Communication method, device, computer readable storage medium and chip

Abstract

The present application provides a communication method, device, computer-readable storage medium and chip, which relate to the field of autonomous driving technology. The communication method is applied to a computer system, which includes a first subsystem and a second subsystem, the security level of the first subsystem is higher than the security level of the second subsystem, and the first subsystem includes a memory access checker, the method comprising: the memory access checker receives a memory access request from a memory access initiator, and determines whether the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator according to pre-configured memory security level division information, and allows the memory access initiator to access the memory address when the security level of the memory address matches the security level of the memory access initiator. The present application can achieve better isolation of different subsystems of the computer system.

Description

Technical Field

[0001] The present application relates to the field of autonomous driving technology, and more specifically, to a communication method, device, computer-readable storage medium and chip. Background Art

[0002] As computer systems become increasingly complex, it is an important issue to ensure the normal operation of each subsystem in the computer system and avoid interference with other normally operating subsystems when abnormalities occur in some subsystems.

[0003] Taking the field of autonomous driving as an example, in order to evaluate the safety risks of automobiles, hazard analysis and risk assessment of autonomous driving systems are generally performed during the design phase of automobile products to identify the hazards of different systems. The greater the safety risk of the system, the higher the corresponding safety requirement level. In order to evaluate the safety level of automobiles, ISO26262 "Road Vehicle Functional Safety" introduces the concept of automotive safety integrity level (ASIL) and defines four different ASILs: ASIL A, ASIL B, ASIL C and ASIL D. Among them, ASIL D is the highest safety integrity, while ASIL A is the lowest safety integrity. In addition, if the risk is identified as QM, there is no need for corresponding safety requirements.

[0004] In the field of autonomous driving, these safety-level systems must reliably guarantee personal safety. Even if a fault or accident occurs in one ASIL domain system partition, it cannot affect the normal operation of another ASIL domain system. This requires strict isolation between different ASIL safety level domains. If the isolation is not clean, it will cause catastrophic consequences. At the same time, it is also necessary to ensure that the communication between different functional safety partitions has low latency and high reliability.

[0005] One solution is to deploy security domain systems of different security levels on different hardware devices by stacking a large number of electronic control units (ECUs) to achieve resource isolation. Different security domain systems communicate using CAN / UART low-speed buses. In this solution, different security domain systems are equivalent to being executed by different devices separately. Although resource isolation is achieved, a large amount of hardware stacking is required, and the communication latency between different security domain systems is also relatively high.

[0006] Another solution is to virtualize physical devices using virtualization technology, and then deploy security domain systems of different security levels on different virtual devices. The hardware of the entire system is managed uniformly by a virtual machine monitor (VMM) (also called a hypervisor), and the hardware devices are shared or exclusively used by a virtual machine (VM) in a shared or direct manner. In this solution, although systems in different security domains are assigned different virtual machines, these virtual machines share some underlying hardware. Therefore, this solution does not completely isolate resources, which affects the reliability of the system to a certain extent. Summary of the invention

[0007] The present application provides a communication method, a computer system, a device, a computer-readable storage medium and a chip to achieve isolation of systems with different security levels in a computer system.

[0008] In a first aspect, a communication method is provided, which is applied to a computer system, the computer system includes a first subsystem and a second subsystem, the security level of the first subsystem is higher than the security level of the second subsystem, the CPU core of the first subsystem, the CPU core of the second subsystem and the memory access checker are integrated on the same chip. The computer system includes an interrupt controller, the interrupt controller is shared by the first subsystem and the second subsystem, the interrupt routing configuration information saved in the interrupt controller is configured by the CPU core of the first subsystem, the interrupt routing configuration information is used to indicate the CPU core that responds to each interrupt, the first subsystem also includes a memory access checker, and the communication method specifically includes: the memory access checker receives a memory access request from a memory access initiator; the memory access checker determines whether the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator according to the pre-configured memory security level division information; when the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, the memory access initiator is allowed to access the memory.

[0009] The memory access request carries the memory address to be accessed by the memory access initiator and the security level information of the memory access initiator, and the memory security level classification information is used to indicate the security level of the memory in different address segments in the computer system.

[0010] Optionally, the above-mentioned computer system is a system in an unmanned driving system.

[0011] When the computer system is a system in an unmanned driving system, the driving of the unmanned driving system can be controlled by the computer system.

[0012] It should be understood that in this application, the higher the security level, the higher the security level.

[0013] Optionally, the method further includes: when the security level of the memory to be accessed by the memory access initiator does not match the security level of the memory access initiator, the memory access initiator is not allowed to access the memory.

[0014] In the present application, by setting the memory access checker in a subsystem with a high security level and dividing the memory of the computer system according to the security level, it is possible to achieve better isolation of different subsystems of the computer system and avoid as much as possible that an abnormality in one subsystem affects the normal operation of other subsystems.

[0015] It should be understood that in the present application, the computer system may also include other subsystems in addition to the first subsystem and the second subsystem, and the number of subsystems included in the computer system is not limited in the present application. When the computer system includes other subsystems, the security level of the other subsystems may be configured in a manner similar to the first subsystem or the second subsystem.

[0016] In the present application, the second subsystem may be further divided into at least two microsystems, and then the at least two microsystems may be configured in the same manner as the first subsystem and the second subsystem.

[0017] For example, the second subsystem can be further divided into a first microsystem and a second microsystem, and the security levels of the first microsystem and the second microsystem can be configured in the above-mentioned manner, so that the security level of the first microsystem is higher than that of the second microsystem.

[0018] In combination with the first aspect, in certain implementations of the first aspect, the above method also includes: the IO device receives an access request from an access device, the access request carries security level information of the access device; when the security level of the access device matches the security level of the IO device, the IO device allows the access device to access the IO device.

[0019] The above IO device is any IO device in the first subsystem or the second subsystem.

[0020] In the present application, the IO device will accept access from the access device only when the security level of the access device matches the security level of the IO device. If the security level of the access device does not match the IP device, the IO device will not accept access from the IO device, thereby providing a certain degree of isolation between the access device and the IO device to prevent the access device whose security level does not match the IO device from accessing the IO device.

[0021] In combination with the first aspect, in some implementations of the first aspect, the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.

[0022] In the present application, the access device is allowed to access the IO device only when the security level of the access device is higher than or equal to the security level of the IO device. That is to say, a device with a high security level can access a device with the same or lower security level, so that a device with a lower security level cannot access a device with a higher security level, thereby achieving a certain degree of isolation between the access device and the IO device.

[0023] Specifically, since a device with a low security level cannot access a device with a high security level, the impact of an abnormality of a device with a low security level on a device with a high security level can be avoided.

[0024] In combination with the first aspect, in certain implementations of the first aspect, the above method also includes: the interrupt controller receives an interrupt request from an interrupt initiator, and the interrupt request carries security level information of the interrupt initiator; the interrupt controller determines whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator based on the configured security level information and the interrupt request, and allows the interrupt receiver to accept the interrupt request if the security level of the interrupt initiator matches the security level of the interrupt receiver.

[0025] In the present application, the interrupt request can be processed through the interrupt controller, so that the interrupt receiver accepts the interrupt request when the security level of the interrupt initiator matches the security level of the interrupt receiver, and isolation between the interrupt initiator and the interrupt receiver can be achieved while processing the interrupt request normally.

[0026] In combination with the first aspect, in certain implementations of the first aspect, the security level of the above-mentioned interrupt initiator matches the security level of the interrupt receiver, including: the interrupt initiator and the interrupt receiver both belong to the first subsystem; the interrupt initiator and the interrupt receiver both belong to the second subsystem; or, the interrupt initiator belongs to the first subsystem and the interrupt receiver belongs to the second subsystem.

[0027] When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, thereby preventing high-security-level devices from receiving or processing interrupt requests initiated by low-security-level devices, thereby avoiding as much as possible the impact of abnormalities in security-level devices on high-security-level devices.

[0028] In combination with the first aspect, in certain implementations of the first aspect, the mismatch between the security level of the interrupt initiator and the security level of the interrupt receiver includes: the interrupt initiator belongs to the second subsystem, and the interrupt receiver belongs to the first subsystem.

[0029] When the security level of the interrupt initiator is lower than the security level of the interrupt receiver, the interrupt receiver does not accept the interrupt request of the interrupt initiator, thereby avoiding interference with the equipment in the high-security system as much as possible when the equipment in the low-security system fails.

[0030] In combination with the first aspect, in certain implementations of the first aspect, the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

[0031] Since the initiator of memory access can only access memory with the same or lower security level, it can avoid devices with low security systems accessing memory with higher security levels as much as possible, and memory isolation can be achieved to a certain extent.

[0032] In combination with the first aspect, in certain implementations of the first aspect, when the security level of the memory access initiator is lower than the security level of the memory that the memory access initiator wants to access, it is determined that the security level of the memory that the memory access initiator wants to access does not match the security level of the memory access initiator.

[0033] In combination with the first aspect, in certain implementations of the first aspect, the first subsystem includes a partition manager, and the method further includes: the partition manager configures the security level for the devices in the first subsystem and the second subsystem according to a security level configuration file of the computer system.

[0034] The security level configuration file of the computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the memory used.

[0035] The partition manager can be used to configure the security levels of the first subsystem and the second subsystem, thereby isolating the first subsystem from the second subsystem.

[0036] It should be understood that before configuring the security level of the first subsystem and the second subsystem, the partition manager can first obtain and parse the security level configuration file of the computer system, and after obtaining the security levels of the devices in the first subsystem and the second subsystem and the memory used, configure the security level of the first subsystem and the second subsystem.

[0037] Optionally, the above security level configuration file is a pre-configured file.

[0038] Specifically, the security level configuration file can be determined in advance based on the device conditions and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system to facilitate subsequent partition management areas to obtain and parse the security level configuration file.

[0039] Optionally, the security level configuration file is obtained from the cloud.

[0040] Specifically, the security level configuration file may be downloaded from the cloud by the computer system.

[0041] In addition, the above security level configuration file may be updated or upgraded regularly or irregularly.

[0042] In combination with the first aspect, in certain implementations of the first aspect, the partition manager configures the security levels for devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager writes the security level information of the CPU core into the security level configuration module corresponding to the CPU core.

[0043] The security level information of the CPU core is used to indicate the security level of the CPU core. The security level configuration module corresponding to the CPU core can be located inside the CPU or outside the CPU.

[0044] The security level configuration module corresponding to the above-mentioned CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.

