JITDomain: Instruction-level JIT code isolation
Elsevier Microprocessors and Microsystems — 2026
Language Virtual Machines (VMs) are the execution engine of high-level languages, present in virtually all computing systems. Their components are complex and a vulnerability in any part of the execution makes the underlying victim computer open to arbitrary code execution. The Just-In-Time (JIT) compilation process is used in VMs for performance purposes by generating optimized code at run time. Taking advantage of the dynamic nature of this code, we present JITDomain, an instruction-level domain isolation solution. It duplicates memory access instructions and ties them to a specific domain to enforce three main guarantees on the JIT code, a critical part of the VM memory: call stack isolation, data access separation, and system call filtering. As new instructions come as drop-in replacement for existing ones, the instrumentation cost and code size overhead is minimized. We implemented the JITDomain solution by extending the RISC-V instruction set architecture and the CVA6 open-source processor at negligible overhead (+ 0.5%). The evaluation performed using Gigue, a JIT code workload generator, shows a performance overhead of less than 2.5%, making it suitable for real-world usage. The implementation does not slow down classical core utilization and is validated by a dedicated functional test suite.