Integrated circuit, integrated circuit system and communication method

Abstract

The invention discloses an integrated circuit, an integrated circuit system and a communication method, and relates to the technical field of integrated circuits, the integrated circuit comprises a first function module, a second function module, an interconnection module and a first isolation module; the first function module and the second function module are in communication connection through the interconnection module; the first isolation module is arranged on a communication link between the first function module and the interconnection module. The second function module is configured to send a first message to the first function module; and the first isolation module is configured to control the transmission of the first message based on the corresponding relationship between the first message and the first preset protocol. According to the scheme provided by the invention, the first isolation module can perform transmission control on the first message, so that the first function module does not receive the first message which does not correspond to the first preset protocol, the first function module is prevented from being stuck, security isolation of different function modules is well realized, and the reliability of the integrated circuit is improved.

Description

[0001] This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on May 31, 2024, with application number 202410702680.5 and invention name “An integrated circuit, an integrated circuit system and a communication method”, all contents of which are incorporated by reference in this application. Technical Field

[0002] The present disclosure relates to the technical field of integrated circuits, and in particular to an integrated circuit, an integrated circuit system, and a communication method. Background Art

[0003] With the continuous progress and development of smart cars, smart cars usually integrate a series of operating systems with rich business functions, such as: intelligent driving systems, smart cockpit systems, in-vehicle infotainment systems and safety island systems.

[0004] Currently, multiple operating systems can run in an integrated circuit. For example, an integrated circuit can include multiple sub-integrated circuits, each of which can serve as a functional module. In this way, the integrated circuit can include multiple functional modules, each of which can run an operating system.

[0005] When multiple operating systems are running at the same time, data interaction will occur between different functional modules of the integrated circuit. When one functional module sends abnormal data to another functional module, the functional module that receives the abnormal data will enter a stuck state due to its inability to process the abnormal data, thereby reducing the operating reliability of the integrated circuit. Summary of the invention

[0006] Embodiments of the present disclosure provide an integrated circuit, an integrated circuit system, and a communication method, which can improve the operational reliability of the integrated circuit.

[0007] In a first aspect of the present disclosure, an integrated circuit is provided, comprising: a first functional module, a second functional module, an interconnection module, and a first isolation module; the first functional module and the second functional module are communicatively connected via the interconnection module; the first isolation module is arranged on a communication link between the first functional module and the interconnection module. The first isolation module is used to determine whether the first functional module and the second functional module communicate according to a preset protocol.

[0008] For example, the second functional module is configured to send a first message to the first functional module; the first isolation module is configured to control the transmission of the first message based on the correspondence between the first message and the first preset protocol. The control of the transmission of the first message may be to control whether the first message continues to be transmitted, to control the transmission time of the first message, or to control the transmission carrier of the first message, etc.

[0009] In the integrated circuit provided by the present invention, when the second functional module sends a first message to the first functional module, the first isolation module can control the transmission of the first message based on the correspondence between the first preset protocol and the first message, so that the first functional module will not receive the first message that does not correspond to the first preset protocol, thereby avoiding the first functional module from getting stuck and improving the reliability of the integrated circuit.

[0010] According to a second aspect of the present disclosure, a communication method based on an integrated circuit is provided, wherein the integrated circuit includes a first functional module and a second functional module, and the method includes: monitoring a first message sent by the second functional module to the first functional module; and controlling the transmission of the first message based on the correspondence between the first message and a first preset protocol.

[0011] The method provided by the present invention can control the transmission of the first message based on the correspondence between the first message and the first preset protocol when the second functional module sends a first message to the first functional module, thereby avoiding the first functional module from getting stuck due to receiving the first message that does not correspond to the first preset protocol, thereby improving the reliability of the integrated circuit.

[0012] According to a third aspect of the present disclosure, an integrated circuit system is provided, which includes: an integrated circuit; a memory for storing executable instructions of the integrated circuit; and an integrated circuit for reading executable instructions from the memory and executing the instructions to implement any of the methods described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a first structural schematic diagram of an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0014] Figure 2 is a second structural schematic diagram of an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0015] Figure 3 It is a schematic diagram of data interaction between modules provided by an exemplary embodiment of the present disclosure.

[0016] Figure 4 It is a schematic diagram of first message transmission control provided by an exemplary embodiment of the present disclosure.

[0017] Figure 5 is a third structural schematic diagram of an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0018] Figure 6 is a fourth structural schematic diagram of an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0019] Figure 7is a fifth structural diagram of an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0020] Figure 8 This is a first flowchart of a communication method based on an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0021] Fig. 9 1 is a second flow chart of a communication method based on an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0022] Fig.10 3 is a third flow chart of a communication method based on an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0023] Fig.11 is a structural diagram of an integrated circuit system provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] To explain the present disclosure, example embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. It should be understood that the present disclosure is not limited to the example embodiments.

