Vehicle-mounted system based on multiple operating systems and control method thereof

Abstract

This application provides a vehicle-mounted system based on multiple operating systems and its control method. The vehicle-mounted system includes: at least one application operating system and a security monitoring operating system, wherein the application operating system and the security monitoring operating system employ different kernels of the same processor; wherein the application operating system is used to run non-security applications; and the security monitoring operating system is communicatively connected to the application operating system and is used to run security monitoring services to perform security monitoring on the application operating system.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to a vehicle system based on multiple operating systems and its control method. Background Technology

[0002] Currently, in-vehicle infotainment systems are becoming increasingly popular. These systems not only include Android entertainment functions, car navigation, and reversing camera functions, but also security monitoring functions such as system safety monitoring.

[0003] However, existing in-vehicle systems are typically based on the Android operating system kernel, implementing their security monitoring functions through a single application. Android is a massive system running numerous applications, and this complexity and size present numerous security vulnerabilities. A malfunction in one application can cause the entire system to crash. Therefore, its security monitoring function is affected by malfunctions in other Android applications, resulting in ineffective security monitoring and low system security. Summary of the Invention

[0004] The main technical problem addressed in this application is to provide a vehicle-mounted system based on multiple operating systems and its control method, so as to improve the effectiveness of safety monitoring and enhance the safety performance of the vehicle-mounted system.

[0005] To address the aforementioned technical problems, this application provides a vehicle-mounted system based on multiple operating systems. This multi-operating system includes: at least one application operating system and a security monitoring operating system, wherein the application operating system and the security monitoring operating system employ different kernels of the same processor; wherein the application operating system is used to run non-security applications; and the security monitoring operating system is communicatively connected to the application operating system and is used to run security monitoring services to perform security monitoring on the application operating system.

[0006] To address the aforementioned technical problems, this application provides a control method for a vehicle-mounted system based on multiple operating systems. The vehicle-mounted system includes at least one application operating system and a safety monitoring operating system. The application operating system includes a second operating system, which uses a different kernel from the safety monitoring operating system on the same processor. The second operating system is used to run fast-start applications. The control method further includes: configuring the kernels for the second operating system and the safety monitoring operating system; receiving a power-on startup command, loading the image file of the safety monitoring operating system into the vehicle-mounted system's runtime memory, and starting the kernel corresponding to the safety monitoring operating system to complete the startup of the safety monitoring operating system and its safety monitoring services; loading the kernel of the second operating system into the runtime memory, and starting the kernel corresponding to the second operating system to complete the sequential loading of the second operating system's driver, the startup of services dependent on the fast-start applications, and the startup of the fast-start applications.

[0007] Compared with existing technologies, the beneficial effects of this application are as follows: This application's multi-operating system-based vehicle system includes at least one application operating system and a security monitoring operating system, wherein the application operating system and the security monitoring operating system employ different kernels of the same processor; wherein, the application operating system is used to run non-security applications; the security monitoring operating system is communicatively connected to the application operating system and is used to perform security monitoring on the application operating system. This application's vehicle system utilizes the security monitoring operating system to achieve security monitoring of the application operating system, and uses different kernels of the same processor to implement the security monitoring operating system and the application operating system respectively, thereby achieving isolation between the two. This avoids the problem of the security monitoring application failing to operate normally due to application malfunctions in the application operating system, thus improving the effectiveness of security monitoring and enhancing the security performance of the vehicle system. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of the structure of an embodiment of the multi-operating system in-vehicle system of this application;

[0009] Figure 2 This is a schematic diagram of the kernel partitioning of the vehicle system in this application;

[0010] Figure 3 This is a schematic diagram of the startup process of the vehicle-mounted system of this application;

[0011] Figure 4 This is another structural diagram of the vehicle system kernel partitioning in this application;

[0012] Figure 5 This is another schematic diagram of the startup process of the vehicle-mounted system in this application;

[0013] Figure 6 This is a schematic diagram of the communication process between different kernels of the multi-operating system in the vehicle system of this application;

