Formal proof of dynamic memory isolation based on MMU

Narjes Jomaa (1, 2) , David Nowak (1, 2) , Gilles Grimaud (1, 2) , Samuel Hym (1, 2)

1 CRIStAL - Centre de Recherche en Informatique, Signal et Automatique de Lille - UMR 9189
2 2XS - Extra Small Extra Safe

For security and safety reasons, it is essential to ensure memory isolation between processes. The memory manager is thus a critical part of the kernel of an operating system. It is common for kernels to ensure memory isolation through a piece of hardware called memory management unit (MMU). However an MMU by itself does not provide memory isolation. It is only a tool the kernel can use to ensure this property. In this paper we show how a proof assistant such as Coq can be used to model a hardware architecture with an MMU, and an abstract model of microkernel supporting preemptive scheduling and memory management. We proceed by making formally explicit the consistency properties that must be preserved in order for memory isolation to be preserved.

Mots clés: Formal proof; Memory isolation; Microkernel; Coq

Domaines: Logique en informatique [cs.LO]; Système d'exploitation [cs.OS]

Narjes Jomaa, David Nowak, Gilles Grimaud, Samuel Hym. Formal proof of dynamic memory isolation based on MMU. Science of Computer Programming, 2018, 162, pp.76-92. ⟨10.1016/j.scico.2017.06.012⟩. ⟨hal-01712347⟩