skip to main content
10.1145/3620665.3640408acmconferencesArticle/Chapter ViewAbstractPublication PagesasplosConference Proceedingsconference-collections
research-article
Open access

Lightweight Fault Isolation: Practical, Efficient, and Secure Software Sandboxing

Published: 27 April 2024 Publication History

Abstract

Software-based fault isolation (SFI) is a longstanding technique that allows isolation of one or more processes from each other with minimal or no use of hardware protection mechanisms. The demand for SFI systems has been increasing due to the advent of cloud and serverless computing, which require systems to run untrusted code with low latency and low context switch times. SFI systems must optimize for a combination of performance, trusted code base (TCB) size, scalability, and implementation complexity. With the rise of ARM64 in both cloud and personal computers, we revisit classic SFI in the context of ARM64 and present a new multi-sandbox SFI scheme that is practical to implement, efficient, and maintains a small TCB. Our technique, called Lightweight Fault Isolation (LFI), supports tens of thousands of 4GiB sandboxes in a single address space and does full software isolation of loads, stores, and jumps with a runtime overhead of 7% on the compatible subset of the SPEC 2017 benchmark suite. In addition to providing low runtime and code size overheads compared to existing multi-sandbox systems, LFI is implemented independently of existing compiler toolchains, has a small static verifier to reduce TCB size, is hardened against basic Spectre attacks, and has broad software support, including for language mechanisms like exceptions and ISA features such as SIMD.

