Programming Languages As Operating Systems
Total Page:16
File Type:pdf, Size:1020Kb
Programming Languages as Op erating Systems (or Revenge of the Son of the Lisp Machine) Matthew Flatt Rob ert Bruce Findler Shriram Krishnamurthi Matthias Felleisen Department of Computer Science Rice University Houston, Texas 77005-1892 reclaim the program's resources|even though the program Abstract and DrScheme share a single virtual machine. The MrEd virtual machine serves b oth as the implementa- To address this problem, MrEd provides a small set of tion platform for the DrScheme programming environment, new language constructs. These constructs allow a program- and as the underlying Scheme engine for executing expres- running program, suchasDrScheme, to run nested programs sions and programs entered into DrScheme's read-eval-print directly on the MrEd virtual machine without sacri cing lo op. We describ e the key elements of the MrEd virtual control over the nested programs. As a result, DrScheme machine for building a programming environment, and we can execute a copyofDrScheme that is executing its own step through the implementation of a miniature version of copy of DrScheme (see Figure 1). The inner and middle DrScheme in MrEd. More generally,weshowhow MrEd de- DrSchemes cannot interfere with the op eration of the outer nes a high-level op erating system for graphical programs. DrScheme, and the middle DrScheme cannot interfere with the outer DrScheme's control over the inner DrScheme. In this pap er, we describ e the key elements of the MrEd 1 MrEd: A Scheme Machine virtual machine, and we step through the implementation of a miniature version of DrScheme in MrEd. More gen- The DrScheme programming environment [10] provides stu- erally,weshowhow MrEd de nes a high-level op erating dents and programmers with a user-friendly environment system (OS) for graphical programs. As in other high-level for developing Scheme programs. Tomake programming OSes, safety and securityinMrEdderive from prop erties of accessible and attractivetonovices, DrScheme provides a the underlying programming language. Mere safety,how- thoroughly graphical environment and runs under several ever, provides neither the level of protection b etween ap- ma jor windowing systems (Windows, MacOS, and Unix/X). plications nor the kind of pro cess control that conventional More than 60 universities and high scho ols currently employ OSes provide. Such protection and control is crucial for im- DrScheme in their computing curriculum, and new scho ols plementing many kinds of programs, includin g programming adopt DrScheme every semester. environments and scripting engines. By describing howwe We implemented DrScheme by rst building MrEd [15], implemented DrScheme in MrEd, we demonstrate howto a p ortable Scheme [23] implementation with a graphical user obtain key OS facilities through small extensions to a high- interface (GUI) to olb ox. MrEd serves b oth as the implemen- level programming language. tation platform for DrScheme, and as the underlying Scheme The remainder of the pap er is organized as follows. Sec- engine for executing expressions and programs entered into tion 2 sketches a miniature DrScheme, called SchemeEsq, DrScheme's read-eval-printloop(repl). This strategy fol- and explains in more detail the implementation challenges lows a long tradition of meta-circular implementation that is for creating a graphical programming environment. Sec- virtually synonymous with Lisp, and generally understo o d tion 3 provides a brief overview of MrEd. Section 4 steps for high-level languages as a whole [20, 25 , 28 ]. through the implementation of SchemeEsq as a MrEd pro- Since DrScheme exp oses MrEd's language constructs di- gram. Section 5 explains how MrEd functions as a high-level rectly to the repl,DrScheme can easily execute programs OS. Section 6 discusses some problems for future work, and that use the full MrEd language, includin g its GUI to ol- Section 7 compares MrEd to related systems. box. At the same time, DrScheme must protect its GUI against interference from the programs it executes, and it must b e able to halt a program that has gone awry and 2 SchemeEsq: The Challenge This researchwas partially supp orted by a Lo dieska Sto ckbridge SchemeEsq, depicted in Figure 2, is a simple programming Vaughan Fellowship, NSF grants CCR-9619756, CDA-9713032,and shell that captures the essential prop erties of DrScheme as CCR-9708957, and a Texas ATP grant. a program-running program. Roughly,SchemeEsq imple- ments a read-eval-printloop(repl) that consumes expres- sions and evaluates them: (define (repl) (print (eval (read))) To app ear: Intl. Conf. on Functional Programming (repl)) (ICFP) { Sept. 27-29 1999, Paris, France 1 DrScheme DrScheme DrScheme 4 4 4 > (run-drscheme) > (run-drscheme) > r r r / . / . / . outer inner middle Figure 1: DrScheme in DrScheme in DrScheme same wayasitwould execute within its own MrEd virtual machine. The crucial requirement for SchemeEsq is that it must run any program securely, in the sense that the program can- 1 not interfere with SchemeEsq's op eration. Indeed, since SchemeEsq is itself a MrEd program, SchemeEsq must b e able to run copies of itself anynumb er of times and to any nesting depth. No matter how manySchemeEsqs are running and how deeply they are nested, each instance of SchemeEsq must b e free from interference from its children. At the same time, a single clicktoReset in the outermost SchemeEsq must terminate all of the other instances. 