Esthetics (or worse?) of Secure Pointers

[Chris Lattner]

> John  eventually convinced me that there's no way to decide
> at compile time what a subfunction's boundedness is. Bummer.
> This led us to the compile-the-whole-thing approach, which
> we all find scary. Hence, this request for more brain cells.

Hmmm... I suppose I was looking at it from a different perspective.  It
seems that if all pointers are bounded pointers, it becomes trivial to
propogate information about the "real" pointed to object (ie, because I
pointer could be at an offset from the 'real' object).  Now if you
introduce transitions between bounded and unbounded pointers, you somehow
have to do a search to resolve what an unbounded pointer points to.

The only practical way I can see to do this (although I don't really know
what I'm talking about, so please remember that.  :) is to compile a whole
program at a time with bounded pointer support.  This isn't neccesarily
hard, except that all of the libraries that it links to also have to be
compiled with bounded pointer support. 

If the libraries have a dual nature (ie, they have 2x the amount of code
as normal, one as bounded and one as unbounded), you wouldn't have a
problem.  In fact for a 'secure' OS distro, for example, this is perfectly
reasonable.

So I guess the question is, is it really reasonable to mix bounded and
unbounded code in the same dynamic instance of a program?  I assume that
bounded pointers would still have to be *somewhat* efficient to maintain
their usefulness... and don't transitions (even if you knew where they
are) significantly effect this performance?

-Chris

http://www.nondot.org/~sabre/os/
http://www.nondot.org/MagicStats/
http://www.nondot.org/~sabre/