一句话：提出基于逐页能力加载屏障的 CHERI 堆时序安全实现，消除撤销时的全局停顿。
针对 C/C++ 的 use-after-free 等时序内存安全违规，CHERI 能力架构此前已提供空间内存安全，CHERIvoke 与 Cornucopia 进一步探索堆时序安全，但 Cornucopia 的 stop-the-world 暂停不实用。本文提出 Cornucopia Reloaded，利用 Arm Morello 与 CHERI-RISC-V 新增的逐页能力加载屏障，重新设计可替换实现，几乎消除应用停顿。在 Morello 上用 CHERI 兼容 SPEC CPU2006 INT、pgbench 和 gRPC QPS 评估：应用不再经历显著的撤销引发全局停顿，且不增加墙钟或 CPU 时间；DRAM 流量开销在 SPEC 中位数为 Cornucopia 的 87%，pgbench 低于 50%。
Violations of temporal memory safety ("use after free", "UAF") continue to pose a significant threat to software security. The CHERI capability architecture has shown promise as a technology for C and C++ language reference integrity and spatial memory safety. Building atop CHERI, prior works - CHERIvoke and Cornucopia - have explored adding heap temporal safety. The most pressing limitation of Cornucopia was its impractical "stop-the-world" pause times. We present Cornucopia Reloaded, a re-designed drop-in replacement implementation of CHERI temporal safety, using a novel architectural feature - a per-page capability load barrier, added in Arm's Morello prototype CPU and CHERI-RISC-V - to nearly eliminate application pauses. We analyze the performance of Reloaded as well as Cornucopia and CHERIvoke on Morello, using the CHERI-compatible SPEC CPU2006 INT workloads to assess its impact on batch workloads and using pgbench and gRPC QPS as surrogate interactive workloads. Under Reloaded, applications no longer experience significant revocation-induced stop-the-world periods, without additional wall- or CPU-time cost over Cornucopia and with median 87% of Cornucopia's DRAM traffic overheads across SPEC CPU2006 and < 50% for pgbench.
@inproceedings{FilardoGW0RDJNC24,
title = {Cornucopia Reloaded: Load Barriers for CHERI Heap Temporal Safety},
author = {Nathaniel Wesley Filardo and Brett F. Gutstein and Jonathan Woodruff and Jessica Clarke and Peter Rugg and Brooks Davis and Mark Johnston and Robert Norton and David Chisnall and Simon W. Moore and Peter G. Neumann and Robert N. M. Watson},
booktitle = {ASPLOS},
year = {2024},
doi = {10.1145/3620665.3640416}
}