4 ms·

Hi, capability-security folk here. Have you considered adopting capability-security language for describing what's going on here? It seems to me that Mill porta

Hi, capability-security folk here. Have you considered adopting capability-security language for describing what's going on here? It seems to me that Mill portals are very much like capability-designed syscalls. In particular, I am reminded of the "no stale stack frame" rule from Monte [0], and its interesting justification: "Since Monte permits mutable state, one author’s code’s behavior could be affected by another author’s code running further up the frame stack. Stale frames make comprehension of code much harder as a result." I wish that we were having more conversations and classes like [1] to get knowledge of KeyKOS and other capability-safe kernels out to CPU makers. We have ideas to share! [0] http://monte.readthedocs.io/en/latest/semantics.html#scope-introduction-dismissal http://monte.readthedocs.io/en/latest/semantics.html#scope-i... [1] https://pdos.csail.mit.edu/6.828/2009/lec/l-microkernel.html https://pdos.csail.mit.edu/6.828/2009/lec/l-microkernel.html

willvarfar 9y ago
Ah well Norm Hardy (KeyKOS) is on team Mill; the Mill is very much a bunch of caps vets :) The Mill isn't a Capability-based Addressing machine, but it is very much a machine that hopes to push normal programs and operating systems in the Capability Object Model direction with first-class support. Now you are using a bugmenot login so I have no idea who you are, but if you're a caps vet we'd love to know your thoughts :)
- DonbunEf7 9y ago
  Curses, time to switch accounts. My thoughts are mostly that I don't want to wait a decade for a Mill. Find me at SPLASH/OCAP if you want to chat.
igodard 9y ago
The Mill grant-based model is semantically quite similar to capabilities, but it associates protection with the accessor (thread/turf) rather than the access (pointer/capability). This lets us preserve the size of a pointer, which no one knows how to do efficiently with capabilities. The difference between the two models is visible when you pass a graph structure across a protection boundary. With caps is is easy to pass the whole graph, and hard to pass only one node. With grants it is vice versa.

willvarfar 9y ago

Ah well Norm Hardy (KeyKOS) is on team Mill; the Mill is very much a bunch of caps vets :) The Mill isn't a Capability-based Addressing machine, but it is very much a machine that hopes to push normal programs and operating systems in the Capability Object Model direction with first-class support. Now you are using a bugmenot login so I have no idea who you are, but if you're a caps vet we'd love to know your thoughts :)

DonbunEf7 9y ago
Curses, time to switch accounts. My thoughts are mostly that I don't want to wait a decade for a Mill. Find me at SPLASH/OCAP if you want to chat.

igodard 9y ago

The Mill grant-based model is semantically quite similar to capabilities, but it associates protection with the accessor (thread/turf) rather than the access (pointer/capability). This lets us preserve the size of a pointer, which no one knows how to do efficiently with capabilities. The difference between the two models is visible when you pass a graph structure across a protection boundary. With caps is is easy to pass the whole graph, and hard to pass only one node. With grants it is vice versa.