5 / 25

slide-6
SLIDE 6

Exposing structures

expose (a) { send(*a, b); } expose (b) { send(a, *b); *b = new T(); } + records with named fields (not in the paper)

Typing Copyless Message Passing (V. Bono) BTW 2011 6 / 25

slide-7
SLIDE 7

Enforcing safety properties

1 no communication errors 2 no memory faults 3 no memory leaks 4 process isolation guaranteed by ownership

LINEAR TYPE SYSTEM!

  • too restrictive in some cases
  • too permissive in others

Typing Copyless Message Passing (V. Bono) BTW 2011 7 / 25

slide-8
SLIDE 8

Linearity is too restrictive

void CLIENT() { (e, f) = open(); spawn { SERVER(f) } send(e, v1); send(e, v2); res = receive(e); close(e); } expose (a) { send(a, *b); *b = new T(); }

  • Typing Copyless Message Passing (V. Bono)

BTW 2011 8 / 25

slide-9
SLIDE 9

Linearity is too permissive

void foo() { (e, f) = open(); send(e, f); close(e); }

Typing Copyless Message Passing (V. Bono) BTW 2011 9 / 25

slide-10
SLIDE 10

Linearity is too permissive

void foo() { (e, f) = open(); send(e, f); close(e); } e f

Typing Copyless Message Passing (V. Bono) BTW 2011 9 / 25

slide-11
SLIDE 11

Linearity is too permissive

void foo() { (e, f) = open(); send(e, f); close(e); } e f

Typing Copyless Message Passing (V. Bono) BTW 2011 9 / 25

slide-12
SLIDE 12

Linearity is too permissive

void foo() { (e, f) = open(); send(e, f); close(e); } f

Typing Copyless Message Passing (V. Bono) BTW 2011 9 / 25

slide-13
SLIDE 13

Modeling processes

void CLIENT() { (e, f) = open(); spawn { SERVER(f) } send(e, v1); send(e, v2); res = receive(e); close(e); }

  • pen(e, f).(SERVER |

e!v1. e!v2. e?(res). free(e). )

  • channel = peer endpoints
  • explicit channel closure

Typing Copyless Message Passing (V. Bono) BTW 2011 10 / 25

slide-14
SLIDE 14

Modeling exposures

expose (a) { send(*a, b); } expose(a, x). x!b. unexpose(a, x). . . . expose (b) { send(a, *b); *b = new T(); } expose(b, x). a!x. cell(c). unexpose(b, c). . . .

  • expose/unexpose ∼ dereferentiation/assignment
  • with type effects

Typing Copyless Message Passing (V. Bono) BTW 2011 11 / 25

slide-15
SLIDE 15

Modeling contracts

contract OP_Service { initial state START { Arg! → WAIT_ARG_2 } state WAIT_ARG_2 { Arg! → WAIT_RES } state WAIT_RES { Res? → END } final state END { } } Client/Import Service/Export !Arg.!Arg.?Res.end ?Arg.?Arg.!Res.end

Typing Copyless Message Passing (V. Bono) BTW 2011 12 / 25

slide-16
SLIDE 16

Types and endpoint types

t ::= Type ∗t (cell type) | ∗• (exposed cell type) | T (endpoint type) T ::= Endpoint Type end (termination) | X (variable) | !t.T (output) | ?t.T (input) | rec X.T (recursive type)

Typing Copyless Message Passing (V. Bono) BTW 2011 13 / 25

slide-17
SLIDE 17

Typing message passing

(T-Open)

∆, a : T, b : T ⊢ P ∆ ⊢ open(a, b).P

(T-Send)

∆, u : T ⊢ P ∆, u : !t.T, v : t ⊢ u!v.P

(T-Receive)

∆, u : T, x : t ⊢ P ∆, u : ?t.T ⊢ u?(x).P

Typing Copyless Message Passing (V. Bono) BTW 2011 14 / 25

slide-18
SLIDE 18

Typing exposures

(T-Expose)

∆, u : ∗•, x : t ⊢ P ∆, u : ∗t ⊢ expose(u, x).P

(T-Unexpose)

∆, u : ∗t ⊢ P ∆, u : ∗•, v : t ⊢ unexpose(u, v).P

Typing Copyless Message Passing (V. Bono) BTW 2011 15 / 25

slide-19
SLIDE 19

Typing exposures: example

expose(a, x). x!b. unexpose(a, x). . . .

