Virtual Open Systems Scientific Publications

Introduction

An important challenge in the design of embedded systems is the consolidation of software applications with different levels of criticality on a common hardware platform. In the automotive domain, a common practice to isolate safety critical applications is through the proliferation of multiple hardware Engine Control Units (ECUs), which are dedicated to basic operations, such as lowering the windows, to critical tasks as Electronic Braking System (EBS), engine control and digital dashboard applications. This is a highly inefficient way of using the available processing power since many of these ECUs are typically not used at their full potential. However, recent multi-core architectures with new hardware extensions (e.g., virtualization, TrustZone) enable the execution of multiple applications on the same platform safely and securely, thus reducing costs and vehicle weight, helping to increase efficiency.

The consolidation of different OSes on the same platform implies the concurrent execution of a critical OS with stringent real-time requirements with non-critical applications. As a matter of fact, connected cars are required to support safety-critical control functions, such as EBS and Electric Power Assist Steering (EPAS) that have to be securely isolated from the In-Vehicle Infotainment (IVI) system. Similarly in avionics, functions are usually classified either as flight-critical (necessary for ensuring a safe flight) or mission-critical (essential for business execution). In this context, the main challenges are to integrate real-time tasks execution with software applications of a GPOS.

In the past, virtualization has been presented as a solution to isolate OSes in a VM. This approach offers the advantages of reducing implementation costs by abstracting the host platform. Additionally, features provided by hypervisors, such as memory partitioning, CPU and interrupts abstraction help the OSes isolation. However, the use of a hypervisor may cause performance overheads, and therefore the critical execution path of real-time operations may not be ensured.

In this context, Virtual Open Systems has developed VOSYSmonitor, a software monitor layer, which enables the native concurrent execution of a safety critical RTOS (or another type of OS) along with a GPOS with the option to use virtualization extensions, such as Linux/KVM, in order to instantiate a variety of different VMs. The monitor layer is the highest secure operating mode available on ARM processors, designed with the hardware security extension ARM TrustZone, which manages the interaction between two execution worlds. In this context, VOSYSmonitor has been designed for the ARMv8-A architecture by guaranteeing peripherals and memory isolation between both OSes with ARM TrustZone. The main advantage of such a solution is to allow dynamically cores sharing between both applications, thus offering a close to native performance. To achieve this, VOSYSmonitor supports a context switch mechanism with a minimal overhead.