ELVER, in collaboration with Arm, Google, the RISC-V community, the CHERI project, the Digital Security by Design project, and other academic groups, has:
(1.1) Established high-confidence mathematically rigorous full-scale semantic models for sequential aspects of multiple architectures, using our Sail instruction-set architecture (ISA) definition language. These include Arm-A (the architecture used by mobile processors, automatically translated from Arm's internal definitions), RISC-V (the emerging open architecture, with the Sail model adopted by RISC-V International as its reference formal model), CHERI-RISC-V (research architectures adding hardware capability support for improved security, with the Sail model used as the primary ISA design and reference document, now being standardised by RISC-V International and commercialised), and Morello (Arm's prototype extension of the Armv8-A architecture incorporating CHERI capabilities).
Each of these is complete enough to boot operating systems. For each, Sail automatically generates multiple artifacts: a C emulator for use as an oracle in hardware and software testing, theorem-prover definitions in Isabelle, Coq, and HOL4 for proof-based verification, and, using our Isla tooling, an SMT-based symbolic evaluator.
(1.2) Developed robust models for Arm-A systems concurrency, covering instruction-fetch and instruction/data cache maintenance, relaxed virtual memory, and exceptions, all in discussion with Arm.
(1.3) Developed a reusable Rocq semantic framework integrating sequential and concurrent semantics.
(2.1) Developed the Isla tooling for SMT-based symbolic evaluation of Sail ISA semantics and integrated this with arbitrary axiomatic relaxed-memory concurrency semantics, including the systems aspects above, letting one for the first time compute the allowed behaviours of concurrent litmus tests with respect to full-scale ISA definitions.
(2.2) Developed, above the Arm virtual memory model, a runtime monitor to find virtual memory synchronisation bugs in the production pKVM hypervisor, developed by Google to protect the Android kernel and virtual machines from each other; this found a security-critical bug.
(3.1) Developed the Islaris tooling (with MPI-SWS) for verification of machine-code above the full-scale sequential Arm-A and RISC-V ISA semantics above, using Isla, Iris, and Rocq; and the AxSL program logic (with Aarhus) for Arm-A user concurrency, again in Iris and Rocq.
(3.2) For CHERI architectures, we showed fundamental mechanised security properties for CHERI-MIPS and the full-scale industry Morello ISA, demonstrating that arbitrary code cannot forge capabilities (up to a domain crossing). For Morello, we generalised this to show a proof of strong encapsulation, building also on Islaris and on the Cerise logical relation proof in Iris. These give substantial assurance in the Morello ISA design, and also discovered security-relevant errors in that design before Morello was taped out - showing for the first time that one can prove rigorous security properties of full-scale industrial ISA designs.
(3.3) For foundational reasoning about C, we developed the RefinedC proof tool and VIP memory object model (in collaboration with MPI-SWS, and building above our 4.1 Cerberus semantics).
(3.4) For more user-friendly reasoning about C, we developed the CN proof tool (also building above our 4.1 Cerberus semantics), that also supports runtime testing of separation-logic assertions.
(3.5) We developed runtime testing for specifications expressed directly in C, for the pKVM hypervisor.
(3.6) We developed compositional semantics for SSA, in the presence of TSO relaxed memory
(4.1) We developed a precise model for pointer provenance in C, resolving a decades-old longstanding problem. The ISO standards committee voted unanimously that this was their preferred direction, and an ISO Technical Specification to this effect is in progress. Covering both this and the sequential behaviour of a large fragment of C, we developed our Cerberus C semantics, and a bounded-model-checker tool for sequential and concurrent C based on the semantics.
The CN proof tool work above is also a re-invention of C: C annotated with separation-logic specifications (both testable and provable) that capture ownership and functional correctness is a quite different language to conventional C, with its ubiquitous undefined behaviour.
(4.2) For CHERI C,we worked on the semantics of pointer provenance there; on the semantics of CHERI C, and on introductory material for CHERI C/C++. We used our understanding of C semantics and pointer provenance to inform the first adaptation of a full C-language operating system (FreeBSD) with an enterprise database (PostgreSQL) to CHERI C for complete spatial and referential memory safety -- and vice versa.
We also worked on the concurrent semantics of JavaScript, WebAssembly, Wait-Free Weak Reference Counting, and the CakeML verified compiler.
