Ceno BaseVM soundness & audit

[hero78119]

this is an super issue to track for reviewing potiential soundness problem

[hero78119]

Some idea discussed with @lightsing

• panic abort + handling

[lightsing]

Security enhancement via ASLR

Alought rust is much safe, attacker could still be able utilize memory corruption vulnerabilities if there are any.
Propose implement ASLR in ceno to preventing such exploitation.

Current: static relocation model used.
Changes to: "pic"

Changes to the loading process

Currently we reserved 128MB size to ROM section from 0x20000000, and 1024MB for RAM starts from 0x80000000.

Using memory.x like:

SECTIONS {
  . = 0;

  .text : ALIGN(0x1000) {
    *(.text .text.*);
  }

  .rodata : ALIGN(0x1000) {
    *(.rodata .rodata.*);
  }

  .data : ALIGN(0x1000) {
    *(.data .data.*);
  }

  .bss : ALIGN(0x1000) (NOLOAD) {
    *(.bss .bss.*);
  }
}

To randomize the address of sections: .text, .rodata, .data, .bss:

• choose a random load_base aligned
• load each section into [load_base + p_vaddr, load_base + p_vaddr + p_memsz)
• set corresponding rwx priviliges.