4 ms·

If you are using vendors' proprietary compilers in place of Gcc, it is purely masochism.

Jtsummers 4y ago
Vendor compilers are common, if not typical, for embedded and safety-critical systems. It's not masochism since they work, and in my experience they work quickly to address any compiler bugs you may discover and report. This is also true for Ada, C++, and Fortran in that domain.
- abrawill 4y ago
  If the hardware is exotic I guess you’d have no choice. But for security critical don’t you run the risk of relying on obscurity rather than security due to the niche-ness of your stack? What does a vendor compiler do or do better than a compatible generic one?
  - Jtsummers 4y ago
    When you get a critical system certified for fielding you aren't just certifying the source code, but the actual executable and build process and test process and other things. This requires reproducibility for years to come. Choosing generic compilers may work in dev and parts of test, but not for actual deployment as a consequence (or it doesn't work well). Suppose you picked clang 11 several years back. Now you need to do an update to the system, you can still use clang 11, but not clang 14 at least not without doing a comprehensive recertification process. Also, if an issue is discovered in clang 11 it's likely been fixed in clang 14, but again you have to get your system recertified with clang 14. And that's if the issue is fixed, it may still exist. With a vendor supplied compiler you can say, "We're using version 11.2". A year or two later an issue is discovered, the vendor will backport a fix to 11.2 giving you 11.2.1 which is much less effort for recertification. You aren't depending on the kindness of strangers (a terrible strategy) because you're actually paying someone to do the work.
    - abrawill 4y ago
      That explains a lot! Never worked with certified code, but I see how it makes sense. Do the vendor compilers have a very focused feature set as a result? To reduce both test surface area and chance of expensive mistakes?
      - moloch-hai 4y ago
        Mainly their own costs. They have a captive market, and tooling is a "cost center".
phoehne 4y ago
Some vendors base their compilers on GCC or Clang. But if you're not using their provided compilers, you either need to 1) be willing to shoulder the expense of making changes to GCC or Clang for whatever you're adding to the silicon in terms of instructions, and 2) be willing to get your combination of RTOS and compiler re-validated for the safety or operational standard on which you need to deliver. But even if you do use GCC or Clang, it doesn't change the mechanics of C++ as a poor language for embedded or operating system work. It just means you have the same choices (e.g. limited support for containers and strings, no exceptions, limited smart pointers, etc.) and you're making that choice based on GCC or Clang's limits.
- moloch-hai 4y ago
  Maybe you should explain to Andreas how C++ was such a bad choice for SerenityOS. Or to authors of the various RTOSes coded in it.
  - phoehne 4y ago
    It's not impossible. Other people have done it. Some have done it with a minimal kernel or micro-kernel in C and then services on top of that in C++. Just doing a quick perusal of their code base, the low level stuff is functions and structs. So, yes, it is a .cpp but not that different from the code you'd write if it were a .c. And it appears they're turning off exceptions and the standard library (which is completely reasonable). They probably have some additional coding standard (internally) like you can't use anything with a constructor in certain contexts, etc. And on a validated RTOS - it might be in C++ under the covers. The examples that come to my mind aren't. But the world is a big and magical place, so I can't say for certain on every RTOS. The F35 uses C++ and a set of very restrictive internal coding standards built on https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C. And no one will die if their copy of Serenity OS crashes.
    - pjmlp 4y ago
      If it is compiled by a C++ compiler, it is C++ regardless of the language features being used. Regarding language guides, C doesn't stop being C, even when castrated via MISRA-C.

Vendor compilers are common, if not typical, for embedded and safety-critical systems. It's not masochism since they work, and in my experience they work quickly to address any compiler bugs you may discover and report. This is also true for Ada, C++, and Fortran in that domain.

abrawill 4y ago
If the hardware is exotic I guess you’d have no choice. But for security critical don’t you run the risk of relying on obscurity rather than security due to the niche-ness of your stack? What does a vendor compiler do or do better than a compatible generic one?
- Jtsummers 4y ago
  When you get a critical system certified for fielding you aren't just certifying the source code, but the actual executable and build process and test process and other things. This requires reproducibility for years to come. Choosing generic compilers may work in dev and parts of test, but not for actual deployment as a consequence (or it doesn't work well). Suppose you picked clang 11 several years back. Now you need to do an update to the system, you can still use clang 11, but not clang 14 at least not without doing a comprehensive recertification process. Also, if an issue is discovered in clang 11 it's likely been fixed in clang 14, but again you have to get your system recertified with clang 14. And that's if the issue is fixed, it may still exist. With a vendor supplied compiler you can say, "We're using version 11.2". A year or two later an issue is discovered, the vendor will backport a fix to 11.2 giving you 11.2.1 which is much less effort for recertification. You aren't depending on the kindness of strangers (a terrible strategy) because you're actually paying someone to do the work.
  - abrawill 4y ago
    That explains a lot! Never worked with certified code, but I see how it makes sense. Do the vendor compilers have a very focused feature set as a result? To reduce both test surface area and chance of expensive mistakes?
    - moloch-hai 4y ago
      Mainly their own costs. They have a captive market, and tooling is a "cost center".

phoehne 4y ago

Some vendors base their compilers on GCC or Clang. But if you're not using their provided compilers, you either need to 1) be willing to shoulder the expense of making changes to GCC or Clang for whatever you're adding to the silicon in terms of instructions, and 2) be willing to get your combination of RTOS and compiler re-validated for the safety or operational standard on which you need to deliver. But even if you do use GCC or Clang, it doesn't change the mechanics of C++ as a poor language for embedded or operating system work. It just means you have the same choices (e.g. limited support for containers and strings, no exceptions, limited smart pointers, etc.) and you're making that choice based on GCC or Clang's limits.

moloch-hai 4y ago
Maybe you should explain to Andreas how C++ was such a bad choice for SerenityOS. Or to authors of the various RTOSes coded in it.
- phoehne 4y ago
  It's not impossible. Other people have done it. Some have done it with a minimal kernel or micro-kernel in C and then services on top of that in C++. Just doing a quick perusal of their code base, the low level stuff is functions and structs. So, yes, it is a .cpp but not that different from the code you'd write if it were a .c. And it appears they're turning off exceptions and the standard library (which is completely reasonable). They probably have some additional coding standard (internally) like you can't use anything with a constructor in certain contexts, etc. And on a validated RTOS - it might be in C++ under the covers. The examples that come to my mind aren't. But the world is a big and magical place, so I can't say for certain on every RTOS. The F35 uses C++ and a set of very restrictive internal coding standards built on https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C. And no one will die if their copy of Serenity OS crashes.
  - pjmlp 4y ago
    If it is compiled by a C++ compiler, it is C++ regardless of the language features being used. Regarding language guides, C doesn't stop being C, even when castrated via MISRA-C.