一句话：利用 CHERI 能力硬件为 JNI 原生代码提供内存安全与隔离，使原生代码达到 Java 同等安全性且性能开销可忽略。
Java 依赖内存保护构建高层安全模型，但通过 JNI 链接的原生代码（包括标准库的大量 C 实现）可绕过内存保护与高层策略。本文提出硬件辅助的 Java 原生代码接口实现，将 Java 安全模型所需保证扩展到原生代码。设计支持对 JVM 拥有的缓冲区进行安全直接访问，并在需要时由硬件强制只读；还引入 Java 语法以声明式描述原生代码的隔离隔间。作者在 C 代码中保留 Java 安全模型的内存安全与隔离要求，使原生代码与 Java 代码同进程运行时具有等价安全影响，性能相对现有不安全原生接口几乎无开销，并在 FPGA 综合的 CHERI 微处理器上给出原型。
Java provides security and robustness by building a high-level security model atop the foundation of memory protection. Unfortunately, any native code linked into a Java program -- including the million lines used to implement the standard library -- is able to bypass both the memory protection and the higher-level policies. We present a hardware-assisted implementation of the Java native code interface, which extends the guarantees required for Java's security model to native code. Our design supports safe direct access to buffers owned by the JVM, including hardware-enforced read-only access where appropriate. We also present Java language syntax to declaratively describe isolated compartments for native code. We show that it is possible to preserve the memory safety and isolation requirements of the Java security model in C code, allowing native code to run in the same process as Java code with the same impact on security as running equivalent Java code. Our approach has a negligible impact on performance, compared with the existing unsafe native code interface. We demonstrate a prototype implementation running on the CHERI microprocessor synthesized in FPGA.
@inproceedings{ChisnallDGBJWMM17,
title = {CHERI JNI},
author = {David Chisnall and Brooks Davis and Khilan Gudka and David Brazdil and Alexandre Joannou and Jonathan Woodruff and A. Theodore Markettos and J. Edward Maste and Robert Norton and Stacey Son and Michael Roe and Simon W. Moore and Peter G. Neumann and Ben Laurie and Robert N.M. Watson},
booktitle = {ASPLOS},
year = {2017},
doi = {10.1145/3037697.3037725}
}