[0014] Figure 7 This is a schematic diagram of the workflow of the safety monitoring operating system in the multi-operating system of this application;

[0015] Figure 8 This is a flowchart illustrating an embodiment of the control method for a multi-operating system vehicle system according to this application;

[0016] Figure 9 This is a schematic diagram of the communication process between different kernels in the control method of the multi-operating system vehicle system of this application;

[0017] Figure 10 This is a schematic diagram of the workflow of the safety monitoring operating system in the control method of the vehicle system based on multiple operating systems in this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0019] This application first proposes a vehicle-mounted system based on multiple operating systems, such as... Figure 1 As shown, Figure 1 This is a schematic diagram of the structure of an embodiment of the multi-operating system in-vehicle system of this application. The in-vehicle system of this embodiment includes: at least one application operating system and a security monitoring operating system 12. The application operating system and the security monitoring operating system 12 use different kernels of the same processor, that is, they use kernel 1 and kernel 2 (and kernel 3) respectively. The application operating system is used to run non-security applications. The security monitoring operating system 12 is communicatively connected to the application operating system and is used to run security monitoring services to perform security monitoring on the application operating system.

[0020] The vehicle system in this embodiment uses a security monitoring operating system 12 to monitor the application operating system. Different kernels of the same processor are used to implement the security monitoring operating system 12 and the application operating system respectively to achieve isolation between the two. This can avoid the problem that the security monitoring application cannot run properly due to abnormal application operation in the application operating system. Therefore, it can improve the effectiveness of security monitoring and improve the security performance of the vehicle system.

[0021] The kernel 2 used to run the security monitoring operating system 12 can be one or more kernels (two or more) from the same processor. The security monitoring operating system 12 is primarily used to run a security monitoring application, i.e., a security monitoring service, to monitor the running status of the application's operating system.

[0022] Among them, kernel 1 (and kernel 3) used to run the application operating system, that is, kernel 1 (and kernel 3) used by the application operating system can be one or more (two or more) other kernels of the same processor.

[0023] In this embodiment, the application operating system includes a first operating system 11 and a second operating system 13. The first operating system 11 can be an Android operating system, which mainly includes: (a) a kernel layer, whose driver modules include all device drivers on the system-on-a-chip (SOC) except for the video (VEDIO) device driver, such as graphics processing unit (GPU), data processing unit (DPU), and other module drivers (including eMMC, I2C, WIFI, USB, etc.); (b) a service layer, whose services include all running services, such as OpenGLES, CarmeraSource, Surfaceflinger, and other running services (such as Storage Service, WIFI Service, Audio Service); and (c) an application layer, whose applications include VEDIOPlayer, Music Play, 3rd Patry APP, etc.

[0024] For a detailed introduction to the Android operating system, please refer to existing technologies; this document does not impose specific limitations. In other embodiments, the application operating system can also be other insecure multi-application systems, etc.

[0025] It should be noted that the multiple (two or more) kernels in this application can be homogeneous or heterogeneous, without any specific limitation.

[0026] Optionally, the second operating system 13 in this embodiment may be a Linux operating system, which uses a different kernel of the same processor as the first operating system and the security monitoring operating system 12. The Linux operating system uses kernel 3, and the Android operating system uses kernel 1. That is, the Linux operating system, the Android operating system and the security monitoring operating system 12 each use an independent kernel in the same processor.

[0027] The Linux operating system is used to run the quick-start application; the Linux operating system only sets the resource items that the quick-start application depends on, in order to simplify the Linux operating system 13 and shorten the startup time of the quick-start application.

[0028] The security monitoring operating system 12 communicates with both the Android and Linux operating systems, and is used to perform security monitoring on the Android operating system and the Linux operating system, respectively.

[0029] The kernel used to run the Linux operating system can be one or more (two or more) other kernels of the same processor.

[0030] Quick-start applications are those that require rapid startup, such as Around View Monitor (AVM) applications, reversing applications in smart cockpits, in-vehicle instrument clusters, and Dealer Management Systems (DMS) applications.

[0031] The following description uses the Linux operating system as an example to illustrate running an AVM application.

