Multi- and many-core processors are becoming increasingly popular in embedded systems. Many of these processors now feature hardware virtualization capabilities, as found on the ARM Cortex A15 and x86 architectures with Intel VT-x or AMD-V support. Hardware virtualization provides a way to partition physical resources, including processor cores, memory, and I/O devices, among guest virtual machines (VMs). Each VM is then able to host tasks of a specific criticality level, as part of a mixed-criticality system with different timing and safety requirements. However, traditional virtual machine systems are inappropriate for mixed-criticality computing. They use hypervisors to schedule separate VMs on physical processor cores. The costs of trapping into hypervisors to multiplex and manage machine physical resources on behalf of separate guests are too expensive for many time-critical tasks. Additionally, traditional hypervisors have memory footprints that are often too large for many embedded computing systems. In this article, we discuss the design of the Quest-V separation kernel, which partitions services of different criticality levels across separate VMs, or sandboxes . Each sandbox encapsulates a subset of machine physical resources that it manages without requiring intervention from a hypervisor. In Quest-V, a hypervisor is only needed to bootstrap the system, recover from certain faults, and establish communication channels between sandboxes. This not only reduces the memory footprint of the most privileged protection domain but also removes it from the control path during normal system operation, thereby heightening security.

Arduino [1] is an open source platform that offers a clear and simple environment for physical computing. It is now widely used in modern robotics and Internet-of-Things (IoT) applications, due in part to its low-cost, ease of programming, and rapid prototyping capabilities. Sensors and actuators can easily be connected to the analog and digital I/O pins of an Arduino device, which features an on-board microcontroller programmed using the Arduino API. We present Qduino, a system developed for Arduino compatible boards. It is built upon our Quest realtime operating system kernel [4] and new Arduino-compatible boards.

Arduino is an open source platform that offers a clear and simple environment for physical computing. It is now widely used in modern robotics and Internet of Things (IoT) applications, due in part to its low-cost, ease of programming, and rapid prototyping capabilities. Sensors and actuators can easily be connected to the analog and digital I/O pins of an Arduino device, which features an on-board microcontroller programmed using the Arduino API. The increasing complexity of physical computing applications has now led to a series of Arduino-compatible devices with faster processors, increased flash storage, larger memories and more complicated I/O architectures. The Intel Galileo, for example, is designed to support the Arduino API on top of a Linux system, code-named Clanton. However, the standard API is restricted to the capabilities found on less powerful devices, lacking support for multithreaded programs, or specification of real-time requirements. In this paper, we present Qduino, a system developed for Arduino compatible boards. Qduino provides an extended Arduino API which, while backward-compatible with the original API, supports real-time multithreaded sketches and event handling. Experiments show the performance gains of Qduino compared to Clanton Linux.

Shared caches in multicore processors are subject to contention from co-running threads. The resultant interference can lead to highly-variable performance for individual applications. This is particularly problematic for real-time applications, requiring predictable timing guarantees. Previous work has applied page coloring techniques to partition a shared cache, so that conflict misses are minimized amongst co-running workloads. However, prior page coloring techniques have not addressed the problem of partitioning a cache on over-committed processors where there are more executable threads than cores. Similarly, page coloring techniques have not proven efficient at adapting the cache partition sizes for threads with varying memory demands.

Quest-V is a separation kernel, which partitions a system into a collection of sandboxes. Each sandbox encapsulates one or more processing cores, a region of machine physical memory, and a subset of I/O devices. Quest-V behaves like a distributed system on a chip, using explicit communication channels to exchange data and migrate addresses spaces between sandboxes, which operate like traditional hosts. This design has benefits in safety-critical systems, which require continued availability in the presence of failures. Additionally, online faults can be recovered without rebooting an entire system. However, the programming model for such a system is more complicated. Each sandbox has its own local scheduler, and threads must communicate using message passing with those in remote sandboxes. Similarly, address spaces may need to be migrated between sandboxes, to ensure newly forked processes do not violate the feasibility of existing local task schedules. Migration may also be needed to move a thread closer to its required resources, such as I/O devices that are not directly available in the local sandbox. This paper describes how Quest-V performs real-time communication and migration without violating service guarantees for existing threads.

Multi- and many-core processors are becoming increasingly popular in embedded systems. Many of these processors now feature hardware virtualization capabilities, such as the ARM Cortex A15, and x86 processors with Intel VT-x or AMD-V support. Hardware virtualization offers opportunities to partition physical resources, including processor cores, memory and I/O devices amongst guest virtual machines. Mixed criticality systems and services can then co-exist on the same platform in separate virtual machines. However, traditional virtual machine systems are too expensive because of the costs of trapping into hypervisors to multiplex and manage machine physical resources on behalf of separate guests. For example, hypervisors are needed to schedule separate VMs on physical processor cores. In this paper, we discuss the design of the Quest-V separation kernel, which partitions services of different criticalities in separate virtual machines, or sandboxes. Each sandbox encapsulates a subset of machine physical resources that it manages without requiring intervention of a hypervisor. Moreover, a hypervisor is not needed for normal operation, except to bootstrap the system and establish communication channels between sandboxes.

This paper describes a real-time USB 2 subsystem for the Quest operating system. Quest is designed for real-time embedded systems. Such systems need to interact with their environment using sensors and actuators. On many embedded platforms today there is support for basic serial, USB 2.0 and 100 Mbps Ethernet. Of these, USB 2.0 supports the highest throughput, while also supporting real-time communication. We show how the Quest USB 2.0 sub-system improves upon some of the deficiencies in USB software stacks in systems such as Linux through experimental evaluation. We demonstrate that the Quest USB sub-system is capable of predictable bandwidth allocation and increased overall performance. By dynamically reordering transaction requests, Quest's USB sub-system is able to avoid unnecessary admission control rejections. Additionally, we are able to provide real-time guarantees for asynchronous USB transactions such as bulk transfers, which are typically treated in a best-effort manner. Real-time guarantees for bulk transactions are necessary for any system interacting with devices that implement bulk endpoints such as in a real-time file system. The paper also introduces an algorithm for USB scheduling that accepts more requests and provides bulk transfer guarantees, for cases where Linux fails.

This paper describes the scheduling framework for a new operating system called "Quest". The three main goals of Quest are to ensure safety, predictability and efficiency of software execution. For this paper, we focus on one aspect of predictability, involving the integrated management of tasks and I/O events such as interrupts. Quest's scheduling infrastructure is based around the concept of a virtual CPU (VCPU). Using both Main and I/O VCPUs, we are able to separate the CPU bandwidth consumed by tasks from that used to complete I/O processing. We introduce a priority-inheritance bandwidth-preserving server policy for I/O management, called PIBS. We show how PIBS operates with lower cost and higher throughput than a comparable Sporadic Server for managing I/O transfers that require small bursts of CPU time. Using a hybrid system of Sporadic Servers for Main VCPUs, and PIBS for I/O VCPUs, we show how to maintain temporal isolation between multiple tasks and I/O transfers from different devices. We believe Quest's VCPU scheduling infrastructure is scalable enough to operate on systems supporting large numbers of threads. For a system of 24 Main VCPUs, we observe a CPU scheduling overhead of approximately 0.3% when VCPU budget is managed in 1ms units.