Segue & ColorGuard: Optimizing SFI Performance and Scalability on Modern Architectures
Software-based fault isolation (SFI) enables in-process isolation through compiler instrumentation of memory accesses, and is a critical part of WebAssembly (Wasm). We present two optimizations that improve SFI performance and scalability: Segue uses x86-64 segmentation to reduce the cost of instrumentation on memory accesses, e.g., it eliminates 44.7% of Wasm's overhead on a Wasm-compatible subset of SPEC CPU 2006, and reduces overhead of Wasm-sandboxed font rendering in Firefox by 75%; ColorGuard leverages memory tagging (e.g., MPK), to enable up to a 15× increase in the number of Wasm instances that can run concurrently in a single address space, improving efficiency for high scale server-side workloads. We also explore the challenges of deploying these optimizations in three production toolchains: Wasm2c, WAMR and Wasmtime.
Authors
- Mingbo Sun
- Wenyong Huang
- Evan Johnson (ORCID: https://orcid.org/0000-0002-1784-4512)
- Shravan Narayan (ORCID: https://orcid.org/0000-0002-0065-6611)
- Tal Garfinkel (ORCID: https://orcid.org/0000-0003-4213-4755)
- Michael LeMay (ORCID: https://orcid.org/0000-0001-6206-9642)
- Dean M. Tullsen (ORCID: https://orcid.org/0000-0003-3174-9316)
- Anjo Vahldiek-Oberwagner (ORCID: https://orcid.org/0000-0002-6983-0630)
- Deian Stefan (ORCID: https://orcid.org/0000-0002-7041-7464)
- Zachary Yedidia (ORCID: https://orcid.org/0009-0006-4244-1690)
- Xin Wang
- Yingchen Wang (ORCID: https://orcid.org/0009-0009-4140-307X)
- Andrew Brown
Institutions
- Intel (United States) (US)
- Berkeley College (US)
- UC San Diego Health System (US)
- Intel (Germany) (DE)
- The University of Texas at Austin (US)
- University of California, Berkeley (US)
- Stanford University (US)
Publication Details
- Published
- 2025-02-06
- DOI
- https://doi.org/10.1145/3669940.3707249
- Citations
- 1
- Primary Topic
- Security and Verification in Computing
- Type
- article
- Field-Weighted Citation Impact
- 2.48