FRESCO：CHERI应用处理器的完整且可扩展的时序安全机制
FRESCO: Complete and Scalable Temporal Safety for CHERI Application Processors
浏览论文内容
中文总结 AI 辅助
FRESCO 是首个为 CHERI 应用处理器提供完整可扩展时序安全的软硬件协同设计方案，通过栈指针着色等机制防御多种内存安全漏洞，运行时开销较小。
中文摘要 AI 辅助
CHERI提供硬件强制的空间内存安全。尽管现有工作已为其扩展了堆时序安全，但栈的使用后返回（use-after-return）问题仍未得到解决。现有防御方案存在不足：编译器分析仅能可靠捕获作为函数返回值逃逸的引用，而动态 sanitizer 带来的开销使其无法用于生产部署。我们提出 FRESCO，其核心原则是栈能力（stack capability）不得超出创建它的栈帧的生命周期。FRESCO 为栈指针赋予每调用一次就生成的来源标识符（provenance identifiers）进行“着色”；从该指针派生的所有能力都会继承该生命周期，且无论以何种方式、在何处逃逸，都会在函数退出时被硬件级失效。由于栈帧的回收频率比堆分配高出几个数量级，FRESCO 通过以下方式管理由此产生的颜色压力：1）Color Saver，一种静态的、感知能力（capability-aware）的逃逸分析，仅将着色应用于需要它的函数，其核心算法已在 Rocq 中通过机械验证；2）能力-颜色分段（capability-color segmentation），将内存划分为不相交的段，每个段拥有独立的颜色命名空间。颜色分段使栈和堆的时序安全能在同一系统中共存，使 FRESCO 成为首个为 CHERI 应用处理器提供完整且可扩展时序安全的软硬件协同设计方案。我们在 CHERI-RISC-V QEMU 全系统模拟器和乱序执行的 CHERI-Toooba FPGA 软核上实现了 FRESCO，软件支持包括启用 CHERI 的 Clang/LLVM 编译器和 CheriBSD 操作系统。FRESCO 在 NIST Juliet 测试套件和 CVE 中系统性地阻止了使用后返回、使用后释放（use-after-free）和双重释放（double-free）漏洞，在 SPEC CPU（几何平均开销 4%）、SQLite 和 PostgreSQL（开销 10%-14%）中仅产生很小的运行时开销。
英文摘要
CHERI provides hardware-enforced spatial memory safety. While prior work extends it with heap temporal safety, stack use-after-return remains unaddressed. Existing defenses fall short: compiler analysis reliably catches only references that escape as function return values, while dynamic sanitizers impose overheads that preclude production deployment. We present FRESCO, built on the principle that a stack capability must not outlive the frame that created it. FRESCO "colors" the stack pointer with per-invocation provenance identifiers; every capability derived from it inherits that lifetime and is hardware-invalidated the moment the function exits, regardless of how or where it escaped. Because stack frames retire orders of magnitude more frequently than heap allocations, FRESCO manages the resulting color pressure through: 1) Color Saver, a static capability-aware escape analysis that confines coloring to functions needing it, and whose core algorithm we mechanically verify in Rocq, and 2) capability-color segmentation, which partitions memory into disjoint segments, each with an independent color namespace. Color segmentation lets stack and heap temporal safety coexist on one system, making FRESCO the first hardware/software co-design to provide complete and scalable temporal safety for CHERI application processors. We realize FRESCO on the CHERI-RISC-V QEMU full-system emulator and the out-of-order CHERI-Toooba FPGA softcore, with software support in the CHERI-enabled Clang/LLVM compiler and CheriBSD OS. FRESCO systematically prevents use-after-return, use-after-free, and double-free across the NIST Juliet Test Suite and CVEs, with only a small run-time overhead in SPEC CPU (4% g.m.), SQLite, and PostgreSQL (10-14%).
