DOCSLIB.ORG

A Transformation-Based Implementation of Lightweight Nested Functions

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Transformation-Based Implementation of Lightweight Nested Functions Vol. 47 No. SIG 0(PRO 29) IPSJ Transactions on Programming June 2006 A Transformation-Based Implementation of Lightweight Nested Functions Tasuku Hiraishi,y Masahiro Yasugiy and Taiichi Yuasay The SC language system has been developed to provide a transformation-based language extension scheme for SC languages (extended/plain C languages with an S-expression based syntax). Using this system, many flexible extensions to the C language can be implemented by transformation rules over S-expressions at low cost mainly because of the pre-existing Common Lisp capabilities for manipulating S-expressions. This paper presents the LW-SC (LightWeight-SC) language as an important application of this system, which features nested functions (i.e., a function de¯ned inside another function). Without returning from a function, the function can manipulate its caller's local variables (or local variables of its indirect callers) by indirectly calling a nested function of its (indirect) caller. Thus, many high-level services with \stack walk" can be easily and elegantly implemented by using LW-SC as an intermediate language. Moreover, such services can be e±ciently implemented because we design and implement LW-SC to provide \lightweight" nested functions by aggressively reducing the costs of creating and maintaining nested functions. The GNU C compiler also provides nested functions as an extension to C, but our sophisticated translator to standard C is more portable and e±cient for occasional \stack walk". port nested functions. A nested function is a 1. Introduction function de¯ned inside another function. With- The C language is often indispensable for de- out returning from a function, the function can veloping practical systems. Furthermore, ex- manipulate its caller's local variables (or local tended C languages are sometimes suitable for variables of its indirect callers) sleeping in the elegant and e±cient development. We can execution stack by indirectly calling a nested implement language extension by modifying a function of its (indirect) caller. C compiler, but sometimes we can do it by This paper presents the implementation of translating an extended C program into C. We an extended SC language, named LW-SC have developed the SC language system8),10) to (LightWeight SC), which features nested func- help such transformation-based language exten- tions☆. Many high-level services with \stack sions. SC languages are extended/plain C lan- walk" mentioned above can be easily and el- guages with an S-expression based syntax and egantly implemented by using LW-SC as an the extensions are implemented by transforma- intermediate language. Moreover, such ser- tion rules over S-expressions. Thus we can re- vices can be e±ciently implemented because duce implementation costs mainly because we we design and implement LW-SC to provide can easily manipulate S-expressions using Lisp. \lightweight" nested functions by aggressively The fact that C has low-level operations (e.g., reducing the costs of creating and maintaining pointer operations) enables us to implement nested functions. Though the GNU C com- many flexible extensions using the SC language piler15) (GCC) also provides nested functions system. But without taking \memory" ad- as an extension to C, our sophisticated transla- dresses, C lacks an ability to access variables tor to standard C is more portable and e±cient sleeping in the execution stack, which is re- for occasional \stack walk". quired to implement high-level services with Note that, though this paper presents an im- \stack walk" such as capturing a stack state for plementation using the SC language system, check-pointing and scanning roots for copying our technique is not limited to it. GC (Garbage Collection). A possible solution to this problem is to sup- ☆ We have previously reported the implementation of y Department of Communications and Computer En- LW-SC as an example of a language extension us- gineering, Graduate School of Informatics, Kyoto ing the SC language system.10) This paper discusses University further details about LW-SC itself. 