References

[1]
Bytecode Alliance. Wasmtime, 2023. URL: https://wasmtime.dev/.
[2]
Bytecode Alliance. Webassembly micro runtime, 2023. URL: https://bytecodealliance.github.io/wamr.dev/.
[3]
Thomas E. Anderson, Brian N. Bershad, Edward D. Lazowska, and Henry M. Levy. Scheduler activations: Effective kernel support for the user-level management of parallelism. In Proceedings of the Thirteenth ACM Symposium on Operating Systems Principles, SOSP '91, page 95--109, New York, NY, USA, 1991. Association for Computing Machinery.
[4]
Arm. Arm Architecture Reference Manual for A-profile architecture, 2016. FEAT_LVA, p. A2-90.
[5]
Arm. Arm Architecture Reference Manual for A-profile architecture, 2016.
[6]
Arm. Arm Architecture Reference Manual for A-profile architecture, 2016. FEAT_CSV2_2, p. A2-76.
[7]
Arm. Arm Architecture Reference Manual for A-profile architecture, 2016. SCXTNUM_EL0, EL0 Read/Write Software Context Number, p. D13-5913.
[8]
Arm. Arm Cortex-X3 Core: Software Optimization Guide, r1p2 edition, 2021.
[9]
Arm. Exploration tools, 2023. URL: https://developer.arm.com/downloads/-/exploration-tools.
[10]
Wasm2c authors. wasm2c: Convert wasm files to c source and header, 2023. URL: https://github.com/WebAssembly/wabt/tree/main/wasm2c.
[11]
B. N. Bershad, S. Savage, P. Pardyak, E. G. Sirer, M. E. Fiuczynski, D. Becker, C. Chambers, and S. Eggers. Extensibility safety and performance in the spin operating system. SIGOPS Oper. Syst. Rev., 29(5):267--283, dec 1995.
[12]
Kevin Boos, Namitha Liyanage, Ramla Ijaz, and Lin Zhong. Theseus: An experiment in operating system structure and state management. In Proceedings of the 14th USENIX Conference on Operating Systems Design and Implementation, OSDI'20, USA, 2020. USENIX Association.
[13]
James Bucek, Klaus-Dieter Lange, and Jóakim v. Kistowski. Spec cpu2017: Next-generation compute benchmark. In Companion of the 2018 ACM/SPEC International Conference on Performance Engineering, ICPE '18, page 41--42, New York, NY, USA, 2018. Association for Computing Machinery.
[14]
Miguel Castro, Manuel Costa, Jean-Philippe Martin, Marcus Peinado, Periklis Akritidis, Austin Donnelly, Paul Barham, and Richard Black. Fast byte-granularity software fault isolation. In Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles, SOSP '09, page 45--58, New York, NY, USA, 2009. Association for Computing Machinery.
[15]
Frank Denis. Performance of webassembly runtimes in 2023, 2023. URL: https://00f.net/2023/01/04/webassembly-benchmark-2023/.
[16]
Úlfar Erlingsson, Martín Abadi, Michael Vrable, Mihai Budiu, and George C. Necula. Xfi: Software guards for system address spaces. In Proceedings of the 7th Symposium on Operating Systems Design and Implementation, OSDI '06, page 75--88, USA, 2006. USENIX Association.
[17]
Bryan Ford and Russ Cox. Vx32: Lightweight user-level sandboxing on the x86. In Rebecca Isaacs and Yuanyuan Zhou, editors, 2008 USENIX Annual Technical Conference, Boston, MA, USA, June 22-27, 2008. Proceedings, pages 293--306. USENIX Association, 2008. URL: http://www.usenix.org/events/usenix08/tech/full_papers/ford/ford.pdf.
[18]
Google. gvisor documentation, 2021. URL: https://gvisor.dev/docs/.
[19]
James Gosling, Bill Joy, and Guy L. Steele. The Java Language Specification. Addison-Wesley Longman Publishing Co., Inc., USA, 1st edition, 1996.
[20]
Andreas Haas, Andreas Rossberg, Derek L. Schuff, Ben L. Titzer, Michael Holman, Dan Gohman, Luke Wagner, Alon Zakai, and JF Bastien. Bringing the web up to speed with webassembly. In Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2017, page 185--200, New York, NY, USA, 2017. Association for Computing Machinery.
[21]
Liang He. A problem about "traps in dead code", 2023. URL: https://github.com/bytecodealliance/wasm-micro-runtime/issues/2773.
[22]
Gernot Heiser and Kevin Elphinstone. L4 microkernels: The lessons from 20 years of research and deployment. ACM Trans. Comput. Syst., 34(1), apr 2016.
[23]
Pat Hickey. How fastly and the developer community are investing in the webassembly ecosystem, 2020. URL: https://www.fastly.com/blog/how-fastly-and-developer-community-invest-in-webassembly-ecosystem.
[24]
Galen C. Hunt and James R. Larus. Singularity: Rethinking the software stack. SIGOPS Oper. Syst. Rev., 41(2):37--49, apr 2007.
[25]
Intel. Intel 64 and IA-32 architectures software developer's manual, 2020.
[26]
RISC-V International. The RISC-V Instruction Set Manual, Volume II: Privileged Architecture, 20211203 edition, 2021. sv57, p. 87.
[27]
Dougall Johnson. Apple microarchitecture research, 2021. URL: https://dougallj.github.io/applecpu/firestorm.html.
[28]
Evan Johnson, David Thien, Yousef Alhessi, Shravan Narayan, Fraser Brown, Sorin Lerner, Tyler McMullen, Stefan Savage, and Deian Stefan. Довер´яй, но провер´яй: SFI safety for native-compiled Wasm. In NDSS. Internet Society, 2021.
[29]
Koen Koning, Xi Chen, Herbert Bos, Cristiano Giuffrida, and Elias Athanasopoulos. No need to hide: Protecting safe regions on commodity hardware. In Proceedings of the Twelfth European Conference on Computer Systems, EuroSys '17, page 437--452, New York, NY, USA, 2017. Association for Computing Machinery.
[30]