[0032] AVM applications rely on three important hardware modules: GPU, DPU, and VEDIO IN. The GPU accelerates image processing, corresponding to the Android Kernel's GPU driver and the Android Service's OpenGLES interface; the DPU is the display module, corresponding to the Android Kernel's DPU driver and the Android Service's Surfacefingler interface; and VEDIO IN is the camera image acquisition module, corresponding to the Android Kernel's VEDIOIN driver and the Android Service's CameraSource interface.

[0033] AVM is a Java application written in the Android application layer. It obtains camera image data captured by the VEDIO IN module through the CameraSource interface, uses the GPU hardware module to perform image data distortion correction and stitching through the algorithm, and finally displays it on the screen through Surfaceflinger.

[0034] The existing in-vehicle systems, such as the AVM system mentioned above, have the following problems:

[0035] (1) Components such as the Camerasource interface, Surfaceflinger service, and OpenGLES library must be loaded into the Android main file system before they can work. The AVM APP can only be started after the entire Android system has started up and entered the main interface. Therefore, in traditional in-vehicle systems, the process of obtaining the AVM image during a cold start of the car is very slow, generally taking more than 20 seconds.

[0036] (2) The Android system is a large application system with many services running. The complex and large system has many security issues. For example, if one of the services runs abnormally, it may cause the entire system to crash, and the AVM application will also be affected. Therefore, the AVM function is affected by the Android system and has low security.

[0037] In this embodiment, the vehicle system separates the AVM function and runs it independently on a Linux operating system, which can achieve the effect of fast AVM startup and safe operation.

[0038] Furthermore, the Linux operating system in this embodiment is custom-tailored, comprising only: (a) the Linux Kernel layer, mainly including the GPU, DPU, and VEDIO device drivers that AVM depends on; (b) the Linux Service layer, mainly including OpenGLES, CarmeraSource, Surfaceflinger, and Safety Service that AVM depends on; and (c) the Linux application layer, which runs only one AVM application. This simplified Linux operating system can further accelerate the startup of AVM.

[0039] The SOC integrates multiple kernels, such as 4 or 8 kernels. This embodiment makes full use of the resource advantages of multi-core systems to run 3 operating systems on the SOC: the first operating system 11 runs on a portion of the kernels, the security monitoring operating system 12 runs on a portion of the kernels, and the second operating system 13 runs on the remaining kernels.

[0040] Furthermore, both the first operating system 11 and the second operating system 13 in this embodiment require the two resource modules, GPU and DPU. Software virtualization technology (Hypervisor) can be used to enable the first operating system 11 and the second operating system 13 to jointly access these two resource modules.

[0041] As can be seen from the above analysis, the vehicle system further includes a SOC, which has multiple physical kernels, and allocates at least one physical kernel to the first operating system 11, the security monitoring operating system 12 and the second operating system 13 respectively.

[0042] Specifically, such as Figure 2 As shown, the SOC allocates physical kernels to the first operating system 11, the security monitoring operating system 12, and the second operating system 13 during runtime. For example, the SOC has four physical kernels Core[0]-Core[3]. Core[0] is allocated to the security monitoring operating system 13; Core[1] is allocated to the second operating system; and Core[2] and Core[3] are allocated to the first operating system 11.

[0043] Optionally, such as Figure 3As shown, the vehicle system is powered on and starts up, running the bootloader to initialize the hardware devices. The SOC allocates different physical kernels to the first operating system 11, the security monitoring operating system 12, and the second operating system 13. The bootloader loads the image file of the security monitoring operating system 12 into the running memory, starts the kernel corresponding to the security monitoring operating system 12, and completes the startup of the security monitoring operating system 12 and its security monitoring services.

[0044] The bootloader loads the min kernel into the running memory and starts the kernel corresponding to the Linux operating system. After the Linux kernel completes driver loading, it starts the CarmeraSource, SurfaceFlinger, and OpenGL ES services that AVM depends on, and finally starts the AVM application.

