Hardware Management
Hardware managment is especially tricky in a least-privilege capabilty system. At the interface with hardware, there are opportunities for software to escalate its privileges either through re-configuring hardware or by collaborating with hardware.
To better manage this complexity, we follow the following principles:
The capability system encodes the total convex hull of rights of a particular component, including the rights it gains by being able to configure and interact with hardware.
This is a bad idea. It allows privilege escalation in CHERI-land through hardware?
While not security relevant, for correctness reasons it may still be desirable to restrict the capabilities a component has access to to the minimum it actually uses, even if it can theoretically escalate.
Software
Overview
Init: Higher-level init process, hands caps to Hw manager
Hardware Manager: Handles caps for the entire hw space. Finds/knows about classes of devices or individual devices. The hardware manager can also be queried for available device classes/devices.
Device Class Manager: Handles caps for a class of devices with shared configurations/interfaces like PCIe or USB.
Device Manager: A device manager is in charge of managing a single “device”. A device manager may maintain caps for the configuration space of the device that a “driver” does not need. A device manager is also responsible for the higher-level management of the device, like initialization and recovery on error, or even just restarting the driver.
Driver: A driver is a translation unit between a device and some abstract interface. It allows higher-level software to interact with the device.
Init
|
|
Hardware Manager
|
+---------------------+------------------+
| | |
Device Class [PCIe] Device Class [USB] Device Manager
| | |
| | |
Device Manager Device Manager Driver...
| |
| |
Driver... Driver...
Edit/view: https://cascii.app/851b3
Open Questions
What about the platform? Is that a totally separate thing from the devices themselves? What is the difference between a PCIe NIC and a memory-mapped NIC? Is the PCIe NIC the same NIC just attached differently? Can/should we abstract away PCIe as an aspect of the platform?
How many scalls in a row are too many? How do they affect performance? What can be done to minimize their performance impact? (Maybe local stacks for high-speed invocations?)
Device Classes
Generic
Generic devices have no need for a class manager and are instead instantiated with a device manager directly.
PCIe
Student project?
USB
Student project?