The Mill grant-based model is semantically quite similar to capabilities, but it associates protection with the accessor (thread/turf) rather than the access (pointer/capability). This lets us preserve the size of a pointer, which no one knows how to do efficiently with capabilities.
The difference between the two models is visible when you pass a graph structure across a protection boundary. With caps is is easy to pass the whole graph, and hard to pass only one node. With grants it is vice versa.
Re:Mill CPU Inter-Process Communication
by willvarfar on Monday October 09, 2017 @02:24AM
(#15431904)
Ah well Norm Hardy (KeyKOS) is on team Mill; the Mill is very much a bunch of caps vets :)
The Mill isn't a Capability-based Addressing machine, but it is very much a machine that hopes to push normal programs and operating systems in the Capability Object Model direction with first-class support.
Now you are using a bugmenot login so I have no idea who you are, but if you're a caps vet we'd love to know your thoughts :)
"Since Monte permits mutable state, one author’s code’s behavior could be affected by another author’s code running further up the frame stack. Stale frames make comprehension of code much harder as a result."
I wish that we were having more conversations and classes like [1] to get knowledge of KeyKOS and other capability-safe kernels out to CPU makers. We have ideas to share!
[0] http://monte.readthedocs.io/en/latest/semantics.html#scope-i...
[1] https://pdos.csail.mit.edu/6.828/2009/lec/l-microkernel.html