Microsoft Imatsegula CHERIOT, Yankho la Hardware Kupititsa patsogolo C Code Security

Microsoft yapeza zomwe zikuchitika zokhudzana ndi pulojekiti ya CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things) pulojekiti, yomwe cholinga chake ndi kuletsa zovuta zachitetezo mu code yomwe ilipo mu C ndi C++. CHERIOT imapereka yankho lomwe limakupatsani mwayi woteteza ma codebases omwe alipo a C/C++ popanda kufunikira kuwakonzanso. Chitetezo chimagwiritsidwa ntchito pogwiritsa ntchito makina osinthidwa omwe amagwiritsa ntchito malangizo apadera a purosesa (ISA), operekedwa ndi purosesa komanso pamlingo wa hardware kuyang'anira kukumbukira kukumbukira, kuyang'ana kulondola kwa ntchito ndi zolozera ndikuwonetsetsa kudzipatula kwa midadada.

Pulojekitiyi idapangidwa ndi diso kuti chikhalidwe chochepa cha chinenero cha C chimakhala gwero la zolakwika pamene mukugwira ntchito ndi kukumbukira, zomwe zimayambitsa mavuto monga buffer kusefukira, kupeza kukumbukira komasulidwa kale, kuchotsedwa kwa pointer, kapena kumasulidwa kawiri. . Zochita zikuwonetsa kuti ngakhale makampani akuluakulu monga Google ndi Microsoft, omwe ali ndi mfundo zowunikira zosintha kwambiri ndikugwiritsa ntchito njira zamakono zachitukuko ndi zida zowunikira zosasunthika, sangatsimikizire kusakhalapo kwa zolakwika pogwira ntchito ndi kukumbukira (mwachitsanzo, pafupifupi 70% ya zofooka mu Microsoft. ndipo Google imayamba chifukwa cha kusunga kukumbukira kosayenera).

Vutoli litha kuthetsedwa pogwiritsa ntchito zilankhulo zamapulogalamu zomwe zimatsimikizira kugwira ntchito motetezeka ndi kukumbukira, kapena kumangiriza ndi macheke owonjezera, mwachitsanzo, pogwiritsa ntchito m'malo mwa zolozera wamba monga MiraclePtr (raw_ptr), yomwe imapanga macheke owonjezera kuti mupeze malo okumbukira omasulidwa. Koma njira zoterezi ndizoyenera kwambiri pamakhodi atsopano, ndipo kukonzanso mapulojekiti omwe alipo a C / C ++ ndizovuta kwambiri, makamaka ngati apangidwa kuti azigwira ntchito m'madera omwe ali ndi zovuta, monga machitidwe ophatikizidwa ndi zipangizo za Internet of Things.

Zida za hardware za CHERIoT zimapangidwa ngati microcontroller kutengera kamangidwe ka RISC-V, kugwiritsa ntchito zomangamanga zotetezedwa za CHERI (Capability Hardware Extension to RISC-V), zomwe zimapereka chitsanzo cha kukumbukira kukumbukira kutengera "kutha" (iliyonse iwerenge ndi kulemba. kugwira ntchito kukumbukira ndikololedwa). Kutengera kamangidwe ka malangizo (ISA) operekedwa ku CHERIOT, pulogalamu yamapulogalamu imamangidwa yomwe imatsimikizira chitetezo chogwira ntchito ndi kukumbukira pamlingo wazinthu zamtundu uliwonse, imapereka chitetezo kuti isakhale ndi mwayi wokumbukira zomwe zamasulidwa kale, ndikukhazikitsa njira yochepetsera kukumbukira kukumbukira. . Njira yodzitetezera ya pulogalamu yomwe yatchulidwayo ikuwonetsedwa mwachindunji mu chilankhulo cha C/C++, chomwe chimalola kuti chigwiritsidwe ntchito kuteteza mapulogalamu omwe alipo (kungobweza ndikugwiritsa ntchito zida zomwe zimathandizira ISA CHERIOT ndizofunikira).

Yankho lomwe likufunsidwa limakupatsani mwayi kuti mutseke zolakwika zomwe zimapangitsa kuti chinthu chipitirire malire a kukumbukira, sichimalola cholozera m'malo (zolozera zonse ziyenera kupangidwa kuchokera ku zolozera zomwe zilipo), ndikuyang'anira mwayi wokumbukira mutatha kumasula (kufikira kulikonse kokumbukira pogwiritsa ntchito cholakwika cholakwika). cholozera kapena cholozera cholozera chinthu chomasulidwa chimapangitsa kuti chosiyana chitayidwe). Mwachitsanzo, kugwiritsa ntchito CHERIOT kumakupatsani mwayi wowunikira malire, kutsatira kukumbukira nthawi zonse, komanso kutsimikizira kukhulupirika kwa pointer m'zigawo zomwe zimagwiritsa ntchito data yosadalirika popanda kusintha ma code.

Pulojekitiyi ikuphatikizapo ndondomeko yowonjezereka ya kamangidwe ka malangizo a CHERIoT, kukhazikitsidwa kwa 32-bit RISC-V CPU yothandizira CHERIoT ISA, ndi zida zosinthidwa za LLVM. Zithunzi za CPU ndi mafotokozedwe a block block ku Verilog amagawidwa pansi pa layisensi ya Apache 2.0. Pakatikati pa Ibex kuchokera ku lowRISC projekiti idagwiritsidwa ntchito ngati maziko a CPU. Mtundu wa khodi wa CHERIoT ISA umafotokozedwa m'chinenero cha Sail ndipo uli ndi chilolezo pansi pa chilolezo cha BSD.

Kuonjezera apo, pulojekiti ya nthawi yeniyeni yogwiritsira ntchito CHERIOT RTOS ikuperekedwa, yomwe imapereka mwayi wopatula zipinda ngakhale pamakina ophatikizidwa ndi 256 MB ya RAM. Khodi ya CHERIoT RTOS imalembedwa mu C ++ ndipo imagawidwa pansi pa layisensi ya MIT. Zigawo zoyambira za OS, monga bootloader, scheduler ndi memory distribution system, zimapangidwa ngati mawonekedwe a zipinda.

Chipinda mu CHERIoT RTOS ndi kuphatikiza kwapayekha kwa code ndi zosintha zapadziko lonse lapansi zomwe zimafanana ndi laibulale yogawana, koma mosiyana ndi yomalizayi, imatha kusintha mawonekedwe ake (yosinthika) ndikuyendetsa mwanjira ina yachitetezo. Palibe code yochokera kunja yomwe ingasamutsire chiwongolero ku code mu chipinda ndi zinthu zolowera, kupatula pofika polowera mwapadera ndikugwiritsa ntchito zolozera kuzinthu zomwe zaperekedwa momveka bwino poyimbira chipinda china. Kukhulupirika ndi chinsinsi ndizotsimikizika pama code ndi zinthu zapadziko lonse lapansi mu chipinda.

Source: opennet.ru

Kuwonjezera ndemanga