<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hi Terence,</div><div><br></div><div><div>I think you're getting hung up on the details of the shadow stack collector. The shadow stack is a GC that is possible within this framework, but of course could be implemented without any special support. Its presence is more misleading than anything else. Taking a step back, the concepts are:</div><div><br></div><div><div>llvm.gcroot instructs the code generator --> My GC needs to be able to find this variable on the stack at runtime.</div><div>gc "x" instructs the code generator --> My GC will use the method "x" to find variables on the stack at runtime.</div><div><br></div><div>Typically, a metadata table (similar to exception handling tables) will be emitted. Its structure is fundamentally map<void*,list<int>>, where the key is the address of a safe point in code (for instance, the address following a 'call' instruction), and the ints indicate the offsets of the live roots within the stack frame. LLVM does not define such a data structure, but the runtime-specific Collector subclass and the GC runtime itself must agree to a common format in order to interoperate.</div><div><br></div><div>ShadowStackCollector uses a completely alternative methodology. A shadow stack could be implemented in user code without any special support. (Indeed, it is implemented entirely as an LLVM IR -> LLVM IR transformation!)</div><div><br></div></div></div><div><br></div><div>On Apr 21, 2008, at 19:12, Terence Parr wrote:</div><div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Apr 20, 2008, at 6:52 PM, Gordon Henriksen wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On 2008-04-20, at 21:05, Terence Parr wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><span class="Apple-style-span" style="-webkit-text-stroke-width: -1; ">how does the gc "shadow-stack" gcroot intrinsic work exactly? I couldn't read the assembly very well. Seems my example above wouldn't work would it unless i create/fill in a shadow stack record?</span></div></div></div></blockquote></div></div></blockquote></div><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"></blockquote></div><div></div></div></blockquote><div><br></div><div>'gc "shadow-stack"' in the LLVM IR instructs the code generator to automatically maintain the linked list of stack frames. You don't have to do anything to maintain these shadow stack frames except to keep your variables in the llvm.gcroot'd allocas. Essentially, it does this:</div><div><br></div><div> struct ShadowStackEntry {</div><div> ShadowStackLink *next;</div><div> const ShadowStackMetadata *metadata;</div><div> void *roots[0];</div><div> };</div></div></div></blockquote><div><br class="webkit-block-placeholder"></div><div>Ok, bear with me here...</div><div><br class="webkit-block-placeholder"></div>What's the difference between ShadowStackLink and ShadowStackEntry?</div><div></div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>This is an abstract type with a flexible array member.</div><div><br></div></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div> <span class="Apple-style-span" style="-webkit-text-stroke-width: -1; "> template <size_t count></span></div><div> struct Roots {</div><div> ShadowStackLink *next;</div><div> const ShadowStackMetadata *metadata;</div><div> void *roots[0];</div><div> };</div></div></div></blockquote></div></div></blockquote><div><br></div><div>This should be roots[n], which makes the difference.</div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div> ShadowStackEntry *shadowStackHead;</div><div> </div><div> // Defined by the code generator.</div><div> const ShadowStackMetadata f_metadata = ...;</div></div></div></blockquote><div><br class="webkit-block-placeholder"></div>Do you mean generated by my front end that emits IR or do you mean the backend? It seems that, since I read the source code and build the symbol table, I would need to build this stack frame type information for LLVM.</div><div></div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>No, the code generator injects this constant. The metadata records how many roots are in the entry, and also stores the 'metadata' parameter to llvm.gcroot if you provide one.</div><div><br></div></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div> <span class="Apple-style-span" style="-webkit-text-stroke-width: -1; "> void f() {</span></div><div> Roots<3> roots;</div><div> roots.next = shadowStackHead;</div><div> roots.metadata = f_metadata;</div><div> roots.roots[0] = NULL;</div><div> roots.roots[1] = NULL;</div><div> roots.roots[2] = NULL;</div></div></div></blockquote><div><br class="webkit-block-placeholder"></div>What are the three roots here? Not sure where anything but the next, metadata are coming from. So the gc "shadow-stack" generates that preamble code? That would make sense</div><div></div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>These would correspond to three gcroot allocas.</div><div><br></div></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div> shadowStackHead = (ShadowStackEntry *) &roots;</div><div> </div><div> ... user code ...</div></div></div></blockquote><div><br class="webkit-block-placeholder"></div>here is where my gcroots go then I guess.</div><div></div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>This is where your uses of them would occur. llvm.gcroot does not emit any code except the preamble.</div><div><br></div></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div> <span class="Apple-style-span" style="-webkit-text-stroke-width: -1; "> shadowStackHead = entry.next; // before any exit</span></div><div> return;</div><div> }</div></div></div></blockquote><div><br class="webkit-block-placeholder"></div>Can you tell me where to find ShadowStackMetadata? A search does not reveal it:</div><div><br class="webkit-block-placeholder"></div><div><div>/usr/local/llvm-2.2 $ find . -name 'ShadowStackMetadata*'</div></div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><br></div><div>This was pseudocode. The ShadowStackCollector actually does instantiate such llvm StructTypes, however; you can refer to its implementation.