Sugar: Secure GPU Acceleration in Web Browsers Zhihao Yao , Zongheng Ma, Yingtong Liu, Ardalan Amiri Sani, Aparna Chandramowlishwaran Trustworthy Systems Lab, UC Irvine 1
WebGL was released in 2011 Source: https://www.google.com/map 2
WebGL is popular WebGL adoption rate by top 100 websites 47.0% 53.0% 3
WebGL is popular Browser support rate (48.8 million visitors) Does not support 4.0% 96.0% Source: http://webglstats.com (2017) 4
https://www.apple.com/macos/sierra/ https://www.google.com/map 5 https://eyes.nasa.gov/curiosity/ http://dlmf.nist.gov
WebGL recap 6
First, a quick recap on OpenGL Native app GL libs user space kernel space Kernel mode GPU driver kernel space hardware GPU hardware 7
First, a quick recap on OpenGL Native app Native app function call GL libs GL libs user space kernel space Kernel mode GPU driver kernel space hardware GPU hardware 8
First, a quick recap on OpenGL Native app Native app GL libs GL libs user space syscall kernel space Kernel mode GPU driver kernel space hardware GPU hardware 9
Use the same design for WebGL? Web app Buggy GL libs user space Malicious kernel space Compromised Kernel mode GPU driver kernel space hardware GPU hardware 10
Web apps are not trusted Web app Buggy GL libs user space Malicious kernel space Compromised Kernel mode GPU driver kernel space hardware GPU hardware 11
GPU driver is buggy Web app Buggy GL libs user space Malicious kernel space Compromised Kernel mode GPU driver kernel space hardware GPU hardware 12
Kernel driver is compromised Web app web app Buggy GL libs GL libs user space Malicious kernel space Compromised Kernel mode GPU driver kernel space hardware GPU hardware 13
Current WebGL design GPU Process Web app Web app Checks Web app GL libs Browser user space kernel space Kernel mode GPU driver kernel space hardware GPU hardware 14
Current WebGL design GPU Process IPC Web app Web app Checks Web app GL libs Browser Browser user space kernel space Kernel mode GPU driver kernel space hardware GPU hardware 15
Security checks in GPU Process GPU Process Web app Web app Checks Web app GL libs Browser user space kernel space Kernel mode GPU driver kernel space hardware GPU hardware 16
TCB of current WebGL Design GPU Process Web app 158,000 LoC Web app Checks Web app (GPU Process) GL libs 457,000 LoC Browser (GL libraries) Kernel mode GPU driver 123,000 LoC (GPU driver) GPU hardware 17
Vulnerabilities in GPU process CVE-2014-1556 GPU Process CVE-2015-7179 Web app CVE-2013-2874 Web app Checks Web app CVE-2017-5031 GL libs CVE-2014-1502 Browser Kernel mode GPU driver GPU hardware 18
Kernel driver is compromised GPU Process Web app Web app Checks Web app GL libs Browser CVE-2011-2601* Chrome 153469 Chrome 483877* Kernel mode GPU driver CVE-2011-2367 CVE-2011-3653 GPU hardware *Not yet fixed 19
Vulnerability examples CVE-2014-1556 execute arbitrary code CVE-2015-7179 execute arbitrary code CVE-2013-2874 read browser UI CVE-2017-5031 read GPU process memory CVE-2014-1502 use of cross-origin contents Chrome Issue 593680 browser hang Chrome Issue 83841 leak system username CVE-2011-2601* system UI freeze Chrome issue 153469 kernel panic Chrome issue 483877* system UI freeze CVE-2011-2367 read of GPU memory CVE-2011-3653 read of GPU memory CVE-2014-3173 read of GPU memory *Not yet fixed 20
Our WebGL vulnerability study https://trusslab.github.io/sugar/webgl_bugs 21
Current WebGL design High Known Zero day System UI performance vulnerabilities vulnerabilities freeze 22
CVE-2014-3173, read of GPU graphics memory We type some private notes in terminal: 23
CVE-2014-3173, read of GPU graphics memory 24
Overview of Sugar Key idea: • Use GPU virtualization to give an untrusted web app a separate vGPU 25
Intel GPU virtualization • We build a prototype on Intel GPU virtualization ● Intel GPU virtualization is available since the 4th generation Core processors [1] 26 [1] https://www.usenix.org/conference/atc14/technical-sessions/presentation/tian Photo credit: https://www.intel.com/pressroom/archive/releases/2008/20081117comp_sm.htm
27
vGPU 2 vGPU 1 GPU GPU 28
