[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTTwfNLhXzLzwrtlfUufy6-l10mpnhig21qWQj5i5wx4":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"339d9bc6-ccd6-4414-96fc-73d0797114b5","article","CHERI Capability：如果指针自带访问范围和权限，会怎样？","cheri-capability-hardware-memory-safety","CHERI capability 为指针加入受保护的边界和权限，使硬件能够限制内存访问。本文讲解它能缓解的漏洞类型，以及时间安全与生态迁移限制。","在许多程序中，指针看起来只是一个内存地址。若程序拿到错误的地址、越过数组边界，或访问了不该触碰的对象，硬件和语言运行时未必能仅凭这个数字判断权限。CHERI（Capability Hardware Enhanced RISC Instructions）研究一种不同思路：让指针不仅携带位置，还携带可验证的边界与权限信息。\n\n可以把普通地址想成一串门牌号，而 CHERI capability 更像一张带有效范围和通行权限的门禁卡。它与地址关联，但还包含边界、权限等元数据，并由硬件保护其完整性。访问发生时，处理器能够检查 capability 是否有效、目标地址是否落在授权范围内、操作是否允许。程序若试图越过对象边界或使用缺失的权限，硬件就可以阻止该访问。\n\n这种方法针对的是常见内存安全漏洞的一大类根源，例如越界访问和不受控指针权限。它不只是给 C\u002FC++ 加上一层事后检查，而是在指针表示和硬件执行模型层面加强约束。研究和生态还涉及操作系统、编译器、ABI、调试工具以及应用迁移，因此不是普通软件仅靠改一个编译选项就能获得全部能力。\n\n边界必须说清楚：能力指针可以帮助限制空间访问范围，却不等于自动解决所有时间安全问题。对象已经释放后，仍需其他机制或编程约束避免使用失效引用；越权但逻辑上错误的合法操作也可能通过检查。CHERI 不能替代认证、输入校验、业务逻辑审计或完整的安全工程。\n\n如果要把它带入现实系统，还要考虑旧代码兼容、指针和数据结构布局变化、第三方库支持、性能特征与开发工具。原型研究的结果不能直接推导为所有生产工作负载都适用。CHERI 的价值更像是建立一种硬件可执行的安全边界，让程序中的引用更难悄悄获得过大的权力。\n\n它值得关注之处，是把“最小权限”从账号和进程层进一步带到对象引用本身：一个指针只能访问它被授予的范围，而不是仅仅因为它握有地址就能做任何事。\n\n来源：[CHERI Alliance：Capabilities](https:\u002F\u002Fcheri-alliance.github.io\u002Fbuild\u002Ftechnology\u002Fcapabilities\u002F)","\u002Fuploads\u002F2026-10-06\u002F774d772b-3783-4f37-856d-9294de6cde68.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"8d35e42e-9f5b-4dd9-b30f-dc2c53d06096","硬件","hardware",{"id":32,"name":33,"slug":34},"88d2bc27-0e0f-468a-b907-2991cb97b87b","人工智能","ai",null,"CHERI Alliance：Capabilities","https:\u002F\u002Fcheri-alliance.github.io\u002Fbuild\u002Ftechnology\u002Fcapabilities\u002F","published",false,60,0,"2026-10-06T00:00:00.000Z","2026-10-06T07:51:41.031Z",[45,53,62],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":42,"createdAt":52},"3f168250-e566-4f42-94c3-770a94401e6f","IOMMU：外设为什么不能随便读写整台机器的内存？","iommu-device-dma-memory-isolation","IOMMU 为设备 DMA 提供地址转换与访问隔离，是虚拟机设备直通和受控用户态驱动的重要基础。本文说明它保护什么、不能保证什么。","\u002Fuploads\u002F2026-10-06\u002Ff86f288a-2fdf-4980-a4be-078d8416273d.jpg",52,"2026-10-06T07:51:20.460Z",{"id":54,"type":6,"title":55,"slug":56,"summary":57,"coverUrl":58,"authorName":14,"sno":59,"publishedAt":60,"createdAt":61},"560f8daa-d53e-49f9-b4cc-54d5f39aea71","1.58 比特大模型：参数只有 −1、0、1，为什么还能推理？","one-bit-llm-bitnet-explained","BitNet b1.58 让模型从训练阶段就使用 −1、0、1 三值权重，探索更低的内存、延迟和能耗。本文解释 1.58 bit 的由来、原生低比特与 INT4 量化的区别、零值的作用，以及为什么收益依赖硬件和运行时。","\u002Fuploads\u002F2026-09-08\u002Fab641d19-d38a-4d44-b40f-649aa1c3191a.jpg",49,"2026-09-08T00:00:00.000Z","2026-09-08T03:19:29.625Z",{"id":63,"type":6,"title":64,"slug":65,"summary":66,"coverUrl":67,"authorName":14,"sno":68,"publishedAt":69,"createdAt":70},"d4a1ef13-fa42-41f3-a9d2-635f47d801d0","RISC-V PMP：处理器怎样给不同特权级划出内存禁区？","riscv-pmp-physical-memory-protection","RISC-V PMP 由高特权级软件配置物理内存区域访问规则，并由处理器在较低权限代码访问时执行检查。本文区分 PMP 与虚拟内存，介绍它在固件和嵌入式安全中的作用及实现边界。","\u002Fuploads\u002F2026-10-13\u002Fecfdd306-c8d2-4bfa-984e-7f579fd86f61.jpg",41,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:39.212Z"]