Dual-system implementation method based on imx8qm

Abstract

This invention discloses a dual-system implementation method based on imx8qm, comprising the following steps: Step 1, after the imx8qm chip powers on, resources are partitioned in the SCU firmware, and the partitioned resources are allocated to two Domains, where Domain 0 is used for the entertainment system and Domain 1 is used for the LCD instrument system; Step 2, access permissions for memory and resources are set for each Domain in the SCU firmware, and resources within each Domain can access each other. When an unrecoverable abnormal error is detected, the Domain is restarted individually; Step 3, the interrupt controller is shared, and the GIC in the SCU is configured to perform write operations at the privileged level of EL3 in aarch64. All write operations call the ATF program running in aarch64 EL3 through SMC instructions; Step 4, communication between the two Domains is achieved through interrupts and shared memory, realizing a dual-system based on imx8qm. Through the technical solution provided by this invention, systems with different security level requirements can be integrated onto a single chip, achieving resource reuse while maintaining mutual isolation.

Description

Technical Field

[0001] This invention relates to embedded virtualization technology, specifically a dual-system implementation method based on imx8qm. Background Technology

[0002] With the development of the automotive industry, LCD instrument panels have become increasingly common, and entertainment systems have become more sophisticated, leading to increasingly complex interactions between these two systems. LCD instrument panels often have higher security requirements than in-vehicle entertainment systems, but the latter are far more complex. Traditional design methods separate these two systems, using a simple, low-computing-power platform to ensure the stability and reliability of the LCD instrument panel, and a high-performance computing platform to ensure the flexibility and versatility of the entertainment system. This significantly increases costs and reduces system flexibility. Virtualization technology allows for the deployment of multiple systems on a single chip, achieving isolation and non-interference between systems, and flexible resource allocation. This allows the LCD instrument panel and entertainment system to be placed on a single chip. Using a purely software-based virtualization solution incurs additional system overhead, and virtualizing complex peripherals (such as GPUs, USB, and audio) is often challenging. NXP's imx8qm is a high-performance chip for the automotive field, supporting virtualization technologies in hardware, such as hardware isolation, resource allocation, and dual GPUs. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a dual-system implementation method based on imx8qm, comprising the following steps:

[0004] Step 1: After the IMX8QM chip powers on and starts up, the resources are divided in the SCU firmware and allocated to two Domains, with Domain 0 used for the entertainment system and Domain 1 used for the LCD instrument system.

[0005] Step 2: Configure access permissions for memory and resources for each Domain in the SCU firmware. Resources within each Domain can access each other. When an unrecoverable abnormal error is detected, restart the Domain individually.

[0006] Step 3: Interrupt controller sharing. In the SCU, the GIC is configured to perform write operations at the EL3 privilege level of the aarch64. All write operations are performed by calling the ATF program running in the aarch64 EL3 through the SMC instruction.

[0007] Step four: The two domains communicate with each other via interrupts and shared memory to achieve a dual system based on imx8qm.

[0008] Furthermore, after the iimx8qm chip powers on, resource allocation is performed in the SCU firmware, including:

[0009] The CPU cores are divided into 6 high-performance CPUs in the iMX8QM. The two most powerful A72 cores are assigned to the entertainment system, and the four less powerful A53 cores are assigned to the LCD instrument system.

[0010] The memory is partitioned, and memory is allocated to the entertainment system and the LCD instrument system according to the set size;

[0011] Peripheral allocation: The imx8qm has two GPUs and two DPs. The two GPUs and two DPs are assigned to the entertainment system and the LCD instrument system, respectively, and other peripherals are assigned to the entertainment system.

[0012] Furthermore, the allocation of the divided resources to two Domains, where Domain0 is used for the entertainment system and Domain1 is used for the LCD instrument system, includes the following steps:

[0013] S1, calls sc_rm_partition_alloc to create Domain0 and Domain1;

[0014] S2, call sc_rm_assign_resource and sc_rm_assign_pad to divide the above resources into different Domains;

[0015] S3 calls sc_rm_memreg_frag and sc_rm_assign_memreg to allocate memory resources to different domains.

