What the Experiments Prove—and What They Do Not
The kSFS evaluation is designed to answer two different questions: whether the boundary can be made fast enough for real workloads, and whether faults in an untrusted filesystem stay contained. This chapter reads the measurements and tests separately, because a high throughput result does not prove isolation and a successful fault-injection result does not prove filesystem correctness. The useful judgment comes from the combination of workload shape, baseline choice, measured gap, and stated limit.
Performance is a middle-ground result
The paper's performance comparison includes ordinary FUSE, an optimized FUSE variant called FUSE-zc, kSFS, native Linux implementations, and in some tests Bento implementations. These baselines do not all represent the same design. Ordinary FUSE supplies a user-space process boundary and its associated crossing cost. FUSE-zc adds a zero-copy style optimization without moving execution into an in-kernel WebAssembly sandbox. Native Linux supplies a highly optimized in-kernel implementation but does not provide the same isolation boundary. Bento represents a memory-safe-language approach with its own implementation and performance characteristics.
That distinction matters before any number is read. If kSFS beats FUSE, the result may reflect both in-kernel execution and the data-path optimizations. If kSFS trails native Linux, the gap may be the cost of instrumentation, validation, serialization, or differences in caching and filesystem behavior. The comparison is not a race with one universal winner. It asks whether a system with stronger fault containment can stay close enough to the fast but less isolated baseline to be useful.
The fio random-I/O experiments make the concurrency story visible. At 64 threads, the paper reports 430 kIOPS for kSFS exFAT random reads, compared with 13.6 kIOPS for FUSE, 137 kIOPS for FUSE-zc, 555 kIOPS for Linux, and 623 kIOPS for Bento. The large gap between ordinary FUSE and FUSE-zc shows that data movement and the user-space path matter. The further gap between FUSE-zc and kSFS shows that zero-copy alone is not the whole explanation: executing the filesystem handler in the kernel contributes materially to the result.
Yet kSFS remains below the Linux and Bento results in that comparison. That residual gap is evidence of a real cost for the boundary. WebAssembly instrumentation, request handling, instance synchronization, and the rules needed to keep the module from accessing arbitrary kernel state do not disappear simply because the function call is local. The result is better described as a large recovery from the user-space penalty with a moderate overhead relative to unisolated or differently isolated implementations.
The sequential measurements tell a similar but less dramatic story. For NTFS, the reported kSFS implementation reaches 2364 MiB/s for reads and 1220 MiB/s for writes. FUSE reaches 2151 MiB/s and 1005 MiB/s, while Linux reaches 3325 MiB/s and 1501 MiB/s. kSFS improves on ordinary FUSE in both directions, but it does not erase the native Linux advantage. Sequential transfers can amortize fixed request costs more effectively than small random operations, so the relative improvement is not expected to match the concurrent random-read result.