sr (nobody.delete@this.nowhere.com) on September 25, 2021 10:19 am wrote:
>
> Main point weren't, and still isn't security from other processes.

For some that is the main point. It's often a design goal. Everybody doing SAS systems, everybody who work on security without any other real goal, people like that.

> Main point of segmentation is to protect your own code from itself.

No.

If you use segments for that, you're just being completely stupid. The overhead is just too high, the complexity requirements are too big.

Seriously.

Once it's about "protect against mistakes", and once you admit that and make it part of the fundamental design (rather than some security thing), the goals change radically, and so does the solutions.

Face it, this is one of the fundamental reasons that paging has. Why? Because virtual memory using paging ends up largely usingh a sparse address space, and debuggability is exactly one of the advantages: it's not about "security", but it's about "wild pointers have much bigger chance of flagging errors".

And you will find a lot of tools that historically used that to good effect, by intentionally spreading out allocations and using guard pages etc. It's very wasteful of VM space (and TLB resources), and it's statistical (you'd put some allocations at beginning of page boundaries, others at the end), but it's quite effective in practice - and it works without special hardware.

The ARM pointer coloring and memory tagging is a very natural extension of that, allowing for finer granularity than one page. It's still statistical in that it doesn't give hard guarantees about incorrect accesses, so it's not some hard security boundary. But that's exactly why it works better. You can enable and disable it dynamically without big costs in code generation, and even when enabled it's actually quite low-cost.

And I think that's fairly fundamental. You get lower overheads by "cheating". In this case, the cheat is that it's not about some hard security, it's about debuggability and about finding software errors early. And that "cheat" fundamentally changes the picture.

And part of the changed picture change is realizing that "segments are stupid, because they are too much of a straight jacket".

Linus