Re: Segments

Scott Lurndal <scott@slp53.sl.home> schrieb:

Michael S <already5chosen@yahoo.com> writes:

On Tue, 07 Jan 2025 14:43:02 GMT
scott@slp53.sl.home (Scott Lurndal) wrote:
>

Thomas Koenig <tkoenig@netcologne.de> writes:

Scott Lurndal <scott@slp53.sl.home> schrieb:
 

Assume a class of load and store instructions containing
>
- One source or destination register
- One base register
- One index register
- One ubound register 

>
See aforementioned CHERI. 

>
CHERY targets C, which on the one hand, I understand (there's a
ton of C code out there), but trying to retrofit a safe memory
model onto C seems a bit awkward - it might have been better to
target a language which has arrays in the first place, unlike C.
>
The floating point size is weird (and also does not catch all
errors, such as writing one element past a huge array).
>
I haven't seen any consideration of how CHERI would integrate
with languages which have multidimensional arrays.  How would
>
 do j=1,10
   do i=1,11
     a(i,j) = 42.
   end do
 end do
>
interact with Cheri if a was a 10*10 array ?  Would it be
necessary to create a capability for a(:,j)? 

 
A multidimensional array is a single contiguous
blob of memory, the capability would encompass the
entire region of memory containing the array.

>
Then out of bound access like a(9,11) would not be caught.
I don't know if it has to be caught by Fortran rules. It is certainly
caught both in Matlab and in Octave. And Matlab has Fortran roots.

And vice versa, Fortran 90 borrowed heavily from Matlab :-)

Out-of-bounds-accesses are an error in Fortran, but the language
does not require.

A compiler is free to create row or column capabilities for C or
FORTRAN if the goal is more than just memory safety.

Would this be reasonably efficient?

Looking at an extreme case, the straightforward matrix
multiplication below (including some initialization so it's
self-contained)

      program main
      implicit none
      real a(0:2,0:2), b(0:2,0:2), c(0:2,0:2)
      integer i,j,k
      do i=0,2
         do j=0,2
            a(i,j) = 2*i + j
            b(i,j) = i - j
            c(i,j) = 0
         end do
      end do
      do j = 0, 2
         do k = 0,2
            do i = 0, 2
               c(i,j) = c(i,j) + a(i,k) * b(k,j)
            end do
         end do
      end do
      print *,c
      end

gives us, in f2c translation to C of the three nested matmul loops,

    for (j = 0; j <= 2; ++j) {
        for (k = 0; k <= 2; ++k) {
            for (i__ = 0; i__ <= 2; ++i__) {
                c__[i__ + j * 3] += a[i__ + k * 3] * b[k + j * 3];
            }
        }
    }

(yes, any bounds checking should have been moved outside the loops :-)
how could capabilities be used to detect bounds violations for all
indices on each access?

And what would the effort be?  Can they be created in the time
for a simple pointer addition, or is something from the OS required?
Would this require something like a "pointer to pointer"?

(I have to admit that I haven't read a lot of CHERI, but what I
have read makes me supect that the designers didn't really have
multi-dimensional arrays in mind; but then neither did the
designers of C, and CHERI is certainly C-centered).