2 months ago
- Fil-C ensures memory safety via a capability system for pointers, dynamically tracking allowed objects and prohibiting out-of-bounds, use-after-free, and other unsafe accesses.
- InvisiCaps are the latest capability model, replacing PLUT, SideCaps, and MonoCaps, offering 64-bit pointers on 64-bit systems and reduced performance overhead to about 4x.
- InvisiCaps support meaningful union usage, thread safety, and flexible memory type reinterpretation without compromising safety.
- Each flight pointer has a trusted lower bound (for bounds checks) and an untrusted intval (the raw C pointer value); lower is immutable by the program.
- When pointers are stored to heap, the intval goes in the object payload and the lower in a separate aux allocation, keeping capabilities invisible to the program.
- Atomic pointers use atomic boxes for lock-free operations, while non-atomic pointers use a cheaper approach with aux allocations.
- Use-after-free is detected deterministically by setting the upper bound equal to the lower, causing a panic on access.
- The model is fanatically compatible, supporting even undefined behavior idioms, and is inspired by SoftBound and CHERI but with better thread safety and compatibility.