Isolation Without Taxation: Near Zero Cost Transitions for SFI

Abstract

Almost all SFI systems use heavyweight transitions that incur significant performance overhead from saving and restoring registers when context switching between application and sandbox code. We identify a set of zero-cost conditions that characterize when sandboxed code is well-structured enough so that security can be guaranteed via lightweight zero-cost transitions. We show that using WebAssembly (Wasm) as an intermediate representation for low-level code naturally results in a SFI system with zero-cost transitions, and modify the Lucet Wasm compiler and its runtime to use zero-cost transitions. Our modifications speed up image and font rendering in Firefox by up to 29.7% and 10% respectively. We also describe a new purpose-built fast SFI system, SegmentZero32, that uses x86 segmentation and LLVM with mostly off-the-shelf passes to enforce our zero-cost conditions. While this enforcement incurs some runtime cost within the sandboxed code, we find that, on Firefox image and font rendering benchmarks, the time saved per transition allows SegmentZero32 to outperform even an idealized hardware isolation system where memory isolation incurs zero performance overhead but the use of heavyweight transitions is required.

Domain Page-Table Isolation

“…Naturally, this imposes a performance overhead while not protecting against control-flow hijack attacks, making it necessary to combine it with CFI. Recent work has explored the possibility of so-called zero-cost transitions between normal and sandboxed code for well-structured code, but still requires CFI [50]. Contrary to previous solutions for memory isolation [26], [65], [88], [76], [51], [35], [68], DPTI does not require ISA extensions or re-purposing of ignored bits in the page table.…”