[0025] It should be noted that the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.

[0026] Before describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described first. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations.

[0027] 1. Operating system refers to a system used to implement the business functions of smart cars. For example, smart driving systems, smart cockpit systems, in-vehicle infotainment systems, and safety island systems are all operating systems with different business functions. Of course, the present disclosure is not limited to the above-mentioned operating systems, and can also be other types of operating systems and operating systems not mentioned in the present disclosure.

[0028] The operating system is run by the processor in the integrated circuit. For operating systems with different performance requirements, different numbers of processors can be configured to run them. For operating systems with higher performance requirements, more processors can be configured to run them. For operating systems with lower performance requirements, fewer processors can be configured to run them.

[0029] 2. An integrated circuit, including at least one processor, a communication link, multiple communication interfaces, a memory and other hardware resources. The processor may include different types such as a central processing unit and a graphics processing unit.

[0030] In the embodiments of the present disclosure, the integrated circuit may be, for example, a system on a chip (SoC), an application processor (AP), etc., which is not limited in the embodiments of the present application.

[0031] In order to run multiple operating systems simultaneously in an integrated circuit, the integrated circuit may include multiple sub-integrated circuits, each of which may include at least one processor, as well as corresponding communication links, multiple communication interfaces, memory and other hardware resources. In other words, each sub-integrated circuit can be used as a functional module, and each functional module can independently run an operating system. In this way, the integrated circuit can include multiple functional modules, thereby running multiple operating systems simultaneously.

[0032] In each functional module, at least one processor can be used to run a pre-assigned operating system, communication links and communication interfaces can be used to realize communication between processors within the functional module, or to realize communication between the functional module and other external modules, and the memory can be used to store information, such as information to be processed, intermediate information during the processing process, and result information after processing.

[0033] In addition, in order to realize and control the data interaction between multiple functional modules, the integrated circuit may also include an interconnection module and an isolation module.

[0034] The interconnection module is used to realize information transmission between multiple functional modules. Among them, the interconnection module includes a communication link and multiple communication interfaces connected to the communication link. Information can be transmitted between multiple communication interfaces in the interconnection module through the communication link. Each communication interface of the interconnection module is respectively connected to the communication interfaces of multiple functional modules, and is used to send information to different functional modules and also to receive information sent by different functional modules. In some examples, multiple functional modules of the integrated circuit can communicate through a bus, and accordingly, the interconnection module can be a bus module in the integrated circuit.

[0035] The isolation module is a newly added module in the embodiment of the present disclosure. In the embodiment of the present disclosure, the isolation module is used to safely isolate the modules that need to be protected in the integrated circuit, and the isolation module includes functional circuits and communication interfaces for implementing security isolation related functions. In the embodiment of the present application, the isolation module can isolate the modules that need to be protected into a safe and independent physical area in hardware to form a secure world. In the secure world, the input or output information must be checked and verified before deciding whether to pass it to another module.

[0036] In the embodiments of the present disclosure, the module to be protected may be a functional module or an interconnection module.

[0037] Taking the example that the module to be protected is a target functional module in an integrated circuit, the isolation module can be set at the interface used for communication between the target functional module and other modules. For example, the isolation module can be set between the communication interface of the target functional module and the communication interface of the interconnection module. In this way, when the information sent and received by the target functional module passes through the isolation module, the isolation module can check and verify the information and decide whether to continue to transmit the information.

[0038] 3. Safety level, such as Automotive Safety Integrity Level (ASIL). The safety level can be determined based on indicators such as severity, exposure, and controllability. For example, the safety level can be divided into level QM (quality management), level A, level B, level C, and level D according to safety requirements from low to high. Among them, level QM indicates the level that will not cause vehicle safety hazards.

[0039] The security level is used to measure the security requirements of each module in the integrated circuit. The higher the security requirements of the module, the higher the security level that needs to be configured for the module; the lower the security requirements of the module, the lower the security level that needs to be configured for the module.

[0040] For example, the safety of the intelligent driving system is related to the personal safety of the driver and passengers. Therefore, the functional modules running the intelligent driving system have higher safety requirements. Therefore, a higher safety level can be configured for the functional modules running the intelligent driving system. For another example, the functional modules running the in-vehicle entertainment system have lower safety requirements. Therefore, a lower safety level can be configured for the functional modules running the in-vehicle entertainment system. The above description of the safety level of each module is only an example and does not constitute a specific limitation on the safety level of each module.

[0041] In addition, it should be noted that in the embodiments of the present application, since each module (such as each functional module, interconnection module and isolation module) contains a processor, functional circuit, communication link, communication interface, etc. for realizing its respective functions, each module may correspond to a hardware area in the integrated circuit, and the hardware area may also be referred to as a hardware domain. Exemplarily, a functional module may be referred to as a hardware domain; an interconnection module may be referred to as an interconnection domain; and an isolation module may be referred to as an isolation domain.

