Re: Capabilities, Anybody?

On 2024-03-08 5:38 p.m., Lawrence D'Oliveiro wrote:

“Capabilities” are an old idea for doing memory protection by storing the
access rights in unforgeable descriptors that are given to authorized
processes. This way, there is no need for the traditional unprivileged-
versus-privileged-processor-mode concept; process A can have privileged
access to memory region X but not Y, while process B can have privileged
access to memory region Y but not X, so neither is “more” privileged than
the other: each one is trusted with just a limited set of privileged
functions.
 The idea fell out of use because of performance issues. But in these more
security-conscious times, the overhead seems more and more like a
reasonable price to pay for the greater control it offers. There is a
project called CHERI, whose concepts have been implemented in Arm’s
“Morello” chip.
 <https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/>

I may have a simple capabilities system going in with the system-on-chip for Bigfoot. Rather than tag every memory word, there is a tag per 64kB memory page. The tags can only be altered by the OS. The tag contains a key and privilege level, so the page access is restricted based on that. But I have the read-write-execute access rights in the page table because there may be more than one user app accessing the page and they may have different access rights. The combination of the tag in the memory system and the access rights from the page table are used.
I gather that capabilities are generally fine-grained, and capability pointers would be generated and handed out by the OS. What happens when a pointer is incremented? A call to the OS to do so?
I think a tag for every word would be costly. It might be easier to tag fetch units. Data being fetched in cache-line quantities.