基于ATSAMD21G18的无MMU受限嵌入式控制器安全防护最佳实践咨询

Hey there, given your setup with the ATSAMD21G18 (no MMU, tight 16KiB RAM / 50MHz CPU constraints) connected to an untrusted public bus, I’ve put together some practical security practices tailored exactly to your needs—focused on preventing controller takeover via buffer overflows and similar exploits, all optimized for your limited resources:

1. 轻量级栈保护（适配小RAM） #

You mentioned stack guards, and the ATSAMD21’s hardware lets you implement a simplified, low-overhead version without eating up too much memory:

• Use the chip’s built-in TRNG (True Random Number Generator) to generate a 4-byte stack cookie at the start of critical functions (like bus data handlers). The TRNG has minimal overhead and is easy to initialize once at boot.
• Add a check for the cookie right before the function returns. If it’s been tampered with, trigger an immediate hard reset via NVIC_SystemReset()—no need for complex error handling, just kill the execution to stop the attack.
• Here’s a quick macro you can reuse:

#include <samd21.h>

// Initialize TRNG once at boot
void trng_init(void) {
  TRNG->CTRLA.bit.ENABLE = 1;
  while (!TRNG->INTFLAG.bit.DATARDY);
}

// Get a random 32-bit value from TRNG
uint32_t get_trng_cookie(void) {
  while (!TRNG->INTFLAG.bit.DATARDY);
  return TRNG->DATA.reg;
}

// Stack guard macros
#define STACK_GUARD_SET() uint32_t _stack_guard = get_trng_cookie();
#define STACK_GUARD_CHECK() if (_stack_guard != get_trng_cookie()) NVIC_SystemReset();

• Apply this to all functions that handle input from the public bus—those are the highest risk for buffer overflows.

2. 强制输入边界校验（第一道防线） #

Since you can’t trust bus nodes, every byte received must be validated before processing:

• For any bus communication (UART, I2C, SPI), first parse the frame’s length field (if your protocol has one) and reject any frame where the length exceeds your pre-allocated buffer size.
• Replace unsafe functions like strcpy, sprintf, or raw memcpy with bounded alternatives. Use GCC’s built-in __builtin_memcpy_chk or write your own simple bounded copy:

// Bounded string copy - returns 0 on success, 1 on overflow
int safe_strcpy(char *dest, const char *src, size_t dest_size) {
  if (dest_size == 0) return 1;
  size_t i = 0;
  while (i < dest_size - 1 && src[i] != '\0') {
    dest[i] = src[i];
    i++;
  }
  dest[i] = '\0';
  return (src[i] != '\0') ? 1 : 0;
}

• Always null-terminate string buffers and verify the terminator is within the buffer bounds to prevent overflow.

3. 代码执行边界锁定 #

The ATSAMD21 has hardware features to block execution of malicious code in RAM or invalid regions:

• Configure the NVM (Non-Volatile Memory) Controller to set your FLASH code regions as read-only. This prevents attackers from overwriting your code via exploits.
• Enable compiler-level checks to restrict the Program Counter (PC) to valid FLASH addresses. Use -fstack-protector-all (GCC) for basic stack/PC protection—this adds minimal overhead and works well on small MCUs.
• Avoid dynamic memory allocation entirely (malloc/free). Static buffers are not only more memory-efficient but also eliminate heap overflow risks. Pre-allocate all buffers at compile time with fixed sizes.

4. 中断与异常安全强化 #

Attackers often target interrupts to take control—lock down your interrupt handling:

• All interrupt service routines (ISRs) that handle bus input must validate data before processing. For example, in an I2C receive ISR, first check if the received data length is within expected bounds before copying it to a buffer.
• Protect the interrupt vector table: The ATSAMD21’s vector table lives in FLASH—use the NVM controller to mark this region as read-only, so attackers can’t redirect interrupts to malicious code.
• Set a default handler for unused interrupts that triggers a hard reset. This closes off potential attack vectors from unhandled interrupts.

5. 软件层面的最小权限隔离 #

Even without an MMU, you can isolate critical code and peripherals:

• Use compiler attributes to place different code modules into separate FLASH sections. For example, put bus-handling code in .bus_section and control logic in .control_section:

__attribute__((section(".bus_section")))
void bus_data_handler(uint8_t *data, size_t len) {
  // Bus processing logic
}

• Use the NVM controller’s page-level protection to restrict access to these sections. For example, the bus section can only access UART/I2C registers, not GPIO or other control peripherals.
• Limit peripheral access: Only let code modules access the peripherals they absolutely need. For example, the bus handler doesn’t need to touch PWM or ADC registers—lock those down via software checks.

6. 简化运行时完整性检查 #

Periodically verify critical code hasn’t been tampered with, without eating too much resources:

• Precompute a CRC32 hash of your most critical functions (bus handlers, reset logic) and store it in a read-only FLASH section at compile time.
• After processing every few bus frames, recompute the CRC32 of those functions and compare it to the stored value. If it doesn’t match, trigger a reset.
• Keep this lightweight—don’t check the entire FLASH, just the high-risk code segments. The CRC32 calculation is fast and uses minimal CPU/RAM.

内容的提问来源于stack exchange，提问作者ooxi