[0045] The bootloader loads the Android Kernel into RAM and starts the corresponding kernel for the Android operating system. After the Android Kernel finishes loading the drivers, it starts all Android services. Finally, after the Android services have started, the Android application is launched.

[0046] Furthermore, to quickly launch the AVM application, a larger number of physical kernels can be allocated to the second operating system 13 during the AVM application startup phase. After the AVM application has started, the physical kernels are then released to the first operating system 11. In this embodiment, configuring a larger number of physical kernels for the second operating system 13 during the AVM application startup phase ensures rapid startup of the AVM application. After the AVM application has started, some of the physical kernels allocated to the second operating system 13 are released to other application operating systems in the vehicle system, such as the first operating system 11, to ensure the running speed of other application operating systems and the rational utilization of resources.

[0047] In another embodiment, kernels can also be allocated to the first operating system 11, the security monitoring operating system 12, and the second operating system 13 using software virtualization (Hypervisor) technology. The vehicle system of this embodiment further includes a kernel virtualization system 14 (such as...). Figure 4 As shown), its general implementation involves designing a software layer at the processor's EL2 (Exception Level). The kernel virtualization system 14 uses Hypervisor technology to virtualize the physical kernel into multiple virtual kernels, with the SOC allocating at least one virtual kernel to the first operating system 11, the security monitoring operating system 12, and the second operating system 13.

[0048] Specifically, such as Figure 4 As shown, the kernel virtualization system 14 uses Hypervisor technology to virtualize the physical kernel Core[0]-Core[3] into multiple virtual kernels VCore[0]-VCore[5]. VCore[0] is assigned to the security monitoring operating system 12; VCore[0] and VCore[2] are assigned to the second operating system 13; and VCore[3], VCore[4] and VCore[5] are assigned to the first operating system 11.

[0049] Optionally, such as Figure 5 As shown, the system powers on and starts up, runs the bootloader, initializes hardware devices, loads the Hypervisor image file into the running memory, and after the Hypervisor starts successfully, it virtualizes multiple virtual kernels; the Hypervisor loads the security monitoring operating system 12 image file into the running memory, starts the kernel corresponding to the security monitoring operating system 12, and completes the startup of the security monitoring operating system 12 and its security monitoring services.

[0050] The hypervisor loads the min kernel into runtime memory and starts the corresponding Linux operating system kernel. After the Linux kernel completes driver loading, it starts the CarmeraSource, SurfaceFlinger, and OpenGL ES services that AVM depends on, and finally starts the AVM application.

[0051] The hypervisor loads the Android Kernel into RAM and starts the corresponding Android operating system kernel. After the Android Kernel finishes loading the drivers, it starts all Android services. Finally, after the Android services have started, it starts the Android application.

[0052] In another embodiment, it can also be combined with Figure 2 The physical partitioning method of the embodiment and Figure 4 The virtual partitioning method in this embodiment involves allocating kernels to a first operating system, a security monitoring operating system, and a second operating system.

[0053] Specifically, the SOC has multiple physical kernels. The kernel virtualization system virtualizes some of the physical kernels into multiple virtual kernels. The SOC allocates at least one virtual kernel to the first operating system and the second operating system, and allocates at least one physical kernel to the security monitoring operating system.

[0054] In other embodiments, a physical kernel may be allocated for the first operating system and / or the second operating system, and a virtual kernel may be allocated for the security monitoring operating system.

[0055] The vehicle system in this embodiment also includes memory.

[0056] Optionally, the vehicle system in this embodiment can also enable communication between different kernels, specifically, such as... Figure 6 As shown, this embodiment implements communication between different kernels based on interrupts and shared memory. Assuming there are n kernels in the SOC, taking Core[0] sending a message to Core[n-1] as an example:

[0057] Core[0] writes a message to the predefined shared memory data_A[]. Core[0] writes an interrupt, and the controller triggers Core[n-1] to receive the interrupt. Core[n-1] receives the interrupt, enters the interrupt handler, and reads the message from the shared memory data_A[].