[0042] Application Overview

[0043] Today's smart cars usually integrate a series of operating systems with rich business functions, such as: intelligent driving systems, smart cockpit systems, in-vehicle infotainment systems and safety island systems.

[0044] At present, multiple operating systems can run in one integrated circuit. For example, an integrated circuit may include multiple sub-integrated circuits, each of which can be used as a functional (or business function) module. In this way, the integrated circuit may include multiple functional modules, each of which can run an operating system. For example, the first sub-integrated circuit implements the intelligent driving function, and the second sub-integrated circuit implements the cockpit entertainment function. The first sub-integrated circuit can also be called the first functional module or the first hardware domain, and the second sub-integrated circuit can also be called the second functional module or the second hardware domain.

[0045] When multiple operating systems are running at the same time, data interaction will occur between different functional modules of the integrated circuit. When one functional module sends abnormal data to another functional module, the functional module receiving the abnormal data will enter a stuck state due to its inability to recognize the abnormal data, thereby making the operating system on the functional module receiving the abnormal data unable to operate normally, reducing the operating reliability of the integrated circuit.

[0046] In order to solve the above problems, the embodiments of the present disclosure provide an integrated circuit, an integrated circuit system and a communication method, which can prevent the functional modules in the integrated circuit from being stuck due to receiving abnormal data, thereby improving the reliability of the operation of the integrated circuit.

[0047] Exemplary Systems

[0048] Figure 1 is a first structural diagram of an integrated circuit provided by an exemplary embodiment of the present disclosure, Figure 1 The integrated circuit 10 in the embodiment includes a first functional module 110, a second functional module 120, an interconnection module 200 and a first isolation module 300. The first functional module 110 and the second functional module 120 are communicatively connected via the interconnection module 200; the first isolation module 300 is arranged on the communication link between the first functional module 110 and the interconnection module 200.

[0049] For example, the interconnection module 200 and the first isolation module 300 may be physically one module or two different modules.

[0050] The first function module 110 can implement the first business function by running the software code corresponding to the first business function, and the second function module 120 can implement the second business function by running the software code corresponding to the second business function.

[0051] For example, the first business function may be an intelligent driving function, then the software code corresponding to the first business function may be the software code of the intelligent driving system; the second business function may be an in-vehicle infotainment function, then the software code corresponding to the second business function may be the software code of the in-vehicle infotainment system.

[0052] In some embodiments, the first functional module 110 and the second functional module 120 may have a preset security level. The security levels of the first functional module 110 and the second functional module 120 may be the same or different. The security levels of the first functional module 110 and the second functional module 120 may be static or dynamically adjusted based on the business functions they perform. The embodiment of the present application does not limit the security levels of the first functional module 110 and the second functional module 120.

[0053] In some embodiments, the isolation module may provide security protection for one or more modules in the first functional module 110 , the second functional module 120 and / or the interconnection module 200 , for example, security isolation functions such as message checking and message blocking.

[0054] In some implementations, the isolation module and the protected module may have a one-to-one association relationship. That is, each protected module is provided with an isolation module. For example, if the protected module is the first functional module 110, then an isolation module, such as the first isolation module 300, needs to be provided for the first functional module 110; if the interconnection module 200 also needs to be protected, then an isolation module needs to be provided for the interconnection module 200. And so on.

[0055] In other implementations, the isolation module and the protected module may have a one-to-many association relationship. That is, one isolation module may provide protection for multiple modules. Figure 1 In the structure shown, the first isolation module 300 can provide protection for both the first functional module 110 and the interconnection module 200. The first isolation module 300 can provide protection for which module or modules based on a preset decision-making mechanism, such as the security level, protection priority, business requirements and / or system configuration of each module, which is not limited in the present embodiment.

[0056] In some embodiments, the isolation module may preferentially provide security protection for functional modules with higher security levels, so as to preferentially ensure that the functional modules with higher security levels will not be stuck due to receiving abnormal data.

[0057] Exemplarily, the first functional module 110 has a higher safety level due to running the intelligent driving system, for example, the safety level of the first functional module 110 is ASIL D; the second functional module 120 has a lower safety level due to running the in-vehicle infotainment system, for example, the safety level of the first functional module 110 is ASIL B. In other words, the safety level of the first functional module 110 is higher than the safety level of the second functional module 120.

[0058] Accordingly, if Figure 1 As shown, since the safety level of the first functional module 110 is relatively high, the first isolation module 300 can be configured for the first functional module 110. Since the safety level of the second functional module 120 is relatively low, it is not necessary to configure an isolation module for the second functional module 120.