[0016] Furthermore, the aforementioned setting access permissions for memory and resources for each Domain in the SCU firmware, allowing resources within each Domain to access each other, and individually restarting the Domain when an unrecoverable abnormal error is detected, includes:

[0017] Resources within each Domain can access each other but cannot access resources in other Domains. If cross-Domain access is required, call sc_rm_set_peripheral_permissions and sc_rm_set_memreg_permissions to set resource and memory attributes.

[0018] Each Domain can call sc_pm_reboot_partition to restart all resources within the Domain individually; resources not belonging to this Domain are not affected.

[0019] When an unrecoverable error is detected, the domain can be restarted independently without affecting other domains.

[0020] Furthermore, regarding the shared interrupt controller, the GIC in the SCU is configured to perform write operations at the EL3 privilege level of the Aarch64. All write operations are initiated by calling the ATF program running in the Aarch64 EL3 via SMC instructions, including:

[0021] In the SCU, the GIC is configured to perform write operations at the EL3 privilege level of aarch64. After this setting, the operating system running on aarch64 EL1 cannot perform write operations on the GIC. All write operations are implemented by calling the ATF program running on aarch64 EL3 through SMC instructions. The GIC is managed uniformly by the ATF to avoid conflicts caused by two domains operating on the GIC at the same time.

[0022] Furthermore, the two domains communicate via interrupts and shared memory to implement a dual-system based on imx8qm, including:

[0023] Domains pre-agree on specific memory addresses for communication: Domain0 uses ipc_mem0, and Domain1 uses ipc_mem1. In the SCU, ipc_mem0 and ipc_mem1 are configured to be readable and writable by both Domain0 and Domain1. When Domain0 wants to communicate with Domain1, it first copies the message to ipc_mem1. Domain0 then uses software to configure the GIC, generating an SGI interrupt on Domain1's CPU. Upon receiving the SGI interrupt, Domain1 retrieves the message from the agreed-upon memory location ipc_mem1. Domain1 sends messages to Domain0 (see references b, c, and d).

[0024] Deploy the Android system and related apps on Domain0, and deploy the QNX system and related applications on Domain1.

[0025] Furthermore, configuring the GIC in the SCU to perform write operations at the EL3 privilege level of aarch64 includes: calling the API sc_rm_set_peripheral_permissions provided by the imx8qm SCU system to set the resource SC_R_GIC attribute to SC_RM_PERM_NSPRIV_R.

[0026] Furthermore, setting ipc_mem0 and ipc_mem1 in the SCU to be readable and writable by both Domain0 and Domain1 includes: calling sc_rm_set_memreg_permissions to set the memory attribute to SC_RM_PERM_FULL.

[0027] Furthermore, the aforementioned dual-system based on imx8qm includes a Linux system and a QNX system.

[0028] A dual-system implementation device based on imx8qm, which applies the aforementioned dual-system implementation method based on imx8qm.

[0029] The beneficial effects of this invention are: it can integrate systems with different security level requirements onto a single chip, achieving resource reuse while maintaining mutual isolation. This effectively reduces hardware costs and improves system stability. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating a dual-system implementation method based on imx8qm.

[0031] Figure 2 This is a diagram illustrating the allocation of system resources.

[0032] Figure 3 A schematic diagram illustrating the implementation of interrupt allocation isolation. Detailed Implementation

[0033] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following description.

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention; that is, the described embodiments are only some embodiments of the invention, and not all embodiments. The components of the embodiments of the invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0035] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention. It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0036] Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0037] The features and performance of the present invention will be further described in detail below with reference to embodiments.

