# Look Mum, no VM Exits! (Almost)

## TL;DR

This paper introduces Jailhouse, a minimal, Linux-based hypervisor that isolates critical workloads by directly assigning hardware to domains, minimizing hypervisor activity and complexity for embedded multi-core systems.

## Contribution

Jailhouse presents a novel architectural approach for a minimal, OS-agnostic hypervisor that combines Linux with isolated special-purpose domains using direct hardware assignment.

## Key findings

- Minimal hypervisor code base achieved
- Negligible overhead in isolating critical workloads
- Direct hardware assignment improves safety and performance

## Abstract

Multi-core CPUs are a standard component in many modern embedded systems. Their virtualisation extensions enable the isolation of services, and gain popularity to implement mixed-criticality or otherwise split systems. We present Jailhouse, a Linux-based, OS-agnostic partitioning hypervisor that uses novel architectural approaches to combine Linux, a powerful general-purpose system, with strictly isolated special-purpose components. Our design goals favour simplicity over features, establish a minimal code base, and minimise hypervisor activity. Direct assignment of hardware to guests, together with a deferred initialisation scheme, offloads any complex hardware handling and bootstrapping issues from the hypervisor to the general purpose OS. The hypervisor establishes isolated domains that directly access physical resources without the need for emulation or paravirtualisation. This retains, with negligible system overhead, Linux's feature-richness in uncritical parts, while frugal safety and real-time critical workloads execute in isolated, safe domains.