[0059] In addition, since the interconnection module 200 needs to realize the communication between the first functional module 110 and the second functional module 120, its function is also very important. Therefore, a relatively high safety level can also be set for it. For example, the safety level of the interconnection module 200 can be set to ASIL C.

[0060] Accordingly, an isolation module may also be configured for the interconnection module 200. For example, the interconnection module 200 may share the first isolation module 300 with the first functional module 110. Alternatively, an isolation module may also be configured separately for the interconnection module 200, which is not specifically limited in the embodiment of the present application.

[0061] Combine the following Figure 1 , taking the second functional module 120 sending the first message to the first functional module 110 as an example, the manner in which the first isolation module 300 provides security protection for the first functional module 110 is exemplarily described.

[0062] The first message may be an access request message sent by the second functional module 120 to the first functional module 110. Exemplarily, the first message includes but is not limited to any one or more of the following: a write request message, a read request message, a synchronization request message, a lock request message, and the like.

[0063] Alternatively, the first message may also be a response message sent by the second functional module 120 to the first functional module 110 after receiving the access request message sent by the first functional module 110. Exemplarily, the first message includes but is not limited to any one or more of the following: a write response message, a read response message, a synchronization response message, a lock response message, etc.

[0064] Taking the first message as an access request message as an example, without setting the first isolation module 300, after the first message is sent from the second functional module 120, it is delivered to the first functional module 110 via the interconnection module 200. If the first message conforms to the first preset protocol, the first functional module 110 can send a response message to the second functional module 120, thereby completing the interactive communication between the first functional module 110 and the second functional module 120.

[0065] Taking the first message as a response message as an example, without setting the first isolation module 300, after the first message is sent from the second functional module 120, it is delivered to the first functional module 110 via the interconnection module 200, thereby completing the interactive communication between the first functional module 110 and the second functional module 120.

[0066] However, no matter the first message is an access request message or a response message, as long as the first message received by the first functional module 110 does not comply with the first preset protocol, the first functional module 110 may be stuck.

[0067] It should be noted that the first message conforms to the first preset protocol, which can also be described as the first message corresponding to the first preset protocol, or the first message is a legal message, the request corresponding to the first message is a legal request, and the response corresponding to the first message is a legal response. Correspondingly, the first message does not conform to the first preset protocol, which can also be described as the first message does not correspond to the first preset protocol, or the first message is an illegal message, the request corresponding to the first message is an illegal request, and the response corresponding to the first message is an illegal response.

[0068] In one example, the first preset protocol can define a way of performing data transmission between modules. For example, the first preset protocol can be that the number of data in the first message is equal to the preset number (or the target number / target quantity). For example, the first protocol is specifically that the number of data in the first message is N, where N≥1. Wherein, data is transmitted in a beat beat manner, each beat may include data of a specified length, and each data transmission may include multiple beats. Each beat can be considered as a data, that is, the number of beats is the number of data. For example, before the second functional module 120 sends the first message to the first functional module 110, the second functional module 120 may first send an indication message to the first functional module 110, and the indication message may include the number of beats to be included in the first message to be sent, that is, the target number of data, and the data length of each beat. After receiving the indication message, the first functional module 110 may enter a suspended state and wait for receiving data. The second functional module 120 may send the first message to the first functional module 110 in units of beats. Next, if the first functional module 110 receives the target number of beats, that is, the number of data in the first message is the same as the target number, it means that the first message corresponds to the first preset protocol. If the number of beats received by the first functional module 110 is different from the target number, that is, the number of data in the first message is different from or unequal to the target number, it means that the first message does not correspond to the first preset protocol.

[0069] In order to prevent the first functional module 110 from being stuck due to receiving a message that does not comply with the first preset protocol, the embodiment of the present application sets a first isolation module 300 between the first functional module 110 and the interconnection module 200. When the first message is received, that is, before the first message is delivered to the first functional module 110, the first isolation module 300 can control the transmission of the first message based on the correspondence between the first message and the first preset protocol.

[0070] Specifically, when the first message does not correspond to the first preset protocol, the first isolation module 300 can block the first message, so that the first functional module 110 will not receive the first message, thereby avoiding the first functional module 110 from getting stuck, and achieving safe isolation of different functional modules.

[0071] In addition, when the first message corresponds to the first preset protocol, the first isolation module 300 can continue to transmit the first message, for example, transparently transmit the first message or transmit it to the first functional module 110 after performing preset processing on the first message. Among them, the preset processing may include, for example, timing control, flow control, priority and arbitration, etc., which are not limited in the embodiments of the present disclosure. In this way, the first functional module 110 can receive the first message to complete the subsequent interactive communication. Among them, the "transparent transmission" here means that the first isolation module 300 will not make any modifications to the first message, and is only responsible for sending the first message to the first functional module 110.