1 2 IPSJ Transactions on Programming June 2006 extended SC-B code transformation rule-set B transformation rule-set A SC preprocessor SC translator SC preprocessor SC translator extended SC-A code C code extended SC-C code SC preprocessor SC translator SC preprocessor SC compiler C compiler transformation rule-set C SC-0 code executable ¯le Fig. 1 Code translation phases in the SC language system. evaluated as a defmacro form of Com- 2. The SC Language System mon Lisp to de¯ne an SC macro. After This section explains the SC language system the de¯nition, every list in the form of for giving the speci¯cation and an implementa- (macro-name ¢ ¢ ¢) is replaced with the re- tion of LW-SC. More details are available in our sult of the application of Common Lisp's past paper.8),10) macroexpand-1 function to the list. The 2.1 Overview algorithm to expand nested macro applica- The SC language system, implemented in tions complies with the standard C speci¯- Common Lisp, deals with the following S- cation. expression-based languages: ² (%defconstant macro-name S-expression) ² SC-0, the base SC language, and de¯nes an SC macro in the same way as ² extended SC languages, a %defmacro directive, except that every and consists of the following three kinds of mod- symbol which eqs macro-name is replaced ules: with S-expression after the de¯nition. ² The SC preprocessor | includes SC ¯les ² (%undef macro-name) and handles macro de¯nitions and expan- unde¯nes the speci¯ed macro de¯ned by sions, %defmacros or %defconstants. ² The SC translator | interprets transfor- ² (%ifdef symbol list 1 list 2) mation rules for translating SC code into (%ifndef symbol list 1 list 2) another SC, and If the macro speci¯ed by symbol is de¯ned, ² The SC compiler | compiles SC-0 code list 1 is spliced there. Otherwise list 2 is into C. spliced. Fig. 1 shows code translation phases in the ² (%if S-expression list 1 list 2) SC language system. Extended SC code is S-expression is macro-expanded, then the translated into SC-0 by the SC translators, then result is evaluated by Common Lisp. If the translated into C by the SC compiler. Be- return value eqls nil or 0, list 2 is spliced fore each translation phase with a transforma- there. Otherwise list 1 is spliced. tion rule-set is applied, preprocessing by the ² (%error string) SC preprocessor is performed. Extension im- interrupts the compilation with an error plementers can develop a new translation phase message string. simply by writing new transformation rules. ² (%cinclude ¯le-name) 2.2 The SC Preprocessor ¯le-name speci¯es a C header ¯le. The C The SC preprocessor handles the following code is compiled into SC-0 and the result SC preprocessing directives to transform SC is spliced there. The SC programmers can programs: use library functions and most of macros ² (%include ¯le-name) such as printf, NULL declared/#defined corresponds to an #include directive in C. in C header ¯les☆. The ¯le ¯le-name is included. ☆ ² In some cases such a translation is not obvious. (%defmacro macro-name lambda-list In particular, it is sometimes impossible to trans- S-expression1¢ ¢ ¢S-expressionn) late #define macro de¯nitions into %defmacro or Vol. 47 No. SIG 0(PRO 29) A Transformation-Based Implementation of Lightweight Nested Functions 3 2.3 The SC Translator and Transfor- uation result of (every #'function-name mation Rules list) is non-nil. A transformation rule for the SC translator The function function-name can be what is de- is given by the syntax: ¯ned as a list of transformation rules or an usual Common Lisp function (a built-in function or (function-name pattern parm2 ¢ ¢ ¢ parmn) what is de¯ned separately from transformation -> expression rules). In evaluating expression, the special variable where a function function-name is de¯ned as x is bound to the whole matched S-expression an usual Lisp function. When the function is and, in the cases except (1), symbol is bound to called, the ¯rst argument is tested whether it the matched part in the S-expression. matches to pattern. If matched, expression is An example of such a function de¯nition can evaluated by the Common Lisp system, then its be given as follows☆: value is returned as the result of the function call. The parameters parm2 ¢ ¢ ¢ parmn, if any, (EX (,a[numberp] ,b[numberp])) are treated as usual arguments. -> `(,a ,b ,(+ a b)) A list of transformation rules may include two (EX (,a ,b)) or more rules with the same function name. In -> `(,a ,b ,a ,b) these cases, the ¯rst argument is tested whether (EX (,a ,b ,@rem)) it matches to each pattern in written order, and -> rem the result of the function call is the value of (EX ,otherwise) expression if matched. -> '(error) It is permitted to abbreviate The application of the function EX can be ex- ¢ ¢ ¢ (function-name pattern1 parm2 parmn) empli¯ed as follows: -> expression ::: (EX '(3 8)) ! (3 8 11) ¢ ¢ ¢ ! (function-name patternm parm2 parmn) (EX '(x 8)) (x 8 x 8) -> expression (EX 8) ! (error) (EX '(3)) ! (error) (all the expressions are identical and only pat- (EX '(x y z)) ! (z) terns are di®erent from each other) to Each set of transformation rules de¯nes one or ¢ ¢ ¢ (function-name pattern1 parm2 parmn) more (in most cases) function(s). A piece of ::: extended SC code is passed to one of the func- ¢ ¢ ¢ (function-name patternm parm2 parmn) tions, which generates transformed code as the -> expression. result. Internally, transformation rules for a func- The pattern is an S-expression consisted of one tion are compiled into an usual Common Lisp of the following elements: function de¯nition (defun).
