--- title: LLVM Merges x86 LFI "Lightweight Fault Isolation" Target... description: Stanford researchers, with Google's support, have merged an x86_64 Lightweight Fault Isolation (LFI) target into LLVM (for LLVM 23), following an earlier... canonical: https://daily.dev/posts/llvm-merges-x86-lfi-lightweight-fault-isolation-target-for-in-process-sandboxing-uwe5roi2i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: LLVM Merges x86 LFI "Lightweight Fault Isolation" Target For In-Process Sandboxing | daily.dev og:description: Stanford researchers, with Google's support, have merged an x86_64 Lightweight Fault Isolation (LFI) target into LLVM (for LLVM 23), following an earlier... og:url: https://daily.dev/posts/llvm-merges-x86-lfi-lightweight-fault-isolation-target-for-in-process-sandboxing-uwe5roi2i og:image: https://api.daily.dev/og/posts/UwE5roi2i.png og:image:alt: LLVM Merges x86 LFI "Lightweight Fault Isolation" Target For In-Process Sandboxing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # LLVM Merges x86 LFI "Lightweight Fault Isolation" Target For In-Process Sandboxing **[Phoronix](https://daily.dev/sources/phoronix)** · 2 min read · 1 upvotes · 0 comments ## Summary Stanford researchers, with Google's support, have merged an x86_64 Lightweight Fault Isolation (LFI) target into LLVM (for LLVM 23), following an earlier AArch64 merge. LFI is a compiler-based in-process sandboxing approach for C, C++, and Assembly code that aims to provide memory safety with minimal performance overhead. Sandbox context switches take only tens of cycles — roughly 100x faster than process-based sandboxes — and LFI delivers 3x–10x lower overhead compared to WebAssembly toolchains. On Spec2017 benchmarks, it incurs ~7% overhead on AArch64 for full sandboxing and ~2% for write-only sandboxing. LFI supports both unmodified libraries and device drivers through different runtimes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Lightweight Fault Isolation (LFI) and how does it differ from WebAssembly sandboxing? Lightweight Fault Isolation is a compiler-based in-process sandboxing technique for C, C++, and Assembly that stays close to the native target ABI instead of aiming for platform independence like WebAssembly. It offers a 3x-10x reduction in sandboxing overhead compared to state-of-the-art Wasm toolchains, with sandbox context switches taking only tens of cycles versus process-based sandboxes. _developers evaluating native sandboxing tradeoffs can follow LFI's LLVM progress on daily.dev._ ### Has the x86-64 LFI target been merged into LLVM yet? Yes, the initial x86_64 LFI target has been merged into LLVM for the LLVM 23 release, following the earlier upstreaming of the AArch64 LFI target. The work originated from Stanford research and has received engineering contributions from Google. _track LLVM 23 changes like the LFI target as they land by following compiler news on daily.dev._ ### How much performance overhead does LFI add compared to native code? On the SPEC2017 benchmark suite, LFI incurs roughly 7% overhead on AArch64 versus native code when providing full sandboxing, and only about 2% overhead when sandboxing writes only, which provides integrity but not secrecy. Sandbox context switches are tens of cycles, often around 100 times faster than process-based sandboxing approaches. _engineers weighing sandboxing overhead against security guarantees can keep up with LFI benchmarks on daily.dev._ ## Similar posts on daily.dev - [Binary Obfuscation that Doesn't Kill LTO: A Recap of My Thotcon Talk](https://daily.dev/posts/binary-obfuscation-that-doesn-t-kill-lto-a-recap-of-my-thotcon-talk-5st70tkez) · Hacker News · 0 upvotes · 0 comments - [Fedora 45 Considering x86\_64 Shadow Stack Usage By Default](https://daily.dev/posts/fedora-45-considering-x86-64-shadow-stack-usage-by-default-76roixxvt) · Phoronix · 0 upvotes · 0 comments - [Software sandboxing: The basics \(2025\)](https://daily.dev/posts/software-sandboxing-the-basics-2025--auazxdqh6) · Lobsters · 0 upvotes · 0 comments - [Tracking down a 25% regression on LLVM RISC-V](https://daily.dev/posts/tracking-down-a-25-regression-on-llvm-risc-v-c7rbsm3us) · Adafruit Blog · 0 upvotes · 0 comments --- Tags: [#general-programming](https://daily.dev/tags/general-programming), [#compiler](https://daily.dev/tags/compiler) [View this post on daily.dev](https://daily.dev/posts/llvm-merges-x86-lfi-lightweight-fault-isolation-target-for-in-process-sandboxing-uwe5roi2i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"LLVM Merges x86 LFI \"Lightweight Fault Isolation\" Target For In-Process Sandboxing","url":"https://daily.dev/posts/llvm-merges-x86-lfi-lightweight-fault-isolation-target-for-in-process-sandboxing-uwe5roi2i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/llvm-merges-x86-lfi-lightweight-fault-isolation-target-for-in-process-sandboxing-uwe5roi2i"},"datePublished":"2026-07-11T10:18:53.929Z","dateModified":"2026-09-14T07:25:26.481Z","description":"Stanford researchers, with Google's support, have merged an x86_64 Lightweight Fault Isolation (LFI) target into LLVM (for LLVM 23), following an earlier...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Phoronix","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Phoronix","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6a26ba379dd64932830aa0c9803dd7ee","url":"https://daily.dev/sources/phoronix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/llvm-merges-x86-lfi-lightweight-fault-isolation-target-for-in-process-sandboxing-uwe5roi2i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"general-programming,compiler","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Phoronix","item":"https://daily.dev/sources/phoronix"},{"@type":"ListItem","position":3,"name":"LLVM Merges x86 LFI \"Lightweight Fault Isolation\" Target For In-Process Sandboxing"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/llvm-merges-x86-lfi-lightweight-fault-isolation-target-for-in-process-sandboxing-uwe5roi2i#faq","mainEntity":[{"@type":"Question","name":"What is Lightweight Fault Isolation (LFI) and how does it differ from WebAssembly sandboxing?","acceptedAnswer":{"@type":"Answer","text":"Lightweight Fault Isolation is a compiler-based in-process sandboxing technique for C, C++, and Assembly that stays close to the native target ABI instead of aiming for platform independence like WebAssembly. It offers a 3x-10x reduction in sandboxing overhead compared to state-of-the-art Wasm toolchains, with sandbox context switches taking only tens of cycles versus process-based sandboxes. developers evaluating native sandboxing tradeoffs can follow LFI's LLVM progress on daily.dev."}},{"@type":"Question","name":"Has the x86-64 LFI target been merged into LLVM yet?","acceptedAnswer":{"@type":"Answer","text":"Yes, the initial x86_64 LFI target has been merged into LLVM for the LLVM 23 release, following the earlier upstreaming of the AArch64 LFI target. The work originated from Stanford research and has received engineering contributions from Google. track LLVM 23 changes like the LFI target as they land by following compiler news on daily.dev."}},{"@type":"Question","name":"How much performance overhead does LFI add compared to native code?","acceptedAnswer":{"@type":"Answer","text":"On the SPEC2017 benchmark suite, LFI incurs roughly 7% overhead on AArch64 versus native code when providing full sandboxing, and only about 2% overhead when sandboxing writes only, which provides integrity but not secrecy. Sandbox context switches are tens of cycles, often around 100 times faster than process-based sandboxing approaches. engineers weighing sandboxing overhead against security guarantees can keep up with LFI benchmarks on daily.dev."}}]} ```