[0072] In the embodiment of the present disclosure, the preset protocol (e.g., the first preset protocol or the second preset protocol) is related to the bus architecture standard adopted for communication between functional modules (e.g., between the first functional module 110 and the second functional module 120). For example, the first preset protocol may comply with the bus architecture standard adopted between the first functional module 110 and the second functional module 120, or in other words, the first preset protocol is designed based on the bus architecture standard adopted between the first functional module 110 and the second functional module 120.

[0073] For example, taking the advanced microcontroller bus architecture (AMBA) standard adopted between the first functional module 110 and the second functional module 120 as an example, the first preset protocol can comply with any one of the advanced peripheral bus (APB) standard, the advanced high-performance bus (AHB) standard, and the advanced extensible interface (AXI) standard.

[0074] Exemplarily, based on the difference in bus architecture standards adopted by the first functional module 110 and the second functional module 120, the content of the bus architecture standard includes but is not limited to at least one of the following:

[0075] Message data volume requirements: including the number of data, such as the number of beats; and / or data length, such as byte length, bit length, etc.

[0076] Message timeout mechanism: including timeout duration, etc.

[0077] Message timing requirements: including restrictions on the number of message clock cycles, signal delays, etc.

[0078] Error handling: defines the error types and handling mechanisms for errors that may occur during message transmission.

[0079] Exemplarily, if the bus architecture standard adopted between the first functional module 110 and the second functional module 120 includes a data volume requirement for a message, then the first preset protocol may be that the number of data in the first message is equal to the target number N, N≥1, then, if the number of data in the first message is not equal to the target number in the first preset protocol, it means that the first message does not correspond to the first preset protocol; if the number of data in the first message is equal to the target number in the first preset protocol, it means that the first message corresponds to the first preset protocol. Among them, the target number may be fixed or may change dynamically in each transmission based on factors such as the data volume requirement to be transmitted, and the embodiments of the present disclosure do not limit this.

[0080] Exemplarily, if the bus architecture standard adopted between the first functional module 110 and the second functional module 120 includes a limit on the number of clock cycles of a message, then the first preset protocol may be that the number of clock cycles for transmitting the first message is less than or equal to the maximum number of clock cycles M, M≥1. Then, if the number of clock cycles for transmitting the first message is greater than the maximum number of clock cycles, it means that the first message does not correspond to the first preset protocol; if the number of clock cycles for transmitting the first message is less than or equal to the maximum number of clock cycles, it means that the first message corresponds to the first preset protocol.

[0081] In some embodiments, the first preset protocol can be stored in a preset register 330, so that the first isolation module 300 can read the first preset protocol from the register 330 to determine the content in the first preset protocol, and then determine whether the first message corresponds to the first preset protocol.

[0082] The register 330 may be located inside the integrated circuit 10 and constitute a part of the integrated circuit 10. In addition, the register 330 may also be an external register 330 located outside the integrated circuit 10. When the register 330 is located inside the integrated circuit 10, the register 330 may be a register 330 exclusively used by the first isolation module 300, or may be a register 330 shared with other modules, such as the first functional module 110, the second functional module 120 and / or the interconnection module 200. The present application does not specifically limit the implementation of the register 330.

[0083] In addition, when the register 330 is located inside the integrated circuit 10, the register 330 can be set inside the isolation module 300 and become a part of the first isolation module 300. Of course, the register 330 can also be set separately in the integrated circuit 10, and does not belong to any module. In addition, the register 330 can also be set in other modules, such as in the first functional module 110, in the second functional module 120, in the interconnection module 200, or in other isolation modules. The embodiment of the present disclosure does not specifically limit the location of the register 330.

[0084] In addition, the number of registers 330 may be one or more. When the number of registers 330 is multiple, the multiple registers 330 may have multiple settings. For example, the multiple registers 330 may all be set in the first isolation module 300. Alternatively, the multiple registers 330 may all be set in other modules. Alternatively, the multiple registers 330 may all exist independently in the integrated circuit 10 and not belong to any module. Alternatively, a part of the multiple registers 330 may be set in the first isolation module 300, and another part may be set in other modules or exist independently. That is to say, when the number of registers 330 is multiple, the embodiment of the present disclosure does not specifically limit the setting method of the registers 330.

[0085] It can be seen from the above technical solution that in the integrated circuit 10 provided by the present invention, when the second functional module 120 sends a first message to the first functional module 110, for example, before the first functional module 110 receives the first message, the first isolation module 300 can control the transmission of the first message based on the correspondence between the first preset protocol and the first message, so that the first functional module 110 will not receive the first message that does not correspond to the first preset protocol, thereby avoiding the first functional module 110 from getting stuck, thereby realizing the safe isolation of different functional modules and improving the reliability of the integrated circuit 10.

