Cornucopia Reloaded: Load Barriers for CHERI Heap Temporal Safety

Filardo, Nathaniel Wesley; Gutstein, Brett F; Woodruff, Jonathan; Clarke, Jessica; Rugg, Peter; Davis, Brooks; Johnston, Mark; Norton, Robert; Chisnall, David; Moore, Simon W; Neumann, Peter G; Watson, Robert NM

Cornucopia Reloaded: Load Barriers for CHERI Heap Temporal Safety

Authors

Filardo, Nathaniel Wesley

Publisher

Association for Computing Machinery (ACM)
Department of Computer Science and Technology
https://doi.org/10.1145/3620665.3640416

Description

Violations of temporal memory safety ("use after free", "UAF") continue to pose a significant threat to software security. The CHERI capability architecture has shown promise as a technology for C and C++ language reference integrity and spatial memory safety. Building atop CHERI, prior works - CHERIvoke and Cornucopia - have explored adding heap temporal safety. The most pressing limitation of Cornucopia was its impractical "stop-the-world" pause times. We present Cornucopia Reloaded, a re-designed drop-in replacement implementation of CHERI temporal safety, using a novel architectural feature - a per-page capability load barrier, added in Arm's Morello prototype CPU and CHERI-RISC-V - to nearly eliminate application pauses. We analyze the performance of Reloaded as well as Cornucopia and CHERIvoke on Morello, using the CHERI-compatible SPEC CPU2006 INT workloads to assess its impact on batch workloads and using pgbench and gRPC QPS as surrogate interactive workloads. Under Reloaded, applications no longer experience significant revocation-induced stop-the-world periods, without additional wall- or CPU-time cost over Cornucopia and with median 87% of Cornucopia's DRAM traffic overheads across SPEC CPU2006 and < 50% for pgbench.
Defense Advanced Research Projects Agency (DARPA) under Contract No. HR0011-18-C-0016 (“ECATS”) and Contract No. HR0011-23-C-0031 ("MTSS")