• 0 Posts
  • 15 Comments
Joined 11 months ago
cake
Cake day: July 27th, 2023

help-circle
  • This is a use-after-free, which should be impossible in safe Rust due to the borrow checker. The only way for this to happen would be incorrect unsafe code (still possible, but dramatically reduced code surface to worry about) or a compiler bug. To allocate heap space in safe Rust, you have to use types provided by the language like Box, Rc, Vec, etc. To free that space (in Rust terminology, dropping it by using drop() or letting it go out of scope) you must be the owner of it and there may be current borrows (i.e. no references may exist). Once the variable is droped, the variable is dead so accessing it is a compiler error, and the compiler/std handles freeing the memory.

    There’s some extra semantics to some of that but that’s pretty much it. These kind of memory bugs are basically Rust’s raison d’etre - it’s been carefully designed to make most memory bugs impossible without using unsafe. If you’d like more information I’d be happy to provide!










  • The issue is not just that a bad update went out. Freak accidents can happen. Software is complicated and you can never be 100% sure. The problem is the specifics. A fat finger should never be able to push a bad update to a system in customers’ hands, forget a system easily capable of killing people in a multitude of ways. I’m not quite as critical as the above commentor but this is a serious issue that should raise major questions about their culture and procedures.

    This isn’t just some website where a fat finger at worst means the site is down for a while (assuming you do the bare minimum and back up your db). This is a vehicle. That’s what they meant about the CAN bus - not that that’s really a concern when the infotainment system just gets bricked, but that they have such lax procedures around software that touches a safety-critical system.

    Having systems in place to ensure only tested, known good builds are pushed is pretty damn basic safety practice. Swiss cheese model. If they can’t even handle the basics, what other bad practices do they have?

    Again, not that I think this is necessarily as bad as the other person - perhaps this is the only mistake they’ve made in their safety procedures and otherwise they’re industry leaders - we don’t know that yet. But this is extremely concerning and until proven otherwise should be investigated and treated as a very serious safety violation. Safety first.


  • No, and the above commentor is a little mixed up. While we originally thought the benefit of RISC CPUs was their smaller instruction set - hence the name - it’s turned out that the gains really come from a couple other things common to RISC architectures. In x86 pretty much every instruction can reference memory directly, but in RISC architectures you can only do it from a few specific instructions. Modern RISC architectures actually tend to have a lot of instructions, so RISC means something more like “load/store architecture” nowadays.

    Another big part of RISC architectures is they try to make instruction fetch+decode as easy as possible. x86 instructions are a nightmare to decode and that adds a lot of complexity and somewhat limits optimization opportunities. There’s some more to it, like how RISC thinks about the job of the compiler, but in my experience load/store and ease of fetch+decode are the main differentiators for RISC.

    More towards your question, a lot of the issues with running x86 programs on ARM (really running any program on a different architecture than it was compiled for) is that it will likely depend on very specific behaviors that may not be the same across architectures and may be computationally expensive to emulate. For some great write-ups about that kind of thing check out the Dolphin (Wii emulator) blog posts.