Re: Capabilities, Anybody?

Robert Finch wrote:

 In the past, capability machines wanted to use capabilities for all relocation and all protection. As long as this is the case, an applica-
tion has an unbounded need for capabilities.

It seems like it would have a lot of overhead, but it might be worth it for security.

 You can grant this with limited capabilities (top 4-odd bits) only when
you have a means to load a new capability into a known <capability> base
register[i]. Since this is privileged data, either the specified function-
ality of this instruction is precisely specified and operates with access to GuestOS address space.....it is difficult to imagine how to add Hyper-
Vision on top of GuestOS supervision.
{{Or do you intend to void Hypervisors?}}

I got the impression that with capabilities processor modes may not be necessary. I think the distinction between hypervisor / supervisor may be lost. Not sure that is a good idea.

Hypervisors are absolutely necessary if you want high RAS where a GuestOS may
crash without taking the system down. Does GuestOS use capabilities supplied
by HyperVisor for which it has no visibility ?? just prescribed uses ??
Consider a ECC error in a Capability and someone trying to use it.
Is the error charged to GuestOS who owns and manages the capability ??
or the application who is only following the prescribed uses of the
capability ?? {{The "why shoot the messenger/innocent" problem.}}