Privbox: Faster System Calls Through Sandboxed Privileged Execution
summary
Privbox implements a semi-privileged sandbox that runs annotated hot paths at ring 0 on Linux (LLVM toolchain) yet vets them with a verifier and instrumentation so they cannot access kernel memory. It converts loads/stores and indirect branches, packs code into code chunks (32 bytes), and exposes a kernel-side gate for fast calls. On x86 Skylake syscall entry falls to ~415 cycles (2.2× faster); I/O-threaded throughput rises up to 1.7×; Redis improves 7.6% today and 11% with SPAP hardware; memcached port took <70 lines and under an hour.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:27System Calls
- 1:12System Call Overhead
- 1:58Existing Approaches
- 3:35Privbox Mechanism
- 4:50Semi-Privileged Execution Mode (SPEM)
- 5:45System Call Gate Function
- 7:18Porting Programs to Privbox
- 8:19Safety Requirements
- 9:36Compilation and Verification
- 12:02Privileged Instructions
- 12:18Load/Store Instructions
- 13:21Branching Instructions
- 14:32Memory Layout
- 15:51Semi-Privileged Access Prevention (SPAP)
- 16:46Evaluation: Entry Overheads
- 17:08Evaluation: I/O Threaded Workloads
- 18:03Evaluation: Real-world Workloads
- 18:44Conclusion
related talks
19mBuilding Dynamic System Call Sandbox with Partial Order Analysis
30mSandBox Mode (SBM) - New Execution Mode Between Kernel and User Space
32mLLMs Behind Bars: Sandboxes at Scale for AI on a Short Leash
21mHarmonizing Performance and Isolation in Microkernels with Efficient Intra-kernel
17mAutomated Policy Synthesis for System Call Sandboxing
39mShadow-Box v2: The Practical and Omnipotent Sandbox for ARM
22mSandboxes all the way down - A hitchhiker's guide to platform...
23mπBox: A Platform for Privacy-Preserving Apps