</div><div><br></div></div></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Taking a giant step back, I can build something similar to semispace.c myself so I'm in control of my world, right? i would set up the shadow stack using IR instructions and could avoid gcroot by notifying my collector as I see fit... </div><div><span class="Apple-style-span" style="-webkit-text-stroke-width: -1; "></span></div></div></blockquote><div><br></div><div>That's true; the shadow stack design is explicitly for uncooperative environments, after all.</div></div></div></blockquote><div><br class="webkit-block-placeholder"></div>The compiler plug-in for a GC is like a sophisticated macro that knows how to emit preambles and post ambles for each function that says it uses that particular GC, right? Does it do more than an include such as figuring out which alloca's I have that are pointers? If so, then why do I need to use gcroot instructions to identify roots? Seems like it would be much easier to understand to just have my output templates emit the preamble and so on. Oh, maybe the optimizer remove some stuff in there for what I think is a root is actually not around anymore.</div><div></div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>The shadow stack is a primitive form of GC with high runtime overhead. It's an easy way to bring up a new collector, and it is highly portable, but it's slow and not multithread-capable. This table is probably the best summary of the benefits of the GC infrastructure:</div><div><br></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><a href="http://llvm.org/docs/GarbageCollection.html#collector-algos">http://llvm.org/docs/GarbageCollection.html#collector-algos</a></blockquote><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><span class="Apple-style-span" style="-webkit-text-stroke-width: -1; ">When you want to eliminate the shadow stack overhead, you will need to (a.) use a conservative GC or (b.) emit stack frame metadata using the LLVM GC support.</span></div></div></div></blockquote><div><br class="webkit-block-placeholder"></div>Unfortunately, I'm thoroughly confused about who generates what. Who is supposed to generate the meta data types?</div></div></blockquote><div><br></div><div>Your code is responsible for defining the object model metadata (vtable pointers, class layouts, etc.).</div><div><br></div><div>For enumerating stack roots, the Collector plugin and the runtime must agree to a common format.</div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>If I am, that is fine, but I really can't find anything in the documentation that is a simple end to end C code -> IR example. Once I get one together, I'll put it in the book I'm writing. I've spent many hours reading and playing as much as I can, but it is still not clear; 'course I ain't always that bright. ;) Note that the paper by Henderson was extremely clear to me, so it's not the contents, it is the details of using LLVM to do GC.</div><div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><span class="Apple-style-span" style="-webkit-text-stroke-width: -1; ">Sorry I'm so lost...just trying to figure out what llvm does for me and what I have to do.</span></div></div></blockquote><div><br></div>No problem!</div><div><br></div><div>Generally speaking, LLVM is going to help you find roots on the stack, which is the part that the compiler backend <i>must</i> help with; the rest is your playground. </div></div></blockquote><div><br class="webkit-block-placeholder"></div>Is that because only code generation knows what roots exist after processing the IR?</div></div></blockquote><div><br></div><div>Only the code generator knows <i>where</i> the roots are after code generation (stack offsets, registers), or at what points the roots must be findable (at safe points).</div><div><br></div><div>It is of course possible to define user data structures to do this (this is what the shadow stack does), but that incurs significant overhead (4 + n stores + 2 loads per function call).</div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>The infrastructure is more suited toward interfacing with an existing GC rather than necessarily making writing a new runtime trivial. (See exception handling for precedent…)<br></div></div></blockquote></div><br><div>Well, writing a new garbage collector seems really straightforward (like to mark and sweep). LLVM will give me the roots and I am free to walk them. The part that I don't understand is who defines what metadata types and how exactly I make use of gcroot and LLVM's support. The concepts are clear, the details seem miles away ;)</div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><br></blockquote></div></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Thanks for all the help...</div><div><br class="webkit-block-placeholder"></div><div>Has anybody else on the list gotten a trivial GC'd language working I could look at? All go back to the scheme translator again to see what I can learn.</div></div></blockquote><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div></div></div><div apple-content-edited="true"> <span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Trebuchet MS; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Trebuchet MS; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Trebuchet MS; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; ">PyPy's used this, but LLVM isn't their best code generator. There are private projects as well.<br class="Apple-interchange-newline"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Trebuchet MS; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Trebuchet MS; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Trebuchet MS; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div><br></div><div>— Gordon</div></span></span></span></span></span></div></span> </div><br></body></html>