Re:Making Rust a Better Fit for Cheri and Other Platforms
by ltratt on Thursday April 14, 2022 @09:17AM
(#31026575)
It's absolutely possible, because the hardware doesn't care about your compilation model: you can mix normal pointers and capabilities as you wish. A challenge is that it's easy to go from capability -> pointer, but harder to go from pointer -> capability -- where do the extra capability bits come from? CHERI C provides a default ("inherit capability bits from the DDC") but I'm not sure that's what I would choose to do.
Re:Making Rust a Better Fit for Cheri and Other Platforms
by roblabla on Thursday April 14, 2022 @08:35AM
(#31026078)
Problem is, there's lots of unsafe code that casts *mut T to &mut T (usually after checking T is valid and whatnot). If &mut T didn't use capabilities, this kind of unsafe code would end up not taking advantage of the CHERI capability checking, which would be unfortunate.
Re:Making Rust a Better Fit for Cheri and Other Platforms
by djmcnab on Thursday April 14, 2022 @09:03AM
(#31026418)
I don't think this is actually a problem, since when casting from `&mut T` to `*mut T`, the returned pointer can only access the data (the T value) directly behind the reference.
The raw pointer would be synthesised with the capability for only the pointee of the original reference.
Now it's possible that CHERI would make this impossible, but it's definitely an angle worth recognising.