Re: Beware: Rep spec on an enumeration type causes code explosion

[Ken Garlington <kennieg@nospam.flash.net>]

John G. Volan wrote:
> 
> Joe Gwinn wrote:
> >
> > I have to disagree somewhat.  We were using enumeration types as message
> > type IDs all over the place, not just at the edges.  For safety-critical
> > messages, the enumerations are not permitted to be numerically contiguous,
> > being required to differ in at least four bits from all other message type
> > integer codes.  This 4-bit requirement is intended to greatly reduce the
> > probability of message spoofing.  (I know this isn't by itself
> > sufficient.  This isn't the entire defense, only the part relevant to the
> > current issue.)
> 
> I don't see how this requirement conflicts with the idiom I sketched
> before (derive a "holey" enumeration type from a parent "contiguous"
> enumeration type, and rely on Ada type conversions to provide the
> necessary mapping).  Your program only needs to deal with these "secure"
> but "holey" message id bit patterns at its edges, where it receives and
> unpacks input messages (whose provenance may be questionable) and where
> it must pack up and transmit output messages (and establish their
> provenance). 

In Wichmann's paper, the use of "holey" booleans was to catch local
memory
faults, so this technique is not necessarily limited to "edges".

Of course, is it worth protecting this use of local memory, but not all
the
others? I'm skeptical...