Load more

Recommended publications
  • Compiling Sandboxes: Formally Verified Software Fault Isolation
    Compiling Sandboxes: Formally Verified Software Fault Isolation Frédéric Besson1[0000−0001−6815−0652], Sandrine Blazy1[0000−0002−0189−0223], Alexandre Dang1, Thomas Jensen1, and Pierre Wilke2[0000−0001−9681−644X] 1 Inria, Univ Rennes, CNRS, IRISA 2 CentraleSupélec, Inria, Univ Rennes, CNRS, IRISA Abstract. Software Fault Isolation (SFI) is a security-enhancing pro- gram transformation for instrumenting an untrusted binary module so that it runs inside a dedicated isolated address space, called a sandbox. To ensure that the untrusted module cannot escape its sandbox, existing approaches such as Google’s Native Client rely on a binary verifier to check that all memory accesses are within the sandbox. Instead of rely- ing on a posteriori verification, we design, implement and prove correct a program instrumentation phase as part of the formally verified com- piler CompCert that enforces a sandboxing security property a priori. This eliminates the need for a binary verifier and, instead, leverages the soundness proof of the compiler to prove the security of the sandbox- ing transformation. The technical contributions are a novel sandboxing transformation that has a well-defined C semantics and which supports arbitrary function pointers, and a formally verified C compiler that im- plements SFI. Experiments show that our formally verified technique is a competitive way of implementing SFI. 1 Introduction Isolating programs with various levels of trustworthiness is a fundamental se- curity concern, be it on a cloud computing platform running untrusted code provided by customers, or in a web browser running untrusted code coming from different origins. In these contexts, it is of the utmost importance to pro- vide adequate isolation mechanisms so that a faulty or malicious computation cannot compromise the host or neighbouring computations.
    [Show full text]
  • Using the GNU Compiler Collection (GCC)
    Using the GNU Compiler Collection (GCC) Using the GNU Compiler Collection by Richard M. Stallman and the GCC Developer Community Last updated 23 May 2004 for GCC 3.4.6 For GCC Version 3.4.6 Published by: GNU Press Website: www.gnupress.org a division of the General: [email protected] Free Software Foundation Orders: [email protected] 59 Temple Place Suite 330 Tel 617-542-5942 Boston, MA 02111-1307 USA Fax 617-542-2652 Last printed October 2003 for GCC 3.3.1. Printed copies are available for $45 each. Copyright c 1988, 1989, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004 Free Software Foundation, Inc. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with the Invariant Sections being \GNU General Public License" and \Funding Free Software", the Front-Cover texts being (a) (see below), and with the Back-Cover Texts being (b) (see below). A copy of the license is included in the section entitled \GNU Free Documentation License". (a) The FSF's Front-Cover Text is: A GNU Manual (b) The FSF's Back-Cover Text is: You have freedom to copy and modify this GNU Manual, like GNU software. Copies published by the Free Software Foundation raise funds for GNU development. i Short Contents Introduction ...................................... 1 1 Programming Languages Supported by GCC ............ 3 2 Language Standards Supported by GCC ............... 5 3 GCC Command Options .........................
