Arm Newsroom Blog
Blog January 20, 2022

Arm Morello: What Is It and Why Is It Important?

Morello is a research and prototyping program to create a more secure hardware architecture for next-generation Arm devices
By Richard Grisenthwaite, EVP, Chief Architect & Fellow, Arm
Lady Using Smartphone

The Arm Morello program is a research program led by Arm to create a more secure hardware architecture for processors of the future. Its unique architectural extensions are based on Arm’s work with the University of Cambridge since 2015 on the CHERI (Capability Hardware Enhanced RISC Instructions) protection model.

The Morello program aims to assess the viability of the Morello Board, a prototype hardware system on chip (SoC) employing unique extensions to the conventional Arm hardware instruction set that significantly improve device security. The Morello Board serves as a real-world test platform for the deployment of more secure hardware architecture in processors of the future.

Why is the Arm Morello program needed?

Security is the greatest challenge computing needs to address to reach its full potential.

Today, we use our smart devices to do far more than communicate. From smartwatches to smart speakers, smartphones to laptops, we rely on these devices to store and share personal information, be they photographs or medical records. We perform financial transactions and make purchases.

All of this presents an enormous security challenge for device makers and developers. Research by Microsoft and Google has shown that 70 percent of vulnerabilities addressed through a security update each year continue to be memory safety issues.

Any device is only as strong as its weakest link and a single vulnerability, if exploited, can compromise an entire network. We see new and more complex attacks against computing systems every day.

Morello employs CHERI architectural extensions

Arm Morello Program

Used in the Arm Morello program, CHERI architectural extensions are designed to mitigate memory safety vulnerabilities – software defects that are exploited by hackers to take control of a device or system – at a hardware level. CHERI augments pointers—the variables in computer code that reference where data is stored in memory—with limits as to how those references can be used, the address ranges that they can use to access and which functionality they can use to access.

We call these “hardware capabilities” and they are unique to the processor architecture.  Once baked into silicon, they cannot be forged in software. Use of these capabilities in place of some or all the memory addresses can improve the spatial memory safety of software, particularly software written in C or C++ code.

These capabilities can also be used as a building block to allow the enforcement of much stronger temporal memory safety with potentially far lower overheads than current approaches to partitioning. We call this ‘compartmentalization’, and as its name suggests, compartmentalization isolates different parts of critical code into individual ‘walled’ areas. Code operating within one compartment has no access to any other area. This means that even if an attacker breaches one piece of the code or data, they are trapped within that one small zone.

Arm Morello Compartmentalization

These hardware capabilities will be fundamental in designing future devices that are hugely resilient to memory corruption vulnerabilities and other forms of software-based exploitation.

What’s the latest on the Arm Morello program?

In early 2019, UK Research and Innovation (a UK Government non-departmental public body) awarded substantial funding to Arm, Cambridge University, Edinburgh University, and Linaro towards the development of an Arm-based industrial prototype for this technology.

The Arm Morello program is the result of the UKRI Digital Security by Design (DSbD) initiative, a program initiated and funded by the UK government’s UK Research and Innovation (a UK Government non-departmental public body) department in 2019.

This program brings Arm together with other global technology leaders including Google and Microsoft to collaborate in securing next-generation devices for businesses and the public across all areas where computing is used.

The Arm Morello program celebrated a major milestone in January 2022 with the availability of prototype SoCs (systems on chips). These prototype Morello Boards augment an Armv8.2-A processor (adapted from the Neoverse N1 server processor) with an experimental version of the Arm architecture—the Morello prototype architecture—based on CHERI principles.

This milestone gives our ecosystem of security specialists, software companies, tools developers and leading academic institutions with the remaining two and a half years to test, write code and collaboratively provide critical feedback to identify whether Morello is a viable security architecture for the future.

Built-in security

For at least two decades, Arm has collaborated with global technology leaders to research and identify new ways to secure next-generation devices for businesses and the public, from Internet of things (IoT) endpoint devices to smartphones, autonomous vehicles, and data centers.

As the provider of the processor architecture touching 70 percent of the world’s seven-plus billion people, Arm is uniquely positioned to bring the best and brightest of the industry together to prioritize security in next-generation technologies across all hardware platforms.

Our collaboration and co-investment with the University of Cambridge, Google, and Microsoft on the Morello program enables us to undertake one of the industry’s most ambitious cybersecurity projects to date. All of those involved are incredibly passionate and confident that the success of the Morello program, CHERI and the Digital Security by Design project will ultimately be viewed as a defining moment in securing the world’s devices.

Arm Morello Program

The Morello Program has the potential to radically change the way we design and program processors in the future to improve built-in security.

Learn More
Author
By Richard Grisenthwaite, EVP, Chief Architect & Fellow, Arm
Article Text
Copy Text

Any re-use permitted for informational and non-commercial or personal use only.

Editorial Contact

Brian Fuller and Jack Melling
Subscribe to Blogs and Podcasts
Get the latest blogs & podcasts direct from Arm

Related

Blog May 18, 2021

Arm’s Ongoing Efforts to Demystify Security

Mark Knight, Director of Architecture Product Management, Arm
Blog Aug 05, 2021

Read the 2021 Arm Security Manifesto

Arm Editorial Team

Media Information

Company Overview & History

Arm is defining the future of computing

Arm Corporate Guidelines

Information on how to use the Arm corporate logo

Media Contacts

Get the latest Media contact information

Latest on X

promopromopromopromopromopromopromopromo