Hardware Management

Hardware managment is especially tricky in a least-privilege capabilty system. At the interface with hardware, there are opportunities for software to escalate its privileges either through re-configuring hardware or by collaborating with hardware.

To better manage this complexity, we follow the following principles:

  • The capability system encodes the total convex hull of rights of a particular component, including the rights it gains by being able to configure and interact with hardware.

    • This is a bad idea. It allows privilege escalation in CHERI-land through hardware?

    • While not security relevant, for correctness reasons it may still be desirable to restrict the capabilities a component has access to to the minimum it actually uses, even if it can theoretically escalate.

Software

Overview

  • Init: Higher-level init process, hands caps to Hw manager

  • Hardware Manager: Handles caps for the entire hw space. Finds/knows about classes of devices or individual devices. The hardware manager can also be queried for available device classes/devices.

  • Device Class Manager: Handles caps for a class of devices with shared configurations/interfaces like PCIe or USB.

  • Device Manager: A device manager is in charge of managing a single “device”. A device manager may maintain caps for the configuration space of the device that a “driver” does not need. A device manager is also responsible for the higher-level management of the device, like initialization and recovery on error, or even just restarting the driver.

  • Driver: A driver is a translation unit between a device and some abstract interface. It allows higher-level software to interact with the device.

                             Init
                               |
                               |
                       Hardware Manager
                               |
         +---------------------+------------------+
         |                     |                  |
Device Class [PCIe]   Device Class [USB]   Device Manager
         |                     |                  |
         |                     |                  |
  Device Manager        Device Manager        Driver...
         |                     |
         |                     |
     Driver...             Driver...

Edit/view: https://cascii.app/851b3

Open Questions

What about the platform? Is that a totally separate thing from the devices themselves? What is the difference between a PCIe NIC and a memory-mapped NIC? Is the PCIe NIC the same NIC just attached differently? Can/should we abstract away PCIe as an aspect of the platform?

How many scalls in a row are too many? How do they affect performance? What can be done to minimize their performance impact? (Maybe local stacks for high-speed invocations?)

Device Classes

Generic

Generic devices have no need for a class manager and are instead instantiated with a device manager directly.

PCIe

Student project?

USB

Student project?