Arm rages against the insecure chip machine with new Morello architecture
- Reference: 1642789264
- News link: https://www.theregister.co.uk/2022/01/21/arm_morello_testing/
- Source link:
The Morello programme involves Arm collaborating with the University of Cambridge and others in tech to develop a processor architecture that is intended to be fundamentally more secure. Morello prototype boards are now being released for testing by developers and security specialists, based on a prototype system-on-chip (SoC) that Arm has built.
Arm said that the limited-edition evaluation boards are based on the Morello prototype architecture embedded into an Armv8.2-A processor. This is an adaptation of the architecture in the Arm Neoverse N1 design aimed at data centre workloads.
[2]
The boards are being handed for evaluation to major stakeholders in the programme such as Google and Microsoft, but also to other interested partners in both the industry and academia via the UK Research and Innovation Digital Security by Design (DSbD) initiative, Arm disclosed.
How does £36m sound, mon CHERI? UK.gov pumps cash into Arm security research [3]READ MORE
Security capabilities in the Morello architecture centre on what Arm calls Capability Hardware Enhanced RISC Instructions, or CHERI. These appear to deliver changes to the way that CPU pointers operate, limiting the address ranges they can use to access memory locations, as well as placing restrictions on how those pointers can be used.
The use of these capabilities in place of some or all the memory accesses can improve the spatial memory safety of software, particularly software written in C or C++ code, according to Arm. Some security threats have involved the use of pointers to access memory locations used by other applications, but poorly written code can also corrupt data in memory the same way.
[4]EC president promises European Chips Act to quadruple homegrown production by 2030
[5]Nvidia promises British authorities it won’t strong Arm rivals after proposed merger
[6]RISC-V CTO: We won't dictate chip design like Arm and x86
[7]US trade watchdog opposes Nvidia's Arm buy, mostly over fears about datacentre innovation
These capabilities can be used to enforce much stronger memory safety by compartmentalising code into separate walled areas, with potentially far lower overheads than current approaches to partitioning, Arm claims. Code operating within one compartment has no access to any other area, which means that even if an attacker compromises one piece of the code or data, they cannot access other areas.
Arm claims there has never been a silicon implementation of this kind of hardware capability in a high-performance CPU, and so the Morello prototype board makes it possible for researchers to evaluate and test the security benefits of this kind of architecture in real-world scenarios.
[8]
David Weston, director of Enterprise and OS Security at Microsoft, said that memory safety exploits are one of the longest-standing and most challenging problems in software security.
"Using core silicon architecture to eliminate whole classes of security issues with minimal performance impact has the opportunity to be transformative with massive positive impact. I am incredibly excited about the Morello project," he said in a statement.
[9]
The Morello programme was [10]started in 2019 by UK Research and Innovation and intended to span five years. This latest milestone allows participants such as security specialists, software companies and academic institutions two and a half years to test, write code and provide critical feedback to identify whether Morello is a viable security architecture for the future, Arm said.
Innovate UK has announced it will be holding a succession of information and launch bootcamps around the Morello developments, starting with a [11]launch webinar to be held on 25 January. ®
Get our [12]Tech Resources
[1] https://www.arm.com/architecture/cpu/morello
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yes7Gpw@DRgK1kqjndgx1AAAAMY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2019/10/18/arm_security_by_design_research/
[4] https://www.theregister.com/2022/01/21/european_chips_act/
[5] https://www.theregister.com/2022/01/10/uk_regulator_nvidia_arm/
[6] https://www.theregister.com/2022/01/04/riscv_international_cto_interview/
[7] https://www.theregister.com/2021/12/03/us_trade_watchdog_tells_nvidia/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yes7Gpw@DRgK1kqjndgx1AAAAMY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yes7Gpw@DRgK1kqjndgx1AAAAMY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2019/10/18/arm_security_by_design_research/
[11] https://www.eventbrite.co.uk/e/what-is-digital-security-by-design-registration-221398297267?aff=ebdssbonlinesearch
[12] https://whitepapers.theregister.com/
The problem with C and C++ (possibly to a lesser extent when well implemented), is there is virtually no runtime error checking. This means it is very easy to run off the ends of something like a C style array, as these are accessed (at the machine level) using a pointer (possibly with an offset).
I have for years thought it would be beneficial if the CPU had registers dedicated for pointers, so that automatic protection could be built in that would do something like trigger a hardware trap if the pointer ever held an invalid value. For example, the pointer "register" would include the upper and lower bounds, so that any dereference of the pointer value would lead to an exception (hardware or software). This would obviously require some work within the compliers and would really need pointer provenance adding to the relevant language standards.
The real issue with the way things are is that programmers know what needs to be done, but it is very, very easy to make one or two mistakes when working on large, complex applications where the combinatorial explosion of control flow paths means it is not possible for a human or analysis tool to be able to detect all possible failures. Lots of explicit bounds tests can be added to try and stop them, but that can lead to serious runtime performance penalties.
Or you could use [1]valgrind right now.
[1] https://valgrind.org/
16-bi and /32-bit x86 had an instruction to do this [1]BOUND (first appears in 286, IIRC). It was never used and not propagated to 64 bit.
[1] https://www.felixcloutier.com/x86/bound
+1 for the Title
... not sure how many will get it though...
David Weston, director of Enterprise and OS Security at Microsoft, said that memory safety exploits are one of the longest-standing and most challenging problems in software security.
Translation: writing software is hard, very hard. Writing good and secure software is even harder.
It is ok to let hardware "help" with some problems. However, the main focus should be educating the software writers. There is a reason why C/C++ are popular languages (because they do specific jobs very well). But simply leaving the checks to hardware is a potential dangerous path too. The less brilliant programmer might get the impression that the hardware will think for the programmer so the programmer can think less. That would be a path to destruction.