[0045] When the above-mentioned partition manager writes the security level information of the CPU core into the security level configuration module corresponding to the CPU core, it can specifically write the security level information of the CPU core into the register corresponding to the security level module corresponding to the CPU core. After writing is completed, the security level module corresponding to the CPU core can obtain the security level information of the CPU core from the register.

[0046] In combination with the first aspect, in certain implementations of the first aspect, in the above-mentioned computer system, there is a one-to-one correspondence between CPU cores and security level configuration modules, and each security level configuration module is used to indicate the security level of the corresponding CPU core.

[0047] That is, each CPU core may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU core. When each CPU core corresponds to a security level configuration module, the corresponding security level can be configured for each CPU core more flexibly.

[0048] In combination with the first aspect, in certain implementations of the first aspect, a security level configuration module corresponding to the CPU core is disposed inside the CPU core.

[0049] When the security level configuration module corresponding to the CPU core is arranged inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.

[0050] In combination with the first aspect, in certain implementations of the first aspect, in the above-mentioned computer system, there is a one-to-one correspondence between the CPU cluster and the security level configuration module, the CPU cluster includes multiple CPU cores, and the security level configuration module is used to indicate the security levels of the multiple CPU cores in the corresponding CPU cluster.

[0051] Each CPU cluster may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster. When each CPU cluster corresponds to a security level configuration module, the number of security level configuration modules can be reduced, thereby simplifying the complexity of the computer system.

[0052] In combination with the first aspect, in certain implementations of the first aspect, the security level configuration module corresponding to the CPU cluster is set in a protocol processing module L3_TAG of an L3 cache corresponding to the CPU cluster.

[0053] In combination with the first aspect, in certain implementations of the first aspect, the partition manager configures the security levels for devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager writes memory security level division information in the memory access checker.

[0054] The memory access checker is written with memory security level division information through the partition manager, so that the memory access checker can check and manage memory access according to the written memory security level division information, which facilitates the subsequent memory isolation.

[0055] In combination with the first aspect, in certain implementations of the first aspect, the partition manager configures the security levels for devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager writes the security level information of the IO device into the security level configuration and detection module corresponding to the IO device, and the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device initiating the access request matches the security level of the IO device.

[0056] By writing the security level information of the IO device into the IO device through the partition manager, the security level of the IO device can be configured. At the same time, the security level configuration and detection module of the configured IO device can also check the security level of the device that initiates the access request, thereby realizing isolation between devices with different security levels.

[0057] In combination with the first aspect, in certain implementations of the first aspect, the above method also includes: starting the first CPU core of the first subsystem so that the partition manager runs on the first CPU core of the first subsystem; the partition manager starts other CPU cores of the first subsystem; after completing the startup of the CPU core of the first subsystem, the partition manager starts the CPU core of the second subsystem in sequence.

[0058] In combination with the first aspect, in certain implementations of the first aspect, the memory of the second subsystem includes a shared memory, and the shared memory is used to transmit data between the first subsystem and the second subsystem. The method also includes: the CPU core of the first subsystem stores the first communication data generated by the first subsystem into the shared memory, and initiates a first interrupt, so that after the CPU core of the second subsystem receives the first interrupt, it reads the first communication data from the shared memory; or, the CPU core of the second subsystem stores the second communication data generated by the first and second subsystems into the shared memory, and initiates a second interrupt, so that after the CPU core of the first subsystem receives the second interrupt, it reads the second communication data from the shared memory.

[0059] In the present application, data can be transmitted between the first subsystem and the second subsystem through the shared memory of the second subsystem, thereby isolating the first subsystem and the second subsystem while ensuring normal communication between the first subsystem and the second subsystem.

[0060] In a second aspect, a communication method is provided, which is applied to a computer system, wherein the computer system includes a first subsystem and a second subsystem, the operating system of the first subsystem is different from the operating system of the second subsystem, and the CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip, and the communication method includes: obtaining a security level configuration file of the computer system; configuring the security levels of the first subsystem and the second subsystem according to the security level configuration file, so that the security level of the CPU core of the first subsystem is higher than the security level of the CPU core of the second subsystem, the security level of the IO device of the first subsystem is higher than the security level of the IO device of the second subsystem, and the security level of the memory used by the first subsystem is higher than the security level of the memory of the second subsystem.

[0061] The security level configuration file of the computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the memory used by the first subsystem and the second subsystem.

[0062] The method of the second aspect may be executed by a partition manager in a computer system, and the partition manager may be a module (software module or virtual module) implemented by software in the computer system.

[0063] Optionally, the above-mentioned computer system is a system in an unmanned driving system.

[0064] When the computer system is a system in an unmanned driving system, the driving of the unmanned driving system can be controlled by the computer system.

[0065] It should be understood that in this application, the higher the security level, the higher the security level.

[0066] In the present application, after obtaining the security level configuration file of the computer system, the security levels of the first subsystem and the second subsystem can be configured according to the security level configuration file of the computer system, thereby achieving security isolation between the first subsystem and the second subsystem, and minimizing the impact of abnormalities in the second subsystem on the normal operation of the first subsystem.

[0067] Optionally, the above security level configuration file is a pre-configured file.

[0068] The above security level configuration file can be determined in advance based on the equipment conditions and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system to facilitate the subsequent partition management area to obtain and parse the security level configuration file.

[0069] Optionally, the security level configuration file is obtained from the cloud.

[0070] Specifically, the security level configuration file may be downloaded from the cloud by the computer system.

[0071] In addition, the above security level configuration file may be updated or upgraded regularly or irregularly.

[0072] In combination with the second aspect, in certain implementations of the second aspect, the above-mentioned configuration of the security levels of the first subsystem and the second subsystem according to the security level configuration file includes: writing the security level information of the CPU core of the computer system into the security level configuration module corresponding to the CPU core of the computer system.

[0073] The security level information of the CPU core is used to indicate the security level of the CPU core. The security level configuration module corresponding to the CPU core can be located inside the CPU or outside the CPU.

[0074] The security level configuration module corresponding to the above-mentioned CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.

[0075] When the security level configuration module corresponding to the CPU core writes the security level information of the CPU core, the security level information of the CPU core can be written into the register corresponding to the security level module corresponding to the CPU core. After writing, the security level module corresponding to the CPU core can obtain the security level information of the CPU core from the register.

[0076] In combination with the second aspect, in certain implementations of the second aspect, there is a one-to-one correspondence between the CPU cores and the security level configuration modules in the above-mentioned computer system, and each security level module is used to indicate the security level of the corresponding CPU core.

[0077] When each CPU core corresponds to a security level configuration module, the corresponding security level can be configured for each CPU core more flexibly.

[0078] In combination with the second aspect, in certain implementations of the second aspect, a security level configuration module corresponding to each CPU core in the computer system is disposed inside each CPU core.

[0079] When the security level configuration module corresponding to the CPU core is arranged inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.

[0080] In combination with the second aspect, in certain implementations of the second aspect, in the above-mentioned computer system, there is a one-to-one correspondence between the CPU cluster and the security level configuration module, the CPU cluster includes multiple CPU cores, and each security level configuration module is used to indicate the security level of the multiple CPU cores in the corresponding CPU cluster.

[0081] Each CPU cluster may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster. When each CPU cluster corresponds to a security level configuration module, the number of security level configuration modules can be reduced, thereby simplifying the complexity of the computer system.

[0082] In combination with the second aspect, in certain implementations of the second aspect, the security level configuration module corresponding to each CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to each CPU cluster.

[0083] In combination with the second aspect, in certain implementations of the second aspect, the first subsystem includes a memory access checker, and the security levels of the first subsystem and the second subsystem are configured according to the security level configuration file, including: writing memory security level division information in the memory access checker.

[0084] By writing memory security level classification information into the memory access checker, the memory access checker can check and manage memory access according to the written memory security level classification information, thereby facilitating the subsequent implementation of memory isolation.

[0085] In combination with the second aspect, in certain implementations of the second aspect, it is characterized in that the security levels of the first subsystem and the second subsystem are configured according to the security level configuration file, including: writing the security level information of the IO device into the security level configuration and detection module corresponding to the IO device, and the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device initiating the access request matches the security level of the IO device.

[0086] By writing the security level information of the IO device into the IO device through the partition manager, the security level of the IO device can be configured. At the same time, the security level configuration and detection module of the configured IO device can also check the security level of the device that initiates the access request, thereby realizing isolation between devices with different security levels.

[0087] In a third aspect, a communication method is provided. The communication method is applied to a computer system, the computer system includes a first subsystem and a second subsystem, the operating system of the first subsystem is different from the operating system of the second subsystem, and the CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip, and the communication method includes:

[0088] Receive security level configuration information of the first subsystem and the second subsystem to configure the security levels of the first subsystem and the second subsystem, so that the security level of the CPU core of the first subsystem is higher than the security level of the CPU core of the second subsystem, the security level of the IO device of the first subsystem is higher than the security level of the IO device of the second subsystem, and the security level of the memory used by the first subsystem is higher than the security level of the memory of the second subsystem.

[0089] In the present application, after receiving the security level configuration information of the first subsystem and the second subsystem, the security levels of the first system and the second subsystem can be configured according to the security level configuration information, thereby achieving security isolation of the first subsystem and the second subsystem, and minimizing the impact of abnormalities in the second subsystem on the normal operation of the first subsystem.

[0090] In combination with the third aspect, in certain implementations of the third aspect, the above-mentioned receiving configuration information of the security levels of the first subsystem and the second subsystem to implement the configuration of the security levels of the first subsystem and the second subsystem includes: receiving security level information of each CPU core in the computer system.

[0091] After receiving the security level information of each CPU core, the configuration of the security level of each CPU core in the computer system is realized.

[0092] In combination with the third aspect, in certain implementations of the third aspect, there is a one-to-one correspondence between the CPU cores and the security level configuration modules in the above-mentioned computer system, and each security level module is used to indicate the security level of the corresponding CPU core.

[0093] That is, each CPU core may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU core. When each CPU core corresponds to a security level configuration module, the corresponding security level can be configured for each CPU core more flexibly.

[0094] In combination with the third aspect, in certain implementations of the third aspect, the security level configuration module corresponding to each CPU core is located inside each CPU core.

[0095] When the security level configuration module corresponding to the CPU core is arranged inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.

[0096] In combination with the third aspect, in certain implementations of the third aspect, there is a one-to-one correspondence between a CPU cluster in a computer system and a security level configuration module, and the security level configuration module is used to indicate the security levels of multiple CPU cores in the corresponding CPU cluster.

