Efficient Linkage-Based Compartmentalization on CHERI

2026-09-29

AI Summary

This work addresses the poor scalability of existing memory isolation mechanisms in supporting large-scale, fine-grained intra-process security domains by proposing an efficient linked isolation model built upon CHERI hardware capabilities. We introduce a novel "one-click" library-boundary isolation strategy, combined with deep customizations to compilers and operating systems for both Armv8-A and RISC-V architectures. This approach enables fine-grained isolation of tens of thousands of security domains and over 500 concurrent domains within UNIX user space, substantially surpassing the concurrency limitations of mechanisms such as Intel MPK. The proposed solution has been validated on Morello and Codasip X730 platforms, demonstrating that the vast majority of C/C++ programs execute without modification, requiring only minor adaptations for the V8 engine.

Abstract

We present an efficient linkage-based model for in-process compartmentalization built on CHERI memory safety, which enables fine-grained compartmentalization of the entire UNIX user-space, scaling to 10K+ compartments on desktop systems. The model's "push-button" compartmentalization along existing library boundaries regularly hosts 500+ compartments per process for large applications such as Chromium, far exceeding the number of concurrently available protection domains supported by other mechanisms (e.g., up to 16 for Intel MPK). Custom policies can further subdivide libraries. Of the thousands of C/C++ programs tested, only the V8 JavaScript engine required source-level adaptation (<300 lines of changed code concerning garbage collection and JIT compilation). We implement the model for CHERI-extended versions of Armv8-A and RISC-V through support in the compiler toolchain and operating system. Case studies illustrate the smooth delegation of memory between compartments, compartment-aware debugging and visualization, as well as extensibility to a complex managed language runtime, demonstrating the benefits of our single-address-space model. We evaluate using multiple processors, including Arm's superscalar Morello and, notably, the first commercial CHERI-enabled RISC-V application core---Codasip's in-order dual-issue X730.

Problem

• compartmentalization
• memory safety
• CHERI
• in-process isolation
• protection domains

Innovation

• CHERI
• Compartmentalization
• Memory Safety
• RISC-V
• Linkage-based Model