Virtual Open Systems Scientific Publications

Introduction

Mixed critical systems are today increasingly important with the emergence of autonomous driving, industrial internet of things, smart cities applications. In fact, there is a need to combine software with different levels of criticality in a single platform, to satisfy both certification (e.g., ISO26262 for automotive, IEC61511 for industry, etc.) and user experience requirements (Linux, Android, etc.). An example of mixed critical application is certainly the cockpit of a road vehicle, where safety related warning icons driven by a Real Time Operating System (RTOS) coexist with infotainment (connectivity, radio, road sign recognition, etc.) based on Linux. The performance requirement of mixed criticality systems are increasing as well, driven by autonomous driving, industry 4.0, etc. In this context, there is a need of virtualization solutions that enable a safe and performant execution of different operating systems. Key requirements for such solutions are: i) strong isolation in terms of memory, CPU and IO, ii) low overhead and iii) certifiability. Existing technologies today, i.e., certified hypervisors, leverage low footprint and CPU virtualization extensions to address requirements. However, there are important security issues with virtualization, mainly due to the fact that this technology has not been designed with security or functional safety in mind. For this reason, looking for a solution that provides high computing power and robustness in terms of security and functional safety, this paper proposes to use x86 based processors System Management Mode (SMM) for mixed critical applications. In fact SMM provides a strongly isolated execution environments that runs no intermediation (low overhead) and benefits from a very thin Trusted Computing Base (certifiability). The key idea behind this is to use the isolation provided by SMM to protect the safety critical execution environment, while the feature rich execution environment is run transparently on the system. In this paper, feasibility of this approach is evaluated by measuring the overhead that would be introduced in CPU context-switch operations between an operating system in SMM mode and Linux.