[0097] Each CPU cluster may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster. When each CPU cluster corresponds to a security level configuration module, the number of security level configuration modules can be reduced, thereby simplifying the complexity of the computer system.

[0098] In combination with the third aspect, in certain implementations of the third aspect, in a computer system, a security level configuration module corresponding to any CPU cluster is set in a protocol processing module L3_TAG of an L3 cache corresponding to any CPU cluster.

[0099] In combination with the third aspect, in certain implementations of the third aspect, configuration information of the security levels of the first subsystem and the second subsystem is received to configure the security levels of the first subsystem and the second subsystem, including: receiving memory security level division information, the memory security level division information is used to indicate the security levels of memories in different address segments in the computer system.

[0100] By receiving memory security level division information, it is possible to configure the security level of memory in different address segments in a computer system.

[0101] In conjunction with the third aspect, in certain implementations of the third aspect, receiving configuration information of the security levels of the first subsystem and the second subsystem to configure the security levels of the first subsystem and the second subsystem includes:

[0102] The security level information of the IO device in the computer system is received, and the access request received by the IO device is detected to determine whether the security level of the access device initiating the access request matches the security level of the IO device.

[0103] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes: receiving an interrupt request initiated by an interrupt initiator, the interrupt request carrying security level information of the interrupt initiator;

[0104] According to the configured security level information and the interrupt request, it is determined whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and if the security level of the interrupt initiator matches the security level of the interrupt receiver, the interrupt receiver is allowed to accept the interrupt request.

[0105] In the present application, the interrupt request can be processed through the interrupt controller, so that the interrupt receiver accepts the interrupt request when the security level of the interrupt initiator matches the security level of the interrupt receiver, and isolation between the interrupt initiator and the interrupt receiver can be achieved while processing the interrupt request normally.

[0106] In conjunction with the third aspect, in some implementations of the third aspect, determining whether the security level of the interrupt initiator matches the security level of the interrupt target device to be accessed by the interrupt device according to the configuration information of the security levels of the first subsystem and the second subsystem and the interrupt request includes:

[0107] When the interrupt initiator and the interrupt target device both belong to the first subsystem, determining that the security level of the interrupt initiator matches the security level of the interrupt target device;

[0108] When the interrupt initiator and the interrupt target device both belong to the second subsystem, it is determined that the security level of the interrupt initiator matches the security level of the interrupt target device.

[0109] When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, thereby preventing high-security-level devices from receiving or processing interrupt requests initiated by low-security-level devices, thereby avoiding as much as possible the impact of abnormalities in security-level devices on high-security-level devices.

[0110] In combination with the third aspect, in certain implementations of the third aspect, when the security level of the memory access initiator is lower than the security level of the memory that the memory access initiator wants to access, it is determined that the security level of the memory that the memory access initiator wants to access does not match the security level of the memory access initiator.

[0111] In combination with the third aspect, in certain implementations of the third aspect, the above method also includes: receiving a memory access request from a memory access initiator, the memory access request carrying a memory address to be accessed by the memory access initiator and security level information of the memory access initiator; when the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, allowing the memory access initiator to access the memory address to be accessed by the memory access initiator, and the memory security level division information is used to indicate the security levels of different segments of memory.

[0112] In combination with the third aspect, in certain implementations of the third aspect, the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

[0113] Since the initiator of memory access can only access memory with the same or lower security level, it can avoid devices with low security systems accessing memory with higher security levels as much as possible, and memory isolation can be achieved to a certain extent.

[0114] In a fourth aspect, a communication method is provided, which is applied to a computer system, wherein the computer system includes a first subsystem and a second subsystem, the operating system of the first subsystem is different from the operating system of the second subsystem, and the CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip. The communication method includes: an IO device receives an access request from an access device, the access request carries security level information of the access device, wherein the IO device is any IO device in the first subsystem or the second subsystem; when the security level of the access device matches the security level of the IO device, the IO device allows the access device to access the IO device.

[0115] In combination with the fourth aspect, in certain implementations of the fourth aspect, the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.

[0116] In a fifth aspect, a computer system is provided, which includes a first subsystem and a second subsystem, and the first subsystem and the second subsystem are used to execute the method in the first aspect.

[0117] In a sixth aspect, a processing device is provided, which includes modules for executing the method in the second aspect.

[0118] In a seventh aspect, a processing device is provided, which includes modules for executing the method in the third aspect.

[0119] In an eighth aspect, a processing device is provided, which includes modules for executing the method in the fourth aspect.

[0120] The processing device in the sixth, seventh and eighth aspects mentioned above may be a chip in the computer system in the first aspect mentioned above.

[0121] In a ninth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a program code, wherein the program code includes instructions for executing the steps in any one of the methods in the second aspect.

[0122] In a tenth aspect, a computer program product comprising instructions is provided, and when the computer program product is run on a computer, the computer is caused to execute any one of the methods in the second aspect.

[0123] In an eleventh aspect, a chip is provided, comprising a processor and a data interface, wherein the processor reads instructions stored in a memory through the data interface to execute any one of the methods in the second aspect.

[0124] Optionally, as an implementation method, the chip may also include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute any one of the methods in the above-mentioned second aspect.

[0125] The above chip can specifically be a field programmable gate array FPGA or an application specific integrated circuit ASIC. BRIEF DESCRIPTION OF THE DRAWINGS

[0126] Figure 1 It is a schematic diagram of the autonomous driving system;

[0127] Figure 2 is a schematic flow chart of a communication method according to an embodiment of the present application;

[0128] Figure 3 is a schematic diagram of the process of processing a memory access request by a memory access checker;

[0129] Figure 4 is a schematic diagram of the process by which an IO device determines whether to accept access from an access device;

[0130] Figure 5 This is a schematic diagram of IO devices accessing memory;

[0131] Figure 6 It is a schematic diagram that each CPU core corresponds to a security level configuration module;

[0132] Figure 7 It is a schematic diagram that each CPU cluster corresponds to a security level configuration module;

[0133] Figure 8 is a schematic flow chart of a communication method according to an embodiment of the present application;

[0134] Fig. 9 is a schematic flow chart of a communication method according to an embodiment of the present application;

[0135] Fig.10 is a schematic flow chart of a communication method according to an embodiment of the present application;

[0136] Fig.11 It is a schematic diagram of the structure of the autonomous driving system;

[0137] Fig.12 is a schematic diagram of the process of configuring the memory access checker by the partition manager;

[0138] Fig.13 is a schematic block diagram of a computer system according to an embodiment of the present application;

[0139] Fig.14 is a schematic block diagram of a processing device according to an embodiment of the present application;

[0140] Fig.15 is a schematic block diagram of a processing device according to an embodiment of the present application;

[0141] Fig.16 is a schematic block diagram of a processing device according to an embodiment of the present application;

[0142] Fig.17 is a schematic diagram of the interrupt configuration in the autonomous driving system;

[0143] Fig.18 It is a schematic diagram of the interrupt handling process;

[0144] Fig.19 It is a schematic diagram of starting a computer system;

[0145] Fig. 20 It is a schematic diagram of shared communication between different subsystems. DETAILED DESCRIPTION

[0146] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0147] The computer system in the present application may specifically be located in an autonomous driving system. When the computer system is located in an autonomous driving system, the (partition) isolation of different subsystems of the computer system is essentially the isolation of different subsystems in the autonomous driving system.

[0148] The following uses the autonomous driving system as an example to explain the partition isolation of the autonomous driving system. For the autonomous driving system, for subsystems with different safety levels in the system, it is necessary to achieve complete isolation of subsystems with different safety levels, and also to achieve normal communication between different subsystems. Figure 1 The partition isolation of the autonomous driving system is explained.

[0149] like Figure 1 As shown, the automatic driving system includes a first subsystem and a second subsystem, wherein the first subsystem is used to identify objects and the second subsystem is used to control the vehicle (control the vehicle's braking, acceleration and turning, etc.). If the first subsystem finds an obstacle in front of the vehicle, it notifies the second subsystem to control the vehicle to brake. When the notification command is issued, if the first subsystem fails, the failure may cause the second subsystem to fail to work properly, so that the braking command of the second subsystem is not correctly executed, and finally it is likely to cause the vehicle to crash into the obstacle and cause a traffic accident.

[0150] Therefore, in Figure 1In the autonomous driving system shown, in order to achieve safe driving, the first subsystem and the second subsystem need to be isolated so that when one of the subsystems fails, the other subsystem can still work normally.

[0151] Combine the following Figure 2 The communication method of the embodiment of the present application is introduced in detail. Figure 2 The communication method shown may be executed by devices in a computer system. Figure 2 The method shown can be applied to a computer system, which includes a first subsystem and a second subsystem, wherein the security level of the first subsystem is higher than the security level of the second subsystem, and the CPU core of the first subsystem, the CPU core of the second subsystem, and the memory access checker are integrated on the same chip. The computer system includes an interrupt controller, which is shared by the first subsystem and the second subsystem, and the interrupt routing configuration information stored in the interrupt controller is configured by the CPU core of the first subsystem, and the interrupt routing configuration information is used to indicate the CPU core that responds to each interrupt, and the first subsystem also includes a memory access checker.

[0152] Figure 2 The method shown includes steps 1001 and 1002, which are described in detail below.

[0153] 1001. Memory Access This sends a memory access request to a memory access checker, and the memory access checker receives the memory access request from a memory access initiator.

[0154] The memory access request carries the memory address that the memory access initiator wants to access and the security level information of the memory access initiator.

[0155] 1002. The memory access checker determines whether the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator based on pre-configured memory security level classification information, and determines whether to allow the memory access initiator to access based on the matching result.

[0156] Specifically, when the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, the memory access initiator is allowed to access the memory; and when the memory security level to be accessed by the memory access initiator does not match the security level of the memory access initiator, the memory access initiator is not allowed to access the memory.

[0157] The above memory security level classification information is used to indicate the security level of the memory in different address segments in the computer system.

[0158] Optionally, the above-mentioned computer system is a system in an unmanned driving system.

[0159] When the computer system is a system in an unmanned driving system, the driving of the unmanned driving system can be controlled by the computer system.

[0160] It should be understood that in this application, the higher the security level, the higher the security level.

[0161] Optionally, the method further includes: when the security level of the memory to be accessed by the memory access initiator does not match the security level of the memory access initiator, the memory access initiator is not allowed to access the memory.

[0162] In the present application, by setting the memory access checker in a subsystem with a high security level and dividing the memory of the computer system according to the security level, it is possible to achieve better isolation of different subsystems of the computer system and avoid as much as possible that an abnormality in one subsystem affects the normal operation of other subsystems.