[0038] like Figure 1 As shown, a dual-system implementation method based on imx8qm includes the following steps:

[0039] Step 1: After the IMX8QM chip powers on and starts up, the resources are divided in the SCU firmware and allocated to two Domains, with Domain 0 used for the entertainment system and Domain 1 used for the LCD instrument system.

[0040] Step 2: Configure access permissions for memory and resources for each Domain in the SCU firmware. Resources within each Domain can access each other. When an unrecoverable abnormal error is detected, restart the Domain individually.

[0041] Step 3: Interrupt controller sharing. In the SCU, the GIC is configured to perform write operations at the EL3 privilege level of the aarch64. All write operations are performed by calling the ATF program running in the aarch64 EL3 through the SMC instruction.

[0042] Step four: The two domains communicate with each other via interrupts and shared memory to achieve a dual system based on imx8qm.

[0043] After the iimx8qm chip powers on, resource allocation is performed in the SCU firmware, including:

[0044] The CPU cores are divided into 6 high-performance CPUs in the iMX8QM. The two most powerful A72 cores are assigned to the entertainment system, and the four less powerful A53 cores are assigned to the LCD instrument system.

[0045] The memory is partitioned, and memory is allocated to the entertainment system and the LCD instrument system according to the set size;

[0046] Peripheral allocation: The imx8qm has two GPUs and two DPs. The two GPUs and two DPs are assigned to the entertainment system and the LCD instrument system, respectively, and other peripherals are assigned to the entertainment system.

[0047] The process of allocating the allocated resources to two Domains, with Domain 0 used for the entertainment system and Domain 1 used for the LCD instrument system, includes the following steps:

[0048] S1, calls sc_rm_partition_alloc to create Domain0 and Domain1;

[0049] S2, call sc_rm_assign_resource and sc_rm_assign_pad to divide the above resources into different Domains;

[0050] S3 calls sc_rm_memreg_frag and sc_rm_assign_memreg to allocate memory resources to different domains.

[0051] The aforementioned configuration of access permissions for memory and resources for each Domain in the SCU firmware, enabling resource access within each Domain to other, and individually restarting a Domain when an unrecoverable exception is detected, includes:

[0052] Resources within each Domain can access each other but cannot access resources in other Domains. If cross-Domain access is required, call sc_rm_set_peripheral_permissions and sc_rm_set_memreg_permissions to set resource and memory attributes.

[0053] Each Domain can call sc_pm_reboot_partition to restart all resources within the Domain individually; resources not belonging to this Domain are not affected.

[0054] When an unrecoverable error is detected, the domain can be restarted independently without affecting other domains.

[0055] The aforementioned interrupt controller sharing involves configuring the GIC in the SCU to perform write operations at the EL3 privilege level of the Aarch64. All write operations are initiated by calling the ATF program running in the Aarch64 EL3 via SMC instructions, including:

[0056] In the SCU, the GIC is configured to perform write operations at the EL3 privilege level of aarch64. After this setting, the operating system running on aarch64 EL1 cannot perform write operations on the GIC. All write operations are implemented by calling the ATF program running on aarch64 EL3 through SMC instructions. The GIC is managed uniformly by the ATF to avoid conflicts caused by two domains operating on the GIC at the same time.

[0057] The two domains communicate via interrupts and shared memory, enabling a dual-system based on imx8qm, including:

[0058] Domains pre-agree on specific memory addresses for communication: Domain0 uses ipc_mem0, and Domain1 uses ipc_mem1. In the SCU, ipc_mem0 and ipc_mem1 are set to be readable and writable by both Domain0 and Domain1. When Domain0 wants to communicate with Domain1, the message is first copied to ipc_mem1.

[0059] a. Domain0 sets up the GIC via software, generating an SGI interrupt on the CPU of Domain1;

[0060] b. After Domain1 receives the SGI interrupt, it retrieves the message from the agreed-upon memory location ipc_mem1;

[0061] c. Domain1 sends a message to Domain0 (see b, c, d);

[0062] Deploy the Android system and related apps on Domain0, and deploy the QNX system and related applications on Domain1.

