Limitations and Opportunities of Modern Hardware Isolation Mechanisms
summary
Implements an NF virtualization framework (SAR) with a migrating‑thread model, per‑domain private heaps and a shared exchange heap, and evaluates Intel MPK, ARM MTE, ARM PAC and Morello/CHERI across SPEC2006/2017 and packet‑processing workloads. Results show MPK+SFI achieves <2% steady‑state overhead but MPK domain switches hit ~250 cycles, SFI/SFI‑style software isolation costs ~17–18%, MTE ~20% and PAC/packed schemes exceed 100%, CHERI passes a capability in ~140 cycles and revocation needs IPIs so zero‑copy and cheap revocation remain unsolved.
AI-written summary · about
chapters (17)
- 0:00Hardware isolation intro
- 1:29Efficient isolation necessity
- 2:32Design principles for isolation
- 4:20Experimental setup
- 5:01Memory protection keys
- 6:26ARM memory tagging
- 7:33ARM CHERI capabilities
- 9:21Pointer authentication
- 10:27Software isolation with SFI
- 11:10Isolation overhead
- 12:39Hardware-assisted segmentation
- 13:41Switching overhead
- 14:46Domain switching impact
- 15:28Data passing overhead
- 16:30Zero-copy challenges
- 17:12Relocation support
- 18:36Conclusion
related talks
50mMPK/PKS Linux Kernel Compartmentalization
21mHarmonizing Performance and Isolation in Microkernels with Efficient Intra-kernel
19mEPK: Scalable and Efficient Memory Protection Keys
19mRethinking Isolation Mechanisms for Datacenter Multitenancy
28mIntroduce Hardware-Level Device Isolation to Zephyr
24mShielding Software From Privileged Side-Channel Attacks
23mMind the gaps why we need new, truly open, multi domain heterogeneous solutions
28mSanctum: Minimal Hardware Extensions for Strong Software Isolation