[0163] It should be understood that in the present application, the computer system may also include other subsystems in addition to the first subsystem and the second subsystem, and the number of subsystems included in the computer system is not limited in the present application. When the computer system includes other subsystems, the security level of the other subsystems may be configured in a manner similar to the first subsystem or the second subsystem.

[0164] In the present application, the second subsystem may be further divided into at least two microsystems, and then the at least two microsystems may be configured in the same manner as the first subsystem and the second subsystem.

[0165] For example, the second subsystem can be further divided into a first microsystem and a second microsystem, and the security levels of the first microsystem and the second microsystem can be configured in the above-mentioned manner, so that the security level of the first microsystem is higher than that of the second microsystem.

[0166] In the above computer system, in addition to isolating the memory accessed by the first subsystem and the second subsystem, the device of the first subsystem and the device of the second subsystem may also be isolated.

[0167] Combine the following Figure 3 A detailed description of the process of processing memory access requests by the memory access checker is given.

[0168] like Figure 3As shown, when the CPU or IO device accesses the memory as the master device, the access request of the CPU or IO device will carry a security level signal. The access request will first arrive at the address decoder for decoding, so as to obtain the memory access address and the security level signal carried in the access request. Next, the memory access checker will verify the security level of the security level signal carried in the access request. Only memory access requests with matching security levels are allowed to access the memory, otherwise a security interrupt will be reported.

[0169] In the present application, the IO device can also determine whether the security level of the access device matches the security level of the IO device according to the access request of the access device, and allow access to the access device if it matches. Figure 4 Provide specific instructions.

[0170] like Figure 4 As shown, the process of the IO device determining whether to accept the access of the access device specifically includes steps 2001 to 2003, and these steps are introduced below.

[0171] 2001. The IO device receives an access request from an access device.

[0172] The access request carries security level information of the access device, and the IO device is any IO device in the first subsystem or the second subsystem.

[0173] 2002. When the security level of the access device matches the security level of the IO device, the IO device allows the access device to access the IO device.

[0174] 2003. When the security level of the access device matches the security level of the IO device, the IO device allows the access device to access the IO device.

[0175] It should be understood that, in the actual execution process, for the same access device, the IO device executes step 2002 or 2003.

[0176] Furthermore, before the above steps 2002 and 2003, Figure 4 The illustrated process may also include step 2004 .

[0177] 2004. Determine whether the security level of the access device matches the security level of the IO device.

[0178] Specifically, in step 2004, the IO device may obtain the security level of the access device according to the access request of the access device, and then determine whether the security level of the access device matches the security level of the IO device according to the security level of the access device and the security level of the IO device.

[0179] In the present application, the IO device will accept access from the access device only when the security level of the access device matches the security level of the IO device. If the security level of the access device does not match the IP device, the IO device will not accept access from the IO device, thereby providing a certain degree of isolation between the access device and the IO device to prevent the access device whose security level does not match the IO device from accessing the IO device.

[0180] Optionally, the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.

[0181] In the present application, the access device is allowed to access the IO device only when the security level of the access device is higher than or equal to the security level of the IO device. That is to say, a device with a high security level can access a device with the same or lower security level, so that a device with a lower security level cannot access a device with a higher security level, thereby achieving a certain degree of isolation between the access device and the IO device.

[0182] Specifically, since a device with a low security level cannot access a device with a high security level, the impact of an abnormality of a device with a low security level on a device with a high security level can be avoided.

[0183] For each IO device, a configuration register can be added to store the security level of the IO device, such as Figure 5 As shown, when the IO device accesses the memory as a master device, the security level information of the IO device will be transmitted on the address bus along with the hardware signal. When the hardware signal passes through the memory access checker, the memory access checker will check the security level of the hardware signal.

[0184] Similarly, if Figure 5 As shown, when the CPU core accesses the IO device, the IO device will check the security level of the CPU core's access request. Only when the security level of the CPU core matches the security level of the IO device, the CPU core is allowed to access the IO device.

[0185] In addition to isolating the memory accessed by the first subsystem and the second subsystem and the device of the first subsystem and the device of the second subsystem, interrupt requests may also be isolated.

[0186] Optionally, Figure 2The method shown also includes: the interrupt controller receives an interrupt request from an interrupt initiator, the interrupt request carrying the security level information of the interrupt initiator; the interrupt controller determines whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator based on the configured security level information and the interrupt request, and allows the interrupt receiver to accept the interrupt request if the security level of the interrupt initiator matches the security level of the interrupt receiver.

[0187] In the present application, the interrupt request can be processed through the interrupt controller, so that the interrupt receiver accepts the interrupt request when the security level of the interrupt initiator matches the security level of the interrupt receiver, and isolation between the interrupt initiator and the interrupt receiver can be achieved while processing the interrupt request normally.

[0188] Optionally, the security level of the interrupt initiator matches the security level of the interrupt receiver, including: the interrupt initiator and the interrupt receiver both belong to the first subsystem; the interrupt initiator and the interrupt receiver both belong to the second subsystem; or the interrupt initiator belongs to the first subsystem and the interrupt receiver belongs to the second subsystem.

[0189] When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, thereby preventing high-security-level devices from receiving or processing interrupt requests initiated by low-security-level devices, thereby avoiding as much as possible the impact of abnormalities in security-level devices on high-security-level devices.

[0190] Optionally, the security level of the interrupt initiator and the security level of the interrupt receiver do not match each other, including: the interrupt initiator belongs to the second subsystem, and the interrupt receiver belongs to the first subsystem.

[0191] When the security level of the interrupt initiator is lower than the security level of the interrupt receiver, the interrupt receiver does not accept the interrupt request of the interrupt initiator, thereby avoiding interference with the equipment in the high-security system as much as possible when the equipment in the low-security system fails.

[0192] Optionally, the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

[0193] Since the initiator of memory access can only access memory with the same or lower security level, it can avoid devices with low security systems accessing memory with higher security levels as much as possible, and memory isolation can be achieved to a certain extent.

[0194] Optionally, when the security level of the memory access initiator is lower than the security level of the memory to be accessed by the memory access initiator, it is determined that the security level of the memory to be accessed by the memory access initiator does not match the security level of the memory access initiator.

[0195] The first subsystem further includes a partition manager. Figure 2 The method shown also includes: the partition manager configures the security level for the devices in the first subsystem and the second subsystem according to the security level configuration file of the computer system.

[0196] The security level configuration file of the computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the memory used.

[0197] The partition manager can be used to configure the security levels of the first subsystem and the second subsystem, thereby isolating the first subsystem from the second subsystem.

[0198] It should be understood that before configuring the security level of the first subsystem and the second subsystem, the partition manager can first obtain and parse the security level configuration file of the computer system, and after obtaining the security levels of the devices in the first subsystem and the second subsystem and the memory used, configure the security level of the first subsystem and the second subsystem.

[0199] Optionally, the above security level configuration file is a pre-configured file.

[0200] Specifically, the security level configuration file can be determined in advance based on the device conditions and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system to facilitate subsequent partition management areas to obtain and parse the security level configuration file.

[0201] Optionally, the security level configuration file is obtained from the cloud.

[0202] Specifically, the security level configuration file may be downloaded from the cloud by the computer system.

[0203] In addition, the above security level configuration file may be updated or upgraded regularly or irregularly.

[0204] In combination with the first aspect, in certain implementations of the first aspect, the partition manager configures the security levels for devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager writes the security level information of the CPU core into the security level configuration module corresponding to the CPU core.

[0205] The security level information of the CPU core is used to indicate the security level of the CPU core. The security level configuration module corresponding to the CPU core can be located inside the CPU or outside the CPU.

[0206] The security level configuration module corresponding to the above-mentioned CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.

[0207] When the above-mentioned partition manager writes the security level information of the CPU core into the security level configuration module corresponding to the CPU core, it can specifically write the security level information of the CPU core into the register corresponding to the security level module corresponding to the CPU core. After writing is completed, the security level module corresponding to the CPU core can obtain the security level information of the CPU core from the register.

[0208] Optionally, in the above computer system, there is a one-to-one correspondence between CPU cores and security level configuration modules, and each security level configuration module is used to indicate the security level of the corresponding CPU core.

[0209] That is, each CPU core may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU core. When each CPU core corresponds to a security level configuration module, the corresponding security level can be configured for each CPU core more flexibly.

[0210] Optionally, the security level configuration module corresponding to the CPU core is set inside the CPU core.

[0211] When the security level configuration module corresponding to the CPU core is arranged inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.

[0212] like Figure 6 As shown, each CPU core is provided with a security level configuration module, so that after the configuration is completed, the signal sent by each CPU core carries the corresponding security level information.

[0213] Assumptions Figure 6 The CPU core shown is a CPU core in an autonomous driving system, and, Figure 6 The safety level configuration module of the CPU core on the left is configured to ASIL-D level. Figure 6 The safety level configuration module of the CPU core on the right is configured as ASIL-B level. Then, the signal of the CPU on the left carries the high safety level information of ASIL-D, and the signal of the CPU on the right carries the low safety level information of ASIL-B.

[0214] It should be understood that the security level configuration module corresponding to each CPU core can also be located outside the CPU core. In this case, the signal sent by the CPU core can also pass through the security level module corresponding to the CPU core, and the security level module corresponding to the CPU core adds the security level information of the CPU core to the signal sent by the CPU core.

[0215] In addition to configuring the CPU security level on a per-CPU basis, you can also configure the CPU security level on a per-CPU basis.

[0216] Optionally, in the above computer system, there is a one-to-one correspondence between a CPU cluster and a security level configuration module, a CPU cluster includes multiple CPU cores, and the security level configuration module is used to indicate the security levels of the multiple CPU cores in the corresponding CPU cluster.

[0217] Each CPU cluster may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster. When each CPU cluster corresponds to a security level configuration module, the number of security level configuration modules can be reduced, thereby simplifying the complexity of the computer system.

[0218] Optionally, the security level configuration module corresponding to the CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to the CPU cluster.

[0219] Optionally, the partition manager configures the security level for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager writes the memory security level division information in the memory access checker.

[0220] The memory access checker is written with memory security level division information through the partition manager, so that the memory access checker can check and manage memory access according to the written memory security level division information, which facilitates the subsequent memory isolation.

[0221] In the present application, a new hardware module can be added to the L3_TAG module (L3_TAG is the protocol processing module of L3 Cache, including all functions except data storage) in the L3 cache (L3 Cache) outside the CPU cluster, and the module can configure the security level of the CPU inside the CPU cluster.

