Hypervisor Fundamentals

Hypervisor Fundamentals in SDV Context

Popek/Goldberg Theorem

A well-designed hypervisor is expected to satisfy the following three key criteria:

itemize

Equivalence

Software running inside a Virtual Machine (VM) should behave identically to how it would run on physical hardware.

The guest operating system should not require awareness of virtualization to function correctly.

Safety (Resource Control)

The hypervisor must retain full control over system resources at all times. This includes:

itemize

Controlling access to hardware devices

Restricting memory access to allocated regions

Managing CPU scheduling

Handling interrupt routing

Isolating faults and terminating misbehaving VMs

itemize

Performance (Efficiency)

Programs running inside virtual machines should experience minimal performance overhead compared to execution on native hardware.

itemize

Relevance in SDV (Software-Defined Vehicle)

In modern SDV architectures, a hypervisor enables multiple domains to coexist on a single hardware platform:

itemize

Infotainment Domain (e.g., Android Automotive OS)

Vehicle Control Domain (e.g., RTOS for safety-critical functions)

Connectivity / Telematics Domain

itemize

Key implications:

itemize

Equivalence ensures legacy automotive software can run without modification.

Safety guarantees strict isolation between safety-critical and non-critical domains (e.g., ADAS vs. IVI).

Performance is essential for real-time responsiveness (e.g., instrument cluster, ADAS processing).

itemize

Types of Virtualization

Full Virtualization

In full virtualization, the guest operating system is unaware of virtualization.

itemize

No modification to guest OS (e.g., Android, Linux)

Hardware is fully emulated or virtualized

Strong isolation between domains

Slightly higher overhead

itemize

SDV Usage:

itemize

Running Android Automotive OS without modification

Supporting third-party OS or legacy systems

itemize

Para-Virtualization

In para-virtualization, the guest OS is aware of virtualization and interacts with the hypervisor via hypercalls.

itemize

Requires OS modification or specialized drivers

Reduced overhead and improved performance

Efficient resource sharing

itemize

SDV Usage:

itemize

Real-time domains (e.g., AUTOSAR, RTOS)

High-performance communication between domains

Optimized I/O (e.g., shared memory, virtio)

itemize

Comparison

center

tabular |c|c|c|

Aspect & Full Virtualization & Para-Virtualization

Guest OS Modification & Not required & Required

Awareness of Virtualization & No & Yes

Performance & Moderate & High

Compatibility & High & Limited

Typical SDV Usage & Android / Linux & RTOS / AUTOSAR

tabular

center

Practical Architecture in SDV

itemize

A single SoC hosts multiple VMs

Hypervisor enforces strict isolation between domains

Mixed-criticality workloads coexist:

itemize

Safety-critical (e.g., ADAS, vehicle control)

Non-critical (e.g., infotainment, apps)

itemize

itemize

Key Benefit:

itemize

Hardware consolidation (fewer ECUs)

Improved maintainability and OTA capability

Strong safety and security isolation

itemize

Summary

An effective hypervisor in SDV must balance:

itemize

Transparency (Equivalence) for software portability

Isolation (Safety) for functional safety (ISO 26262)

Efficiency (Performance) for real-time automotive workloads

itemize

Different virtualization techniques (full vs. para) are selected based on domain requirements, balancing compatibility and performance.