3 MrEd Overview Figure 2: SchemeEsq MrEd acts as a high-level OS to service the GUI, security, and scalabili ty needs of SchemeEsq. In the same waythata current pro duction OS (e.g., Unix/X, Microsoft Windows) de nes a GUI API, a pro cess mo del, and a library-li nki ng This rough repl sketch relies on extensive underlying ma- mechanism, MrEd de nes constructs within Scheme for cre- chinery to implement each of the read, eval,and print steps. ating GUIs, securely executing untrusted co de, and linking SchemeEsq mo dels DrScheme in more detail, showing how together co de mo dules: read gets characters from the user, where print sends its out- put, etc. Furthermore, unlike the repl function, SchemeEsq GUI construction | MrEd provides GUI elements via demonstrates howtocatch errors in the user's program and built-in classes that a programmer can instantiate or how to stop a program's execution. extend. Event dispatching is automatic and normally SchemeEsq's repl accepts expressions, evaluates them, synchronous, but MrEd also p ermits controlled, asyn- and displays the results, all within a GUI text edi- chronous (i.e., parallel) event handling. In addition, tor. For simplicity,we assume that the user submits a MrEd provides sp ecial supp ort for multimedia editor complete Scheme expression for evaluation by hitting applicati ons (hence the Ed in MrEd ), suchasword the Enter key.Ifarepl expression signals an error, pro cessors and drawing programs. SchemeEsq prints the error message and creates a new Emb edding and security | MrEd provides multiple input prompt. At all times, the text preceding the threads of execution, thread-sp eci c con guration, and current prompt is lo cked so the user cannot mo dify it. resource control. These constructs supp ort the secure In addition to standard Scheme, SchemeEsq's repl emb edding of programs within other programs that provides access to the entire MrEd to olb ox, p ermit- control the emb edded execution environment and re- ting the user's program to create threads and GUI ob- source consumption. jects. User-created GUI elements must not interfere Mo dularity and extensibil ity | MrEd's mo dule and with SchemeEsq's own GUI. For example, the user's class constructs enable the construction of reusable program might create a mo dal dialog that disables all comp onents. These comp onent constructs naturally of the user's other windows, but it must not disable complement MrEd's ob ject-oriented GUI to olb ox, al- the SchemeEsq window. lowing a programmer to implement reusable and com- SchemeEsq's Reset button stops the currentevalua- p osable extensions of GUI elements. tion, reclaiming all resources currently in use bythe The following sections provide an overview of MrEd's con- user's program. All active threads and GUI elements structs. Section 3.1 describ es a few details of MrEd's GUI created by the program must b e destroyed. to olb ox, whichweprovide for the sake of de ning a concrete Although SchemeEsq redirects printed output from the implementation of SchemeEsq. Section 3.2 describ es MrEd's user's program to its repl window, the program must 1 Except by running out of memory; see Section 6. otherwise execute within SchemeEsq in exactly the 2 constructs for program emb edding and security. The ideas MrEd's GUI classes also handle the graphical layout of underlying these constructs form the main contribution of windows. Our example frame demonstrates a simple layout; the pap er. Finally, Section 3.3 describ es MrEd's supp ort for the frame's elements are lined up top-to-b ottom. In general, mo dular and ob ject-oriented programming, whichisintegral a programmer sp eci es the layout of a windowby assigning to our mo del of programs and pro cesses. each GUI element to a parent container.Avertical con- tainer, such as a frame, arranges its children in a column, Recommendation: Skip the Exp erience and Rationale boxes for a and a horizontal container arranges its children in a row. A rst reading. container can b e a child of another container; for example, to place two buttons side-by-side in a frame, a programmer 3.1 GUI Construction creates a horizontal panel for the buttons: MrEd provides the basic building blo cks of GUI programs| (define panel (make-object horizontal-panel% frame)) such as frames (top-level windows), mo dal dialogs, menus, (make-object button% \Left" panel ...) buttons, checkboxes, and text elds|via built-in classes (make-object button% \Right" panel ...) that the programmer can instantiate or extend.