[0086] It should be noted that Figure 1 The integrated circuit 10 shown in the figure is only exemplary. The number of functional modules, the number of isolation modules, and whether an operating system is running in the functional module can be set according to actual conditions. Figure 1 The circuit structure of the integrated circuit 10 is only an example. Figure 1 It does not limit the protection scope of the present disclosure.

[0087] Exemplary Devices

[0088] Figure 2 1 is a second structural diagram of an integrated circuit 10 provided by an exemplary embodiment of the present disclosure.

[0089] like Figure 2 As shown, in some embodiments, the first isolation module 300 may include a protocol checking submodule 310. The protocol checking submodule 310 may include functions such as monitoring messages passing through the first isolation module 300, performing protocol checking on the monitored messages, and / or controlling the transmission of messages based on the protocol checking results. The protocol checking submodule 310 may include a functional circuit and a communication interface for implementing its functions. When the first message sent by the second functional module 120 to the first functional module 110 passes through the first isolation module 300, the protocol checking submodule 310 may monitor or detect the first message, and based on the correspondence between the first message and the first preset protocol, continue to transmit or block the first message, so that the first functional module 110 will not receive the first message that does not correspond to the first preset protocol, thereby avoiding the first functional module 110 from being stuck. Continuing to transmit may include transparently transmitting the first message, or transmitting the first message to the first functional module 110 after performing preset processing on the first message. The “transparent transmission” here means that the protocol checking submodule 310 will not make any modification / processing to the first message, and is only responsible for forwarding the first message to the first functional module 110 .

[0090] Further Figure 2 As shown, in one embodiment, the protocol checking submodule 310 may include a first monitoring unit 311 and a first processing unit 312. In one example, each unit in the protocol checking submodule 310, such as the first monitoring unit 311 and the first processing unit 312, may be two different sub-functional circuits in the protocol checking submodule 310, and the first monitoring unit 311 and the first processing unit 312 may be communicatively connected via a communication interface in the protocol checking submodule 310. The embodiment of the present application does not limit the implementation of the first monitoring unit 311 and the first processing unit 312.

[0091] The first monitoring unit 311 may monitor the messages passing through the first isolation module 300 based on the first preset protocol.

[0092] In one implementation, the first monitoring unit 311 may obtain the first preset protocol from the register 330 in advance to determine the monitoring strategy for the message. The first monitoring unit 311 may obtain the first preset protocol from the register 330 when powered on, or the first monitoring unit 311 may periodically obtain the first preset protocol from the register 330, or the first monitoring unit 311 may also obtain the first preset protocol from the register 330 based on an externally input control signal or indication information. The embodiment of the present application is not limited to this.

[0093] In one example, the message monitoring strategy of the first monitoring unit 311 may include: monitoring one or more channels in the bus architecture standard that the first preset protocol complies with, where the channel may refer to a logical path used for different types of data transmission during the bus transmission process.

[0094] Exemplarily, taking the AXI standard as an example, the following channels may be included: a master channel, a slave channel, a write data channel, a read data channel, a write address channel, a read address channel, a write response channel, and a read response channel.

[0095] It should be noted here that the host interface may be the communication interface of the first functional module 110, and the slave interface may be the communication interface of the second functional module 120, or the slave interface may be the communication interface of the first functional module 110, and the host interface may be the communication interface of the second functional module 120. Specifically, it can be flexibly configured in the register 330 according to the design of the bus, and the embodiment of the present application does not limit this.

[0096] Exemplarily, when the security level of the first functional module 110 is higher than that of the second functional module 120 , the host interface may be the communication interface of the second functional module 120 , and the slave interface may also be the communication interface of the first functional module 110 .

[0097] Next, the first monitoring unit 311 may determine the correspondence between the first message and the first preset protocol when monitoring the first message sent by the second functional module 120 .

[0098] For example, taking the first message as a write request message, if the first monitoring unit 311 monitors the write request message sent by the second functional module 120 to the first functional module 110 in the write data channel, the first monitoring unit 311 can detect whether the number of data to be written is the same as the target number in the first preset protocol. If they are the same, it is determined that the first message corresponds to the first preset protocol. If they are not the same, it is determined that the first message does not correspond to the first preset protocol.

[0099] The following takes the case where the first message is a write request message and the first preset protocol complies with the AXI standard as an example to exemplarily illustrate the manner in which the first monitoring unit 311 determines the correspondence between the first message and the first preset protocol.

[0100] The contents of the AXI standard may at least include:

[0101] Address of the first beat of the burst: The address of the first beat in a write / read data operation. If it is a write operation, the address is the write address; if it is a read operation, the address is the read address.

[0102] Number of beats (transfers) inside the burst: The target number of beats in a write / read data operation, that is, the target number of data.

[0103] Size of each beat: The data length of each beat.

