Software virtualization has been a major topic in the enterprise space for quite some time, but has become an important technology for embedded systems only in the last few years. The application of the technology to the enterprise space has been well described elsewhere by companies such as Citrix Systems, IBM & VMware. The situation is less well defined for developers of embedded systems. Most importantly, the use of virtualization and its implementation in the form of a hypervisor in embedded systems are very different from enterprise applications. An effective implementation of an embedded hypervisor must deal with a number of issues specific to such applications. These issues include the highly integrated nature of embedded systems, the requirement for isolated functional blocks within the system to communicate rapidly, the need for real-time/deterministic performance, the resource-constrained target environment and the wide range of security and reliability requirements.
Contents |
A hypervisor provides a software virtualization environment in which other software, including operating systems, can run with the appearance of full access to the underlying system hardware, but in fact such access is under the complete control of the hypervisor. The software running in such a hypervisor managed environment is said to be executing within a virtual machine (VM). Multiple VMs may be managed simultaneously by a hypervisor. Hypervisors are generally classed as type 1 or type 2, depending on whether the hypervisor is running in supervisor mode or privileged mode on “bare metal” (type 1) or is itself hosted by an operating system (type 2).
An embedded hypervisor is a type 1 hypervisor that supports the requirements of embedded systems development and is designed into the embedded device from the outset, rather than loaded subsequent to device deployment. The requirements for a hypervisor architecture suitable for embedded applications is quite distinct from hypervisors aimed at enterprise applications, which have a fundamentally different set of requirements. See references [1] & [2] for a more detailed discussion. These requirements are summarized below.
To meet the requirements typical of most embedded applications, an embedded hypervisor must provide multiple VMs, each of which is essentially indistinguishable from the underlying hardware to which the virtualised software needs access. This ensures that the embedded code that runs on the real machine will run on the virtual machine and vice versa. The size and efficiency of the implementation is also an issue for an embedded hypervisor, as it needs to maintain as closely as possible the native speed, real-time response and determinism and power efficiency of the underlying hardware platform.
Implementations for embedded systems applications have been most commonly based on the use of a microkernel or small separation kernel, with virtualization built-in as an integral capability. This was introduced with PikeOS in 2005[3]. Examples of these approaches have been produced by companies such as Open Kernel Labs (microkernel) and LynuxWorks (small separation kernel). VirtualLogix appears to take the position that an approach based on a dedicated Virtual Machine Monitor (VMM) would be even smaller and more efficient. This issue is the subject of some ongoing debate; see references [4], [5] & [6]. However, the main point at issue is the same on all sides of the discussion – the speed and size of the implementation (for a given level of functionality) are of major importance. For example: " . . . hypervisors for embedded use must be real-time capable, as well as resource-miserly." [7]
The small code size generated by these approaches is of such great importance since system resources such as memory are typically highly constrained in embedded applications, compared to enterprise systems. Thus embedded hypervisors usually have a memory footprint from several tens to several hundred kilobytes, depending on the efficiency of the implementation and the level of functionality provided. An implementation requiring several megabytes of memory (or more) is generally not acceptable.
The small size of the hypervisor also provides the basis for a minimal trusted computing base (TCB). This TCB is the only part of the entire system code which is allowed to run in privileged mode, thus enhancing the inherent security of the system. The amount of trusted user-mode code can be kept to an absolute minimum with this approach. This is in contrast to type 2 hypervisors, which are commonly designed to be used with a guest OS underneath any other software.
This approach also means that the TCB can be made highly secure & reliable [8]. Standard software-engineering techniques, such as code inspections and systematic testing, can be used to reduce the number of bugs in such a small code base to a tiny fraction of the defects that must be expected for a hypervisor and guest OS combination that may be 100,000–300,000 lines in total. [9]
One of the most important functions required in an embedded hypervisor is a secure message-passing mechanism, which is needed to support real-time communication between processes. In the embedded environment, a system will typically have a number of closely coupled tasks, some of which may require secure isolation from each other. In a virtualized environment, the embedded hypervisor will support and enforce this isolation between multiple VMs. These VMs will therefore require access to a mechanism that provides low-latency communication between the tasks.
