On Sat, Apr 27, 2019 at 10:46 PM Ingo Molnar <mingo@xxxxxxxxxx> wrote: > - A C language runtime that is a subset of current C syntax and > semantics used in the kernel, and which doesn't allow access outside > of existing objects and thus creates a strictly enforced separation > between memory used for data, and memory used for code and control > flow. > > - This would involve, at minimum: > > - tracking every type and object and its inherent length and valid > access patterns, and never losing track of its type. > > - being a lot more organized about initialization, i.e. no > uninitialized variables/fields. > > - being a lot more strict about type conversions and pointers in > general. > > - ... and a metric ton of other details. Several research groups have tried to do this, and it is very difficult to do. In particular this was almost exactly the goal of C-Cured [1]. Much more recently, there's Microsoft's CheckedC [2] [3], which is less ambitious. Check the references of the latter for lots of relevant work. If anyone really pursues this they should talk directly to researchers who've worked on this, e.g. George Necula; you need to know what *didn't* work well, which is hard to glean from papers. (Academic publishing is broken that way.) One problem with adopting "safe C" or Rust in the kernel is that most of your security mitigations (e.g. KASLR, CFI, other randomizations) probably need to remain in place as long as there is a significant amount of C in the kernel, which means the benefits from eliminating them will be realized very far in the future, if ever, which makes the whole exercise harder to justify. Having said that, I think there's a good case to be made for writing kernel code in Rust, e.g. sketchy drivers. The classes of bugs prevented in Rust are significantly broader than your usual safe-C dialect (e.g. data races). [1] https://web.eecs.umich.edu/~weimerw/p/p477-necula.pdf [2] https://www.microsoft.com/en-us/research/uploads/prod/2019/05/checkedc-post2019.pdf [3] https://github.com/Microsoft/checkedc Rob -- Su ot deraeppa sah dna Rehtaf eht htiw saw hcihw, efil lanrete eht uoy ot mialcorp ew dna, ti ot yfitset dna ti nees evah ew; deraeppa efil eht. Efil fo Drow eht gninrecnoc mialcorp ew siht - dehcuot evah sdnah ruo dna ta dekool evah ew hcihw, seye ruo htiw nees evah ew hcihw, draeh evah ew hcihw, gninnigeb eht morf saw hcihw taht.