Dexter Kozen. Language-based security. In Mirosław Kutyłowski, Leszek Pacholski, and Tomasz Wierzbicki, editors, Mathematical Foundations of Computer Science 1999, pages 284--298, Berlin, Heidelberg, 1999. Springer Berlin Heidelberg.
[31]
Andrew Lamoureux. Ground-up aarch64, 2021. URL: https://binary.ninja/2021/04/05/groundup-aarch64.html.
[32]
Michael Larabel. Amazon graviton3 vs. intel xeon vs. amd epyc performance, 2022. URL: https://www.phoronix.com/review/graviton3-amd-intel.
[33]
Amit Levy, Bradford Campbell, Branden Ghena, Daniel B. Giffin, Pat Pannuto, Prabal Dutta, and Philip Levis. Multiprogramming a 64kb computer safely and efficiently. In Proceedings of the 26th Symposium on Operating Systems Principles, SOSP '17, page 234--251, New York, NY, USA, 2017. Association for Computing Machinery.
[34]
James Litton, Anjo Vahldiek-Oberwagner, Eslam Elnikety, Deepak Garg, Bobby Bhattacharjee, and Peter Druschel. Light-weight contexts: An os abstraction for safety and performance. In Proceedings of the 12th USENIX Conference on Operating Systems Design and Implementation, OSDI'16, page 49--64, USA, 2016. USENIX Association.
[35]
LLVM. Aarch64: compress jump tables to minimum size needed to reach destinations, 2017. URL: https://reviews.llvm.org/D32564.
[36]
LLVM. Assembling a complete toolchain, 2023. URL: https://clang.llvm.org/docs/Toolchain.html.
[37]
Filipe Manco, Costin Lupu, Florian Schmidt, Jose Mendes, Simon Kuenzer, Sumit Sati, Kenichi Yasukata, Costin Raiciu, and Felipe Huici. My vm is lighter (and safer) than your container. In Proceedings of the 26th Symposium on Operating Systems Principles, SOSP '17, page 218--233, New York, NY, USA, 2017. Association for Computing Machinery.
[38]
Yandong Mao, Haogang Chen, Dong Zhou, Xi Wang, Nickolai Zeldovich, and M. Frans Kaashoek. Software fault isolation with api integrity and multi-principal modules. In Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles, SOSP '11, page 115--128, New York, NY, USA, 2011. Association for Computing Machinery.
[39]
Stephen McCamant and Greg Morrisett. Efficient, verifiable binary sandboxing for a cisc architecture. 2005.
[40]
Stephen McCamant and Greg Morrisett. Evaluating sfi for a cisc architecture. In Proceedings of the 15th Conference on USENIX Security Symposium - Volume 15, USENIX-SS'06, USA, 2006. USENIX Association.
[41]
Greg Morrisett, Karl Crary, Neal Glew, and David Walker. Stack-based typed assembly language. J. Funct. Program., 12(1):43--88, jan 2002.
[42]
Greg Morrisett, Gang Tan, Joseph Tassarotti, Jean-Baptiste Tristan, and Edward Gan. Rocksalt: Better, faster, stronger sfi for the x86. In Proceedings of the 33rd ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI '12, page 395--404, New York, NY, USA, 2012. Association for Computing Machinery.
[43]
Greg Morrisett, David Walker, Karl Crary, and Neal Glew. From system f to typed assembly language. ACM Trans. Program. Lang. Syst., 21(3):527--568, may 1999.
[44]
musl. musl libc, 2023. URL: https://musl.libc.org/.
[45]
G. J. Myers and B. R. S. Buckingham. A hardware implementation of capability-based addressing. SIGARCH Comput. Archit. News, 8(6):12--24, oct 1980.
[46]
Shravan Narayan, Craig Disselkoen, Daniel Moghimi, Sunjay Cauligi, Evan Johnson, Zhao Gang, Anjo Vahldiek-Oberwagner, Ravi Sahita, Hovav Shacham, Dean M. Tullsen, and Deian Stefan. Swivel: Hardening webassembly against spectre. In Michael Bailey and Rachel Greenstadt, editors, 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021, pages 1433--1450. USENIX Association, 2021. URL: https://www.usenix.org/conference/usenixsecurity21/presentation/narayan.
[47]
Shravan Narayan, Tal Garfinkel, Mohammadkazem Taram, Joey Rudek, Daniel Moghimi, Evan Johnson, Chris Fallin, Anjo Vahldiek-Oberwagner, Michael LeMay, Ravi Sahita, Dean Tullsen, and Deian Stefan. Going beyond the limits of sfi: Flexible and secure hardware-assisted in-process isolation with hfi. In Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 3, ASPLOS 2023, page 266--281, New York, NY, USA, 2023. Association for Computing Machinery.
[48]
Vikram Narayanan, Tianjiao Huang, David Detweiler, Dan Appel, Zhaofeng Li, Gerd Zellweger, and Anton Burtsev. Redleaf: Isolation and communication in a safe operating system. In Proceedings of the 14th USENIX Conference on Operating Systems Design and Implementation, OSDI'20, USA, 2020. USENIX Association.
[49]
George C. Necula. Proof-carrying code. In Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL '97, page 106--119, New York, NY, USA, 1997. Association for Computing Machinery.
[50]
NodeJS. uvwasi, 2023. URL: https://github.com/nodejs/uvwasi.
[51]
David D. Redell, Yogen K. Dalal, Thomas R. Horsley, Hugh C. Lauer, William C. Lynch, Paul R. McJones, Hal G. Murray, and Stephen C. Purcell. Pilot: An operating system for a personal computer. Commun. ACM, 23(2):81--92, feb 1980.
[52]
David Sehr, Robert Muth, Cliff Biffle, Victor Khimenko, Egor Pasko, Karl Schimpf, Bennet Yee, and Brad Chen. Adapting software fault isolation to contemporary CPU architectures. In 19th USENIX Security Symposium, Washington, DC, USA, August 11-13, 2010, Proceedings, pages 1--12. USENIX Association, 2010. URL: http://www.usenix.org/events/sec10/tech/full_papers/Sehr.pdf.
[53]
seL4. sel4 performance, 2023. URL: https://sel4.systems/About/Performance/home.pml.