Sugar’s design Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver hardware vGPU GPU hardware 29
Sugar’s design Web app GPU Process function call GL libs GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver hardware vGPU GPU hardware 30
Sugar’s design Web app GPU Process GL libs function call GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver hardware vGPU GPU hardware 31
Sugar’s design Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver hardware vGPU GPU hardware 32
Sugar’s design Web app GPU Process GL libs virtual GL libs vGPU driver graphics Browser plane primary Kernel mode graphics GPU driver plane vGPU GPU hardware 33
Why is Sugar secure? 34
Web app process is untrusted Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver hardware vGPU GPU hardware 35
Web app process is sandboxed Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver hardware vGPU GPU hardware 36
vGPU is isolated Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver hardware vGPU GPU hardware 37
Sugar’s TCB is small Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space 34,400 LoC Kernel mode (GPU virtualization) GPU driver hardware vGPU GPU hardware 38
Vulnerability examples CVE-2014-1556 execute arbitrary code CVE-2015-7179 execute arbitrary code CVE-2013-2874 read browser UI CVE-2017-5031 read GPU process memory CVE-2014-1502 use of cross-origin contents Chrome Issue 593680 browser hang Chrome Issue 83841 leak system username CVE-2011-2601* system UI freeze Chrome issue 153469 kernel panic Chrome issue 483877* system UI freeze CVE-2011-2367 read of GPU memory CVE-2011-3653 read of GPU memory CVE-2014-3173 read of GPU memory *Not yet fixed 39
Limitation of this Sugar design Intel vGPU hang will cause a real GPU hang 40
Dual-GPU Sugar Key idea: Use two GPUs to fully isolate the virtual graphics plane and the primary graphics plane. ● Solves system UI freeze ● Provides better performance isolation 41
Dual-GPU Sugar’s design Web app GPU process GL libs GL libs vGPU driver user space Browser kernel space Kernel mode Kernel mode GPU 1 driver GPU 2 driver hardware vGPU GPU 1 hardware GPU 2 hardware 42 Photo credit: https://www.amd.com/zh-tw/products/graphics/desktop/6000/6990
Many computers have two GPUs dell.com/Inspiron15 apple.com/macbook-pro store.hp.com/envy 43
Intel’s 8th Generation Core Processors with Radeon RX Vega M Graphics Source: https://newsroom.intel.com/news/8th-gen-intel-core-radeon-rx-vega-m-graphics 44
Sugar’s implementation 45
WebGL in web app process Reuse most of GPU process code WebKit / Blink GPU Process Ported from GPU process WebGL frontend WebGL backend WebGL backend GL libs GL libs vGPU driver 46
vGPU driver as a library We modify GL libs to issue function calls instead of syscalls WebKit / Blink WebGL frontend WebGL backend GL libs function call vGPU driver 47
Register: trap and emulate Web app GPU Process GL libs GL libs vGPU driver Mapped Browser user space registers kernel space Kernel mode GPU driver hardware vGPU GPU hardware 48
Register: trap and emulate Web app GPU Process GL libs GL libs vGPU driver Mapped Browser user space registers kernel space Kernel mode GPU virtualization GPU driver layer will emulate hardware vGPU GPU hardware 49
Interrupt: deliver as signal Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space Kernel mode GPU driver Interrupt hardware vGPU GPU hardware 50
Interrupt: deliver as signal Web app GPU Process GL libs GL libs vGPU driver Browser user space kernel space The virtualization layer Kernel mode delivers as a signal GPU driver Interrupt hardware vGPU GPU hardware 51
Interrupt: deliver as signal Web app GPU Process GL libs GL libs vGPU driver Signal Browser user space kernel space Kernel mode GPU driver Interrupt hardware vGPU GPU hardware 52
DMA overview Main GPU DMA memory 53
DMA overview Page Main vGPU DMA table memory 54
Evaluations 55
Sugar’s performance is good under the same WebGL benchmarks that Chrome uses 56
Sugar’s performance is good under the same WebGL benchmarks that Chrome uses 60 FPS 57
Sugar’s CPU overhead is low Sugar is better than CPU rendering by 375% on average 58
Recommend
More recommend
