Re: Segments

MitchAlsup1 <mitchalsup@aol.com> schrieb:

On Mon, 6 Jan 2025 22:02:30 +0000, Thomas Koenig wrote:
>

Hmm... a beginning of an idea (for which I am ready to be shot
down, this is comp.arch :-)
>
This would work best for languages which explicitly pass
array bounds or sizes (like Fortran's assumed size arrays,
or, if I read this correctly, Rust's slices).
>
Assume a class of load and store instructions containing
>
- One source or destination register
- One base register
- One index register
- One ubound register
>
Memory access is to base + index, with one additional point:
If index > ubound, then the instruction raises an exception.

>
Now, you are only checking the ubound and not the lbound; so,
you only stumble over ½ the bound errors.

If the base register does point to the start of the entity,
that would also be covered, at least for one-dimensional
arrays.

>
Where you should START is with a data structure that defines
the memory region::
>
     First Byte accessible Possibly lbound
     Last  Byte accessible Possibly ubound
     other stuff as needed
>
Then figure out how to efficiently perform the checks in ISA
of choice (or add to ISA).

One such example is defined in the Fortran standard, in the C
descriptors, from ISO_Fortran_binding.h .  There are two data
structures:  The CFI_dim_t structure, which describes (in integer
variables) the lower bound, the extend (a.k.a number of elements)
and the stride.  The CFI_cdesc_t structure then describes the
base address (a void *), the length of an individual element,
the version, the rank, the type, several attributes (is it
allocatable or a pointer) and the number of dimension.

You can see an example at

https://gcc.gnu.org/git/?p=gcc.git;a=blob_plain;f=libgfortran/ISO_Fortran_binding.h;hb=refs/heads/master

(Unfortunately, for historical reasons, gfortran uses another
format internally for array descriptors).

Hmm... let's look at a simplified example.

void bounds_error (const char *fmt, ...) __attribute__ ((format (printf, 1,2)))
  __attribute__ ((noreturn));

void set_element (double *a, unsigned long lower, unsigned long upper,
                  unsigned long n)
{
  if (n < lower || n > upper)
    bounds_error ("Error: %ld not between %ld and %ld", n, lower, upper);
  a[n - lower] = 1.0;
}

it is hard avoiding two comparisons and branches without having
some sort of range comparison, something like

cmpr Rdst,Rsrc,Rlow,Rhigh

which would then set conditional bits according to the different
ranges that Rsrc can be in.

This works less well with C's pointers, for which you would have
to pass some sort of fat pointer.  Compilers would have to make
sure that the address of the base object is passed.

>
I blame the programmers for not using FAT pointers (and then
teaching the compilers how to get rid of most of the checks.)
Nothing is preventing C programmers from using FAT pointers,
and thereby avoid all those buffer overruns.

They still have to do it by hand, it is much easier to do if
the language they use would offer it.