A Static Verification Framework for Message Passing in Go using Behavioural Types Julien Lange 1 , Nicholas Ng 2 , Bernardo Toninho 3 , Nobuko Yoshida 2 1 University of Kent 2 Imperial College London 3 Universidade Nova de Lisboa 1 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary The Go Programming Language Developed at Google for multicore programming Statically typed, natively compiled, concurrent Channel-based message passing for concurrency Used by major technology companies, e.g. 2 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Go and concurrency Approach and philosophy Do not communicate by sharing memory; Instead, share memory by communicating — Go language proverb Encourages message passing over locking Goroutines : lightweight threads Channels : typed FIFO queues Inspired by Hoare’s CSP/ process calculi 3 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Static verification framework for Go Overview 2 Model checking Behavioural mCRL2 model checker Types Transform Check safety and liveness and verify Type inference 1 3 Termination checking KITTeL termination prover SSA IR Go source code Address type ↔ program gap 4 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Goroutines 1 func main() { 2 ch := make(chan string) 3 go send(ch) go keyword + function call 4 print(<-ch) Spawns function as goroutine 5 close(ch) 6 } Runs in parallel to parent 7 8 func send(ch chan string) { 9 ch <- "Hej ICSE!" 10 } 5 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Channels Create new channel 1 func main() { Synchronous by default 2 ch := make(chan string) 3 go send(ch) Receive from channel 4 print(<-ch) Close a channel 5 close(ch) 6 } No more values sent to it 7 Can only close once 8 func send(ch chan string) { 9 ch <- "Hej ICSE!" Send to channel 10 } 6 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Channels 1 func main() { 2 ch := make(chan string) Also select-case : 3 go send(ch) Wait on multiple channel 4 print(<-ch) operations 5 close(ch) 6 } switch-case for 7 communication 8 func send(ch chan string) { 9 ch <- "Hej ICSE!" 10 } 6 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Deadlock detection 1 func main() { 2 Send message thru channel ch := make(chan string) 3 go send(ch) Print message on screen 4 print(<-ch) 5 close(ch) Output: 6 } $ go run hello.go 7 Hej ICSE! 8 func send(ch chan string) { $ 9 ch <- "Hej ICSE!" 10 } 7 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Deadlock detection Missing ’go’ keyword Only one (main) goroutine 1 // import _ "net" 2 func main() { Send without receive - blocks 3 ch := make(chan string) 4 send(ch) // Oops Output: 5 print(<-ch) $ go run deadlock.go 6 close(ch) fatal error: all goroutines 7 } are asleep - deadlock! 8 $ 9 func send(ch chan string) { 10 ch <- "Hej ICSE" 11 } 8 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Deadlock detection Missing ’go’ keyword 1 // import _ "net" Go’s runtime deadlock detector 2 func main() { Checks if all goroutines are 3 ch := make(chan string) 4 send(ch) // Oops blocked (‘global’ deadlock) 5 print(<-ch) Print message then crash 6 close(ch) 7 Some packages disable it } 8 (e.g. net ) 9 func send(ch chan string) { 10 ch <- "Hej ICSE" 11 } 8 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Deadlock detection Missing ’go’ keyword 1 import _ "net" // unused 2 func main() { 3 ch := make(chan string) 4 send(ch) // Oops Import unused, unrelated package 5 print(<-ch) 6 close(ch) 7 } 8 9 func send(ch chan string) { 10 ch <- "Hej ICSE" 11 } 8 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Concurrency in Go Deadlock detection Missing ’go’ keyword 1 import _ "net" // unused Only one (main) goroutine 2 func main() { Send without receive - blocks 3 ch := make(chan string) 4 send(ch) // Oops Output: 5 print(<-ch) 6 close(ch) $ go run deadlock2.go 7 } 8 Hangs: Deadlock NOT detected 9 func send(ch chan string) { 10 ch <- "Hej ICSE" 11 } 8 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Our goal Check liveness/safety properties in addition to global deadlocks Apply process calculi techniques to Go Use model checking to statically analyse Go programs 9 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Behavioural type inference Abstract Go communication as Behavioural Types 2 Model checking Behavioural mCRL2 model checker Types Transform Check safety and liveness and verify 1 Type inference 3 Termination checking KITTeL termination prover SSA IR Go source code Address type ↔ program gap 10 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Infer Behavioural Types from Go Program Behavioural Types Go source code Types of CCS-like [Milner ’80] 1 func main() { process calculus 2 ch := make(chan int) 3 go send(ch) Send/Receive 4 print(<-ch) new (channel) 5 close(ch) 6 } parallel composition (spawn) 7 Go-specific 8 func send(c chan int) { 9 Close channel c <- 1 10 } Select (guarded choice) 11 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Overview Concurrency in Go Behavioural type inference Model checking behavioural types Termination checking Summary Infer Behavioural Types from Go Program Go source code Inferred Behavioural Types 1 func main() { main() = ( new ch ); 2 ch := make(chan int) (send � ch � | 3 go send(ch) 4 ch; print(<-ch) 5 → close(ch) close ch) , 6 } 7 8 func send(c chan int) { send( ch ) = ch 9 c <- 1 10 } 11 /26 Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida mrg.doc.ic.ac.uk A Static Verification Framework for Message Passing in Go using Behavioural Types
Recommend
More recommend