An inter-process communication (IPC) mechanism can be used to provide these functions, as well as invoking all system services, and implemented in a manner which ensures that the desired level of VM isolation is maintained. Also, due to its significant impact on system performance, such an IPC mechanism should be highly optimised for minimal latency. [10]
Lastly, an embedded hypervisor needs to be in complete control of system resources, including memory accesses, to ensure that software cannot break out of the VM. So an embedded hypervisor requires the target CPU to provide memory management support (typically using an MMU). However, unlike the enterprise space, a number of processors aimed at embedded applications do not provide such support, so selection of a suitable target architecture able to support a Type 1 hypervisor may be an issue.
Some of the most common use cases for an embedded hypervisor are:
1. OS independence
Designers of embedded systems may have many hardware drivers and system services which are specific to a target platform. If support for more than one OS is required on the platform, either concurrently or consecutively using a common hardware design, an embedded hypervisor can greatly simplify the task. Such drivers and system services can be implemented just once for the virtualized environment; these services are then available to any hosted OS. This level of abstraction also allows the embedded developer to implement or change a driver or service in either hardware or software at any point, without this being apparent to the hosted OS.
2. Support for multiple operating systems on a single processor
Typically this is used to run a real-time operating system (RTOS) for low-level real-time functionality (such as the communication stack) while at the same time running a high-level OS, (HLOS) like Linux or Windows, to support user applications, such as a web browser or calendar. The objective might be to upgrade an existing design without the added complexity of a second processor, or simply to minimize the bill of materials (BoM).
3. System security
An embedded hypervisor is able to provide secure encapsulation for any subsystem defined by the developer, so that a compromised subsystem cannot interfere with other subsystems. For example, an encryption subsystem needs to be strongly shielded from attack to prevent leaking the information the encryption is supposed to protect. As the embedded hypervisor can encapsulate a subsystem in a VM, it can then enforce the required security policies for communication to and from that subsystem.
4. System reliability
The encapsulation of a subsystem components into a VM ensures that failure of any subsystem cannot impact other subsystems. This encapsulation keeps faults from propagating from a subsystem in one VM to a subsystem in another VM, improving reliability. This may also allow a subsystem to be automatically shut down and restarted on fault detection. This can be particularly important for embedded device drivers, as this is where the highest density of fault conditions is seen to occur, and is thus the most common cause of OS failure and system instability. It also allows the encapsulation of operating systems that were not necessarily built to the reliability standards demanded of the new system design.
5. Dynamic update of system software
Subsystem software or applications can be securely updated and tested for integrity, by downloading to a secure VM before “going live” in an executing system. Even if this process then fails, the system can revert to its former state by restarting the original software subsystem/application, without halting system operation.
6. Legacy code re-use
Virtualization allows legacy embedded code to be used with the OS environment it has been developed and validated with, while freeing the developer to use a different OS environment in a separate VM for new services and applications. Legacy embedded code, written for a particular system configuration may assume exclusive control of all system resources of memory, I/O and processor. This code base can be re-used unchanged on alternative system configurations of I/O and memory through the use of a VM to present a resource map and functionality that is consistent with the original system configuration, effectively de-coupling the legacy code from the specifics of a new or modified hardware design.
Where access to the operating system source code is available, paravirtualization is commonly used to virtualize the OS’s on processors without hardware virtualization support, and thus the applications supported by the OS can also run unmodified and without re-compilation in new hardware platform designs.
Even without source access, legacy binary code can be executed in systems running on processors with hardware virtualization support such as the AMD-V, Intel VT technologies and the latest ARM processors with virtualization support[11]. The legacy binary code could run completely unmodified in a VM with all resource mapping handled by the embedded hypervisor, assuming the system hardware provides equivalent functionality.
7. IP protection
Valuable proprietary IP may need protection from theft or misuse when an embedded platform is being shipped for further development work by (for example) an OEM customer. An embedded hypervisor makes it possible to restrict access by other system software components to a specific part of the system containing IP that needs to be protected.
8. Software license segregation
Software IP operating under one licensing scheme can be separated from other software IP operating under a different scheme. For example, the embedded hypervisor can provide an isolated execution environment for proprietary software sharing the processor with open source software subject to the GPL [12].
9. Migration of applications from uni-core to multi-core systems
As new processors utilise multi-core architectures to increase performance, the embedded hypervisor can manage the underlying architecture and present a uni-processor environment to legacy applications and operating systems while efficiently using the new multiprocessor system design. In this way a change in hardware environment does not require a change to the existing software.