The need to reduce size, weight, power, and cost in domains traditionally concerned with safety and security (e.g., automotive, aerospace) led to a growing interest in developing dependable mixed-critical systems, in which multiple software modules with different criticality are allocated on the same computing platform.
Supporting this trend requires a solid foundation in isolation and access control mechanisms, which can be achieved through effective partitioning.
Partitioning in high-end processors is achieved by combining multiple privilege levels, with virtual memory support provided by a Memory Management Unit.
Conversely, low-end processors expose a lower number of privilege levels and do not support memory virtualization; instead, they typically rely on a Memory Protection Unit that enforces isolation.
The use of low-end processors for mixed-criticality systems forces all partitions to run at the lowest privilege and rely on a software module running at the highest privilege for critical services (e.g., processor control and exception handling).
As a result, upgrading a partition can potentially require adding new code to the highest privilege software module, introducing new certification challenges.
ARM architectures successfully address this issue on Cortex-M processors by creating multiple virtualized areas with asymmetric privileges called contexts.
In recent years, due to their higher cost efficiency, greater modularity, and increased flexibility, RISC-V architectures have been considered as alternatives to ARM-based ones in embedded systems, but RISC-V ISA still lacks a standardised context-division framework for low-end processors, despite various proposals.
This work fills this gap by proposing a lightweight hardware extension that permits multi-context execution on RISC-V processors equipped with only two privilege levels and a memory protection unit.
The proposed architecture consists of two contexts: the first retains unconditional control over all processor resources, but can selectively delegate a configurable subset of them to the second.
Moreover, the proposed architecture enables configurable trade-offs between isolation guarantees, hardware resource usage, and software overhead.
We tested our solution on the Ibex RISC-V processor, targeting a Xilinx FPGA.
The measured resource utilization of the extension is negligible: the FPGA logic utilisation increased by a maximum of 3.28% in lookup tables, 0.49% extra flip-flops, and no additional Block RAM or DSP usage compared to the standard configuration of the processor.
Regarding software overhead, we measured the minimum number of clock cycles required for interrupt handling across the two contexts. Specifically, compared to the standard version of the Ibex processor, we observed minor to negligible overhead in clock cycles for intra-context interrupts and a reduction for inter-context interrupts.
We further validated the design by deploying an ARINC-653 application and measuring the number of clock cycles needed to perform context switches, which averaged from around sixty clock cycles to a few hundred based on the switching strategy employed.
Compared to existing solutions targeting RISC-V ISA for creating a multi-context environment on low-end processors, our extension delivers stronger isolation guarantees, lower software overhead, and lower hardware resources usage.