[0063] The method of configuring the GIC in the SCU to perform write operations at the EL3 privilege level of aarch64 includes: calling the API sc_rm_set_peripheral_permissions provided by the imx8qm SCU system to set the resource SC_R_GIC attribute to SC_RM_PERM_NSPRIV_R.

[0064] The method of setting ipc_mem0 and ipc_mem1 in the SCU to be readable and writable by both Domain0 and Domain1 includes: calling sc_rm_set_memreg_permissions to set the memory attribute to SC_RM_PERM_FULL.

[0065] The aforementioned dual-system based on imx8qm includes a Linux system and a QNX system.

[0066] A dual-system implementation device based on imx8qm, which applies the aforementioned dual-system implementation method based on imx8qm.

[0067] Specifically, in order to more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below:

[0068] A72 / A53: A CPU with an Aarch64 architecture; the IMX8QM has 4 A53 cores and 2 A72 cores.

[0069] MEM: Memory

[0070] GPU: Graphics Processing Unit

[0071] DP: Display Processing Unit (DP)

[0072] USB: Universal Serial Bus

[0073] CSI: Camera Serial Interface

[0074] BT: Bluetooth

[0075] WI-FI: Wireless Fidelity

[0076] LINUX: An open-source operating system

[0077] QNX: A microkernel operating system widely used in the automotive field.

[0078] Domain: The domain in which resources are partitioned

[0079] EL0 / EL1 / EL2 / EL3: Four privileged modes of aarch64

[0080] ATF:ARM Trusted firmware

[0081] OS: Operating System. The operating systems used in this article include Linux / QNX.

[0082] sc_rm_partition_alloc: An NXP API function used to create Domains

[0083] The sc_rm_assign_resource: NXP API function is used to allocate peripheral resources to a specific domain.

[0084] The sc_rm_assign_pad NXP API function is used to assign a specified pad to a specific domain.

[0085] sc_rm_memreg_frag: An NXP API function used to create memory regions.

[0086] The sc_rm_assign_memreg NXP API function is used to allocate a specific memory region into a domain.

[0087] sc_rm_set_peripheral_permissions: An NXP API function used for peripheral access permissions.

[0088] The sc_rm_set_memreg_permissions function is an NXP API function used to set memory access permissions.

[0089] sc_pm_reboot_partition: An NXP API function used to restart resources within a domain;

[0090] ipc_mem0 and ipc_mem0: A memory segment used for communication between Domains, created by sc_rm_memreg_frag.

[0091] After the IMX8QM chip powers on, resources are allocated in the SCU firmware. In this scheme, resources are allocated to two domains: Domain 0 for the entertainment system and Domain 1 for the LCD instrument cluster system. The main resource allocation scheme is as follows: Figure 2 As shown.

[0092] CPU: The iMX8QM has 6 high-performance CPUs. The two most powerful A72 CPUs are assigned to the entertainment system, and the four less powerful A53 CPUs are assigned to the LCD instrument panel system.

[0093] Memory: The system has a total of 4GB of memory, with 3GB allocated to the entertainment system and 1GB allocated to the LCD instrument panel system;

[0094] Peripherals: The iMX8QM has two GPUs and two DisplayPorts, which are assigned to the entertainment system and the LCD instrument system respectively. Most other peripherals, such as USB, CSI, BT, and WIFI, are assigned to the entertainment system.

[0095] a. Call sc_rm_partition_alloc to create Domain0 and Domain1.

[0096] b. Use sc_rm_assign_resource and sc_rm_assign_pad to allocate the above resources to different domains.

[0097] c. Call sc_rm_memreg_frag and sc_rm_assign_memreg to allocate memory resources to different domains.