    [Show full text]
  • Bringing GNU Emacs to Native Code
    Bringing GNU Emacs to Native Code Andrea Corallo Luca Nassi Nicola Manca [email protected] [email protected] [email protected] CNR-SPIN Genoa, Italy ABSTRACT such a long-standing project. Although this makes it didactic, some Emacs Lisp (Elisp) is the Lisp dialect used by the Emacs text editor limitations prevent the current implementation of Emacs Lisp to family. GNU Emacs can currently execute Elisp code either inter- be appealing for broader use. In this context, performance issues preted or byte-interpreted after it has been compiled to byte-code. represent the main bottleneck, which can be broken down in three In this work we discuss the implementation of an optimizing com- main sub-problems: piler approach for Elisp targeting native code. The native compiler • lack of true multi-threading support, employs the byte-compiler’s internal representation as input and • garbage collection speed, exploits libgccjit to achieve code generation using the GNU Com- • code execution speed. piler Collection (GCC) infrastructure. Generated executables are From now on we will focus on the last of these issues, which con- stored as binary files and can be loaded and unloaded dynamically. stitutes the topic of this work. Most of the functionality of the compiler is written in Elisp itself, The current implementation traditionally approaches the prob- including several optimization passes, paired with a C back-end lem of code execution speed in two ways: to interface with the GNU Emacs core and libgccjit. Though still a work in progress, our implementation is able to bootstrap a func- • Implementing a large number of performance-sensitive prim- tional Emacs and compile all lexically scoped Elisp files, including itive functions (also known as subr) in C.
    [Show full text]
  • Hop Client-Side Compilation
    Chapter 1 Hop Client-Side Compilation Florian Loitsch1, Manuel Serrano1 Abstract: Hop is a new language for programming interactive Web applications. It aims to replace HTML, JavaScript, and server-side scripting languages (such as PHP, JSP) with a unique language that is used for client-side interactions and server-side computations. A Hop execution platform is made of two compilers: one that compiles the code executed by the server, and one that compiles the code executed by the client. This paper presents the latter. In order to ensure compatibility of Hop graphical user interfaces with popular plain Web browsers, the client-side Hop compiler has to generate regular HTML and JavaScript code. The generated code runs roughly at the same speed as hand- written code. Since the Hop language is built on top of the Scheme program- ming language, compiling Hop to JavaScript is nearly equivalent to compiling Scheme to JavaScript. SCM2JS, the compiler we have designed, supports the whole Scheme core language. In particular, it features proper tail recursion. How- ever complete proper tail recursion may slow down the generated code. Despite an optimization which eliminates up to 40% of instrumentation for tail call in- tensive benchmarks, worst case programs were more than two times slower. As a result Hop only uses a weaker form of tail-call optimization which simplifies recursive tail-calls to while-loops. The techniques presented in this paper can be applied to most strict functional languages such as ML and Lisp. SCM2JS can be downloaded at http://www-sop.inria.fr/mimosa/person- nel/Florian.Loitsch/scheme2js/.
