In modern mixed-criticality cockpit architectures, a single SoC runs an untrusted multi-gigabyte Android Automotive OS alongside safety-critical vehicle dynamics tasks. When Android suffers an out-of-memory kernel panic or initiates 8K video decoding, the automotive hypervisor must ensure deterministic sub-microsecond interrupt dispatching for ISO 26262 ASIL-D partitions.
Shared hardware interrupt controllers (such as Arm GICv3/v4) must prioritize safety interrupts (SGIs and PPIs) directly into ASIL-D execution contexts without traversing the guest scheduler. Hypervisors configure GIC virtual CPU interfaces to bypass guest trap latency entirely for critical signal lines.
While general-purpose enterprise hypervisors rely on dynamic credits or fair-share scheduling, automotive standards dictate static cyclic time windows for critical virtual machines. Even under catastrophic CPU saturation, each safety partition is guaranteed its dedicated execution budget within a strictly bounded 500-microsecond cycle.