4 ms·

Wasm now supports multiple modules and multiple linear memories per module, so it ought to be quite possible to compile C to Wasm in a way that enforces C's obj

Wasm now supports multiple modules and multiple linear memories per module, so it ought to be quite possible to compile C to Wasm in a way that enforces C's object access rules, much like CHERI if perhaps not Fil-C itself.

IshKebab 11mo ago
You wouldn't be able to get quite as fine-grained. One memory per object is probably horrifically slow. And I don't know about Fil-C, but CHERI at least allows capabilities (pointers with bounds) to overlap and subset each other. I.e. you could allocate an arena and get a capability for that, and then allocate an object inside that arena and get a smaller capability for that, and then get a pointer to a field in that object and get capability just for that field.
- zozbot234 11mo ago
  One would probably just need to define WASM extensions that allow for such subsetting. Performance will probably be competitive with software implementations of CHERI (perhaps with varying levels of hardware acceleration down the road) which isn't that bad.
- Findecanor 11mo ago
  Fil-C has like one "linear memory" per object and each capability gives read/write access to the whole object. But Fil-C has its compiler which does analysis passes for eliding bounds-checks where they are not needed, and I think it could theoretically do a better job at that than a WASM compiler with multi-memories, because C source code could contain more information. Unlike WASM, but like CHERI, every pointer in memory is also tagged, and would lose its pointer status if overwritten by an integer, so it is still more memory-safe in that way.
  - IshKebab 11mo ago
    It has a separate address space for each object? That seems unlikely. Is it not pretty much a software implementation of CHERI?
pjmlp 11mo ago
Some WebAssembly runtimes now do support those parts of the specification.
favflam 11mo ago
The multiple linear memory is supported in wasi preview 3? I thought it was not supported as of preview 2.

IshKebab 11mo ago

You wouldn't be able to get quite as fine-grained. One memory per object is probably horrifically slow. And I don't know about Fil-C, but CHERI at least allows capabilities (pointers with bounds) to overlap and subset each other. I.e. you could allocate an arena and get a capability for that, and then allocate an object inside that arena and get a smaller capability for that, and then get a pointer to a field in that object and get capability just for that field.

zozbot234 11mo ago
One would probably just need to define WASM extensions that allow for such subsetting. Performance will probably be competitive with software implementations of CHERI (perhaps with varying levels of hardware acceleration down the road) which isn't that bad.
Findecanor 11mo ago
Fil-C has like one "linear memory" per object and each capability gives read/write access to the whole object. But Fil-C has its compiler which does analysis passes for eliding bounds-checks where they are not needed, and I think it could theoretically do a better job at that than a WASM compiler with multi-memories, because C source code could contain more information. Unlike WASM, but like CHERI, every pointer in memory is also tagged, and would lose its pointer status if overwritten by an integer, so it is still more memory-safe in that way.
- IshKebab 11mo ago
  It has a separate address space for each object? That seems unlikely. Is it not pretty much a software implementation of CHERI?

pjmlp 11mo ago

Some WebAssembly runtimes now do support those parts of the specification.

favflam 11mo ago

The multiple linear memory is supported in wasi preview 3? I thought it was not supported as of preview 2.