一句话：提出 HFI 硬件辅助隔离，以处理器增量扩展实现安全、灵活、高效的进程内隔离，克服 SFI 的多项限制。
现有软件故障隔离（SFI）虽能在进程内隔离不可信代码，但面临运行时开销、可扩展性有限、易受 Spectre 攻击以及与既有代码兼容性差等限制。本文提出硬件辅助故障隔离（HFI），仅对现有高性能处理器的数据路径和控制路径做增量扩展，即可支持安全、灵活且高效的进程内隔离。HFI 既能无缝集成 WebAssembly 等现有 SFI 系统，也能直接沙箱化未修改的本机二进制，从而降低采用门槛。作者面向 x86-64，使用 gem5 模拟器和基于编译器的仿真，在真实与合成工作负载混合上评估 HFI。
We introduce Hardware-assisted Fault Isolation (HFI), a simple extension to existing processors to support secure, flexible, and efficient in-process isolation. HFI addresses the limitations of existing software-based isolation (SFI) systems including: runtime overheads, limited scalability, vulnerability to Spectre attacks, and limited compatibility with existing code. HFI can seamlessly integrate with current SFI systems (e.g., WebAssembly), or directly sandbox unmodified native binaries. To ease adoption, HFI relies only on incremental changes to the data and control path of existing high-performance processors. We evaluate HFI for x86-64 using the gem5 simulator and compiler-based emulation on a mix of real and synthetic workloads.
@inproceedings{paperbot10103,
title = {Going beyond the Limits of SFI: Flexible and Secure Hardware-Assisted In-Process Isolation with HFI},
author = {Shravan Narayan and Tal Garfinkel and Mohammadkazem Taram and Joey Rudek and Daniel Moghimi and Evan Johnson and Chris Fallin and Anjo Vahldiek-Oberwagner and Michael LeMay and Ravi Sahita and Dean Tullsen and Deian Stefan},
booktitle = {ASPLOS},
year = {2023},
doi = {10.1145/3582016.3582023}
}