[0058] Optionally, such as Figure 7 As shown, this embodiment uses the following method to monitor the motion status of the first operating system 11 and the second operating system 13 by the security monitoring operating system 12: The Safety Service running on the second operating system 13 and the first operating system 11 will send messages at fixed intervals through inter-process communication (IPC) to inform the Safety Monitoring Service Safety Monitor running on the security monitoring operating system 12. The message type can be defined by the user, and two types of messages can be defined: "alive" and "fatal".

[0059] If the Safety Monitor receives "alive", it assumes the operating system sending the message is running normally, takes no action, and continues listening for messages. If the Safety Monitor receives "fatal", it assumes the operating system sending the message has encountered a fatal error and needs to be restarted to restore normal operation. If the Safety Monitor does not receive any messages from the operating system within the specified time, it assumes the operating system that did not send messages has encountered a fatal error and needs to be restarted to restore normal operation.

[0060] Furthermore, Safety Monitor can also monitor its own operating status through a watchdog, such as sending a feeding signal to the Watchdog's Register at fixed intervals. If Safety Monitor malfunctions and fails to feed the watchdog in time, the safety monitoring operating system 12 will restart to restore normal operation.

[0061] This application further proposes a control method for an in-vehicle system based on multiple operating systems, such as... Figure 8 As shown, Figure 8This is a flowchart illustrating an embodiment of the control method for a multi-operating system-based vehicle system according to this application. The control method of this embodiment can be used in the aforementioned multi-operating system-based vehicle system, and specifically includes the following steps:

[0062] Step S81: Configure the kernel for the second operating system and the security monitoring operating system.

[0063] The in-vehicle system also includes at least one application operating system and a safety monitoring operating system. The application operating system includes a second operating system, and the SOC configures the kernel for both the second operating system and the safety monitoring operating system. The SOC configures the kernel for the second operating system, and the second operating system and the safety monitoring operating system reside on different kernels of the processor. The second operating system is used to run fast-start applications; specifically, the second operating system only configures the resource items that the fast-start applications depend on, in order to simplify the Linux operating system and shorten the startup time of the fast-start applications.

[0064] Quick-start applications are those that need to be launched quickly, such as AVM applications, reversing applications in smart cockpits, in-vehicle instrument applications, and in-vehicle DMS applications.

[0065] Furthermore, the application operating system may also include a first operating system. The SOC configures the kernels for the first operating system, the second operating system, and the security monitoring operating system, respectively.

[0066] During SOC runtime, at least one physical kernel is allocated to the first operating system, the security monitoring operating system, and the second operating system; or during SOC runtime, the physical kernel of the SOC is virtualized into multiple virtual kernels through the kernel virtualization system using Hypervisor technology, and the SOC allocates at least one virtual kernel to the first operating system, the security monitoring operating system, and the second operating system; or, through the kernel virtualization system using Hypervisor technology, part of the physical kernel of the SOC is virtualized into multiple virtual kernels, and the SOC allocates at least one virtual kernel to the first operating system and the second operating system, and allocates at least one unvirtualized physical kernel to the security monitoring operating system.

[0067] In other embodiments, the SOC may also allocate a physical kernel for the first operating system and / or the second operating system, and a virtual kernel for the security monitoring operating system.

[0068] In this embodiment, the second operating system can be a Linux operating system, and the first operating system can be an Android operating system; in other embodiments, the first operating system can also be other insecure multi-application systems, etc.

[0069] Step S82: Upon receiving the power-on startup command, load the image file of the security monitoring operating system into the running memory of the control system, and start the kernel corresponding to the security monitoring operating system to complete the startup of the security monitoring operating system and its security monitoring services.

[0070] Step S83: Load the kernel of the second operating system into the running memory and start the kernel corresponding to the second operating system to run, and sequentially complete the loading of the second operating system's driver, the startup of the services that the quick-start application depends on, and the startup of the quick-start application.

[0071] Furthermore, the control method of this embodiment also includes step S84.

[0072] Step S84: Load the kernel of the first operating system into the running memory and start the kernel corresponding to the first operating system to run, and complete the driver loading, service startup and application startup of the first operating system in sequence.

