News for hackers. Stuff that matters.
Re:Securing tomorrow's software: the need for memory safety ... by pizlonator on Thursday February 27, 2025 @09:02PM (#43200837)
BTW I wrote another doc to try to explain what's happening. Hope this helps.

https://github.com/pizlonator/llvm-project-deluge/blob/delug...

Re:Securing tomorrow's software: the need for memory safety ... by woodruffw on Thursday February 27, 2025 @10:41PM (#43201466)
Thank you, I found this very helpful!
Re:Securing tomorrow's software: the need for memory safety ... by fweimer on Saturday March 01, 2025 @02:48PM (#43222941)
This is helpful as well because it at least alludes to the data structures: https://github.com/pizlonator/llvm-project-deluge/blob/delug...

One more thing: I assume the memory allocator has a somewhat efficient way to recover the pointer to the start of the allocation from a pointer inside it, for interoperability with the legacy C world. For recompiled code, this is not used because the capability is either tracked in registers, or loaded from the shadow memory.

Re:Securing tomorrow's software: the need for memory safety ... by pizlonator on Monday March 03, 2025 @09:52AM (#43242279)
The GC does marking using the capability pointer, not the pointer's integer value. So, there's no need for a general "hey GC, what object does this point into and where does it start" query.

The capability is the start of the allocation most of the time. It might have a bit in it saying that it's an aligned allocation (indicating alignment greater than 16 bytes), in which case there's an alignment hole between the start of what the GC thinks is the allocation and where the capability starts. Also capabilities might be global, meaning that there is no need to mark them. So, to mark a capability (which the runtime calls an "object"), the algorithm is something like:

    if (object->is_global)
        return;
    void* thing_to_mark;
    if (UNLIKELY(object->is_aligned))
        thing_to_mark = object & -object->alignment;
    else
        thing_to_mark = object;
    mark(thing_to_mark);