[0104] Figure 3 It is a schematic diagram of data interaction between modules provided by an exemplary embodiment of the present disclosure.

[0105] The following is combined with Figure 3 , taking the first message as a write request message and the first preset protocol conforming to the AXI standard as an example, for example, the first preset protocol is that the number of data in the first message is equal to 5 beats, the manner in which the second functional module 120 sends the first message to the first functional module 110 is exemplarily described:

[0106] Exemplarily, before the second functional module 120 sends the first message to the first functional module 110 , the second functional module 120 may send a write indication message to the first functional module 110 on the write address channel.

[0107] The write indication message may include the writing address starting address of the first beat in the first message to be written, the data length transfers size of each beat in the first message, and the number of beats in the first message transfers length:

[0108] Exemplarily, the write indication message may specifically include the following parameters:

[0109] Starting address: 0x1004 / / The write address of the first beat is 0x1004

[0110] transfers size: 4Bytes / / The data length of each beat is 4 bytes

[0111] transfers length: 5beats / / The number of beats is 5 (i.e. the target number)

[0112] That is, the first preset protocol can be included in the write indication message. For example, the write indication message includes "transfers length: 5 beats" to indicate that the first preset protocol is the transfers length of the first message is equal to 5, that is, the first preset protocol is the number of data in the first message is equal to 5 beats.

[0113] After receiving the write indication message, the first functional module 110 may enter a suspended state and wait for receiving data.

[0114] Next, the second function module 120 may send a first message to the first function module 110 on the write data channel.

[0115] Exemplarily, if the second functional module 120 sends a first message that complies with the first preset protocol, then the first message contains 5 beats, and the data length of each beat is 4 bytes. If the second functional module 120 sends a first message that does not comply with the first preset protocol, then the first message may contain only 3 beats or even fewer beats, or the data length of each beat may not be 4 bytes.

[0116] Next, the first functional module 110 can detect the number of beats it receives, and determine whether all the beats in the first message have been received based on the transfers length parameter in the write indication message. If all the beats in the first message have been received, the first functional module 110 can release the suspended state and send a response message to the second functional module 120 in the write response channel. If all the beats in the first message have not been received, the first functional module 110 can continue to remain in the suspended state and wait for the remaining beats to be received.

[0117] For example, if the transfers length is 5 beats, then if the first function module 110 receives 5 beats of data, the first function module 110 can determine that all beats in the first message are received. If the first function module 110 only receives 3 beats of data, the first function module 110 can determine that all beats in the first message are not received.

[0118] Accordingly, the first monitoring unit 311 can monitor the write address channel and the write data channel of the AXI standard. By monitoring the write address channel, the write instruction message sent by the second functional module 120 can be monitored, and then the specific value in the transfers length parameter corresponding to the first message can be determined, that is, the target number can be determined. By monitoring the write data channel, the first message sent by the second functional module 120 can be monitored, and then the corresponding relationship between the first message and the first preset protocol can be determined according to the monitored transfers length parameter and the number of beats in the monitored first message.

[0119] Exemplarily, when the transfers length is 5 beats, if the first monitoring unit 311 monitors that the first message contains 5 beats of data, then the first monitoring unit 311 can determine that the first message corresponds to the first preset protocol. If the first monitoring unit 311 monitors that the number of beats in the first message is not 5, for example, the first message contains 3 beats of data, then the first monitoring unit 311 can determine that the first message does not correspond to the first preset protocol.

[0120] Next, when the first monitoring unit 311 has determined the correspondence between the first message and the first preset protocol, the first processing unit 312 performs transmission control on the first message based on the correspondence between the first message and the first preset protocol.

[0121] In one implementation, when the first message corresponds to the first preset protocol, the first processing unit 312 may transparently transmit the first message to the first functional module 110. In this way, the first functional module 110 may receive the first message corresponding to the first preset protocol and process the first message.

[0122] In one implementation, the first processing unit 312 may block the first message when the first message does not correspond to the first preset protocol. In this way, the first functional module 110 will not receive the first message that does not correspond to the first preset protocol, thereby preventing the first functional module 110 from getting stuck, and achieving safe isolation of different functional modules.

[0123] In one implementation, when the first message does not correspond to the first preset protocol, the first monitoring unit 311 may also determine the error type of the first message. Exemplarily, if the number of data to be written in the first message is less than the target number, the error type may be data number discrepancy, for example, the error type is insufficient data number; if the number of data to be written in the first message is more than the target number, the error type may be data number discrepancy, for example, the error type is excessive data number; if the data length of the first message is different from the target data length in the first preset protocol, the error type may be data length difference of the data; when the first message is a response message, if the first message is not received within the first time length after the request message is sent, the error type may be timeout.

[0124] In the embodiment of the present application, the error type can be pre-configured in the register 330, and the embodiment of the present application does not specifically limit the number and content of the error types.

