Embedded hypervisor

An embedded hypervisor is a hypervisor that supports the requirements of embedded systems.

The requirements for an embedded hypervisor are distinct from hypervisors targeting server and desktop applications. An embedded hypervisor is designed into the embedded device from the outset, rather than loaded subsequent to device deployment. While desktop and enterprise environments use hypervisors to consolidate hardware and isolate computing environments from one another, in an embedded system, the various components typically function collectively to provide the device's functionality. Mobile virtualization overlaps with embedded system virtualization, and shares some use cases.

Typical attributes of embedded virtualization include efficiency, security, communication, isolation and real-time capabilities.

Background

Software virtualization has been a major topic in the enterprise space since the late 1960s, but only since the early 2000s has its use appeared in embedded systems. The use of virtualization and its implementation in the form of a hypervisor in embedded systems are very different from enterprise applications. An effective implementation of an embedded hypervisor must deal with a number of issues specific to such applications. These issues include the highly integrated nature of embedded systems, the requirement for isolated functional blocks within the system to communicate rapidly, the need for real-time/deterministic performance, the resource-constrained target environment and the wide range of security and reliability requirements.

Hypervisor

A hypervisor provides one or more software virtualization environments in which other software, including operating systems, can run with the appearance of full access to the underlying system hardware, where in fact such access is under the complete control of the hypervisor. These virtual environments are called virtual machines (VM)s, and a hypervisor will typically support multiple VMs managed simultaneously.

Classification

Hypervisors are generally classed as either type 1 or type 2, depending on whether the hypervisor runs exclusively in supervisor mode or privileged mode (type 1) or is itself hosted by an operating system as a regular application (type 2).

Type 1 hypervisors manage key system resources required to maintain control over the virtual machines, and facilitate a minimal trusted computing base (TCB). Type 2 hypervisors typically run as an application within a more general purpose operating system, relying on services of the OS to manage system resources. Nowadays kernel extensions are often loaded to take advantage of hardware with virtualization support.

Embedded hypervisor

An embedded hypervisor is most often a type 1 hypervisor which supports the requirements of embedded systems development. See references and for a more detailed discussion.

These requirements are summarized below.

• A small, fast hypervisor with support for multiple isolated VMs;
• Support for lightweight but secure encapsulation of medium-grain subsystem components that interact strongly;
• High-bandwidth, low-latency communication between system components, subject to a configurable, system-wide security policy;
• Minimal impact on system resources and support real-time latency guarantees;
• Ability to implement a scheduling policy between VMs and provide support for real-time system components;

Implementation

An embedded hypervisor typically provides multiple VMs, each of which emulates a hardware platform on which the virtualised software executes. The VM may emulate the underlying native hardware, in which case embedded code that runs on the real machine will run on the virtual machine and vice versa. An emulation of the native hardware is not always possible or desired, and a virtual platform may be defined instead.

When a VM provides a virtual platform, guest software has to be ported to run in this environment, however since a virtual platform can be defined without reliance on the native hardware, guest software supporting a virtual platform can be run unmodified across various distinct hardware platforms supported by the hypervisor.

Embedded hypervisors employ either paravirtualization or use virtualization features of the underlying CPU. Paravirtualization is required in cases where the hardware does not assist, and involves often extensive modifications to core architecture support core of guest kernels. Emulation of hardware at the register level is rarely seen in embedded hypervisors as this is very complex and slow. The custom nature of embedded systems means that the need to support unmodified binary-only guest software which require these techniques is rare.

The size and efficiency of the implementation is also an issue for an embedded hypervisor, as embedded systems are often much more resource constrained than desktop and server platforms. It is also desirable for the hypervisor to maintain, as closely as possible, the native speed, real-time response and determinism and power efficiency of the underlying hardware platform.

Hypervisor design

Implementations for embedded systems applications have most commonly been based on small microkernel and separation kernel designs, with virtualization built-in as an integral capability. This was introduced with PikeOS in 2005. Examples of these approaches have been produced by companies such as Open Kernel Labs (microkernel followed by a separation kernel) and LynuxWorks (separation kernel). VirtualLogix appears to take the position that an approach based on a dedicated Virtual Machine Monitor (VMM) would be even smaller and more efficient. This issue is the subject of some ongoing debate. However, the main point at issue is the same on all sides of the discussion – the speed and size of the implementation (for a given level of functionality) are of major importance. For example: " ... hypervisors for embedded use must be real-time capable, as well as resource-miserly."

Resource requirements

Embedded systems are typically highly resource constrained due to cost and technical limitations of the hardware. It is therefore important for an embedded hypervisor to be as efficient as possible. The microkernel and separation kernel based designs allow for small and efficient hypervisors. Thus embedded hypervisors usually have a memory footprint from several tens to several hundred kilobytes, depending on the efficiency of the implementation and the level of functionality provided. An implementation requiring several megabytes of memory (or more) is generally not acceptable.

With the small TCB of a type 1 embedded hypervisor, the system can be made highly secure & reliable. Standard software-engineering techniques, such as code inspections and systematic testing, can be used to reduce the number of bugs in such a small code base to a tiny fraction of the defects that must be expected for a hypervisor and guest OS combination that may be 100,000–300,000 lines in total.

VM communication

One of the most important functions required in an embedded hypervisor is a secure message-passing mechanism, which is needed to support real-time communication between processes. In the embedded environment, a system will typically have a number of closely coupled tasks, some of which may require secure isolation from each other. In a virtualized environment, the embedded hypervisor will support and enforce this isolation between multiple VMs. These VMs will therefore require access to a mechanism that provides low-latency communication between the tasks.