[0073] The vehicle system in this embodiment utilizes a security monitoring operating system to monitor the application operating system. Different kernels of the same processor are used to implement the security monitoring operating system and the application operating system respectively, so as to achieve isolation between the two. This can avoid the problem that the security monitoring application cannot run properly due to abnormal application operation in the application operating system. Therefore, it can improve the effectiveness of security monitoring and improve the security performance of the vehicle system.

[0074] This embodiment separates the quick-start application and runs it independently in a Linux operating system, which can achieve the effect of fast application startup and safe operation.

[0075] In other embodiments, the execution order of steps S82 to S84 is not limited.

[0076] In one application scenario, after the SOC allocates physical kernels for the Android operating system, the security monitoring operating system, and the Linux operating system, the vehicle system powers on and starts up, running the bootloader to initialize the hardware devices. The SOC allocates different physical kernels for the Android operating system, the security monitoring operating system, and the Linux operating system respectively. The bootloader loads the image file of the security monitoring operating system into the running memory, starts the kernel corresponding to the security monitoring operating system, and completes the startup of the security monitoring operating system and its security monitoring services.

[0077] The bootloader loads the min kernel into the running memory and starts the kernel corresponding to the Linux operating system. After the Linux kernel completes driver loading, it starts the CarmeraSource, SurfaceFlinger, and OpenGL ES services that AVM depends on, and finally starts the AVM application.

[0078] The bootloader loads the Android Kernel into RAM and starts the corresponding kernel for the Android operating system. After the Android Kernel finishes loading the drivers, it starts all Android services. Finally, after the Android services have started, the Android application is launched.

[0079] In another application scenario, after the SOC allocates virtual kernels for the Android operating system, the security monitoring operating system, and the Linux operating system, the system powers on and starts up, runs the bootloader, initializes the hardware devices, loads the Hypervisor image file into the running memory, and after the Hypervisor starts successfully, it virtualizes multiple virtual kernels; the Hypervisor loads the security monitoring operating system image file into the running memory, starts the kernel corresponding to the security monitoring operating system, and completes the startup of the security monitoring operating system and its security monitoring services.

[0080] The hypervisor loads the min kernel into runtime memory and starts the corresponding Linux operating system kernel. After the Linux kernel completes driver loading, it starts the CarmeraSource, SurfaceFlinger, and OpenGL ES services that AVM depends on, and finally starts the AVM application.

[0081] The hypervisor loads the Android Kernel into RAM and starts the corresponding Android operating system kernel. After the Android Kernel finishes loading the drivers, it starts all Android services. Finally, after the Android services have started, it starts the Android application.

[0082] Furthermore, to quickly launch the fast-start application, the SOC allocates a preset number of kernels to the second operating system, and releases some kernels to the first operating system after the second operating system has started. This preset number is greater than the number of kernels required for the second operating system to run the fast-start application. This embodiment configures a larger number of physical kernels for the second operating system during the AVM application startup phase, ensuring fast AVM application startup. After the AVM application starts, some of the physical kernels allocated to the second operating system are released to other application operating systems in the vehicle system, such as the first operating system, to ensure the running speed of other application operating systems and the rational utilization of resources.

[0083] Optionally, the control method of this application can also realize communication between different cores. The processor (SOC) has a first core and a second core, corresponding to the application operating system and the security monitoring system, respectively. The control method of this embodiment realizes communication between different cores based on interrupts and shared memory. Specifically, this communication method includes, as follows: Figure 9 Steps S91 to S93 are shown.

[0084] Step S91: The application operating system writes a message to the shared memory.

[0085] The first kernel writes a message to shared memory.

[0086] Step S92: Apply the operating system write interrupt to trigger the security monitoring system to receive the interrupt.

[0087] The first kernel writes an interrupt to trigger the second kernel to receive the interrupt.

[0088] Step S93: After receiving the interrupt, the security monitoring operating system enters the interrupt handler and reads the message from the shared memory.

[0089] After receiving the interrupt, the second kernel enters the interrupt handler and reads the message from shared memory.

