cyclone safe programming at the strongcstrong level of abstraction.pptVIP

11 January 2005 Dan Grossman: Cyclone Cyclone: A Memory-Safe C-Level Programming Language Dan Grossman University of Washington Joint work with: Trevor Jim ATT Research Greg Morrisett Harvard University Michael Hicks University of Maryland A safe C-level language Cyclone is a programming language and compiler aimed at safe systems programming C is not memory safe: void f(int* p, int i, int v) { p[i] = v; } Address p+i might hold important data or code Memory safety is crucial for reasoning about programs Caller’s problem? void g(void**, void*); int y = 0; int *z = y; g(z,0xBAD); *z = 123; Might be safe, but not if g does *x=y Type of g enough for code generation Type of g not enough for safety checking Safe low-level systems For a safety guarantee today, use YFHLL Your Favorite High Level Language YFHLL provides safety in part via: hidden data fields and run-time checks automatic memory management Data representation and resource management are essential aspects of low-level systems There are strong reasons for C-like languages Some insufficient approaches Compile C with extra information type fields, size fields, live-pointer table, … treats C as a higher-level language Use static analysis very difficult less modular Ban unsafe features there are many you need them Cyclone in brief A safe, convenient, and modern language at the C level of abstraction Safe: memory safety, abstract types, no core dumps C-level: user-controlled data representation and resource management, easy interoperability, “manifest cost” Convenient: may need more type annotations, but work hard to avoid it Modern: add features to capture common idioms “New code for legacy or inherently low-level systems” The plan from here Experience with Cyclone Benchmarks, ports, systems, compiler, … All on Earth so far ? Not-NULL pointers Type-variable examples generics region-based memory management Brief view of “everything else” Related wo