Re: Arbitrary Sandbox

[Robert A Duff <bobduff@shell01.TheWorld.com>]

"Randy Brukardt" <randy@rrsoftware.com> writes:

>> You mean "already there" in 386/pentium?  Languages don't use it because
>> it's inefficient, and because whatever segmentation can do can be done
>> better by some combination of software and paging.
>
> The only reason it is "inefficient" was because OSes didn't use it.

And OSes didn't use it because it for the reasons I stated.  It's a
cyclic thing -- I'm sure Intel could have made it faster if there
was demand.

But there's an inherent inefficiency in segmentation: the size of
all your pointers doubles.  Or to look at it the other way around,
for any given amount of address space, it's split inconveniently.
With the amount of memory I can afford today, a 32-bit segment
number plus a 32-bit offset wouldn't be enough (both too few
segments and segment size too small).  64-bit seg num plus
64-bit offset?  OK, big enough, but inefficient.  64-bit flat
address space: perfect!  ;-)

>... That is, 
> it was quite efficient on an 386 (the only big expense occurs when reloading 
> segment registers, and that was something that occurred very rarely in the 
> two-segment model we used).

OK, I have no idea what two-segment model you used.  I was picturing
some sort of one-heap-object-per-segment model, and that sort of
thing, which some folks have advocated as a "solution" to the
problem of indexing out of bounds in languages that don't
require detection of that.

> As far as "software" and "paging" being able to do anything, this makes no 
> sense at all. Pages on the x86 architecture don't (or at least didn't until 
> fairly recently) have any memory permissions associated with them, so it was 
> impossible to use that to prevent executing data.

They had read/write bits and user/supervisor bits (per page) as far
back as 80386.  You're right that execute permission was a glaring
omission.  And even that isn't such a big deal if you use languages
that have array bounds checking -- like Ada (to bring this slightly
back on topic!).  Note that a no-execute stack doesn't prevent
security problems if you can overwrite return addresses -- you
can make them point to snippets of legitimate (executable) code.

But if you allow me to forget about x86 misfeatures, I stand by my
statement, "whatever segmentation can do can be done better by some
combination of software and paging" -- assuming a well designed
paging system.  And assuming well designed programming languages!

- Bob