[0090] Assuming there are n cores in the SOC, let's take Core[0] sending a message to Core[n-1] as an example:

[0091] Core[0] writes a message to the predefined shared memory data_A[]. Core[0] writes an interrupt, and the controller triggers Core[n-1] to receive the interrupt. Core[n-1] receives the interrupt, enters the interrupt handler, and reads the message from the shared memory data_A[].

[0092] It should be noted that the kernels of the different operating systems mentioned above can communicate with each other using the above method.

[0093] Optionally, the control method of this application can also realize the security monitoring of the application operating system by the security monitoring operating system. Specifically, it can be achieved through, for example... Figure 10 The method shown in this embodiment includes steps S101 to S103.

[0094] Step S101: The application operating system sends a message to the security monitoring operating system.

[0095] The Safety Service running on the application's operating system sends messages at fixed intervals via inter-process communication (IPC) to inform the Safety Monitor service running on the security monitoring operating system. The message type is user-defined, and two message types can be defined: "alive" and "fatal".

[0096] Step S102: The security monitoring operation determines the running status of the application operating system based on the message or the waiting time for receiving messages.

[0097] If the Safety Monitor receives "alive", it assumes the application's operating system is running normally and takes no action, continuing to listen for messages. If the Safety Monitor receives "fatal", it assumes the application's operating system has encountered a fatal error and needs to be restarted to restore normal operation. If the Safety Monitor does not receive any messages from the application's operating system within the specified time, it assumes the application's operating system has encountered a fatal error and needs to be restarted to restore normal operation.

[0098] Step S103: If the running status is abnormal, the security monitoring operating system restarts the application operating system.

[0099] If the application's operating system malfunctions, the security monitoring system will restart the application's operating system.

[0100] The security monitoring operating system communicates with both the Android and Linux operating systems, and the above method can be used to achieve security monitoring of the Android and Linux operating systems.

[0101] Furthermore, Safety Monitor can also monitor its own operating status through a watchdog, such as sending a feed signal to the watchdog's register at fixed intervals. If Safety Monitor malfunctions and fails to feed the watchdog in time, it can restart the safety monitoring operating system to restore normal operation.

[0102] For a description of each of the above operating systems, please refer to the above embodiments; they will not be repeated here.

[0103] Unlike existing technologies, this application's multi-operating system for vehicle systems includes: at least one application operating system and a security monitoring operating system, both using different kernels of the same processor; wherein, the application operating system is used to run non-security applications; and the security monitoring operating system is communicatively connected to the application operating system for security monitoring of the application operating system. This application's vehicle system utilizes the security monitoring operating system to achieve security monitoring of the application operating system, and employs different kernels of the same processor to implement the security monitoring operating system and the application operating system separately, thus achieving isolation between the two. This avoids the problem of security monitoring applications failing to function properly due to application malfunctions in the application operating system, thereby improving the effectiveness of security monitoring and enhancing the security performance of the vehicle system.

[0104] This application proposes to run the AVM application independently in a system, allocating the multi-core SOC to the kernels required by the security monitoring operating system, the kernels required by the second operating system, and the kernels required by the first operating system. The AVM application runs on the second operating system, the Android application runs on the first operating system, and Safety Monitor runs on the security monitoring operating system to monitor the running status of the second and first operating systems and handle abnormal recovery, achieving the effects of fast startup (AVM startup and display can be completed in about 3 seconds) and safe operation.

[0105] This application places the AVM application in the second operating system because the second operating system only needs to support the AVM application, which can be very streamlined to achieve fast startup. Compared with the complex and large first operating system, the streamlined second operating system runs fewer services and has a single application, so it is more stable and secure. Moreover, the first and second operating systems are isolated, so any abnormalities in the operation of the first operating system will not affect the second operating system.

[0106] The system architecture and method proposed in this application are not only applicable to scenarios involving rapid startup and safe operation of AVM, but also to other module scenarios, such as rapid startup in reverse in a smart cockpit, rapid startup of in-vehicle instrument panel, and rapid startup of in-vehicle DMS system.

