Abstract:Abstract Memory safety bugs continue to be a major source of security vulnerabilities in our critical infrastructure. The CHERI project has proposed extending conventional architectures with hardware-supported capabilities to enable fine-grained memory protection and scalable compartmentalisation, allowing historically memory-unsafe C and C++ to be adapted to deterministically mitigate large classes of vulnerabilities, while requiring only minor changes to existing system software sources. Arm is currently designing and building Morello, a CHERI-enabled prototype architecture, processor, SoC, and board, extending the high-performance Neoverse N1, to enable industrial evaluation of CHERI and pave the way for potential mass-market adoption. However, for such a major new security-oriented architecture feature, it is important to establish high confidence that it does provide the intended protections, and that cannot be done with conventional engineering techniques. In this paper we put the Morello architecture on a solid mathematical footing from the outset. We define the fundamental security property that Morello aims to provide, reachable capability monotonicity, and prove that the architecture definition satisfies it. This proof is mechanised in Isabelle/HOL, and applies to a translation of the official Arm specification of the Morello instruction-set architecture (ISA) into Isabelle. The main challenge is handling the complexity and scale of a production architecture: 62,000 lines of specification, translated to 210,000 lines of Isabelle. We do so by factoring the proof via a narrow abstraction capturing essential properties of arbitrary CHERI ISAs, expressed above a monadic intra-instruction semantics. We also develop a model-based test generator, which generates instruction-sequence tests that give good specification coverage, used in early testing of the Morello implementation and in Morello QEMU development, and we use Arm’s internal test suite to validate our model. This gives us machine-checked mathematical proofs of whole-ISA security properties of a full-scale industry architecture, at design-time. To the best of our knowledge, this is the first demonstration that that is feasible, and it significantly increases confidence in Morello.

Relaxed exception semantics for Arm-A (extended version)

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Armlock: Hardware-Based Fault Isolation For Arm

Isla: integrating full-scale ISA semantics and axiomatic concurrency models (extended version)

From Algebra To Operational Semantics

On Thin Air Reads: Towards an Event Structures Model of Relaxed Memory

Verifying C11 programs operationally

Trace Semantics and Algebraic Laws for MCA ARMv8 Architecture Based on UTP.

Idev: Exploring and Exploiting Semantic Deviations in ARM Instruction Processing

Adding Explicit Load-Acquire and Store-Release Instructions to the RISC-V ISA

UTP Semantics for the MCA ARMv8 Architecture

Flexible Instruction-Set Semantics via Abstract Monads (Experience Report)

Lost in Interpretation: Navigating Challenges in Validating Persistency Models Amid Vague Specs and Stubborn Machines, All with a Sense of Humour

Compiling a Calculus for Relaxed Memory: Practical constraint-based low-level concurrency

The Problem of Programming Language Concurrency Semantics

PACSafe: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

Taming undefined behavior in LLVM

Verified Security for the Morello Capability-enhanced Prototype Arm Architecture

Automatically Locating ARM Instructions Deviation between Real Devices and CPU Emulators

CryptSan: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

ARMORY: Fully Automated and Exhaustive Fault Simulation on ARM-M Binaries