Memory disaggregation via Compute Express Link (CXL) enables multiple hosts to share remote memory, improving utilization for data-intensive workloads. Today, virtual memory enables process-level isolation on a host and CXL enables host-level isolation. This creates a critical security gap: the absence of process-level memory isolation in shared disaggregated memory. We present Space-Control, a hardware-software co-design that provides fine-grained, process-level isolation for shared disaggregated memory. Space-Control authenticates execution context in the hardware and enforces access control on every memory access and amortizes lookup times with a small cache. Our design allows up to 127 processes Simulation Toolkit (SST) based CXL model, Space-Control incurs minimal performance overhead of 3.3%, making shared disaggregated memory isolation practical.

翻译：通过计算快速链路（CXL）实现的内存分解允许多个主机共享远程内存，从而提高了数据密集型工作负载的利用率。目前，虚拟内存实现了主机上的进程级隔离，而CXL则实现了主机级隔离。这导致了一个关键的安全漏洞：共享分解内存中缺乏进程级内存隔离。本文提出空间控制，一种软硬件协同设计，为共享分解内存提供细粒度的进程级隔离。空间控制在硬件中验证执行上下文，并在每次内存访问时强制执行访问控制，同时通过小型缓存分摊查找时间。我们的设计允许最多127个进程共享分解内存，而无需修改应用程序或操作系统。在基于模拟系统工具包（SST）的CXL模型评估中，空间控制仅产生3.3%的性能开销，使得共享分解内存隔离具有实际可行性。