Abstract:Abstract Memory safety bugs continue to be a major source of security vulnerabilities in our critical infrastructure. The CHERI project has proposed extending conventional architectures with hardware-supported capabilities to enable fine-grained memory protection and scalable compartmentalisation, allowing historically memory-unsafe C and C++ to be adapted to deterministically mitigate large classes of vulnerabilities, while requiring only minor changes to existing system software sources. Arm is currently designing and building Morello, a CHERI-enabled prototype architecture, processor, SoC, and board, extending the high-performance Neoverse N1, to enable industrial evaluation of CHERI and pave the way for potential mass-market adoption. However, for such a major new security-oriented architecture feature, it is important to establish high confidence that it does provide the intended protections, and that cannot be done with conventional engineering techniques. In this paper we put the Morello architecture on a solid mathematical footing from the outset. We define the fundamental security property that Morello aims to provide, reachable capability monotonicity, and prove that the architecture definition satisfies it. This proof is mechanised in Isabelle/HOL, and applies to a translation of the official Arm specification of the Morello instruction-set architecture (ISA) into Isabelle. The main challenge is handling the complexity and scale of a production architecture: 62,000 lines of specification, translated to 210,000 lines of Isabelle. We do so by factoring the proof via a narrow abstraction capturing essential properties of arbitrary CHERI ISAs, expressed above a monadic intra-instruction semantics. We also develop a model-based test generator, which generates instruction-sequence tests that give good specification coverage, used in early testing of the Morello implementation and in Morello QEMU development, and we use Arm’s internal test suite to validate our model. This gives us machine-checked mathematical proofs of whole-ISA security properties of a full-scale industry architecture, at design-time. To the best of our knowledge, this is the first demonstration that that is feasible, and it significantly increases confidence in Morello.

Operationally Proving Memory Access Violations in Isabelle/HOL

Applying Rely-Guarantee Reasoning on Concurrent Memory Management and Mailbox in μC/OS-II: A Case Study.

Applying Rely-Guarantee Reasoning on Concurrent Memory Management and Mailbox in C/OS-II: A Case Study

Binsec/Rel: Symbolic Binary Analyzer for Security with Applications to Constant-Time and Secret-Erasure

Verifying C11 programs operationally

Verifying C11-Style Weak Memory Libraries

SNIP: Speculative Execution and Non-Interference Preservation for Compiler Transformations

Verifying C11-Style Weak Memory Libraries via Refinement

RealityCheck: Bringing Modularity, Hierarchy, and Abstraction to Automated Microarchitectural Memory Consistency Verification

TrABin: Trustworthy Analyses of Binaries

Verified Security for the Morello Capability-enhanced Prototype Arm Architecture

Practical Rely/Guarantee Verification of an Efficient Lock for seL4 on Multicore Architectures

RTL2M$μ$PATH: Multi-$μ$PATH Synthesis with Applications to Hardware Security Verification

Modal Abstractions for Virtualizing Memory Addresses

CommCSL: Proving Information Flow Security for Concurrent Programs using Abstract Commutativity

Integrating Owicki-Gries for C11-Style Memory Models into Isabelle/HOL

Libra: Architectural Support For Principled, Secure And Efficient Balanced Execution On High-End Processors (Extended Version)

Formal Modelling, Testing and Verification of HSA Memory Models using Event-B

Model Checking for Microarchitectural Data Sampling Security

Verification-Preserving Inlining in Automatic Separation Logic Verifiers (extended version)

Saturation Memory Access: Mitigating Memory Spatial Errors without Terminating Programs.