    [Show full text]
  • Practical Control-Flow Integrity
    Practical Control-Flow Integrity by Ben Niu Presented to the Graduate and Research Committee of Lehigh University in Candidacy for the Degree of Doctor of Philosophy in Computer Science Lehigh University January, 2016 Copyright © 2015 Ben Niu. All rights reserved. ii Approved and recommended for acceptance as a dissertation in partial fulfillment of the re- quirements for the degree of Doctor of Philosophy. Ben Niu Practical Control-Flow Integrity Date Gang Tan, Dissertation Director Accepted Date Committee Members Gang Tan (Chair) Mooi-Choo Chuah Michael Spear Stephen McCamant iii ACKNOWLEDGEMENTS I am very grateful to my great advisor Prof. Gang Tan. I had no idea how to do research when I came to Lehigh, and he taught me what to think of, how to think, how to present my thoughts, and how to write them down. His door was always open for discussion, he replied emails during weekends, and he provided detailed guidance on any technical problem. I was constantly surprised at his breadth of knowledge and depth of understanding, and I enjoyed working with him. I also thank my thesis committee members, Prof. Mooi-Choo Chuah, Prof. Michael Spear, and Prof. Stephen McCamant for their courses, research works and insightful comments on my research. Michael’s parallel programming course introduced me lock-free algorithms and his operating system course consolidated my system programming skills. Stephen’s research on SFI provided me a foundation in my research, without which I would be still looking for decent solutions. I appreciate my colleagues at MSRC during my internship at Microsoft, especially Matt & Ken, Suha, Vishal, Swamy, Joe, Axel and Marcus.
    [Show full text]
  • Objective-C Internals Realmac Software
    André Pang Objective-C Internals Realmac Software 1 Nice license plate, eh? In this talk, we peek under the hood and have a look at Objective-C’s engine: how objects are represented in memory, and how message sending works. What is an object? 2 To understand what an object really is, we dive down to the lowest-level of the object: what it actually looks like in memory. And to understand Objective-C’s memory model, one must first understand C’s memory model… What is an object? int i; i = 0xdeadbeef; de ad be ef 3 Simple example: here’s how an int is represented in C on a 32-bit machine. 32 bits = 4 bytes, so the int might look like this. What is an object? int i; i = 0xdeadbeef; ef be af de 4 Actually, the int will look like this on Intel-Chip Based Macs (or ICBMs, as I like to call them), since ICBMs are little- endian. What is an object? int i; i = 0xdeadbeef; de ad be ef 5 … but for simplicity, we’ll assume memory layout is big-endian for this presentation, since it’s easier to read. What is an object? typedef struct _IntContainer { int i; } IntContainer; IntContainer ic; ic.i = 0xdeadbeef; de ad be ef 6 This is what a C struct that contains a single int looks like. In terms of memory layout, a struct with a single int looks exactly the same as just an int[1]. This is very important, because it means that you can cast between an IntContainer and an int for a particular value with no loss of precision.
    [Show full text]
  • Using and Porting the GNU Compiler Collection
    Using and Porting the GNU Compiler Collection Richard M. Stallman Last updated 14 June 2001 for gcc-3.0 Copyright c 1988, 1989, 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001 Free Software Foundation, Inc. For GCC Version 3.0 Published by the Free Software Foundation 59 Temple Place - Suite 330 Boston, MA 02111-1307, USA Last printed April, 1998. Printed copies are available for $50 each. ISBN 1-882114-37-X Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with the Invariant Sections being “GNU General Public License”, the Front-Cover texts being (a) (see below), and with the Back-Cover Texts being (b) (see below). A copy of the license is included in the section entitled “GNU Free Documentation License”. (a) The FSF’s Front-Cover Text is: A GNU Manual (b) The FSF’s Back-Cover Text is: You have freedom to copy and modify this GNU Manual, like GNU software. Copies published by the Free Software Foundation raise funds for GNU development. Short Contents Introduction......................................... 1 1 Compile C, C++, Objective C, Fortran, Java ............... 3 2 Language Standards Supported by GCC .................. 5 3 GCC Command Options ............................. 7 4 Installing GNU CC ............................... 111 5 Extensions to the C Language Family .................. 121 6 Extensions to the C++ Language ...................... 165 7 GNU Objective-C runtime features .................... 175 8 gcov: a Test Coverage Program ...................... 181 9 Known Causes of Trouble with GCC ................... 187 10 Reporting Bugs.................................