[54]
Simon Shillaker and Peter Pietzuch. Faasm: Lightweight isolation for efficient stateful serverless computing. In Proceedings of the 2020 USENIX Conference on Usenix Annual Technical Conference, USENIX ATC'20, USA, 2020. USENIX Association.
[55]
Christopher Small. A tool for constructing safe extensible c++ systems. In Proceedings of the 3rd Conference on USENIX Conference on Object-Oriented Technologies (COOTS) - Volume 3, COOTS'97, page 13, USA, 1997. USENIX Association.
[56]
Livio Soares and Michael Stumm. Flexsc: Flexible system call scheduling with exception-less system calls. In Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation, OSDI'10, page 33--46, USA, 2010. USENIX Association.
[57]
Mincheol Sung, Pierre Olivier, Stefan Lankes, and Binoy Ravindran. Intra-unikernel isolation with intel memory protection keys. In Proceedings of the 16th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, VEE '20, page 143--156, New York, NY, USA, 2020. Association for Computing Machinery.
[58]
Gang Tan. Principles and Implementation Techniques of Software-Based Fault Isolation. Now Publishers Inc., Hanover, MA, USA, 2017.
[59]
Anjo Vahldiek-Oberwagner, Eslam Elnikety, Nuno O. Duarte, Michael Sammler, Peter Druschel, and Deepak Garg. Erim: Secure, efficient in-process isolation with protection keys (mpk). In Proceedings of the 28th USENIX Conference on Security Symposium, SEC'19, page 1221--1238, USA, 2019. USENIX Association.
[60]
Kenton Varda. Webassembly on cloudflare workers, 2018. URL: https://blog.cloudflare.com/webassembly-on-cloudflare-workers/.
[61]
Robert Wahbe, Steven Lucco, Thomas E. Anderson, and Susan L. Graham. Efficient software-based fault isolation. In Andrew P. Black and Barbara Liskov, editors, Proceedings of the Fourteenth ACM Symposium on Operating System Principles, SOSP 1993, The Grove Park Inn and Country Club, Asheville, North Carolina, USA, December 5-8, 1993, pages 203--216. ACM, 1993.
[62]
Sebastian Winkel and Jason Agron. Introducing intel® advanced performance extensions (intel® apx), 2023. URL: https://www.intel.com/content/www/us/en/developer/articles/technical/advanced-performance-extensions-apx.html.
[63]
Keith Winstein. wasm2c: run tests with -o2 on non-windows, 2022. URL: https://github.com/WebAssembly/wabt/pull/1939.
[64]
Jonathan Woodruff, Robert N.M. Watson, David Chisnall, Simon W. Moore, Jonathan Anderson, Brooks Davis, Ben Laurie, Peter G. Neumann, Robert Norton, and Michael Roe. The cheri capability model: Revisiting risc in an age of risk. In Proceeding of the 41st Annual International Symposium on Computer Architecuture, ISCA '14, page 457--468. IEEE Press, 2014.
[65]
Jean Yang and Chris Hawblitzel. Safe to the last instruction: Automated verification of a type-safe operating system. In Proceedings of the 31st ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI '10, page 99--110, New York, NY, USA, 2010. Association for Computing Machinery.
[66]
Bennet Yee, David Sehr, Gregory Dardyk, J. Bradley Chen, Robert Muth, Tavis Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar. Native client: a sandbox for portable, untrusted x86 native code. Commun. ACM, 53(1):91--99, 2010.
[67]
Jiyong Yu, Aishani Dutta, Trent Jaeger, David Kohlbrenner, and Christopher W. Fletcher. Synchronization storage channels (S2C): Timer-less cache Side-Channel attacks on the apple m1 via hardware synchronization instructions. In 32nd USENIX Security Symposium (USENIX Security 23), pages 1973--1990, Anaheim, CA, August 2023. USENIX Association. URL: https://www.usenix.org/conference/usenixsecurity23/presentation/yu-jiyong.
[68]
Bin Zeng, Gang Tan, and Greg Morrisett. Combining control-flow integrity and static analysis for efficient and validated data sandboxing. In Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS '11, page 29--40, New York, NY, USA, 2011. Association for Computing Machinery.
[69]
Lu Zhao, Guodong Li, Bjorn De Sutter, and John Regehr. Armor: Fully verified software fault isolation. In Proceedings of the Ninth ACM International Conference on Embedded Software, EMSOFT '11, page 289--298, New York, NY, USA, 2011. Association for Computing Machinery.
[70]
Yajin Zhou, Xiaoguang Wang, Yue Chen, and Zhi Wang. Armlock: Hardware-based fault isolation for arm. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS '14, page 558--569, New York, NY, USA, 2014. Association for Computing Machinery.

Cited By

View all

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
ASPLOS '24: Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2
April 2024
1299 pages
ISBN:9798400703850
DOI:10.1145/3620665
This work is licensed under a Creative Commons Attribution International 4.0 License.

Sponsors

In-Cooperation

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 27 April 2024

Check for updates

Badges

Qualifiers

  • Research-article

Funding Sources

Conference

ASPLOS '24

Acceptance Rates

Overall Acceptance Rate 535 of 2,713 submissions, 20%

Upcoming Conference

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)993
  • Downloads (Last 6 weeks)92
Reflects downloads up to 18 Jan 2025

Other Metrics

Citations

Cited By

View all

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media