diff --git a/images/CapabilityHandles.svg b/images/CapabilityHandles.svg index 0e015a7..29c8291 100644 --- a/images/CapabilityHandles.svg +++ b/images/CapabilityHandles.svg @@ -1,4 +1,4 @@ -
Heap Reference
Heap Object
Sandbox Lookup Table
Existing Sandbox
Using Capabilities
\ No newline at end of file +
Heap Reference
Heap Object
Sandbox Lookup Table
Existing Sandbox
Using Capabilities
\ No newline at end of file diff --git a/images/ContextsAndIsolates.svg b/images/ContextsAndIsolates.svg index 9af56ce..282fe43 100644 --- a/images/ContextsAndIsolates.svg +++ b/images/ContextsAndIsolates.svg @@ -1,4 +1,4 @@ -
Isolate
Secure CHERI
Context
Context
Compartments
Isolate
Compartments
Isolate
Context
Lightweight
CHERI Isolate
Lightweight
CHERI Isolate
Lightweight
CHERI Isolate
Secure CHERI
Context
Secure CHERI
Context
Context
Context
Context
Context
Context
\ No newline at end of file +
Isolate
Context
Compartments
Isolate
Compartments
Isolate
Lightweight
CHERI Isolate
Secure CHERI
Context
Context
Lightweight
CHERI Isolate
Context
Lightweight
CHERI Isolate
Context
Secure CHERI
Context
Secure CHERI
Context
Context
Context
Context
\ No newline at end of file diff --git a/images/hybridV8.svg b/images/hybridV8.svg new file mode 100644 index 0000000..c108df9 --- /dev/null +++ b/images/hybridV8.svg @@ -0,0 +1,4 @@ + + + +
Privileged Space
Privileged Space 2
Sandboxed Space
Sandboxed
Object
Pointer Table
Privileged
Object
V8 memory layout with parallel units of work (Contexts/Isolates),
showing existing sandbox infrastructure in solid lines and
prospective hybrid CHERI improvements in dashed lines
Context/Isolate n
n-1
n-2
n-3
n+1
n+2
n+3
(3)
Sandboxed space becomes hybrid compartment boundary
(1)
Contexts/Isolates become Hybrid compartments
(2)
Hybrid capabilities
replace Sandbox table
lookups
\ No newline at end of file diff --git a/poster.odg b/poster.odg index f95a3d8..6794d19 100644 Binary files a/poster.odg and b/poster.odg differ