[0222] like Figure 7 As shown, one CPU cluster corresponds to one L3_TAG, and a security level configuration module is added to the L3_TAG. One security level configuration module is used to indicate the security levels of multiple CPU cores in the corresponding CPU cluster.

[0223] For example, when Figure 7 When the safety level module in L3_TAG is configured to ASIL-D level, the signal of each CPU will carry the high safety level information of ASIL-D after passing through the L3_TAG; similarly, when the safety level module in L3_TAG is configured to ASIL-B or QM, the signal of each CPU will carry the low safety level information of ASIL-B or QM after passing through the L3_TAG.

[0224] Optionally, the partition manager configures the security levels for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager writes the security level information of the IO device into the security level configuration and detection module corresponding to the IO device, and the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device initiating the access request matches the security level of the IO device.

[0225] By writing the security level information of the IO device into the IO device through the partition manager, the security level of the IO device can be configured. At the same time, the security level configuration and detection module of the configured IO device can also check the security level of the device that initiates the access request, thereby realizing isolation between devices with different security levels.

[0226] Optionally, Figure 2 The method shown also includes: starting the first CPU core of the first subsystem so that the partition manager runs on the first CPU core of the first subsystem; the partition manager starts other CPU cores of the first subsystem; after completing the startup of the CPU core of the first subsystem, the partition manager starts the CPU core of the second subsystem in sequence.

[0227] Optionally, the memory of the second subsystem includes a shared memory, which is used to transmit data between the first subsystem and the second subsystem. The method also includes: the CPU core of the first subsystem stores the first communication data generated by the first subsystem into the shared memory, and initiates a first interrupt, so that the CPU core of the second subsystem reads the first communication data from the shared memory after receiving the first interrupt; or, the CPU core of the second subsystem stores the second communication data generated by the first and second subsystems into the shared memory, and initiates a second interrupt, so that the CPU core of the first subsystem reads the second communication data from the shared memory after receiving the second interrupt.

[0228] In the present application, data can be transmitted between the first subsystem and the second subsystem through the shared memory of the second subsystem, thereby isolating the first subsystem and the second subsystem while ensuring normal communication between the first subsystem and the second subsystem.

[0229] Combine the following Figure 8 The communication method of the embodiment of the present application is described in detail.

[0230] Figure 8 It is a schematic flow chart of the communication method of an embodiment of the present application. Figure 8 The communication method shown is applied to a computer system, which includes a first subsystem and a second subsystem. The operating system of the first subsystem is different from the operating system of the second subsystem. The CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip.

[0231] Figure 8 The method shown includes steps 3001 and 3002, and these two steps are described in detail below.

[0232] 3001. Obtain a security level profile of a computer system.

[0233] The security level configuration file of the computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the memory used by the first subsystem and the second subsystem.

[0234] 3002. Configure the security levels of the first subsystem and the second subsystem according to the security level configuration file, so that the security level of the CPU core of the first subsystem is higher than the security level of the CPU core of the second subsystem, the security level of the IO device of the first subsystem is higher than the security level of the IO device of the second subsystem, and the security level of the memory used by the first subsystem is higher than the security level of the memory of the second subsystem.

[0235] Figure 8 The method shown may be executed by a partition manager in a computer system. The partition manager may be a module (software module or virtual module) implemented by software in the computer system.

[0236] Optionally, the above-mentioned computer system is a system in an unmanned driving system.

[0237] When the computer system is a system in an unmanned driving system, the driving of the unmanned driving system can be controlled by the computer system.

[0238] It should be understood that in this application, the higher the security level, the higher the security level.

[0239] In the present application, after obtaining the security level configuration file of the computer system, the security levels of the first subsystem and the second subsystem can be configured according to the security level configuration file of the computer system, thereby achieving security isolation between the first subsystem and the second subsystem, and minimizing the impact of abnormalities in the second subsystem on the normal operation of the first subsystem.

[0240] Optionally, the above security level configuration file is a pre-configured file.

[0241] The above security level configuration file can be determined in advance based on the equipment conditions and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system to facilitate the subsequent partition management area to obtain and parse the security level configuration file.

[0242] Optionally, the security level configuration file is obtained from the cloud.

[0243] Specifically, the security level configuration file may be downloaded from the cloud by the computer system.

[0244] In addition, the above security level configuration file may be updated or upgraded regularly or irregularly.

[0245] Optionally, the above step 3002 specifically includes:

[0246] 3002a. Write the security level information of the CPU core of the computing system into the security level configuration module corresponding to the CPU core of the computing system.

[0247] The security level information of the CPU core is used to indicate the security level of the CPU core. The security level configuration module corresponding to the CPU core can be located inside the CPU or outside the CPU.

[0248] The security level configuration module corresponding to the above-mentioned CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.

[0249] When the security level configuration module corresponding to the CPU core writes the security level information of the CPU core, the security level information of the CPU core can be written into the register corresponding to the security level module corresponding to the CPU core. After writing, the security level module corresponding to the CPU core can obtain the security level information of the CPU core from the register.

[0250] Optionally, there is a one-to-one correspondence between the CPU cores and the security level configuration modules in the above-mentioned computer system, and each security level module is used to indicate the security level of the corresponding CPU core.

[0251] When each CPU core corresponds to a security level configuration module, the corresponding security level can be configured for each CPU core more flexibly.

[0252] Optionally, the security level configuration module corresponding to each CPU core in the above-mentioned computer system is arranged inside each CPU core.

[0253] When the security level configuration module corresponding to the CPU core is arranged inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.

[0254] Optionally, in the above computer system, there is a one-to-one correspondence between a CPU cluster and a security level configuration module, a CPU cluster includes multiple CPU cores, and each security level configuration module is used to indicate the security level of the multiple CPU cores in the corresponding CPU cluster.

[0255] Each CPU cluster may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster. When each CPU cluster corresponds to a security level configuration module, the number of security level configuration modules can be reduced, thereby simplifying the complexity of the computer system.

[0256] Optionally, the security level configuration module corresponding to each CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to each CPU cluster.

[0257] Optionally, the first subsystem includes a memory access checker, and the step 3002 specifically includes:

[0258] 3002b. Write memory security level classification information into the memory access checker.

[0259] By writing memory security level classification information into the memory access checker, the memory access checker can check and manage memory access according to the written memory security level classification information, thereby facilitating the subsequent implementation of memory isolation.

[0260] Optionally, the above step 3002 specifically includes:

[0261] 3002c. Write the security level information of the IO device into the security level configuration and detection module corresponding to the IO device. The security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device initiating the access request matches the security level of the IO device.

[0262] By writing the security level information of the IO device into the IO device through the partition manager, the security level of the IO device can be configured. At the same time, the security level configuration and detection module of the configured IO device can also check the security level of the device that initiates the access request, thereby realizing isolation between devices with different security levels.

[0263] Combine the following Fig. 9 The communication method of the embodiment of the present application is described in detail.

[0264] Fig. 9 It is a schematic flow chart of the communication method of an embodiment of the present application. Fig. 9 The communication method shown is applied to a computer system, which includes a first subsystem and a second subsystem. The operating system of the first subsystem is different from the operating system of the second subsystem. The CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip.

[0265] Fig. 9 The method shown includes steps 4001 and 4002, and these two steps are described in detail below.

[0266] 4001. Receive security level configuration information of a first subsystem and a second subsystem.

[0267] 4002. Configure the security levels of the first subsystem and the second subsystem according to the security level configuration information of the first subsystem and the second subsystem.

[0268] It should be understood that after step 4002, the security level of the CPU core of the first subsystem can be higher than the security level of the CPU core of the second subsystem, the security level of the IO device of the first subsystem can be higher than the security level of the IO device of the second subsystem, and the security level of the memory used by the first subsystem can be higher than the security level of the memory of the second subsystem.

[0269] In the present application, after receiving the security level configuration information of the first subsystem and the second subsystem, the security levels of the first system and the second subsystem can be configured according to the security level configuration information, thereby achieving security isolation of the first subsystem and the second subsystem, and minimizing the impact of abnormalities in the second subsystem on the normal operation of the first subsystem.

[0270] Optionally, the above step 4001 specifically includes:

[0271] 4001a. Receive security level information of each CPU core in the computer system.

[0272] After receiving the security level information of each CPU core, the configuration of the security level of each CPU core in the computer system is realized.

[0273] Optionally, there is a one-to-one correspondence between the CPU cores and the security level configuration modules in the above-mentioned computer system, and each security level module is used to indicate the security level of the corresponding CPU core.

[0274] When each CPU core corresponds to a security level configuration module, the corresponding security level can be configured for each CPU core more flexibly.

[0275] Optionally, the security level configuration module corresponding to each CPU core is located inside each CPU core.

[0276] When the security level configuration module corresponding to the CPU core is arranged inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.

[0277] Optionally, there is a one-to-one correspondence between the CPU clusters in the computer system and the security level configuration modules, and the security level configuration module is used to indicate the security levels of the multiple CPU cores in the corresponding CPU cluster.

[0278] Each CPU cluster may correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster. When each CPU cluster corresponds to a security level configuration module, the number of security level configuration modules can be reduced, thereby simplifying the complexity of the computer system.

[0279] Optionally, in the computer system, the security level configuration module corresponding to any CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to any CPU cluster.

[0280] Optionally, the above step 4001 specifically includes:

[0281] 4001b. Receive memory security level classification information, where the memory security level classification information is used to indicate the security level of memory in different address segments in the computer system.

[0282] By receiving memory security level division information, it is possible to configure the security level of memory in different address segments in a computer system.

[0283] Optionally, the above step 4001 specifically includes:

[0284] 4001c. Receive security level information of an IO device in the computer system, and detect the access request received by the IO device to determine whether the security level of the access device initiating the access request matches the security level of the IO device.

[0285] Optionally, Fig. 9 The method shown also includes:

[0286] 4003. Receive an interrupt request initiated by an interrupt initiator, where the interrupt request carries security level information of the interrupt initiator;

[0287] 4004. Determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator according to the configured security level information and the interrupt request, and allow the interrupt receiver to accept the interrupt request if the security level of the interrupt initiator matches the security level of the interrupt receiver.

[0288] In the present application, the interrupt request can be processed through the interrupt controller, so that the interrupt receiver accepts the interrupt request when the security level of the interrupt initiator matches the security level of the interrupt receiver, and isolation between the interrupt initiator and the interrupt receiver can be achieved while processing the interrupt request normally.

