Project
hardware-enforced compartments inside one C process
IA2 splits a C or C++ program into compartments where the build already drew boundaries, at its shared libraries, and has the CPU enforce them: memory protection keys on x86-64, memory tagging on 64-bit Arm. One process, one address space, no messages.
main.c
x180x0100000000000000__wrap_start_plugin
save · switch stacks · scrub · movz x18 · callplugin.c
x180x0200000000000000secretclean_exitplugin_secretEvery load and store IA2's compiler emits carries x18's tag in the top byte of its pointer, and the processor compares that tag with the tag on the 16 bytes it reaches. Equal, the access goes ahead; different, it faults at that instruction. Shared memory carries no tag and is never checked.
On x86-64 the permission belongs to the thread, so even code IA2 never compiled is held to the running compartment’s key. On Arm it travels in the pointer, and code IA2 did not compile uses whatever tag it was handed.
IA2 adds a step to a C build. Its rewriter, a tool built on Clang, finds every call that crosses a boundary and writes a gate for it, into a directory of its own; the original sources are left alone. IA2’s CMake functions do the whole build: its video player example is two calls to one of them.
add_ia2_compartment(video_decoder LIBRARY
SOURCES video_decoder.c
PKEY 2
INCLUDE_DIRECTORIES include
)
add_ia2_compartment(video_player EXECUTABLE
SOURCES video_player.c
LIBRARIES video_decoder ${SDL2_LIBRARIES} ${FFMPEG_LIBRARIES}
PKEY 1
)IA2 gives coarse spatial memory safety: a stray read or write in one compartment cannot reach another’s private stack, heap, globals or thread-local storage, in either direction. That is narrower than memory safety.
IA2 bounds what a bug reaches. It does not prevent the bug.
Both are reachable from every compartment. In the nginx demo, about two thousand function pointers that nginx core calls sit in shared memory.
Code that takes over control flow can jump straight to a gate’s WRPKRU or movz x18. The design relies on control-flow integrity to close that gap.
A gate is generated per function, and a variadic function’s arguments differ at every call, so a variadic call across a boundary runs ungated, in the caller’s compartment. The rewriter reports each such function, and the private data it could reach.
Code that does not clamp pointers, the kernel and hand-written assembly among it, uses whatever tag a pointer carries.
On x86-64 an optional tracer checks every call that maps, unmaps or protects memory against which compartment owns it. Arm has none yet.
why one buggy library can compromise a whole C program, how IA2 splits a process into compartments along its shared libraries, and how two CPU features already in shipping hardware, x86 protection keys and Arm memory tagging, enforce the split.
The writeup has the design in full. For what it does not answer, write to us.