An inter-process communication (IPC) mechanism can be used to provide these functions, as well as invoking all system services, and implemented in a manner which ensures that the desired level of VM isolation is maintained. Also, due to its significant impact on system performance, such an IPC mechanism should be highly optimised for minimal latency.

Hardware requirements

An embedded hypervisor needs to be in complete control of system resources, including memory accesses, to ensure that software cannot break out of the VM. A hypervisor therefore requires the target CPU to provide memory management support (typically using an MMU). Many embedded processors including such as ARM, MIPS and PowerPC have followed desktop and server chip vendors in adding hardware support for virtualization. There are still a large proportion of embedded processors however which do not provide such support and a hypervisor supporting paravirtualization is required.

ARM processors are notable in that most of their application class processor designs support a technology called ARM TrustZone, which provides essentially hardware support for one privileged and one unprivileged VM. Normally a minimal Trusted Execution Environment (TEE) OS is run in the Secure World and a native kernel running in the Non-secure World.

Use cases

Some of the most common use cases for an embedded hypervisor are:

1. OS independence

Designers of embedded systems may have many hardware drivers and system services which are specific to a target platform. If support for more than one OS is required on the platform, either concurrently or consecutively using a common hardware design, an embedded hypervisor can greatly simplify the task. Such drivers and system services can be implemented just once for the virtualized environment; these services are then available to any hosted OS. This level of abstraction also allows the embedded developer to implement or change a driver or service in either hardware or software at any point, without this being apparent to the hosted OS.

2. Support for multiple operating systems on a single processor

Typically this is used to run a real-time operating system (RTOS) for low-level real-time functionality (such as the communication stack) while at the same time running a general purpose OS, (GPOS) like Linux or Windows, to support user applications, such as a web browser or calendar. The objective might be to upgrade an existing design without the added complexity of a second processor, or simply to minimize the bill of materials (BoM).

3. System security

An embedded hypervisor is able to provide secure encapsulation for any subsystem defined by the developer, so that a compromised subsystem cannot interfere with other subsystems. For example, an encryption subsystem needs to be strongly shielded from attack to prevent leaking the information the encryption is supposed to protect. As the embedded hypervisor can encapsulate a subsystem in a VM, it can then enforce the required security policies for communication to and from that subsystem.

4. System reliability

The encapsulation of a subsystem components into a VM ensures that failure of any subsystem cannot impact other subsystems. This encapsulation keeps faults from propagating from a subsystem in one VM to a subsystem in another VM, improving reliability. This may also allow a subsystem to be automatically shut down and restarted on fault detection. This can be particularly important for embedded device drivers, as this is where the highest density of fault conditions is seen to occur, and is thus the most common cause of OS failure and system instability. It also allows the encapsulation of operating systems that were not necessarily built to the reliability standards demanded of the new system design.

5. Dynamic update of system software

Subsystem software or applications can be securely updated and tested for integrity, by downloading to a secure VM before “going live” in an executing system. Even if this process then fails, the system can revert to its former state by restarting the original software subsystem/application, without halting system operation.

6. Legacy code re-use

Virtualization allows legacy embedded code to be used with the OS environment it has been developed and validated with, while freeing the developer to use a different OS environment in a separate VM for new services and applications. Legacy embedded code, written for a particular system configuration may assume exclusive control of all system resources of memory, I/O and processor. This code base can be re-used unchanged on alternative system configurations of I/O and memory through the use of a VM to present a resource map and functionality that is consistent with the original system configuration, effectively de-coupling the legacy code from the specifics of a new or modified hardware design.

Where access to the operating system source code is available, paravirtualization is commonly used to virtualize the OS’s on processors without hardware virtualization support, and thus the applications supported by the OS can also run unmodified and without re-compilation in new hardware platform designs.

Even without source access, legacy binary code can be executed in systems running on processors with hardware virtualization support such as the AMD-V, Intel VT technologies and the latest ARM processors with virtualization support. The legacy binary code could run completely unmodified in a VM with all resource mapping handled by the embedded hypervisor, assuming the system hardware provides equivalent functionality.

7. IP protection

Valuable proprietary IP may need protection from theft or misuse when an embedded platform is being shipped for further development work by (for example) an OEM customer. An embedded hypervisor makes it possible to restrict access by other system software components to a specific part of the system containing IP that needs to be protected.

8. Software license segregation

Software IP operating under one licensing scheme can be separated from other software IP operating under a different scheme. For example, the embedded hypervisor can provide an isolated execution environment for proprietary software sharing the processor with open source software subject to the GPL.

9. Migration of applications from uni-core to multi-core systems

As new processors utilise multi-core architectures to increase performance, the embedded hypervisor can manage the underlying architecture and present a uni-processor environment to legacy applications and operating systems while efficiently using the new multiprocessor system design. In this way a change in hardware environment does not require a change to the existing software.

Commercial products

• Crucible by Star Lab Corp.
• Cross-OS Hypervisor - Allows applications to run natively on a single OS platform from MapuSoft Technologies, Inc.
• OKL4 Hypervisor - Supports ARM based smart connected devices (embedded, mobile). Used in defense and security sensitive applications. Supported commercially by Cog Systems.
• INTEGRITY Multivisor - A Type II microkerner virtualization service of the safety/security-certified INTEGRITY RTOS