[0289] It should be understood that the security level information configured in the above step 4004 includes the security level information of the first subsystem and the second subsystem.

[0290] Optionally, the above step 4004 specifically includes:

[0291] 4004a, when both the interrupt initiator and the interrupt target device belong to the first subsystem, determining that the security level of the interrupt initiator matches the security level of the interrupt target device;

[0292] 4004b. When the interrupt initiator and the interrupt target device both belong to the second subsystem, determine whether the security level of the interrupt initiator matches the security level of the interrupt target device.

[0293] When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, thereby preventing high-security-level devices from receiving or processing interrupt requests initiated by low-security-level devices, thereby avoiding as much as possible the impact of abnormalities in security-level devices on high-security-level devices.

[0294] Optionally, when the security level of the memory access initiator is lower than the security level of the memory to be accessed by the memory access initiator, it is determined that the security level of the memory to be accessed by the memory access initiator does not match the security level of the memory access initiator.

[0295] Optionally, Fig. 9 The method shown also includes:

[0296] 4005. Receive a memory access request from a memory access initiator, where the memory access request carries a memory address to be accessed by the memory access initiator and security level information of the memory access initiator;

[0297] 4006. When the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, the memory access initiator is allowed to access the memory address to be accessed by the memory access initiator. The memory security level division information is used to indicate the security levels of different memory segments.

[0298] Optionally, the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

[0299] Since the initiator of memory access can only access memory with the same or lower security level, it can avoid devices with low security systems accessing memory with higher security levels as much as possible, and memory isolation can be achieved to a certain extent.

[0300] Combine the following Fig.10 The communication method of the embodiment of the present application is described in detail.

[0301] Fig.10 It is a schematic flow chart of the communication method of an embodiment of the present application. Fig.10 The communication method shown is applied to a computer system, which includes a first subsystem and a second subsystem. The operating system of the first subsystem is different from the operating system of the second subsystem. The CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip.

[0302] Fig.10 The method shown includes steps 5001 and 5002, and these two steps are described in detail below.

[0303] 5001. The IO device receives an access request from the access device.

[0304] The access request carries security level information of the access device, and the IO device is any IO device in the first subsystem or the second subsystem.

[0305] 5002. When the security level of the access device matches the security level of the IO device, the IO device allows the access device to access the IO device.

[0306] Furthermore, Fig.10 The method shown may further include step 5003 .

[0307] 5003. When the security level of the access device does not match the security level of the IO device, the IO device does not allow the access device to access the IO device.

[0308] Optionally, the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.

[0309] The computer system to which the communication method of the embodiment of the present application is applied may specifically be an autonomous driving system (or the computer system may also be considered to be located in the autonomous driving system). Fig.11 The specific structure of the autonomous driving system is introduced in detail.

[0310] Fig.11 It is a structural diagram of the autonomous driving system.

[0311] like Fig.11 As shown, the autonomous driving system can be divided into a high-safety operation subsystem and a low-safety operation subsystem in terms of software, wherein the ASIL of the high-safety operation subsystem is higher than the ASIL of the low-safety subsystem. For example, the ASIL of the high-safety subsystem may be ASIL-D, and the ASIL of the low-safety subsystem may be any one of QM, ASIL-A, ASIL-B and ASIL-C.

[0312] Among them, the first subsystem in the embodiment of the present application can be equivalent to Fig.11 The high-security operating system shown in the figure, the second subsystem can be equivalent to Fig.11 The second subsystem is shown.

[0313] Fig.11 The autonomous driving system shown can be divided into a hardware layer and a software layer. The hardware layer provides security attribute configuration, security detection, and security error reporting, and the software layer provides a partition manager for resource isolation and interrupt management based on the platform. The hardware layer and software layer are described in detail below.

[0314] Hardware layer:

[0315] Security configuration and detection logic is added to the hardware layer to detect whether the operating system software and device direct memory access (DMA) are legal. These security configuration and detection logics include the security level configuration of the CPU core, the security detection of memory access by the memory access checker, the security configuration and inspection of input and output (IO) devices, and the security inspection of interrupt configuration. The following is a detailed introduction to these security configuration and detection logics.

[0316] Security level configuration of the CPU core: used to configure the corresponding security level for the CPU core (the CPU core in the high-security subsystem is configured to a high security level, and the CPU core in the low-security subsystem is configured to a low security level). After the CPU core is configured with the corresponding security level, the signal sent by the CPU core can carry the corresponding security level information and be transmitted on the bus.

[0317] Specifically, when configuring the security level of the CPU core, it can be achieved by configuring the security level information for the security level configuration module corresponding to the CPU core.

[0318] Memory access checker: performs security checks on address accesses sent to memory DDR. Access is allowed only if the security level matches, otherwise it is denied.

[0319] Interrupt configuration security check: Check the security level of the interrupt to ensure that only CPUs with high security levels can operate high-security interrupt configurations, otherwise access is denied.

[0320] Security configuration and check of IO devices: used to configure the corresponding IO devices into different security levels. After completing the security level configuration, the address access issued by the IO device will carry a security level signal. In addition, the module can also perform security level checks on access requests to the current device initiated by other devices to confirm whether the security levels match.

[0321] Software layer:

[0322] The software layer mainly adds a partition manager for resource isolation and division and shared memory communication between different functional safety partitions. The partition manager mainly includes the following modules: isolation and division of CPU cores, isolation and division of memory resources, configuration of IO device security levels, isolation and configuration of interrupt resources, secure boot of multiple operating systems, and data communication based on shared memory. The following is a detailed introduction to the role of each module.

[0323] Isolation and division of safety cores: This module is used to divide the safety level of the CPU cores used by each operating system. Specifically, the CPUs used by the high-safety operating system and the low-safety operating system can be written in the configuration file and not shared with each other (a CPU core will not belong to both the high-safety system and the low-safety system). For example, during the system startup process, the CPU used by the high-safety operating system can be configured to lock-step mode with a functional safety level of ASIL-D, and the CPU used by the low-safety operating system can be configured to normal mode with a functional safety level of ASIL-B or QM level.

[0324] Isolation and division of memory resources: This module is used to divide the memory used by different operating systems and not share them with each other. High-security operating systems use ASIL-D level memory, and low-security operating systems use ASIL-B or QM level memory. In addition, the module can also write memory layout information (memory allocation information) to the memory access checker through registers.

[0325] IO device safety level configuration: used to configure the functional safety level of each IO device, such as ASIL-D, ASIL-B or QM level.

[0326] Isolation and configuration of interrupt resources: used to manage global shared and critical high-security interrupt configurations. It can also handle operation requests for high-interrupt configurations sent by low-security operating systems. If the request is legitimate, the operation is performed on behalf of the client, otherwise it is rejected.

[0327] Secure boot of multiple operating systems: This module is used to start operating systems with corresponding functional safety levels on high-security CPUs and low-security CPUs respectively.

[0328] Data communication between multiple operating systems: A shared memory is opened in the low-functional safety memory for data transmission between operating systems with different functional safety levels. After the data is placed in the shared memory, an interrupt is used to notify the other party to retrieve the data. The high-functional safety system will verify the legitimacy of the shared memory data sent by the low-functional safety system.

[0329] It should be understood that Fig.11 The security configuration and inspection of the security device in the embodiment can be specifically a security configuration and inspection module, and the security level configuration of the CPU core can be specifically a security level configuration module of the CPU core. The above-mentioned security configuration and inspection module, security level configuration module, interrupt controller and memory access checker can be integrated in the same chip (the chip is not shown in the figure).

[0330] Next, combine Fig.12 Describes the process of configuring the memory access checker for the partition manager.

[0331] Fig.12 A schematic diagram showing a partition manager configuring a memory access checker is shown. Fig.12 The process shown includes steps 6001 to 6003, which are described in detail below.

[0332] 6001. Get the memory configuration file.

[0333] Taking the ARM64 platform as an example, the above memory configuration file can be carried in the device tree source (DTS) file. The above memory configuration file can divide the memory address range used by subsystems of different security levels. For example, the above memory configuration file can include the following configuration information:

[0334]

[0335] The above configuration information indicates that the memory in the range of 0 to 0x40000000 is allocated to the subsystem with the ASIL-D safety level, and the memory in the range of 0x40000000 to 0x80000000 is allocated to the subsystem with the ASIL-B safety level.

[0336] 6002. Determine memory partition information according to a memory configuration file.

[0337] After obtaining the memory configuration file, the partition manager determines the memory partition information by parsing the memory configuration file.

[0338] 6003. Configure a memory access checker according to the memory partition information.

[0339] For example, by parsing the configuration information, the partition manager determines that the memory in the range of 0 to 0x40000000 is allocated to the subsystem with the ASIL-D safety level, and the memory in the range of 0x40000000 to 0x80000000 is allocated to the subsystem with the ASIL-B safety level. Next, the partition manager can configure the memory division to the memory access checker, so that the memory access checker can perform security checks on the memory address access initiated by each operating system or other IO device.

[0340] Specifically, when a low-security operating system wants to access the ASIL-D memory of a high-security operating system, the memory access checker will detect the security level mismatch, intercept the memory address access, and report a safety interrupt to notify the application software that a safety error of out-of-bounds access has occurred.

[0341] The above text combines with the accompanying drawings to introduce the communication method of the embodiment of the present application in detail. The following text combines with the accompanying drawings to describe the computer system and processing device of the embodiment of the present application. It should be understood that the computer system and processing device introduced below are capable of executing the corresponding steps of the communication method of the embodiment of the present application. When introducing the computer system and processing device of the embodiment of the present application below, repeated descriptions are appropriately omitted.

[0342] Fig.13 It is a schematic block diagram of a computer system according to an embodiment of the present application. Fig.13The computer system 8000 shown includes a first subsystem 8010 and a second subsystem 8020 , and the first subsystem 8010 includes a memory access checker 8011 .

[0343] The security level of the first subsystem 8010 is higher than the security level of the second subsystem 8020 , and the CPU core of the first subsystem 8010 , the CPU core of the second subsystem 8020 , and the memory access checker 8011 are integrated on the same chip.

[0344] The memory access checker 8011 is used to receive a memory access request from a memory access initiator, where the memory access request carries the memory address to be accessed by the memory access initiator and the security level information of the memory access initiator;

[0345] The memory access checker 8011 is also used to determine whether the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator based on pre-configured memory security level classification information, and to allow the memory access initiator to access the memory address when the security level of the memory address matches the security level of the memory access initiator, wherein the memory security level classification information is used to indicate the security levels of memories in different address segments in the computer system.

