OmniWasm: Efficient, Granular Fault Isolation and Control-Flow Integrity for Arm Microcontrollers

Traditional embedded systems often ignore security, instead focusing on simplicity. Unfortunately, increasingly per-vasive network connectivity exposes these systems to malicious input, and the consolidation of code of various qualities and sources onto single systems increases the chance of errant behavior. Microcontrollers do not often have advanced security facilities to help prevent malicious threats - even the use of memory protection to constrain the ill-effects of a compromise is not pervasive. Software techniques to provide strong security properties for application execution often focus on limiting accessible memory through dynamic checks on memory accesses through software fault isolation (SFI), and on ensuring that software cannot suffer from control-flow hijack attacks through control-flow integrity (CFI). This paper introduces OmniWasm, which provides sandboxes in which applications execute that provide both SFI and CFI. OmniWasm focuses on two core contributions. First, it reduces the overhead of these techniques by using a novel application of common, but obscure memory operations to both limit sandboxed memory accesses (SFI) using hardware, and allow memory accesses outside the sandbox to enable CFI. Second, it focuses on enabling embedded soft-ware to be decomposed into multiple sandboxes by providing optimized communication facilities between them that avoid thread context switching overheads and providing single-copy message passing. We show that the overheads of OmniWasm are better than existing software address validation techniques while also providing better memory utilization. We also show that OmniWasm enables significant performance gains for inter-sandbox communication across varying message sizes.