Ecient SoftwareBased Fault Isolation Rob ert Wahbe Steven Lucco Thomas E Anderson Susan L Graham Computer Science Division University of California Berkeley CA Intro duction Abstract Application programs often achieve extensibilityby One way to provide fault isolation among co op erating incorp orating indep endently develop ed software mo d software mo dules is to place each in its own address ules However faults in extension co de can render a space However for tightlycoupled mo dules this so software system unreliable or even dangerous since lution incurs prohibitivecontext switchoverhead In such faults could corrupt p ermanent data Toin this pap er we present a software approach to imple crease the reliability of these applications an op erat menting fault isolation within a single address space ing system can provide services that prevent faults in Our approach has two parts First we load the co de distrusted mo dules from corrupting application data and data for a distrusted mo dule into its own fault do Such fault isolation services also facilitate software de main a logically separate p ortion of the applications velopmentby helping to identify sources of system fail address space Second we mo dify the ob ject co de of a ure distrusted mo dule to prevent it from writing or jump For example the postgres database manager in ing to an address outside its fault domain Both these cludes an extensible typ e system Sto Using this software op erations are p ortable and programming lan facility postgres queries can refer to generalpurp ose guage indep endent co de that denes constructors destructors and pred Our approach p oses a tradeo relative to hardware icates for userdened data typ es such as geometric fault isolation substantially faster communication b e ob jects Without fault isolation any query that uses tween fault domains at a cost of slightly increased extension co de could interfere with an unrelated query execution time for distrusted mo dules We demon or corrupt the database strate that for frequently communicating mo dules im Similarly recent op erating system research has fo plementing fault isolation in software rather than hard cused on making it easier for third partyvendors ware can substantially improve endtoend application to enhance parts of the op erating system An ex p erformance ample is microkernel design parts of the op erat This work was supp orted in part by the National Sci ing system are implemented as userlevel servers that ence Foundation CDA Defense Advanced Research can b e easily mo died or replaced More gener Pro jects Agency DARPA under grantMDAJ and contracts DABTC and NC the Digi allyseveral systems have added extension co de into tal Equipment Corp oration the Systems Research Center and the op erating system for example the BSD network the External Research Program and the ATT Foundation packet lter MRA MJ applicationsp ecic vir Anderson was also supp orted by a National Science Foundation tual memory management HC and Active Mes Young InvestigatorAward The content of the paper does not necessarily reect the p osition or the p olicy of the Government sages vCGS Among industry systems Microsofts and no ocial endorsement should b e inferred Ob ject Linking and Emb edding system Cla can link together indep endently develop ed software mo d ules Also the Quark Xpress desktop publishing sys To app ear in the Pro ceedings of the Symp osium on Op tem Dys is structured to supp ort incorp oration of erating System Principles Email frwahbe lucco tea grahamgcsberkeleyedu segments In this pap er we concentrate on a sim generalpurp ose third party co de As with postgres ple transformation technique called sandb oxing that faults in extension mo dules can render any of these only slightly increases the execution time of the mo d systems unreliable ied ob ject co de We also investigate techniques that One waytoprovide fault isolation among co op erat provide more debugging information but which incur ing software mo dules is to place each in its own address greater execution time overhead space Using Remote Pro cedure Call RPC BN Our approach p oses a tradeo relative to hardware mo dules in separate address spaces can call into each based fault isolation Because we eliminate the need to other through a normal pro cedure call interface Hard cross hardware b oundaries we can oer substantially ware page tables prevent the co de in one address space lowercost RPC b etween fault domains A safe RPC in from corrupting the contents of another our prototyp e implementationtakes roughly sona Unfortunately there is a high p erformance cost DECstation and roughly s on a DEC Al to providing fault isolation through separate address pha more than an order of magnitude faster than spaces Transferring control across protection b ound any existing RPC system This reduction in RPC time aries is exp ensive and do es not necessarily scale comes at a cost of slightly increased distrusted mo dule with improvements in a pro cessors integer p erfor execution time On a test suite including the the C mance ALBL A crossaddressspace RPC requires spec b enchmarks sandb oxing incurs an average of at least a trap into the op erating system kernel copy execution time overhead on b oth the DECstation ing each argument from the caller to the callee sav and the Alpha ing and restoring registers switching hardware ad Softwareenforced fault isolation may seem to b e dress spaces on manymachines ushing the transla counterintuitive we are slowing down the common tion lo okaside buer and a trap back to user level case normal execution to sp eed up the uncommon These op erations must b e rep eated up on RPC re case crossdomain communication But for fre turn The execution time overhead of an RPC even quently communicating fault domains our approach with a highly optimized implementation will often can oer substantially b etter endtoend p erformance be two to three orders of magnitude greater than To demonstrate this we applied softwareenforced the execution time overhead of a normal pro cedure fault isolation to the postgres database system run call BALL ALBL ning the Sequoia b enchmark The b enchmark The goal of our workistomake fault isolation cheap makes use of the postgres extensible data typ e sys enough that system develop ers can ignore its p erfor tem to dene geometric op erators For this b ench mance eect in cho osing which mo dules to place in mark the software approach reduced fault isolation separate fault domains In many cases where fault iso overhead by more than a factor of three on a DECsta lation would b e useful crossdomain pro cedure calls tion are frequentyet involve only a mo derate amountof Asoftware approach also provides a tradeo b e computation p er call In this situation it is imprac tween p erformance and level of distrust If some mo d tical to isolate each logically separate mo dule within ules in a program are trusted while others are dis its own address space b ecause of the cost of crossing trusted as may b e the case with extension co de only hardware protection b oundaries the distrusted mo dules incur any execution time over We prop ose a software approach to implementing head Co de in trusted domains can run at full sp eed fault isolation within a single address space Our ap Similarly it is p ossible to use our techniques to im proach has two parts First we load the co de and data plement full security preventing distrusted co de from for a distrusted mo dule into its own fault domaina even reading data outside of its domain at a cost of logically separate p ortion of the applications address higher execution time overhead Wequantify this ef space A fault domain in addition to comprising a con fect in Section tiguous region of memory within an address space has The remainder of the pap er is organized as follows a unique identier which is used to control its access to Section provides some examples of systems that re pro cess resources such as le descriptors Second we quire frequentcommunication b etween fault domains mo dify the ob ject co de of a distrusted mo dule to pre Section outlines howwe mo dify ob ject co de to pre vent it from writing or jumping to an address outside vent it from generating illegal addresses Section its fault domain Program mo dules isolated in sepa describ es howwe implementlow latency crossfault rate softwareenforced fault domains can not mo dify domain RPC Section presents p erformance results each others data or execute each others co de except for our prototyp e and nally Section discusses some through an explicit crossfaultdomain RPC interface related work Wehave identied several programminglanguage indep endent transformation strategies that can render ob ject co de unable to escap e its own co de and data Background the distrusted part of the application Section quan ties this tradeo b etween domaincrossing overhead In this section wecharacterize in more detail the and application execution time overhead and demon typ e of application that can b enet from software strates that even if domaincrossing overhead repre enforced fault isolation We defer further description sents a mo dest prop ortion of the total application ex of the postgres extensible typ e system until Section ecution time softwareenforced fault isolation is cost which gives p erformance measurements for this ap eective plication The op erating systems community has fo cused con SoftwareEnforced Fault Iso siderable attention on supp orting kernel extensibil ity For example the UNIX