[Paper Review] IRQ Coloring: Mitigating Interrupt-Generated Interference on ARM Multicore Platforms

Ralf Ramsauer, Jan Kiszka+7 more|arXiv (Cornell University)|May 19, 2017

Real-Time Systems Scheduling12 references54 citations

TL;DR

This paper presents Jailhouse, a minimal, open-source, Linux-based hypervisor that enables static hardware partitioning on ARM and x86 multicore platforms by deferring hypervisor activation until after Linux has initialized hardware. By directly assigning physical resources to isolated guest domains without paravirtualization or scheduling, Jailhouse achieves near-zero hypervisor overhead, enabling real-time workloads to run with deterministic low-latency interrupt handling (average 810ns, max ~5µs), while preserving full Linux compatibility for non-critical components.

ABSTRACT

Mixed-criticality systems, which consolidate workloads with different criticalities, must comply with stringent spatial and temporal isolation requirements imposed by safety-critical standards (e.g., ISO26262). This, per se, has proven to be a challenge with the advent of multicore platforms due to the inner interference created by multiple subsystems while disputing access to shared resources. With this work, we pioneer the concept of Interrupt (IRQ) coloring as a novel mechanism to minimize the interference created by co-existing interrupt-driven workloads. The main idea consists of selectively deactivating specific ("colored") interrupts if the QoS of critical workloads (e.g., Virtual Machines) drops below a well-defined threshold. The IRQ Coloring approach encompasses two artifacts, i.e., the IRQ Coloring Design-Time Tool (IRQ DTT) and the IRQ Coloring Run-Time Mechanism (IRQ RTM). In this paper, we focus on presenting the conceptual IRQ coloring design, describing the first prototype of the IRQ RTM on Bao hypervisor, and providing initial evidence about the effectiveness of the proposed approach on a synthetic use case.

Motivation & Objective

• To address the challenge of integrating safety-critical and non-critical workloads on shared hardware in embedded systems.
• To reduce hypervisor complexity and certification effort by avoiding scheduling, virtual CPUs, and paravirtualization.
• To enable unmodified legacy applications to run in isolated, real-time-critical domains with minimal performance overhead.
• To demonstrate that direct hardware assignment with deferred hypervisor activation can achieve deterministic real-time behavior on modern multicore platforms.

Proposed method

• Activating the Jailhouse hypervisor via a kernel module after Linux has fully booted, transforming Linux into a root cell guest.
• Using hardware virtualization extensions (e.g., ARM MMU, x86 VMX) to establish isolated, non-overlapping physical memory and I/O regions for each guest domain.
• Implementing direct hardware assignment to guests, eliminating the need for device emulation or paravirtualized drivers.
• Deferring hypervisor activation to leverage Linux’s extensive hardware initialization and driver support before partitioning.
• Minimizing hypervisor code to less than 3.4k SLOC for the core, with only essential management hypercalls for configuration and monitoring.
• Using a non-scheduling, non-virtualized architecture to avoid context switches and scheduling overhead, focusing only on isolation and interrupt routing.

Experimental results

Research questions

• RQ1 Can a minimal, non-scheduling hypervisor achieve real-time determinism on modern multicore platforms without paravirtualization?
• RQ2 How does deferred hypervisor activation impact system initialization and real-time performance?
• RQ3 What is the actual interrupt latency overhead introduced by a minimal hypervisor in a mixed-criticality environment?
• RQ4 To what extent can unmodified Linux and legacy applications coexist with real-time workloads in isolated domains?
• RQ5 Can direct hardware assignment eliminate the need for complex virtualization layers while still ensuring strong isolation and performance guarantees?

Key findings

• The average interrupt latency in the Jailhouse environment is approximately 810ns, with a narrow deviation, demonstrating high determinism.
• Outliers in interrupt latency reach up to nearly 5µs, primarily caused by shared system bus contention with neighboring guests.
• Hypervisor-induced interrupt latency is not significantly affected by interrupt frequency but depends on the utilization of neighboring guest domains due to bus contention.
• The hypervisor core is under 3.4k SLOC across all supported architectures, significantly reducing attack surface and certification burden.
• The approach enables unmodified Linux and legacy applications to run in isolated, non-critical domains with negligible performance overhead.
• The design avoids scheduling and virtual CPU management, eliminating costly context switches and simplifying real-time behavior.