[0346] Optionally, the computer system 8000 further includes:

[0347] An IO device, used to receive an access request from an access device, wherein the access request carries security level information of the access device, wherein the IO device is any IO device in the first subsystem or the second subsystem;

[0348] The IO device is further configured to allow the access device to access the IO device when the security level of the access device matches the security level of the IO device.

[0349] Optionally, the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.

[0350] Optionally, the computer system 8000 further includes:

[0351] An interrupt controller, wherein the first subsystem and the second subsystem share the interrupt controller, the interrupt routing configuration information stored in the interrupt controller is configured by the CPU core of the first subsystem, and the interrupt routing configuration information is used to indicate the CPU core that responds to each interrupt

[0352] The interrupt controller is used to:

[0353] receiving an interrupt request from an interrupt initiator, wherein the interrupt request carries security level information of the interrupt initiator;

[0354] According to the configured security level information and the interrupt request, determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and allow the interrupt receiver to accept the interrupt request if the security level of the interrupt initiator matches the security level of the interrupt receiver.

[0355] Optionally, the matching of the security level of the interrupt initiator with the security level of the interrupt receiver includes:

[0356] The interrupt initiator and the interrupt receiver both belong to the first subsystem;

[0357] The interrupt initiator and the interrupt receiver both belong to the second subsystem; or,

[0358] The interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.

[0359] Optionally, the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including:

[0360] The security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

[0361] Optionally, the first subsystem further includes:

[0362] A partition manager, the partition manager is used to:

[0363] The security levels of the devices in the first subsystem and the second subsystem are configured according to the security level configuration file of the computer system, and the security level configuration file of the computer system is used to indicate the security levels of the devices in the first subsystem and the second subsystem and the memory used.

[0364] Optionally, the partition manager is used to:

[0365] The security level information of the CPU core of the computer system is written into the security level configuration module corresponding to the CPU core of the computer system, and the security level information of the CPU core of the computer system is used to indicate the security level of the CPU core of the computer system.

[0366] Optionally, the partition manager is used to write the memory security level division information into the memory access checker.

[0367] Optionally, the partition manager is used to:

[0368] The security level information of the IO device is written into the security level configuration and detection module corresponding to the IO device. The security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device initiating the access request matches the security level of the IO device, wherein the IO device is any IO device in the first subsystem or the second subsystem.

[0369] Optionally, the computer system further includes:

[0370] An initial startup module, used for starting the first CPU core of the first subsystem, so that the partition manager runs on the first CPU core of the first subsystem;

[0371] The partition manager is used to start other CPU cores of the first subsystem;

[0372] After the CPU core of the first subsystem is started, the partition manager is further used to start the CPU core of the second subsystem in sequence.

[0373] Optionally, it is characterized in that the memory of the second subsystem includes a shared memory, the shared memory is used to transmit data between the first subsystem and the second subsystem, the CPU core of the first subsystem is used to store the first communication data generated by the first subsystem into the shared memory, and initiate a first interrupt, so that the CPU core of the second subsystem reads the first communication data from the shared memory after receiving the first interrupt; or

[0374] The CPU core of the second subsystem is used to store the second communication data generated by the second subsystem into the shared memory and initiate a second interrupt so that the CPU core of the first subsystem reads the second communication data from the shared memory after receiving the second interrupt.

[0375] Fig.14 It is a schematic block diagram of a processing device according to an embodiment of the present application. Fig.14 The processing device 9000 shown includes a memory 9001 and a processor 9002 .

[0376] Fig.14 The processing device 9000 shown can be applied to a computer system, which includes a first subsystem and a second subsystem. The operating system of the first subsystem is different from the operating system of the second subsystem. The CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip, and the processing device is located in the first subsystem.

[0377] The memory 9001 is used to store programs. When the program stored in the memory 9001 is executed by the processor 9002, the processor 9002 is used to Figure 8 The various steps in the method shown.

[0378] Fig.15 It is a schematic block diagram of a processing device according to an embodiment of the present application. Fig.15 The processing device 10000 shown includes a memory 10001 and a processor 10002 .

[0379] Fig.15 The processing device 10000 shown can be applied to a computer system. The processing device 10000 is applied to a computer system. The computer system includes a first subsystem and a second subsystem. The operating system of the first subsystem is different from the operating system of the second subsystem. The CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the processing device 10000. The processing device 10000 is located in the first subsystem. The processing device 10000 includes:

[0380] A security level configuration module 10001 is used to receive security level configuration information of the first subsystem and the second subsystem;

[0381] The security level configuration module 10001 is further used to configure the security levels of the first subsystem and the second subsystem according to the received security level configuration file, and the security level of the memory used by the first subsystem is higher than the security level of the memory of the second subsystem.

[0382] The processing device 10000 may be a chip in a computer system.

[0383] Optionally, the security level configuration module 10001 is used to:

[0384] The security level information of each CPU core in the computer system is received to configure the security level of each CPU core in the computer system.

[0385] Optionally, the processing device further includes:

[0386] The memory access checker 10002 is used to receive memory security level classification information, and the memory security level classification information is used to indicate the security level of the memory in different address segments in the computer system.

[0387] Optionally, the processing device further includes:

[0388] The security level configuration and detection module 10003 is used to receive the security level information of the IO devices in the computer system;

[0389] The security level configuration and detection module 10003 is also used to detect the access request received by the IO device in the computer system to determine whether the security level of the access device initiating the access request matches the security level of the IO device in the computer system.

[0390] Optionally, the processing device further includes:

[0391] Interrupt controller 10004 is used to determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator based on the configured security level information and the interrupt request, and allow the interrupt receiver to accept the interrupt request if the security level of the interrupt initiator matches the security level of the interrupt receiver.

[0392] Optionally, the matching of the security level of the interrupt initiator with the security level of the interrupt receiver includes:

[0393] The interrupt initiator and the interrupt receiver both belong to the first subsystem;

[0394] The interrupt initiator and the interrupt receiver both belong to the second subsystem; or,

[0395] The interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.

[0396] Optionally, the security level configuration module 10001 is used to:

[0397] Receiving a memory access request from a memory access initiator, the memory access request carrying a memory address to be accessed by the memory access initiator and security level information of the memory access initiator;

[0398] When the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, the memory access initiator is allowed to access the memory address to be accessed by the memory access initiator, and the memory security level division information is used to indicate the security levels of different segments of memory.

[0399] Optionally, the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including:

[0400] The security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

[0401] Fig.16 It is a schematic block diagram of a processing device according to an embodiment of the present application. Fig.16 The processing device 11000 shown includes a receiver 11001 and a processor 11002 .

[0402] Fig.16 The processing device 11000 shown can be applied to a computer system, which includes a first subsystem and a second subsystem. The operating system of the first subsystem is different from the operating system of the second subsystem. The CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip. The processing device 11000 is located in the first subsystem.

[0403] The receiver 11001 and the processor 11002 in the processing device 11000 can be used to execute Fig.10 The various steps in the method shown.

[0404] The apparatus 11000 may be a device in a computer system, for example, an IO device.

[0405] In order to have a further understanding of the communication method and related devices of the embodiments of the present application, the relevant communication process is introduced in detail below using the autonomous driving system as an example.

[0406] like Fig.17 As shown in the figure, when designing the hardware of the autonomous driving system, the interrupt controller configuration can be divided into two parts. The core and shared interrupt configurations are designed to the ASIL-D level, and only the safety lock-step core can operate them. This also prevents the low-security operating system on the non-lock-step core from maliciously changing the interrupt when it fails, thereby avoiding the impact on the high-security operating system. The interrupt configuration includes enabling interrupts, disabling interrupts, and routing interrupts. If an ordinary CPU core (non-lock-step core) wants to operate the configuration, it must send the request to the lock-step core to let the lock-step core operate on its behalf. Per-Core configuration and some low-security configurations do not distinguish between security levels. Each CPU can operate, including the ordinary CPU where the low-security operating system is located, because the high-security operating system will not use this part of the configuration. Even if there is a problem with the low-security operating system, it will not affect the operation of the high-security operating system.

[0407] in, Fig.17GIC_STREAMBUS in it indicates the bus, GICD indicates the interrupt distributor (distrubitor), GICR indicates the interrupt redistributor (REdistrubitor), and ITS indicates the interrupt translation service components (ITS). DEVICE_ASILD indicates a device with a security level of ASILD, DEVICE_ASILB indicates a device with a security level of ASILB, DEVICE_QM indicates a device with a security level of QM, OS ASILD indicates an operating system with a security level of ASILD, and OS ASILB indicates an operating system with a security level of ASILB.

[0408] Combination of the above Fig.17 The interrupt configuration is introduced. Fig.18 Introduce the partition manager and interrupt handling process.

[0409] The partition manager is located in the high-security operating system. During system startup, it will call the interrupt controller driver according to the configuration of the high-security operating system configuration file to configure the globally shared ASIL-D resources, including the non-ASIL-D resources (configuration) used by the high-security operating system.

[0410] During the startup of the low-security operating system, the interrupt configuration file is parsed, and the operation of the ASIL-D interrupt configuration is bypassed. The operation of the ASIL-D interrupt is converted into an interrupt operation request for the high-security operating system, and the high-security operating system performs the operation on its behalf. After receiving the request, the high-security operating system will check whether the operation is legal. For example, if the interrupt number to be operated belongs to a device managed by the high-security operating system, the high-security operating system will reject it. This is because the devices managed by the two operating systems are independent and not shared. Similarly, the high-security operating system will also reject the initialized globally shared ASIL-D interrupt configuration, because it has been initialized by the partition management during the startup of the high-security operating system and does not need to be reinitialized. The above process is as follows. Fig.18 For performance reasons, a low-security operating system will reduce the interrupt configuration of ASIL-D at runtime.

[0411] The CPU used for isolation of the high-functional safety operating system is configured in advance in the configuration file. For example, for the ARM64 platform, its configuration file is DTS (Device Tree Source). The OS kernel can parse the DTS configuration file to know which CPUs to use and establish the CPU topology. During SMP boot, the partition manager notifies the BIOS or ATF (ARM64 platform) in turn according to the configuration file to configure the CPU to be started into a lock-step state or a normal state, and pull up the corresponding CPU to run. The process is as follows: Fig.19 shown.

[0412] After the local SMP of the high-security operating system is started, the partition manager will pull up the first core of the low-security operating system. After the first core of the low-security operating system is pulled up, it jumps into the internal kernel entry address of the low-security operating system and then initializes it. The CPUs used by the low-security operating system are also divided in advance in the configuration file. The low-security operating system pulls up the CPUs allocated to it in turn according to the CPU division in its own configuration file. Because it is a low-security operating system, it does not need to configure the CPU belonging to it to lock-step state.

