Separation Kernel Robustness Testing: The XtratuM Case Study

Abstract

With time and space partitioned architectures becoming increasingly appealing to the European space sector, the dependability of separation kernel technology is a key factor to its applicability in European Space Agency projects. This paper explores the potential of the data type fault model, which injects faults through the Application Program Interface, in separation kernel robustness testing. This fault injection methodology has been tailored to investigate its relevance in uncovering vulnerabilities within separation kernels and potentially contributing towards fault removal campaigns within this domain. This is demonstrated through a robustness testing case study of the XtratuM separation kernel for SPARC LEON3 processors. The robustness campaign exposed a number of vulnerabilities in XtratuM, exhibiting the potential benefits of using such a methodology for the robustness assessment of separation kernels.

A Comprehensive Survey on the Use of Hypervisors in Safety-Critical Systems

“…During a study on the robustness of the separation kernels, XtratuM was used on a LEON3 as a use case and 9 notable vulnerabilities were discovered that had not been detected during the validation campaigns of the hypervisor development [84]. This not only demonstrates the effectiveness of the error injection method used, but it was a considerable help to further strengthen XtratuM, as part of the hypervisor developer team was involved in the experiment.…”