Typing Copyless Message Passing (V. Bono) BTW 2011 16 / 25

slide-20
SLIDE 20

Typing exposures: example

{a : ∗(!s.T), b : s} ⊢ expose(a, x). x!b. unexpose(a, x). . . .

Typing Copyless Message Passing (V. Bono) BTW 2011 16 / 25

slide-21
SLIDE 21

Typing exposures: example

{a : ∗(!s.T), b : s} ⊢ expose(a, x). {a : ∗•, x :!s.T, b : s} ⊢ x!b. unexpose(a, x). . . .

Typing Copyless Message Passing (V. Bono) BTW 2011 16 / 25

slide-22
SLIDE 22

Typing exposures: example

{a : ∗(!s.T), b : s} ⊢ expose(a, x). {a : ∗•, x :!s.T, b : s} ⊢ x!b. {a : ∗•, x : T} ⊢ unexpose(a, x). . . .

Typing Copyless Message Passing (V. Bono) BTW 2011 16 / 25

slide-23
SLIDE 23

Typing exposures: example

{a : ∗(!s.T), b : s} ⊢ expose(a, x). {a : ∗•, x :!s.T, b : s} ⊢ x!b. {a : ∗•, x : T} ⊢ unexpose(a, x). {a : ∗T} ⊢ . . .

Typing Copyless Message Passing (V. Bono) BTW 2011 16 / 25

slide-24
SLIDE 24

Typable leak

void foo() { (e, f) = open(); send(e, f); close(e); }

  • pen(e, f).

e!f. free(e). T = !T.end T = rec X.?X.end

Typing Copyless Message Passing (V. Bono) BTW 2011 17 / 25

slide-25
SLIDE 25

Typable leak

void foo() { (e, f) = open(); send(e, f); close(e); } {} ⊢ open(e, f). e!f. free(e). T = !T.end T = rec X.?X.end

Typing Copyless Message Passing (V. Bono) BTW 2011 17 / 25

slide-26
SLIDE 26

Typable leak

void foo() { (e, f) = open(); send(e, f); close(e); } {} ⊢ open(e, f). {e : T, f : T} ⊢ e!f. free(e). T = !T.end T = rec X.?X.end

Typing Copyless Message Passing (V. Bono) BTW 2011 17 / 25

slide-27
SLIDE 27

Typable leak

void foo() { (e, f) = open(); send(e, f); close(e); } {} ⊢ open(e, f). {e : T, f : T} ⊢ e!f. {e : end} ⊢ free(e). T = !T.end T = rec X.?X.end

Typing Copyless Message Passing (V. Bono) BTW 2011 17 / 25

slide-28
SLIDE 28

Typable leak

void foo() { (e, f) = open(); send(e, f); close(e); } {} ⊢ open(e, f). {e : T, f : T} ⊢ e!f. {e : end} ⊢ free(e). {} ⊢ 0 T = !T.end T = rec X.?X.end

Typing Copyless Message Passing (V. Bono) BTW 2011 17 / 25

slide-29
SLIDE 29

Understanding the problem

“Improper” recursion? T = !T.end T = rec X.?X.end No, the following endpoint types are safe S = rec X.!X.end S = ?S.end It’s a matter of “ownership”

Typing Copyless Message Passing (V. Bono) BTW 2011 18 / 25

slide-30
SLIDE 30

Understanding the problem

“Improper” recursion? T = !T.end T = rec X.?X.end No, the following endpoint types are safe S = rec X.!X.end S = ?S.end It’s a matter of “ownership”