[0107] The above description is merely an embodiment of this application and does not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A vehicle-mounted system based on multiple operating systems, characterized in that, include: At least one application operating system and a security monitoring operating system, wherein the application operating system and the security monitoring operating system use different kernels of the same processor; The application operating system is used to run insecure applications; The security monitoring operating system is communicatively connected to the application operating system and is used to run security monitoring services to perform security monitoring on the application operating system. The application operating system includes a second operating system, which uses a different kernel from the security monitoring operating system of the processor. The second operating system is a Linux operating system and is used to run the fast-start application. The second operating system is only configured to load the resource items that the fast-start application depends on. The security monitoring operating system is communicatively connected to the second operating system and is used to perform security monitoring on the second operating system.

2. The vehicle-mounted system according to claim 1, characterized in that, The application operating system also includes a first operating system, which is communicatively connected to the security monitoring operating system. The security monitoring operating system is also used to perform security monitoring on the first operating system.

3. The vehicle-mounted system according to claim 2, characterized in that, The vehicle system further includes a system-on-a-chip (SoC), which has multiple physical kernels and allocates at least one of the physical kernels to the first operating system, the security monitoring operating system, and the second operating system, respectively.

4. The vehicle-mounted system according to claim 2, characterized in that, The vehicle system further includes a system-on-a-chip and a kernel virtualization system. The system-on-a-chip is provided with a physical kernel. The kernel virtualization system virtualizes at least a portion of the physical kernel into multiple virtual kernels. The system-on-a-chip allocates at least one virtual kernel and / or at least one physical kernel to the first operating system, the security monitoring operating system, and the second operating system, respectively.

5. A control method for a vehicle-mounted system based on a multi-operating system, characterized in that, The vehicle-mounted system includes at least one application operating system and a security monitoring operating system. The application operating system includes a second operating system, which uses the same processor but a different kernel as the security monitoring operating system. The second operating system is a Linux operating system, and it is used to run fast-start applications. The control method includes: Configure the kernel for the second operating system and the security monitoring operating system; Upon receiving the power-on startup command, the image file of the safety monitoring operating system is loaded into the running memory of the vehicle system, and the kernel corresponding to the safety monitoring operating system is started to complete the startup of the safety monitoring operating system and its safety monitoring services. The kernel of the second operating system is loaded into the running memory, and the kernel corresponding to the second operating system is started to run. The driver loading of the second operating system, the startup of the services that the quick-start application depends on, and the startup of the quick-start application are completed in sequence.

6. The control method according to claim 5, characterized in that, The application operating system further includes a first operating system, which uses a different kernel from the security monitoring operating system and the second operating system of the processor. The control method further includes: Configure the kernel for the first operating system; The kernel of the first operating system is loaded into the running memory, and the kernel corresponding to the first operating system is started to run, thereby completing the driver loading, service startup, and application startup of the first operating system in sequence.

7. The control method according to claim 6, characterized in that, Configuring the kernel for the first operating system, the second operating system, and the security monitoring operating system includes: Each of the security monitoring operating system, the second operating system, and the first operating system is allocated at least one physical kernel; or Virtualize at least a portion of the physical kernel into multiple virtual kernels; Each of the security monitoring operating system, the second operating system, and the first operating system is allocated at least one virtual kernel and / or at least one physical kernel.

8. The control method according to claim 6, characterized in that, Configure the kernel for the second operating system, including: Allocate a preset number of kernels to the second operating system; The control method further includes: after the second operating system has started up, releasing a portion of the kernel to the first operating system.

9. The control method according to claim 5, characterized in that, The control method further includes: The application's operating system writes messages to shared memory; The application operating system writes an interrupt, triggering the security monitoring operating system to receive the interrupt; Upon receiving the interrupt, the security monitoring operating system enters the interrupt handler and reads the message from the shared memory.

10. The control method according to claim 5, characterized in that, Further includes: The application operating system sends a message to the security monitoring operating system; The security monitoring operation determines the running status of the application operating system based on the message or the waiting time for receiving the message; If the running status is abnormal, the security monitoring operating system will restart the application operating system.

Images