Capability-based memory isolation is a promising new architectural primitive. Software can access low-level memory only via capability handles rather than raw pointers, which provides a natural interface to enforce security restrictions. Existing architectural capability designs such as CHERI provide spatial safety, but fail to extend to other memory models that security-sensitive software designs may desire. In this paper, we propose Capstone, a more expressive architectural capability design that supports multiple existing memory isolation models in a trustless setup, i.e., without relying on trusted software components. We show how Capstone is well-suited for environments where privilege boundaries are fluid (dynamically extensible), memory sharing/delegation are desired both temporally and spatially, and where such needs are to be balanced with availability concerns. Capstone can also be implemented efficiently. We present an implementation sketch and through evaluation show that its overhead is below 50% in common use cases. We also prototype a functional emulator for Capstone and use it to demonstrate the runnable implementations of six real-world memory models without trusted software components: three types of enclave-based TEEs, a thread scheduler, a memory allocator, and Rust-style memory safety -- all within the interface of Capstone.

翻译：基于能力的内存隔离是一种有前景的新型架构原语。软件只能通过能力句柄而非原始指针访问底层内存，这为实施安全限制提供了自然接口。现有CHERI等架构化能力设计虽能提供空间安全性，但无法扩展到安全敏感型软件设计可能需要的其他内存模型。本文提出Capstone这一更具表现力的架构化能力设计，在无需依赖可信软件组件的无信任环境中支持多种现有内存隔离模型。我们展示了Capstone如何完美适配特权边界具有流动性（动态可扩展性）、需要时空双重内存共享/委托、且需在可用性与此类需求间取得平衡的应用场景。Capstone还可高效实现：我们给出实现草案，通过评估证明其在常见用例中开销低于50%。此外，我们为Capstone构建了功能模拟器原型，并以此证明在无可信软件组件条件下，可基于Capstone接口实现六种真实世界内存模型的可运行实例：三种类型的飞地式TEE、线程调度器、内存分配器，以及类Rust内存安全。