Bao hypervisor introduces static partitioning for embedded real-time isolation

Bao is a lightweight, open-source Type 1 hypervisor specifically engineered for embedded systems that require high levels of isolation and predictable real-time performance. Unlike traditional hypervisors that use dynamic scheduling, Bao employs a static partitioning architecture to assign dedicated hardware resources to specific workloads.

The project is designed for mixed-criticality environments, such as automotive electronics and industrial controllers, where different applications have varying safety and timing requirements. By eliminating the need for a privileged Linux management virtual machine, Bao maintains a significantly smaller trusted computing base, which enhances the overall security and reliability of the system.

Technical architecture of the Bao hypervisor

• Resource Allocation: Implements a static partitioning model that provides a direct one-to-one mapping between virtual CPUs and physical processor cores, removing the overhead of conventional vCPU scheduling.
• Memory and I/O Management: Utilizes hardware-supported address translation for memory isolation and allows for the direct assignment of I/O devices and physical interrupts to specific virtual machines.
• Guest Support: Capable of running diverse workloads including Linux, FreeRTOS, Zephyr, and bare-metal applications on the same physical platform.
• Inter-guest Communication: Provides explicit shared-memory configurations to allow controlled communication between isolated guests while maintaining strict resource separation.
• Minimalist Design: Avoids reliance on a heavy management operating system, reducing the amount of software that must be trusted to maintain guest isolation.

Why it matters

Bao provides a specialized alternative to KVM or Xen for developers working on embedded hardware and real-time operating systems. Its ability to run Linux alongside RTOS workloads like Zephyr makes it highly relevant for the development of safety-critical automotive and industrial IoT systems.