Flexible Tag-based Policies for Compartmentalized C
summary
A hardware-accelerated tag-monitoring design called PIPE programmable interlocks attaches metadata to registers and memory and enforces C-level policies via control-point rules; three concrete policies are implemented: strict no-sharing, classic block-offset capability semantics, and a hybrid pooled capability model that keeps local objects untagged to save tags. The paper claims tag-C (C+policy) produces fail-stops for every memory-model error and for the pooled model also reflects fail-stops back to model errors. Implementation status: machine-backed semantics and pencil‑and‑paper proofs in progress; a verified compiler to the machine-level policy is underway.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:41Hardware Architecture
- 1:38Targets
- 2:47Machinelevel policies
- 4:10Safety tuning
- 6:13Highlevel tag policy
- 6:36What is a compartment
- 7:39Policies
- 8:40No Sharing Policy
- 11:24Memory Model
- 12:14Mode of Sharing
- 13:10Tag Use
- 14:23pooled capability pilot
- 15:52shared capability rule
- 16:36static analysis
- 18:03validation
- 19:02conclusion
related talks
31mMemory Tagging and how it improves C/C++ memory safety
01h 46mA little Introduction to Control Flow Integrity
26mEfficient Protection of Path-Sensitive Control Security
44mLinux Kernel Control-Flow Integrity Sup...
01h 34mA Little Introduction to Control Flow Integrity in C++
33mCNCF SIG-Security Deep Dive
23mHardware security for critical national infrastructure
19mA Dependent Nominal Physical Type System for Static Analysis of Memory in Low Level Code