  Capability-based memory isolation is a promising new architectural primitive.
Software can access low-level memory only via capability handles rather than
raw pointers, which provides a natural interface to enforce security
restrictions. Existing architectural capability designs such as CHERI provide
spatial safety, but fail to extend to other memory models that
security-sensitive software designs may desire. In this paper, we propose
Capstone, a more expressive architectural capability design that supports
multiple existing memory isolation models in a trustless setup, i.e., without
relying on trusted software components. We show how Capstone is well-suited for
environments where privilege boundaries are fluid (dynamically extensible),
memory sharing/delegation are desired both temporally and spatially, and where
such needs are to be balanced with availability concerns. Capstone can also be
implemented efficiently. We present an implementation sketch and through
evaluation show that its overhead is below 50% in common use cases. We also
prototype a functional emulator for Capstone and use it to demonstrate the
runnable implementations of six real-world memory models without trusted
software components: three types of enclave-based TEEs, a thread scheduler, a
memory allocator, and Rust-style memory safety -- all within the interface of
Capstone.