    [Show full text]
  • Using the GNU Compiler Collection
    Using the GNU Compiler Collection Richard M. Stallman Last updated 20 April 2002 for GCC 3.2.3 Copyright c 1988, 1989, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc. For GCC Version 3.2.3 Published by the Free Software Foundation 59 Temple Place—Suite 330 Boston, MA 02111-1307, USA Last printed April, 1998. Printed copies are available for $50 each. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with the Invariant Sections being “GNU General Public License”, the Front-Cover texts being (a) (see below), and with the Back-Cover Texts being (b) (see below). A copy of the license is included in the section entitled “GNU Free Documentation License”. (a) The FSF’s Front-Cover Text is: A GNU Manual (b) The FSF’s Back-Cover Text is: You have freedom to copy and modify this GNU Manual, like GNU software. Copies published by the Free Software Foundation raise funds for GNU development. i Short Contents Introduction ...................................... 1 1 Compile C, C++, Objective-C, Ada, Fortran, or Java ....... 3 2 Language Standards Supported by GCC ............... 5 3 GCC Command Options .......................... 7 4 C Implementation-defined behavior ................. 153 5 Extensions to the C Language Family ................ 157 6 Extensions to the C++ Language ................... 255 7 GNU Objective-C runtime features.................. 267 8 Binary Compatibility ........................... 273 9 gcov—a Test Coverage Program ................... 277 10 Known Causes of Trouble with GCC ...............
    [Show full text]
  • Memory-Efficient Tail Calls in the JVM with Imperative Functional Objects
    Memory-efficient Tail Calls in the JVM with Imperative Functional Objects Tom´aˇsTauber1, Xuan Bi1, Zhiyuan Shi1, Weixin Zhang1, Huang Li2, Zhenrui Zhang2, Bruno C. d. S. Oliveira1 1 The University of Hong Kong, Pok Fu Lam Road, Hong Kong SAR 2 Zhejiang University, 38 Zheda Road, Hangzhou, China Abstract. This paper presents FCore: a JVM implementation of Sys- tem F with support for full tail-call elimination (TCE). Our compilation technique for FCore is innovative in two respects: it uses a new rep- resentation for first-class functions called imperative functional objects; and it provides a way to do TCE on the JVM using constant space. Unlike conventional TCE techniques on the JVM, allocated function objects are reused in chains of tail calls. Thus, programs written in FCore can use idiomatic functional programming styles, relying on TCE, and perform well without worrying about the JVM limitations. Our empirical results show that programs which use tail calls can run in constant space and with low execution time overhead when compiled with FCore. 1 Introduction A runtime environment, such as the JVM, attracts both functional programming (FP) languages’ compiler writers and users: it enables cross-platform develop- ment and comes with a large collection of libraries and tools. Moreover, FP lan- guages give programmers on the JVM other benefits: simple, concise and elegant ways to write different algorithms; high code reuse via higher-order functions; and more opportunities for parallelism, by avoiding the overuse of side-effects (and shared mutable state) [2]. Unfortunately, compilers for functional languages are hard to implement efficiently in the JVM.
    [Show full text]
  • Jekyll on Ios: When Benign Apps Become Evil
    Jekyll∗ on iOS: When Benign Apps Become Evil Tielei Wang, Kangjie Lu, Long Lu, Simon Chung, and Wenke Lee School of Computer Science, College of Computing, Georgia Institute of Technology ftielei.wang, kangjie.lu, long, pchung, [email protected] Abstract In addition to the standard security features like Ad- dress Space Layout Randomization (ASLR), Data Exe- Apple adopts the mandatory app review and code sign- cution Prevention (DEP), and Sandboxing, iOS enforces ing mechanisms to ensure that only approved apps can the mandatory App Review and code signing mecha- run on iOS devices. In this paper, we present a novel nisms [31]. App Review inspects every app submitted attack method that fundamentally defeats both mecha- by third parties (in binary form) and only allows it to nisms. Our method allows attackers to reliably hide ma- enter the App Store if it does not violate App Store’s reg- licious behavior that would otherwise get their app re- ulations [5]. To further prohibit apps distributed through jected by the Apple review process. Once the app passes channels other than the App Store (i.e., unsigned apps), the review and is installed on an end user’s device, it can the code signing mechanism disallows unsigned code be instructed to carry out the intended attacks. from running on iOS devices. As a result, all third-party The key idea is to make the apps remotely exploitable apps running on iOS devices (excluding jailbroken de- and subsequently introduce malicious control flows by vices [48]) have to be approved by Apple and cannot be rearranging signed code.
