6 ms·

It will also effectively destroy performance for general purpose computing. Aside from secure enclaves and certain specific computing usages, it doesn't seem to

• ksec 5y ago
  >It will also effectively destroy performance for general purpose computing. Is that a confirmed statement or is that an assumption? Just wondering.
  • cperciva 5y ago
    It's an assumption, and so far it seems to be wrong. The whole point of having production boards is to allow for more testing of performance impacts; but evidence so far is that most applications see a single-digit percentage impact. Some applications may even see improved performance, since relying on hardware bounds checking can allow software bounds checking to be elided.
    • ksec 5y ago
      >see a single-digit percentage impact That seems like a very very good trade off! Do we know any downside to it? Sorry I tend to ask for cons when things sounds too good to be true. ( Apart from the need to recompile )
      • swetland 5y ago
        Pointers are 128bit (to be large enough to contain the range, permission, type, etc, as well as the address), so existing code will at a minimum need recompilation, but likely much C/C++ code that makes assumptions about sizes of pointers and integers and the ability to freely convert between them will need to be adjusted. Pointer-heavy data structures will see increases in memory pressure due to pointers doubling in size relative to typical modern 64bit platforms. Still pretty cool.
        • monocasa 5y ago
          The upper 64 bits doesn't contain the permissions directly, but a value to lookup in a PowerPC style hash page table for the permissions, range, type, etc. If it encoded it directly, it wouldn't be an object capability system. It only needs to be large enough to cover the number of objects in an address space that are covered by the scheme. It's 128 bit to then round that up to a power of two for hardware reasons but still have a 64but pointer. I could see a Cheri V2 that uses multi level schemes for both the object lookup and the offset address to pack it back into 64 bits, but that's added complexity that's not strictly needed for an MVP of test designs.
  • Findecanor 5y ago
    To get full protection also against dangling pointers to deallocated objects ("temporal safety"), a service similar not too unlike a garbage collector would have to be used. Several algorithms have been developed, and the best of those have had an average runtime overhead of around 5% in benchmarks of algorithms, but in some benchmarks the overhead has been over 25%. Then there is overhead for memory that has yet to be cleared for reuse. I haven't seen any benchmark of any real application. (I might just have missed it though)
    • khuey 5y ago
      CHERI doesn't tackle "temporal" safety, only "spatial" safety.
      • rst 5y ago
        It can be used as a basis for systems with temporal safety; the MS blog post here has a capsule description of how they're doing that.
• pjmlp 5y ago
  Performance in detriment of everything else is what brought us here in first place.