  Multi- and many-core processors are becoming increasingly popular in embedded
systems. Many of these processors now feature hardware virtualization
capabilities, such as the ARM Cortex A15, and x86 processors with Intel VT-x or
AMD-V support. Hardware virtualization offers opportunities to partition
physical resources, including processor cores, memory and I/O devices amongst
guest virtual machines. Mixed criticality systems and services can then
co-exist on the same platform in separate virtual machines. However,
traditional virtual machine systems are too expensive because of the costs of
trapping into hypervisors to multiplex and manage machine physical resources on
behalf of separate guests. For example, hypervisors are needed to schedule
separate VMs on physical processor cores. In this paper, we discuss the design
of the Quest-V separation kernel, that partitions services of different
criticalities in separate virtual machines, or sandboxes. Each sandbox
encapsulates a subset of machine physical resources that it manages without
requiring intervention of a hypervisor. Moreover, a hypervisor is not needed
for normal operation, except to bootstrap the system and establish
communication channels between sandboxes.
