Download XtratuM User Manual - ESA Microelectronics Section

124/134
3495
Chapter 10. Security issues
In the case of a covert channel, the maximum bandwidth is determined by the duration of the longest
hypercall divided by the clock resolution. A rough estimation (supposing that the maximum message
length is 4096 Bytes) is 4 bits at each partition context switch.
In the case of a side channel, the bandwidth is drastically reduced due to the uncertainty/randomness
introduced by the execution of the target partition.
3500
3505
There are several strategies to address this issue:
1. At integrator level: design a scheduling plan that lest some idle time before the end of a slot and
the beginning of the next one. The Xoncrete scheduling tool is able to implement that solution
automatically. Figure 10.1 shows two scenarios: scenario 1 where the integrator has not left spare
time between one partition slot and the next one, enabling the partition in light grey overrunning
the start of the dark gray one. Scenario 2 sketches the same case but leaving spare time between
one slot and the next one. So, in this case, execution overruns can not occur.
2. At partition level: stop invoking hypercalls some time before the end of the slot. This way, there
will be no hypercalls being executed when the slot end occurs, so the next partition will start
always with no delay.
3510
3. At hypervisor level:
(a) Change the design of XtratuM to convert it preemptable. Hypercalls would be interrupted
when the end of the slot is reached, and later resumed when the partition is active again.
3515
(b) Implement the partial preemptability in XtratuM (voluntary preemption). XtratuM is by
default atomic (non-preemptable) but at some designated safe places in the code, the preemption is allowed.
Figure 10.1: Covert channel caused by an incorrect scheduling plan and a solution.
Printed: November 26, 2012
xm-4-usermanual-047d