Virtualization hardware can potentially be accessed from userspace [1]. That might be both more fine grained and more performant than a fully separate address space.
Failing that maybe it is time to bring back segments.
Because you have to round trip through the host kernel to do anything that leaves that context, it's a bit slower and doesn't really get you the perf gains overall you might think. : /
But yeah, segments coming back would be really neat.
The MPX extensions? AMD never supported them, and I've heard rumors that Intel might be dropping support since support never really took off for it. In addition to the meltdown like effects that probably exist, I'd be afraid of the cache effect side channels of just everything needed to load the base and bounds registers.
Not MPX, I think it is called MPK[1]; basically a process can tag each page with a 4 bit identifier (via a kernel provided API) and then, by loading the id on a special register can restrict its own accesses to pages with different keys.
Failing that maybe it is time to bring back segments.
[1]https://github.com/ramonza/dune/blob/master/README