A Virtualized Separation Kernel for Mixed-Criticality Systems

Abstract

Multi- and many-core processors are becoming increasingly popular in embedded systems. Many of these processors now feature hardware virtualization capabilities, as found on the ARM Cortex A15 and x86 architectures with Intel VT-x or AMD-V support. Hardware virtualization provides a way to partition physical resources, including processor cores, memory, and I/O devices, among guest virtual machines (VMs). Each VM is then able to host tasks of a specific criticality level, as part of a mixed-criticality system with different timing and safety requirements. However, traditional virtual machine systems are inappropriate for mixed-criticality computing. They use hypervisors to schedule separate VMs on physical processor cores. The costs of trapping into hypervisors to multiplex and manage machine physical resources on behalf of separate guests are too expensive for many time-critical tasks. Additionally, traditional hypervisors have memory footprints that are often too large for many embedded computing systems. In this article, we discuss the design of the Quest-V separation kernel, which partitions services of different criticality levels across separate VMs, or sandboxes . Each sandbox encapsulates a subset of machine physical resources that it manages without requiring intervention from a hypervisor. In Quest-V, a hypervisor is only needed to bootstrap the system, recover from certain faults, and establish communication channels between sandboxes. This not only reduces the memory footprint of the most privileged protection domain but also removes it from the control path during normal system operation, thereby heightening security.

Deterministic Memory Hierarchy and Virtualization for Modern Multi-Core Embedded Systems

“…Differently from the literature mentioned above, however, we rely on virtualisation support. A lightweight hypervisor, namely Jailhouse, allocates physical memory pages that map to non-overlapping cache [13], [40], [28]. In comparison, our work sets itself apart because: (i) we propose a technique to perform deterministic allocation of cache content to lower pessimism in estimating Worst-Case-Execution Time (WCET); (ii) we conduct an in-depth evaluation on the impact of the additional memory translation layer introduced by virtualisation; and (iii) we investigate the benefits of cache invalidation, software-, and hardware-driven prefetching.…”

Tuned Pipes: End-to-End Throughput and Delay Guarantees for USB Devices

“…Future work includes the development of a tuned pipe abstraction in our sister Quest-V system [25]. USB 3.x provides support for host controller virtualization so it is possible to have Quest real-time system services sharing a single host controller and bus with legacy Linux services.…”

A Review of Recent Techniques in Mixed-Criticality Systems

“…West et al 50 introduced Quest-V, 96 which uses hardware virtualization to detach system components into sandboxes. Sandboxes administer their own subsets of performing scheduling and machine resources, I/O management, and memory without the participation of a hypervisor.…”