Segue & ColorGuard: Optimizing SFI Performance and Scalability on Modern Architectures

Shravan Narayan; Tal Garfinkel; Evan Johnson; Zachary Yedidia; Yingchen Wang; Andrew Brown; Anjo Vahldiek-Oberwagner; Michael LeMay; Wenyong Huang; Xin Wang; Mingqiu Sun; Dean M. Tullsen; Deian Stefan

doi:10.1145/3669940.3707249

ASPLOS2025顶会

Segue & ColorGuard: Optimizing SFI Performance and Scalability on Modern Architectures

Shravan Narayan, Tal Garfinkel, Evan Johnson, Zachary Yedidia, Yingchen Wang, Andrew Brown, Anjo Vahldiek-Oberwagner, Michael LeMay, Wenyong Huang, Xin Wang, Mingqiu Sun, Dean M. Tullsen, Deian Stefan

DOI 出版方

2025年份

1被引次数

5顶会引用

摘要

Software-based fault isolation (SFI) enables in-process isolation through compiler instrumentation of memory accesses, and is a critical part of WebAssembly (Wasm). We present two optimizations that improve SFI performance and scalability: Segue uses x86-64 segmentation to reduce the cost of instrumentation on memory accesses, e.g., it eliminates 44.7% of Wasm's overhead on a Wasm-compatible subset of SPEC CPU 2006, and reduces overhead of Wasm-sandboxed font rendering in Firefox by 75%; ColorGuard leverages memory tagging (e.g., MPK), to enable up to a 15× increase in the number of Wasm instances that can run concurrently in a single address space, improving efficiency for high scale server-side workloads. We also explore the challenges of deploying these optimizations in three production toolchains: Wasm2c, WAMR and Wasmtime.