[0098] Configure the memory and resource access permissions for each Domain in the SCU firmware to ensure that an error in one Domain will not affect other Domains.

[0099] a. Resources within each Domain can access each other (e.g., the two A72 CPUs in Domain0 can access GPU0, which also belongs to Domain0), but cannot access resources in other Domains (e.g., the A72 CPU in Domain0 cannot access GPU1 in Domain1; if forced to access, an error will occur).

[0100] b. If cross-Domain access to resources is required, sc_rm_set_peripheral_permissions and sc_rm_set_memreg_permissions need to be called to set resource and memory attributes. For example, if communication between two Domains requires the use of shared memory, sc_rm_set_memreg_permissions needs to be called to set the specified memory attribute to SC_RM_PERM_FULL so that the two Domains can access this memory at the same time.

[0101] c. Each Domain can call sc_pm_reboot_partition to restart all resources within the Domain independently; resources not belonging to this Domain are unaffected. When an unrecoverable exception error is detected, the Domain can be restarted independently without affecting other Domains.

[0102] Interrupt Controller (GIC) Sharing. Unlike other resources that can be arbitrarily split across two domains, the imx8qm only has one interrupt controller. This invention employs a unique approach, combining the resource access permission mechanism provided by imx8qm with the characteristics of the aarch64 architecture to achieve GIC sharing. First, the GIC is configured in the SCU to only allow write operations at the EL3 privilege level of aarch64 (by calling the imx8qm SCU-provided API sc_rm_set_peripheral_permissions, setting the resource SC_R_GIC attribute to SC_RM_PERM_NSPRIV_R). After this configuration, the operating system (QNX / Linux) running on aarch64 EL1 cannot perform write operations on the GIC; all write operations must be implemented through SMC instructions calling the ATF program running on aarch64 EL3. The GIC is centrally managed by the ATF, preventing conflicts caused by simultaneous operations on the GIC by two domains. OS write operations on the GIC are as follows... Figure 3 As shown

[0103] Communication between the two domains is achieved through interrupts and shared memory.

[0104] a. Domains pre-agree on specific memory addresses for communication. Domain0 uses ipc_mem0, and Domain1 uses ipc_mem1. In the SCU, ipc_mem0 and ipc_mem1 are set to be readable and writable by both Domain0 and Domain1 (by calling sc_rm_set_memreg_permissions to set the memory attribute to SC_RM_PERM_FULL).

[0105] b. When Domain0 wants to communicate with Domain1, it first copies the message to ipc_mem1;

[0106] c. Domain0 sets up the GIC via software to generate an SGI interrupt on the CPU of Domain1;

[0107] d. After receiving the SGI interrupt, Domain1 retrieves the message from the agreed-upon memory location ipc_mem1;

[0108] e. Domain1 sends a message to Domain0 (see b, c, d);

[0109] Deploy the Android system and related apps on Domain0, and deploy the QNX system and related applications on Domain1.