[0413] Combine the following Fig. 20 The process of shared communication between different subsystems is introduced in detail.

[0414] like Fig. 20 As shown in the figure, the memory can be divided into different functional safety areas, such as ASIL-D and ASIL-B. Different functional safety OS use different levels of memory areas, such as high safety OS uses ASIL-D memory, and low functional safety OS uses ASIL-B memory. When the two share memory communication, a section of memory is opened in the low functional safety memory area, so that both OS can read and write access to the area. Let's explain it separately below. Fig. 20 The functions of each module are shown.

[0415] IRQ Notifier / Handler: After one OS puts data in the shared memory, it calls IRQ Notifier to notify another OS to get the data from the shared memory. After receiving the interrupt, the other OS enters the IRQ Handler, checks in the Handler which shared memory the data needs to be taken from, and notifies the target app to get the data.

[0416] Driver hmem driver: This driver provides the function of allocating shared memory areas and gives the mapped memory to user mode for use.

[0417] Interface 1 is Libshmem, which is an encapsulation interface provided to the upper user state. It completes the operation of shared memory through interfaces such as open and mmap.

[0418] When the Guest OS runs on the low-security OS through the Hypervisor, the Guest OS provides a shmem FE driver for communicating with the low-security Host OS. This driver communicates with the shemem BE driver to complete the Guest OS's reading and writing of shared memory.

[0419] Shmem FE driver: Shared memory front-end program, which provides the address mapping function of Stage 1 of the Guest OS itself and connects with the back-end driver of the Host OS Shmem BE driver.

[0420] Shmem BE driver: shared memory backend program, handles the exit of shared memory frontend program, calls libshmem to complete the mapping of Stage2, and calls IRQ Notifier to notify the other OS to receive data; when receiving data from the other OS, the shared memory backend program injects an interrupt to the Guest OS. After receiving the injected interrupt, the shared memory frontend program notifies the corresponding App in the Guest to read the data.

[0421] End-to-end (E2E): End-to-end protection. When data is transmitted from a high-security operating system to a low-security operating system, the integrity and correctness of the data are verified through CRC.

[0422] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0423] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0424] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0425] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0426] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0427] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0428] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: The method is applied to a computer system, the computer system comprising a first subsystem and a second subsystem, the security level of the first subsystem being higher than the security level of the second subsystem; The first subsystem includes a memory access checker, wherein a CPU core of the first subsystem, a CPU core of the second subsystem, and the memory access checker are integrated on the same chip, and the method includes: The memory access checker receives a memory access request from a memory access initiator, wherein the memory access request carries a memory address to be accessed by the memory access initiator and security level information of the memory access initiator; The memory access checker determines whether the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator according to pre-configured memory security level classification information, and allows the memory access initiator to access the memory address when the security level of the memory address matches the security level of the memory access initiator, wherein the memory security level classification information is used to indicate the security levels of memories of different address segments in the computer system; The computer system further includes an interrupt controller, the first subsystem and the second subsystem share the interrupt controller, the interrupt routing configuration information stored in the interrupt controller is configured by the CPU core of the first subsystem, and the interrupt routing configuration information is used to indicate the CPU core that responds to each interrupt, and the method further includes: The interrupt controller receives an interrupt request from an interrupt initiator, wherein the interrupt request carries security level information of the interrupt initiator; The interrupt controller determines whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator based on the configured security level information and the interrupt request, and allows the interrupt receiver to accept the interrupt request if the security level of the interrupt initiator matches the security level of the interrupt receiver.

2. The method according to claim 1, characterized in that The method further comprises: The IO device receives an access request from an access device, the access request carrying security level information of the access device, wherein the IO device is any IO device in the first subsystem or the second subsystem; When the security level of the access device matches the security level of the IO device, the IO device allows the access device to access the IO device.

3. The method according to claim 2, characterized in that The security level of the access device matches the security level of the IO device, including: The security level of the access device is greater than or equal to the security level of the IO device.

4. The method according to any one of claims 1 to 3, characterized in that The security level of the interrupt initiator matches the security level of the interrupt receiver, including: The interrupt initiator and the interrupt receiver both belong to the first subsystem; The interrupt initiator and the interrupt receiver both belong to the second subsystem; or, The interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.

5. The method according to any one of claims 1 to 4, characterized in that The security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: The security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

6. The method according to any one of claims 1 to 5, characterized in that The first subsystem includes a partition manager, and the method further includes: The partition manager configures security levels for devices in the first subsystem and the second subsystem according to a security level configuration file of the computer system, where the security level configuration file of the computer system is used to indicate security levels of devices in the first subsystem and the second subsystem and memory used.

7. The method according to claim 6, characterized in that The partition manager configures the security level for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: The partition manager writes the security level information of the CPU core of the computer system into the security level configuration module corresponding to the CPU core of the computer system, where the security level information of the CPU core of the computer system is used to indicate the security level of the CPU core of the computer system.

8. The method according to claim 6 or 7, characterized in that The partition manager configures the security level for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: The partition manager writes the memory security level division information into the memory access checker.

9. The method according to any one of claims 6 to 8, characterized in that The partition manager configures the security level for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: The partition manager writes the security level information of the IO device into the security level configuration and detection module corresponding to the IO device. The security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device initiating the access request matches the security level of the IO device, wherein the IO device is any IO device in the first subsystem or the second subsystem.

10. The method according to any one of claims 6 to 9, characterized in that The method further comprises: Starting a first CPU core of the first subsystem so that the partition manager runs on the first CPU core of the first subsystem; The partition manager starts other CPU cores of the first subsystem; After completing the startup of the CPU core of the first subsystem, the partition manager sequentially starts the CPU core of the second subsystem.

11. The method according to any one of claims 1 to 10, characterized in that The memory of the second subsystem includes a shared memory, and the shared memory is used to transmit data between the first subsystem and the second subsystem. The method further includes: The CPU core of the first subsystem stores the first communication data generated by the first subsystem into the shared memory, and initiates a first interrupt, so that the CPU core of the second subsystem reads the first communication data from the shared memory after receiving the first interrupt; or The CPU core of the second subsystem stores the second communication data generated by the second subsystem into the shared memory and initiates a second interrupt, so that the CPU core of the first subsystem reads the second communication data from the shared memory after receiving the second interrupt.

12. A computer system, characterized in that: include: a first subsystem, the first subsystem comprising a memory access checker; a second subsystem, wherein the security level of the first subsystem is higher than the security level of the second subsystem, and the CPU core of the first subsystem, the CPU core of the second subsystem and the memory access checker are integrated on the same chip in the computer system; The memory access checker is used to receive a memory access request from a memory access initiator, wherein the memory access request carries a memory address to be accessed by the memory access initiator and security level information of the memory access initiator; The memory access checker is further used to determine whether the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator according to pre-configured memory security level classification information, and to allow the memory access initiator to access the memory address when the security level of the memory address matches the security level of the memory access initiator, wherein the memory security level classification information is used to indicate the security levels of memories of different address segments in the computer system; An interrupt controller, wherein the first subsystem and the second subsystem share the interrupt controller, the interrupt routing configuration information stored in the interrupt controller is configured by the CPU core of the first subsystem, and the interrupt routing configuration information is used to indicate the CPU core that responds to each interrupt The interrupt controller is used to: receiving an interrupt request from an interrupt initiator, wherein the interrupt request carries security level information of the interrupt initiator; According to the configured security level information and the interrupt request, determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and allow the interrupt receiver to accept the interrupt request if the security level of the interrupt initiator matches the security level of the interrupt receiver.

13. The computer system of claim 12, wherein: The computer system further comprises: An IO device, used to receive an access request from an access device, wherein the access request carries security level information of the access device, wherein the IO device is any IO device in the first subsystem or the second subsystem; The IO device is further configured to allow the access device to access the IO device when the security level of the access device matches the security level of the IO device.

14. The computer system of claim 13, wherein: The security level of the access device matches the security level of the IO device, including: The security level of the access device is greater than or equal to the security level of the IO device.

15. The computer system according to any one of claims 12 to 14, characterized in that: The security level of the interrupt initiator matches the security level of the interrupt receiver, including: The interrupt initiator and the interrupt receiver both belong to the first subsystem; The interrupt initiator and the interrupt receiver both belong to the second subsystem; or, The interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.

16. The computer system according to any one of claims 12 to 15, characterized in that: The security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: The security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.

17. The computer system according to any one of claims 12 to 16, characterized in that: The first subsystem includes a partition manager, and the partition manager is used to: The security levels of the devices in the first subsystem and the second subsystem are configured according to the security level configuration file of the computer system, and the security level configuration file of the computer system is used to indicate the security levels of the devices in the first subsystem and the second subsystem and the memory used.

18. The computer system of claim 17, wherein: The partition manager is used to: The security level information of the CPU core of the computer system is written into the security level configuration module corresponding to the CPU core of the computer system, and the security level information of the CPU core of the computer system is used to indicate the security level of the CPU core of the computer system.

19. The computer system according to claim 17 or 18, characterized in that: The partition manager is used to write the memory security level division information into the memory access checker.

20. The computer system according to any one of claims 17 to 19, characterized in that: The partition manager is used to: The security level information of the IO device is written into the security level configuration and detection module corresponding to the IO device. The security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device initiating the access request matches the security level of the IO device, wherein the IO device is any IO device in the first subsystem or the second subsystem.

21. The computer system according to any one of claims 17 to 20, characterized in that: The computer system further comprises: An initial startup module, used for starting the first CPU core of the first subsystem, so that the partition manager runs on the first CPU core of the first subsystem; The partition manager is used to start other CPU cores of the first subsystem; After the CPU core of the first subsystem is started, the partition manager is further used to start the CPU core of the second subsystem in sequence.

22. The computer system according to any one of claims 12 to 21, characterized in that: The memory of the second subsystem includes a shared memory, and the shared memory is used to transmit data between the first subsystem and the second subsystem. The CPU core of the first subsystem is used to store the first communication data generated by the first subsystem into the shared memory, and initiate a first interrupt, so that the CPU core of the second subsystem reads the first communication data from the shared memory after receiving the first interrupt; or The CPU core of the second subsystem is used to store the second communication data generated by the second subsystem into the shared memory and initiate a second interrupt so that the CPU core of the first subsystem reads the second communication data from the shared memory after receiving the second interrupt.

Images