Hacker News Reader

Comment by TuxSH | Hacker News Reader

Also this is _de facto_ limited to userspace application for the mainstream OSes if my understanding is correct.

Reading Fil-C website's "InvisiCaps by example" page, I see that "Laundering Integers As Pointers" is disallowed. This essentially disqualifies Fil-C for low-level work, which makes for a substantial part of C programs.

(int2ptr for MMIO/pre-allocated memory is in theory UB, in practice just fine as long as you don't otherwise break aliasing rules (and lifetime rules in C++) - as the compiler will fail to track provenance at least once).

But that isn't really what Fil-C is aimed at - the value is, as you implied, in hardening userspace applications.

View on HN

It’s not so fundamental of a limitation.

Fil-C already allows memory mapped I/O in the form of mmap.

The only thing missing that is needed for kernel level MMIO is a way to forge a capability. I don’t allow that right now, but that’s mostly a policy decision. It also falls out from the fact that InvisiCaps optimize the lower by having it double as a pointer to the top of the capability. That’s also not fundamental; it’s an implementation choice.

It’s true that InvisiCaps will always disallow int to ptr casts, in the sense that you get a pointer with no capability. You’d want MMIO code to have some intrinsic like `zunsafe_forge_ptr` that clearly calls out what’s happening and then you’d use that wherever you define your memory mapped registers.

I'm curious, what's your strategy for integrating the GC with low-level code? I've been thinking about trying to use it for Arduino development. Mostly as a thought experiment for now (as I'm playing with Rust on RP2040).

If it's userlevel code, then it just works.

It's a concurrent GC.

If I wanted to go to kernel, I'd probably get rid of the GC. I've tweeted about what Fil-C would look like without GC. Short version: use-after-free would not trap anymore, but you wouldn't be able to use it to break out of the capability system. Similar to CHERI without its capability GC.

Arduino is kinda both. You have full control over the execution flow, but then you have to actually exercise the full control over the execution flow. The only major wrinkle are the hardware interrupts.

One interesting feature is that there might be some synergy there. The GC safepoints can be used to implement cooperative multitasking, with capabilities making it safe.

Can you "launder" pointers through integers just to do things like drop `const`? It's a very common pattern to have to drop attributes like `const` due to crappy APIs: `const foo a = ...; foo b = (foo *)(uintptr_t)a;`

Hopefully Pizlo will correct me if I get this wrong, but I don't think Fil-C's pointer tagging enforces constness, which isn't needed for C in any case. This C code compiles with no warnings and outputs "Howlong\n" with GCC 12.2.0-14 -ansi -pedantic -Wall -Wextra:

    #include <stdio.h>

    int main()
    {
      const char c[] = "Howling\n";
      char *p = (char*)c;
      p[4] = 'o';
      printf("%s", c);
      return 0;
    }

Somewhat to my surprise, it still compiles successfully with no warnings as C++ (renaming to deconst.cc and compiling with g++). I don't know C++ that well, since I've only been using it for 35 years, which isn't nearly long enough to learn the whole language unless you write a compiler for it.

Same results with Debian clang (and clang++) version 14.0.6 with the same options.

Of course, if you change c[] to *c, it will segfault. But it still compiles successfully without warnings.

Laundering your pointer through an integer is evidently not necessary.

Did you compile with -Wcast-qual?

No, that does give a warning.

Fil-C capabilities have a read only bit of this purpose.

Interesting, so you really can enforce constness on references? Does that mean the above code will crash on Fil-C?

I tried it and it doesn't crash when compiled with Fil-C, FYI. But I guess it wouldn't be too hard to implement.

Just using const in C isn’t enough, since C’a const is unsound, so I ignore it.

But if you try to write to a readonly global constant then you’ll panic. And there are a handful of ways to allocate readonly data via Fil-C’s APIs.

> Just using const in C isn’t enough, since C’a const is unsound, so I ignore it.

And now I have confused faces looking at me why I just laughed out loud.

> I don't know C++ that well, since I've only been using it for 35 years

Ok that got a chuckle out of me haha

> > I don't know C++ that well, since I've only been using it for 35 years, which isn't nearly long enough to learn the whole language unless you write a compiler for it.

No one person could write a compiler for it, and even if they could they would forget as much in doing so as they could learn.

Walter Bright did, although maybe C++ has gotten enough bigger since then that your statement has become true.

As kragen already posted, you can cast from const-pointer to non-const directly.

Not allowing a cast from integer to pointer is the point of having pointers as capabilities in the first place.

Central in that idea of capabilities is that you can only narrow privileges, never widen them. An intptr_t would in-effect be a capability narrowed to be used only for hashing and comparison, with the right for reading and writing through it stripped away.

BTW, if you would store the uintptr_t then it would lose its notion of being a pointer, and Fil-C's garbage collector would not be able to trace it.

The C standard allows casts both ways, but the [u]intptr_t types are optional. However, C on hardware capability architectures' (CHERI, Elbrus, I dunno about AS/400) tend to make the type available anyway because the one-way cast is so common in real-world code.

Yes. That works.

If the laundering through integers is syntactically obvious - obvious that the cast back from int used a int that obviously can from a pointer - then I allow it.

What do you need that for, why wouldn't `const foo * a = ...; foo * b = (foo *)a;` work?

I'll preface this by saying my experience is with embedded, not kernel, but I can't imagine MMIO is significantly different.

There would still be ways to make it work with a more restricted intrinsic, if you didn't want to open up the ability for full pointer forging. At a high level, you're basically just saying "This struct exists at this constant physical address, and doesn't need initialisation". I could imagine a "#define UART zmmio_ptr(UART_Type, 0x1234)" - which perhaps requires a compile time constant address. Alternatively, it's not uncommon for embedded compilers to have a way to force a variable to a physical address, maybe you'd write something like "UART_Type UART __at(0x1234);". I believe this is technically already possible using sections, it's just a massive pain creating one section per struct for dozens and dozens.

Unfortunately the way existing code does it is pretty much always "#define UART ((UART_Type*)0x1234)". I feel like trying to identify this pattern is probably too risky a heuristic, so source code edits seem required to me.

Check out this document to see how the Fil-C ports of Python and Perl and so on work:

https://github.com/mbrock/filnix/blob/main/ports/analysis.md

This is still within the userspace application realm but it's good to know that Fil-C does have explicit capability-preserving operations (`zxorptr`, `zretagptr`, etc) to do e.g. pointer tagging, and special support for mapping pointers to integer table indices and back (`zptrtable`, etc).

Yes, I think that's reasonable. I imagine you wouldn't have to extend Fil-C very much to sneak some memory-mapped I/O addresses into your program, but maybe having the garbage collector pause the program in the middle of an interrupt handler would have other bad effects. Like, if you were generating a video signal, you'd surely get display glitches.

You don't have to do int2ptr for mmio or absolute addresses, you can punt that to the linker.

    extern struct uart UART0;

Then place that symbol at address X in your linker script.

Reply on news.ycombinator.com