[0110] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A dual-system implementation method based on imx8qm, characterized in that, Includes the following steps: Step 1: After the IMX8QM chip powers on and starts up, the resources are divided in the SCU firmware and allocated to two Domains, with Domain 0 used for the entertainment system and Domain 1 used for the LCD instrument system. Step 2: Configure access permissions for memory and resources for each Domain in the SCU firmware. Resources within each Domain can access each other. When an unrecoverable abnormal error is detected, restart the Domain individually. Step 3: Interrupt controller sharing. In the SCU, the GIC is configured to perform write operations at the EL3 privilege level of the Aarch64. All write operations are performed by calling the ATF program running in the Aarch64 EL3 via SMC instructions, including: In the SCU, the GIC is configured to perform write operations at the EL3 privilege level of aarch64. After this setting, the operating system running on aarch64 EL1 cannot perform write operations on the GIC. All write operations are implemented by calling the ATF program running on aarch64 EL3 through SMC instructions. The GIC is managed uniformly by ATF to avoid conflicts caused by two domains operating on the GIC at the same time. Step four: Communication between the two domains is achieved through interrupts and shared memory, realizing a dual system based on imx8qm; The aforementioned configuration of access permissions for memory and resources for each Domain in the SCU firmware, enabling resource access within each Domain to other, and individually restarting a Domain when an unrecoverable exception is detected, includes: Resources within each Domain can access each other but cannot access resources in other Domains. If cross-Domain access is required, call sc_rm_set_peripheral_permissions and sc_rm_set_memreg_permissions to set resource and memory attributes. Each Domain calls sc_pm_reboot_partition to restart all resources within the Domain individually; resources not belonging to this Domain are unaffected. The two domains communicate via interrupts and shared memory, enabling a dual-system based on imx8qm, including: a. Domains pre-agree on specific memory addresses for communication. Domain0 uses ipc_mem0, and Domain1 uses ipc_mem1. In the SCU, ipc_mem0 and ipc_mem1 are set to be readable and writable by both Domain0 and Domain1 (by calling sc_rm_set_memreg_permissions to set the memory attribute to SC_RM_PERM_FULL). b. When Domain0 wants to communicate with Domain1, it first copies the message to ipc_mem1; c. Domain0 sets up the GIC via software to generate an SGI interrupt on the CPU of Domain1; d. After receiving the SGI interrupt, Domain1 retrieves the message from the agreed-upon memory location ipc_mem1; e. Domain1 sends a message to Domain0 (see b, c, d); Deploy the Android system and related apps on Domain0, and deploy the QNX system and related applications on Domain1.

2. The dual-system implementation method based on imx8qm according to claim 1, characterized in that, After the imx8qm chip powers on, resource allocation is performed in the SCU firmware, including: The CPU cores are divided into 6 high-performance CPUs in the iMX8QM. The two most powerful A72 cores are assigned to the entertainment system, and the four less powerful A53 cores are assigned to the LCD instrument system. The memory is partitioned, and memory is allocated to the entertainment system and the LCD instrument system according to the set size; Peripheral allocation: The imx8qm has two GPUs and two DPs. The two GPUs and two DPs are assigned to the entertainment system and the LCD instrument system, respectively, and other peripherals are assigned to the entertainment system.

3. The dual-system implementation method based on imx8qm according to claim 1, characterized in that, The process of allocating the allocated resources to two Domains, with Domain 0 used for the entertainment system and Domain 1 used for the LCD instrument system, includes the following steps: S1 calls sc_rm_partition_alloc to create Domain0 and Domain1; S2, call sc_rm_assign_resource and sc_rm_assign_pad to divide the above resources into different Domains; S3 calls sc_rm_memreg_frag and sc_rm_assign_memreg to allocate memory resources to different domains.

4. The dual-system implementation method based on imx8qm according to claim 3, characterized in that, When an unrecoverable error is detected, the domain is restarted independently without affecting other domains.

5. The dual-system implementation method based on imx8qm according to claim 1, characterized in that, The method of configuring the GIC in the SCU to perform write operations at the EL3 privilege level of aarch64 includes: calling the API sc_rm_set_peripheral_permissions provided by the imx8qm SCU system to set the resource SC_R_GIC attribute to SC_RM_PERM_NSPRIV_R.

6. The dual-system implementation method based on imx8qm according to claim 1, characterized in that, The method of setting ipc_mem0 and ipc_mem1 in SCU to be readable and writable by both Domain0 and Domain1 includes: calling sc_rm_set_memreg_permissions to set the memory attribute to SC_RM_PERM_FULL.

7. The dual-system implementation method based on imx8qm according to claim 1, characterized in that, The aforementioned dual-system based on imx8qm includes a Linux system and a QNX system.

8. A dual-system implementation device for imx8qm, characterized in that, The dual-system implementation method based on imx8qm as described in any one of claims 1-7 is applied.

Images