There are some kinds of heap isolation worth doing, eg some mentioned in https://www.synacktiv.com/sites/default/files/2022-10/attack....

But the good ones rely on PAC (pointer signing), which comes from CHERI and x86 doesn't have it.

Not exactly the same, but Mozilla had a whacky idea of compiling C to WASM and then WASM back to native code, which gives a natively running program that is sandboxing its own memory accesses:

https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...

Intel MPX had both hardware support for "bounds tables" and bounds checks[0], along with a "memory key" system[1] more similar to CHERI for memory tagging (only at page granularity, however). Both were massive failures and they are no longer supporting the extensions on new chips going forward.

0: https://www.kernel.org/doc/html/v5.5/x86/intel_mpx.html 1: https://lwn.net/Articles/643797/

Meanwhile Solaris Sparc is doing it since 2015, we have ongoing ARM MTE, Apple's PAC, and Microsoft with CherIoT and Pluton.

Yet another example of Intel's failure to deliver.

MPX is dead, but memory protection keys are a distinct feature and work fine (with some limitations); I haven't seen anything about them being removed at all and Intel doesn't note them in their deprecated features list. AMD even added support for them in Zen3.

Oh, TIL. I was under the impression they were both removed , and didn't know AMD had it either.

I worked on a prototype to add kernel-mediated segmentation to linux. its easy to associate a segment map to a thread, and manage maps in virtual addresses and provide a call gate which is a registered procedure that can change a map.

making it airtight and useful in an existing programming environment is less straightforward