    [Show full text]
  • Selective Tail Call Elimination
    Selective Tail Call Elimination Yasuhiko Minamide Ins七i七u七e of In．forma七ion Sciences and Electronics University of Tsukuba and PRESTO， JST ISE－TR－03－192 Abstrac七 Tail calls are expected not to consume stack space in most functional languages． How－ ever， there is no support for tail calls in some environments． Even in such environments， proper tail calls can be implemented with a technique called a trampoline． To reduce the overhead of trampolining while preserving stack space asymptotically we propose selec－ tive tail call elimination based on an effect system． The effect system infers the number of successive tail calls generated by the execution of an expression， and trampolines are introduced only when the’ 凵@are necessary． 聰 1 Introduction Tail calls are expected not to consume stack space in most functional languages． lm－ plementation of proper tail calls requires some support from a target environment， but some environments including C and Java Virtual Machine （JVM） ［10］ do not provide such support． Even in such environments， proper tail calls can be implemented with a technique called a trampoline． However， the trampoline ．technique is based on a non一一 standard calling convention and is considered to introduce too much overhead． Thus， most compilers for such environments do not adopt trampolining and abandon proper tail calls ［2， 17， 3］． To solve this problem we selectively introduce trampolines based on an effect system． We consider a typed call－by－value language as a source language of selective tail call elimination． Effect
    [Show full text]
  • Mocfi: a Framework to Mitigate Control-Flow Attacks on Smartphones
    MoCFI: A Framework to Mitigate Control-Flow Attacks on Smartphones Lucas Davi1, Alexandra Dmitrienko2, Manuel Egele3, Thomas Fischer4, Thorsten Holz4, Ralf Hund4, Stefan Nurnberger¨ 1, Ahmad-Reza Sadeghi1;2 1CASED/Technische Universitat¨ Darmstadt, Germany 3University of California, Santa Barbara, USA flucas.davi,stefan.nuernberger,[email protected] [email protected] 2Fraunhofer SIT, Darmstadt, Germany 4Ruhr-Universitat¨ Bochum, Germany falexandra.dmitrienko,[email protected] fthomas.fischer,thorsten.holz,[email protected] Abstract based buffer overflows [4, 5], uncontrolled format strings vulnerabilities [23], or integer overflows [9]). Many current Runtime and control-flow attacks (such as code injec- systems offer a large attack surface, because they still use tion or return-oriented programming) constitute one of the software programs implemented in unsafe languages such most severe threats to software programs. These attacks as C or C++. In particular, modern smartphone platforms are prevalent and have been recently applied to smartphone like Apple’s iPhone and Google’s Android have recently applications as well, of which hundreds of thousands are become appealing attack targets (e.g., [25, 33, 26, 27, 43]) downloaded by users every day. While a framework for and increasingly leak sensitive information to remote adver- control-flow integrity (CFI) enforcement, an approach to saries (e.g., the SMS database [26]). prohibit this kind of attacks, exists for the Intel x86 plat- A general approach to mitigate control-flow attacks is the form, there is no such a solution for smartphones. enforcement of control-flow integrity (CFI) [1]. This tech- In this paper, we present a novel framework, MoCFI nique asserts the basic safety property that the control-flow (Mobile CFI), that provides a general countermeasure of a program follows only the legitimate paths determined against control-flow attacks on smartphone platforms by en- in advance.
    [Show full text]