Along with multicore technology, virtualization software has become invaluable to developers seeking to combine several embedded functions in a single hardware platform that boosts system performance and decreases development costs. Warren describes the critical functions of hypervisors and processors with hardware-assist features and presents a few examples of platforms that show how virtualization can consolidate dissimilar functions while maintaining isolation and security.

Virtualization is rapidly becoming one of the hottest technologies in the embedded space, offering designers a host of new hardware and software options for product development and future modifications. With the proper architecture, virtualization can be used to combine multiple embedded functions into a single hardware platform to minimize development costs, power requirements, and the number of system components. This consolidation feature allows designers to merge existing applications with diverse operating software into a single system without the need to modify legacy code.

Combined with the recent popularity of multicore technology, virtualization can also boost the performance and responsiveness of individual software segments by assigning additional processing power. Similarly, virtualization allows General-Purpose Operating Systems (GPOSs) such as Windows or Linux to be easily combined with real-time software or safety/security-critical functions while retaining the required determinism and isolation.

Originally introduced by IBM in the 1960s for enterprise servers, virtualization enables multiple copies of the OS to run in parallel on a single CPU, thereby reducing the number of machines required. Unlike the enterprise environment where hardware and operating software are consistent across platforms, the embedded industry employs a wide variety of processor architectures and I/O structures, so virtualization cannot be applied the same way. For example, enterprise-level applications typically create virtual copies that represent the entire machine environment to maximize CPU utilization. Unfortunately, this comes at the expense of responsiveness to external events, making this approach impractical for time-critical applications.

The latest virtualization software now available for embedded applications allows the development team to independently allocate system resources including memory, additional processors, and I/O to each operating environment to optimize performance.

Hardware allocation

Virtualization platforms are built by adding a real-time Virtual Machine Monitor (VMM) or hypervisor software layer directly above the hardware to create and manage individual partitions that contain guest OSs. The hypervisor allocates system hardware resources such as memory, I/O, and processor cores to each partition while maintaining the necessary separation between operating environments.

A critical function of the hypervisor is to maintain isolation between partitions and continue running even if another OS crashes. Multicore processors allow hypervisors to create a variety of configurations to support embedded development. For example, an OS can run on a single core or be spread across multiple cores to increase performance. Similarly, multiple OSs can also run on a single core if timing is not an issue.

Several variations of hypervisor software are available for virtualization applications. Full virtualization is a nearly complete simulation of the actual hardware, which allows a guest OS to run without modification. Partial virtualization simulates some but not the entire target environment, so guest software might need some modifications to run in this environment. Using paravirtualization, guest programs are executed in their own isolated domains without a simulated hardware environment. Although guest programs must be specifically modified to run in a paravirtualization environment, having the guest OS communicate directly with the hypervisor can improve performance and efficiency.

The latest generations of embedded processors include built-in hardware functions to increase performance and speed up interaction between virtual environments. For example, Intel Virtualization Technology (Intel VT) includes facilities to trap certain VMM instructions in hardware and simplify the hypervisor functions to reduce virtualization overhead. Intel VT for Directed I/O adds hardware accelerators that allow secure assignment of specific I/O devices to specific OSs to decrease the load on the processor and accelerate data movement. For example, a hardware-based network controller can be used to offload the Ethernet stack processing to improve the performance of high-speed networks.

Another improvement is to implement I/O queuing mechanisms so that operating software does not waste time waiting for operations to finish. In addition, specialized Intel functions such as Extended Page Table and Page Attribute Table provide a hardware-assist to the partitioning and allocation of physical memory among virtual machines.

Virtual platform examples

Software vendors offer designers a variety of hypervisor-based products to capture the advantages of virtualization for embedded systems. For example, PikeOS from SYSGO incorporates paravirtualization technology to create a combination Real-Time OS (RTOS) and virtualization environment that enables multiple OS partitions to work on separate sets of resources within a single machine (see Figure 1).

 

 

The recently released PikeOS version 3.3 supports a wide range of operating software including Linux, ARINC 653, POSIX, Android, and others. PikeOS also runs on multiple single- and multicore processor architectures such as x86, PowerPC, MIPS, ARM, and SPARC/LEON. Multicore processor support offers flexibility to users who can select an execution model ranging from pure Asymmetric Multi-Processing (AMP) to full Symmetric Multi-Processing (SMP). PikeOS is certifiable to safety standards such as DO-178B/C, IEC 61508, EN 50128, and ISO 26262. The PikeOS microkernel architecture is small and compact, resulting in real-time performance that competes with conventional proprietary RTOS products.

Virtual platforms that combine safety-critical embedded functions with a large GPOS must contain security provisions allowing unaffected partitions to continue operating in the event of a software failure or cyber attack. The recently released LynxSecure version 5.1 hypervisor from LynuxWorks offers military-grade protection features for customers building secure embedded systems. LynxSecure 5.1 provides two types of device virtualization including direct assignment of physical devices to individual guest OSs for maximum security and secure device sharing across selected guests for maximum functionality (see Figure 2).

 

 

LynxSecure also offers two virtualization schemes: para-virtualized guest OSs such as Linux for maximum performance and fully virtualized guests such as Windows, Solaris, Chromium, LynxOS-178, and LynxOS-SE, requiring no changes to the software. Another key performance feature LynxSecure delivers is the ability to run both fully virtualized and paravirtualized guest OSs with SMP capabilities across multiple cores.

These products demonstrate how virtualization technology allows designers to consolidate dissimilar functions while maintaining the required isolation and security. Along with a multitude of new software offerings, companies selling off-the-shelf boards and modules are now implementing hardware configurations that are friendly to virtualization applications. These boards have onboard memory that is easily configured for virtualization, along with smaller form factors and lower power requirements to support consolidated systems.

All of these products and design advantages point to a long-term, continuing trend in virtual technology for the embedded marketplace. Although it might require a change in embedded design philosophy, virtualization technology has developed into a valuable weapon in the developer’s toolkit.