Typing Copyless Message Passing (V. Bono) BTW 2011 18 / 25

slide-31
SLIDE 31

Understanding the problem

“Improper” recursion? T = !T.end T = rec X.?X.end No, the following endpoint types are safe S = rec X.!X.end S = ?S.end It’s a matter of “ownership”

Typing Copyless Message Passing (V. Bono) BTW 2011 18 / 25

slide-32
SLIDE 32

Type weight

In summary

  • “receive state” = “has type ?T.S”
  • only endpoints in “receive state” can have a non-empty queue

Solution

  • T = “depth of the queue of an endpoint with type T”
  • only endpoint types with finite weight are admitted

T = !T.end T = rec X.?X.end T = T = ∞ S = rec X.!X.end S = ?S.end S = S = 1

Typing Copyless Message Passing (V. Bono) BTW 2011 19 / 25

slide-33
SLIDE 33

Type weight

In summary

  • “receive state” = “has type ?T.S”
  • only endpoints in “receive state” can have a non-empty queue

Solution

  • T = “depth of the queue of an endpoint with type T”
  • only endpoint types with finite weight are admitted

T = !T.end T = rec X.?X.end T = T = ∞ S = rec X.!X.end S = ?S.end S = S = 1

Typing Copyless Message Passing (V. Bono) BTW 2011 19 / 25

slide-34
SLIDE 34

Type weight

In summary

  • “receive state” = “has type ?T.S”
  • only endpoints in “receive state” can have a non-empty queue

Solution

  • T = “depth of the queue of an endpoint with type T”
  • only endpoint types with finite weight are admitted

T = !T.end T = rec X.?X.end T = T = ∞ S = rec X.!X.end S = ?S.end S = S = 1

Typing Copyless Message Passing (V. Bono) BTW 2011 19 / 25

slide-35
SLIDE 35

On weights and reachability

Proposition

If a : T, b : S and b ∈ reach(a, µ), then S < T. Finite weight = bounded queue T = rec X.?int.X T = 1 Finite weight = acyclic heap ∗(?∗•.end)

Typing Copyless Message Passing (V. Bono) BTW 2011 20 / 25

slide-36
SLIDE 36

Well-behaved processes

P is well behaved if (∅; P) ⇒ (µ; Q) implies:

1 fn(Q) ⊆ dom(µ) 2 dom(µ) ⊆ reach(fn(Q), µ) 3 Q ≡ P1 | P2 implies reach(fn(P1), µ) ∩ reach(fn(P2), µ) = ∅ 4 Q ≡ P1 | P2 and (µ; P1) → where P1 does not have unguarded

parallel compositions imply either

  • P1 = 0, or
  • P1 = a?(x).P where the queue of a is empty

Typing Copyless Message Passing (V. Bono) BTW 2011 21 / 25

slide-37
SLIDE 37

Well-behaved processes

P is well behaved if (∅; P) ⇒ (µ; Q) implies:

1 fn(Q) ⊆ dom(µ) 2 dom(µ) ⊆ reach(fn(Q), µ) 3 Q ≡ P1 | P2 implies reach(fn(P1), µ) ∩ reach(fn(P2), µ) = ∅ 4 Q ≡ P1 | P2 and (µ; P1) → where P1 does not have unguarded

parallel compositions imply either

  • P1 = 0, or
  • P1 = a?(x).P where the queue of a is empty

Typing Copyless Message Passing (V. Bono) BTW 2011 21 / 25

slide-38
SLIDE 38

Well-behaved processes

P is well behaved if (∅; P) ⇒ (µ; Q) implies:

1 fn(Q) ⊆ dom(µ) 2 dom(µ) ⊆ reach(fn(Q), µ) 3 Q ≡ P1 | P2 implies reach(fn(P1), µ) ∩ reach(fn(P2), µ) = ∅ 4 Q ≡ P1 | P2 and (µ; P1) → where P1 does not have unguarded

parallel compositions imply either

  • P1 = 0, or
  • P1 = a?(x).P where the queue of a is empty

Typing Copyless Message Passing (V. Bono) BTW 2011 21 / 25

slide-39
SLIDE 39

Well-behaved processes

P is well behaved if (∅; P) ⇒ (µ; Q) implies:

1 fn(Q) ⊆ dom(µ) 2 dom(µ) ⊆ reach(fn(Q), µ) 3 Q ≡ P1 | P2 implies reach(fn(P1), µ) ∩ reach(fn(P2), µ) = ∅

Q ≡ P1 | P2 implies fn(P1) ∩ fn(P2) = ∅

4 Q ≡ P1 | P2 and (µ; P1) → where P1 does not have unguarded

parallel compositions imply either

  • P1 = 0, or
  • P1 = a?(x).P where the queue of a is empty

Typing Copyless Message Passing (V. Bono) BTW 2011 21 / 25

slide-40
SLIDE 40

Well-behaved processes

P is well behaved if (∅; P) ⇒ (µ; Q) implies:

1 fn(Q) ⊆ dom(µ) 2 dom(µ) ⊆ reach(fn(Q), µ) 3 Q ≡ P1 | P2 implies reach(fn(P1), µ) ∩ reach(fn(P2), µ) = ∅

Q ≡ P1 | P2 implies fn(P1) ∩ fn(P2) = ∅

4 Q ≡ P1 | P2 and (µ; P1) → where P1 does not have unguarded

parallel compositions imply either

  • P1 = 0, or
  • P1 = a?(x).P where the queue of a is empty

Typing Copyless Message Passing (V. Bono) BTW 2011 21 / 25

slide-41
SLIDE 41

Results

Theorem (Subject reduction)

If ∆ ⊢ P and (µ; P) → (µ′; P′), then ∆′ ⊢ P′ for some ∆′.

Theorem (Soundness)

If ⊢ P, then P is well behaved.

Typing Copyless Message Passing (V. Bono) BTW 2011 22 / 25

slide-42
SLIDE 42

Concluding remarks [BMP@ESOP2011]

Formalization of Sing#

  • contracts ⇒ endpoint types (= session types)
  • expose ⇒ opaque references ∗• (= simple behavioral types)

Sing# restrictions

  • Sing# too forbids sending endpoints in “receive state”. . .
  • . . . for implementative reasons
  • Sing# is leak-free, incidentally?

Typing Copyless Message Passing (V. Bono) BTW 2011 23 / 25

slide-43
SLIDE 43

A new extension: polymorphic endpoint types

Modeling parametric contracts !α(α).?(α).end

  • But. . .

⊢ open(e, f).e!f.free(e).0 e : !α(α).end f : ?α(α).end Idea: bounded polymorphism

  • !α T(α).end

(T has ∞ weight)

  • T S implies T ≤ S

Typing Copyless Message Passing (V. Bono) BTW 2011 24 / 25

slide-44
SLIDE 44

A new extension: polymorphic endpoint types

Modeling parametric contracts !α(α).?(α).end

  • But. . .

⊢ open(e, f).e!f.free(e).0 e : !α(α).end f : ?α(α).end Idea: bounded polymorphism

  • !α T(α).end

(T has ∞ weight)

  • T S implies T ≤ S

Typing Copyless Message Passing (V. Bono) BTW 2011 24 / 25

slide-45
SLIDE 45

A new extension: polymorphic endpoint types

Modeling parametric contracts !α(α).?(α).end

  • But. . .

⊢ open(e, f).e!f.free(e).0 e : !α(α).end f : ?α(α).end Idea: bounded polymorphism

  • !α T(α).end

(T has ∞ weight)

  • T S implies T ≤ S

Typing Copyless Message Passing (V. Bono) BTW 2011 24 / 25

slide-46
SLIDE 46

Thank you

Typing Copyless Message Passing (V. Bono) BTW 2011 25 / 25