HN
Today

The Fil-C Optimized Calling Convention

Fil-C introduces an ingenious calling convention designed for memory safety in C, even for adversarial code, without penalizing common, well-behaved calls. It leverages arithmetic signature encoding and complex ELF tricks to optimize direct function calls, showcasing a masterful application of low-level compiler techniques. Hacker News revels in this detailed exploration of performance-driven safety, applauding its technical depth and the individual effort behind it.

87
Score
15
Comments
#8
Highest Rank
10h
on Front Page
First Seen
May 18, 6:00 PM
Last Seen
May 19, 3:00 AM
Rank Over Time
981218141516202022

The Lowdown

Fil-C presents a sophisticated optimized calling convention aiming to enforce memory safety within C programs, even under deliberately "adversarial" conditions like misusing function pointers or mismatched signatures. The core challenge addressed is how to implement these robust safety checks without introducing significant performance overhead for the vast majority of legitimate function calls. The solution involves a multi-layered approach that prioritizes efficiency in the common case while ensuring safety when violations occur.

  • Adversarial C Safety: Fil-C's calling convention guarantees memory safety against common C misbehaviors, such as calling function pointers with incorrect signatures, passing wrong argument types or counts, or importing/exporting symbols with type mismatches. It either panics or defines safe behavior for these scenarios.
  • Optimized Common Paths: For typical, well-behaved function calls, Fil-C achieves near-native performance by passing arguments and return values in registers, minimizing overhead.
  • Generic Calling Convention: A robust, yet less efficient, generic calling convention serves as a universal fallback. It involves rigorous capability checks, temporary buffer allocation for arguments and return values, and "getter" calls for symbol resolution.
  • Register Calling Convention via Arithmetic Signatures: This optimization uses a 64-bit arithmetic encoding to represent function signatures. If the caller's expected signature matches the callee's encoded signature, a highly efficient fast_entrypoint is used. Otherwise, specialized thunks translate between calling conventions, leveraging the generic path. This yielded a >1% speed-up.
  • Direct Call Optimization with ELF Tricks: For direct function calls, Fil-C aims to completely bypass capability checks and symbol resolution by calling a signature-mangled implementation directly. This requires intricate ELF symbol manipulation, including weak/strong symbol rules and COMDAT handling, to ensure the correct implementation is called without infinite loops or NULL dereferences. This provided another >1% speed-up.
  • Performance and Safety Synergy: The project demonstrates that comprehensive memory safety for C can be achieved without major performance compromises, by intelligently deferring or eliminating checks in provably safe scenarios through deep compiler and linker integration. Ultimately, Fil-C's optimized calling convention transforms inefficient, check-heavy function calls into highly efficient, direct register-based transfers for the common case. This is accomplished through innovative arithmetic signature encoding and a sophisticated dance with ELF's symbol resolution mechanisms, proving that memory safety in C can coexist with performance.

The Gossip

Fil-C's Foundational Function

Many commenters sought to understand Fil-C's core motivation. The consensus among replies is that it aims to provide memory safety for existing C and C++ codebases, a significant endeavor given the inherent complexities of these languages. This goal resonates strongly with the HN audience.

Technical Deep Dive Dialogues

The discussion included detailed technical queries, such as clarification on the `my_thread` argument, which some felt could be more efficiently described as a reserved register. A challenging aspect raised is how to allow higher-level language runtimes (like interpreters) to inform Fil-C that their own checks obviate the need for duplicate, lower-level safety validations, a problem the author acknowledges as "super hard".

Singular Talent Saluted

There was widespread awe and admiration for Filip Pizlo, the main architect behind Fil-C, with many commenters surprised by the project's primarily solo development. The author modestly confirmed this, while acknowledging valuable contributions from a few others, highlighting the impressive scope for a single individual.

Contextual Critiques & Content Cues

Comments also provided context and additional resources for understanding Fil-C. One user shared a video explaining "InvisiCaps" as a core mechanism for tracking types and access rights. There was also a brief, unelaborated question about adapting Fil-C for non-threaded environments, reflecting diverse use-case considerations.