Typing Copyless Message Passing

Abstract

Abstract. We present a calculus that models a form of process interaction based on copyless message passing, in the style of Singularity OS. The calculus is equipped with a type system ensuring that well-typed processes are free from faults, leaks, and communication errors. The type system is essentially linear, but we show that linearity alone is inadequate. On the one hand, it is too strict when dealing with heap-allocated objects; on the other hand, it leaves room for scenarios where well-typed processes leak significant amounts of memory. We address these problems using dedicated types for keeping track of dereferenced pointers and by basing the type system upon an original variant of session types.

Polymorphic Endpoint Types for Copyless Message Passing

“…At first sight it might seem that these properties can be trivially enforced through a linear type system based on session types [10,11]. However, in [2] we remarked how linearity alone can be too restrictive in some contexts and too permissive in others. To illustrate why linearity can be too restrictive, consider the code fragment expose (a) { send(b, arg, *a); *a := new T(); } which dereferences the pointer a and sends *a on the endpoint b. Linearity is violated right after the send(arg, b, *a) command, since *a is owned both by the sender (indirectly, through a) as well as by the receiver.…”

“…The cell is linear in the sense that it allows setting its content only if the previous content has been retrieved. This cell implementation resembles that of a 1-place buffer, but we retain the name "cell" for continuity with our previous work [2].…”

“…In [2] we presented CoreSing♯, a formalization of the core features of Sing♯ -the language used for the implementation of Singularity OS -along with a type system ensuring that well-typed processes are free from communication errors, memory faults, and memory leaks. At first sight it might seem that these properties can be trivially enforced through a linear type system based on session types [10,11].…”

“…Also, the availability of polymorphic endpoint types allows us to encode linear mutable cells. This renders the * t and * • types superfluous and makes our model even more essential with respect to the one presented in [2].…”

Shared Contract-Obedient Endpoints

“…In order to support such behaviours we distinguish reception from scanning (also called peeking) and consider that unspecified receptions might occur only on scanning, not on reception. 2 The reason why we omit deadlocks is not that we find them uninteresting, but rather that there is no simple way to treat them without introducing new notions; see Leino et al [16] or session types [15] for analyses of message-passing programs dealing with deadlocks. 3 The ownership hypothesis and separation property also apply to global variables.…”