VOSySmonitoRV: a mixed-criticality solution on 64bit Linux-capable RISC-V platform

This thesis has been developed during a six months internship in Virtual Open Systems company located in Grenoble, France. The company is specialized in design and implementation of high-performance mixed-critical virtualization solutions on low-power multi-core & heterogeneous platforms for automotive, IoT edge, cloud computing solutions. Embedded systems are widely used in many fields nowadays, often in mixed-criticality environments i.e., systems that need a real-time component with a certain time and safety constraints alongside a rich operating system. VOSySmonitor was proposed as a solution for mixed-criticality embedded systems on Arm architecture based on Arm TrustZone. The thesis work consists in the evaluation and implementation of this solution on a 64bit RISC-V Linux-capable platform, VOSySmonitoRV. RISC-V is an innovative and open instruction-set architecture that was originally designed at Berkeley to support education and research. The importance of RISC-V ISA is in its open-source licence and open standard, thanks to its frozen ISA everyone can invest in writing software that will run forever on RISC-V-like processors. RISC-V is extensible, the privileged architecture, approved and also frozen, allows many possible software stacks that define different execution environments thanks to the privileged levels. VOSySmonitoRV has the advantages of virtualization to allow the secure co-execution of two, or more, OSes in an isolated manner, but it does not exploit the virtualization support for security reasons. VOSySmonitoRV executes in M-mode, the higher privileged level. The first result is a prototype, starting from a company one, that is done on the SiFive HiFive Unleashed platform. The co-execution of the two OSes is on separate harts (cores), allocating three harts for Linux and one for the real-time OS. In this way there is a really strong isolation thanks to the PMP unit that gives memory and peripheral isolation. However, RTOS workload can be characterized for a long time by scheduled idle tasks. In order to efficiently use the RTOS hart and to give Linux almost native performance, the most challenging feature of VOSySmonitoRV is the co-execution of a safety-critical OS with a non-critical OS on a single hart. The feasibility of this feature depends on the latency of the context switch between OSes because it must be under a reasonable threshold otherwise both operating systems would have unacceptable performance losses, especially for the real-time OS. The evaluation is done through a custom benchmark that measures the latency of a context switch between privileged levels. Results are very promising for the realization of the shared core, ensuring that it is a further optimization rather than a loss. A second prototype with the shared core is developed but it is not fully operational yet.