I was reading Capability-Based Computer Systems[1] on the bus this morning, and had some thoughts regarding W7, my plan to implement it in Haskell, and ideas for a capability-enabled hypervisor. Here's some of those notes (handily written down on index cards for future reference).

Capabilities hypervisor

• It seems that applications (I'll call them unikernels for lack of a better term) running on the hypervisor might be implemented in some type of virtual machine. It would be best if this virtual machine could be targeted by LLVM, but I'm not sure that's possible. This lets me implement capability registers as a "hardware" feature.

• Memory space: at first, my thought was to dedicate physical memory to a unikernel. However, this doesn't fit with the capability model in which capabilities and memory are context-independent: a unikernel should be able to grant capabilities to its memory to other unikernels. More specifically, memory should be per-object, and a procedure should be able to grant capabilities to other procedures for the objects that it has rights to. I'll need to work out a suitable proxy scheme for this by which proxy objects are created to grant access to.

• Filesystem isolation: disk images for unikernel, copy-on-write for sharing, snapshotting for persistence.

• Forking: a unikernel can create a new slot within its resource limit group.

Some quotes

On address spaces:

Every procedure can have, in fact, its own address space.

On why my original idea of per-unikernel dedicated memory is wrong:

A capability system provides a dynamically-changing address space; it changes whenever the program changes a capability register.

On the relationship between processes and memory:

A capability, however, is not process-local. Capabilities are context independent; that is, the segment addressed by a capability is independent of the process using that capability. A process can share a segment by copying or sending a capability from its capability list to the capability list of a cooperating process. Each of the processes can then access the segment.

Rethinking filesystem ideas

Memory is context independent. What if filesystems were too? Maybe this applies to file objects (directories, regular files, pipes, etc...)

This approach would work well with a hardware approach that doesn't use the POSIX file model; that model assumes a shared file system. It might be best to just rethink this to get the model that works for a unikernel. I wonder if a CAS system would be useful here.

References

1. H. M. Levy. Capability-Based Computer Systems. Digital Equipment Corporation 1984. ISBN 0-932376-22-3.