[0125] In one implementation, when the first message does not correspond to the first preset protocol, the first processing unit 312 may process the first message using different strategies based on different error types of the first message.

[0126] In the first example, for any error type, the first processing unit 312 may block the first message.

[0127] In the second example, if the error type of the first message is that the number of data in the first message is less than the target number, the first processing unit 312 can block the first message and complete the number of data in the first message to the target number, obtain the first associated message, and send the first associated message to the first functional module 110.

[0128] For example, assuming that the first preset protocol is that the target number of the first message is 10 data, and the first message only includes 5 data, then it can be determined that the number of data in the first message is less than the target number. In this case, the first processing unit 312 can block the first message, and on the basis of the 5 data of the first message, add 5 more data, so as to obtain a first associated message including 10 data. Then, the first associated message is sent to the first functional module 110.

[0129] Figure 4 It is a schematic diagram of first message transmission control provided by an exemplary embodiment of the present disclosure.

[0130] Combine the following Figure 4 , taking the case where the first message is a write request message and the first preset protocol complies with the AXI standard as an example, the manner in which the first processing unit 312 sends the first association message is exemplarily described.

[0131] Exemplarily, when the transfers length is 5 beats, that is, the target number is 5 data, if the first monitoring unit 311 detects that the number of beats in the first message is less than 5, for example, the first message contains 3 beats of data, then the first processing unit 312 can block the first message, and add 2 beats of data to the 3 beats of data in the first message, thereby obtaining a first associated message containing 5 beats of data, and sending the first associated message containing 5 beats of data to the first functional module 110.

[0132] That is, the first processing unit 312 can replace the first message with a data number less than the target number with a first associated message with a data number equal to the target number, so as to meet the target number requirement in the first preset protocol. In this way, when the first functional module 110 receives the first associated message with a data number that meets the first preset protocol, it will not get stuck, thereby achieving a good safety isolation of different functional modules and improving the reliability of the integrated circuit 10.

[0133] It should be noted that the first processing unit 312 does not know the correct content of the 5 missing data in the first message. In this case, the first processing unit 312 can supplement the missing data according to the preset content, for example, supplement the meaningless data pre-configured in the register 330, supplement the blank data with all 0s, etc. The embodiment of the present application does not limit the specific content of the data supplemented by the first processing unit 312.

[0134] It is understandable that since the first preset protocol defines the target number of data in the message but does not define the specific content of the message, based on the first preset protocol, when the first functional module 110 receives data, as long as it receives the target number of data, it will be considered that all data that complies with the first preset protocol has been received from the second functional module 120. Therefore, the first functional module 110 will release the suspended state of waiting to receive data and will not get stuck, thereby achieving good security isolation of different functional modules.

[0135] For example, if the target number is 10 data, then if the first functional module 110 receives the first associated message containing 10 data, it will be considered that it has received all the data that complies with the first preset protocol. Therefore, the first functional module 110 will release the suspended state, so there will be no jamming, and the security isolation of different functional modules is well achieved.

[0136] In the third example, if the error type of the first message is that the number of data in the first message is less than the target number, the first processing unit 312 may not block the first message, but first transparently transmit the first message, and after transparently transmitting the first message, send a certain number of supplementary data to the first functional module 110, so that the sum of the number of data in the first message and the number of data in the supplementary data is equal to the target number. Among them, the supplementary data can be meaningless data pre-configured in the register 330, blank data with all 0s, etc., which is not limited in the embodiment of the present application. In this way, the number of data received by the first functional module 110 can also meet the requirements of the first preset protocol, so that it will not get stuck, and the safe isolation of different functional modules is well achieved.

[0137] In the fourth example, if the error type of the first message is that the number of data in the first message is greater than the target number, the first processing unit 312 can block the first message and intercept the target number of data from the first message to obtain a second associated message, and send the second associated message to the first functional module 110.

[0138] Exemplarily, the first processing unit 312 may intercept the data of the first target number from the first message based on the order of each data in the first message; or, may intercept the data of the second target number from the first message; or, may intercept the data of the intermediate target number from the first message. Alternatively, the first processing unit 312 may select the target number of data from the first message based on certain rules, for example: selecting the target number of data from the first message at dynamically variable or fixed intervals, or randomly extracting the target number of data from the first message, etc. The disclosed embodiment does not specifically limit the method of intercepting the target number of data from the first message.

[0139] In this way, after receiving the second association message, the first functional module 110 will believe that it has received all the data that complies with the first preset protocol from the second functional module 120. Therefore, the first functional module 110 will release the suspended state of waiting for receiving data, and will not get stuck, thereby achieving good security isolation of different functional modules.

[0140] In the fifth example, if the error type of the first message is that the number of data in the first message is greater than the target number, the first processing unit 312 can transparently transmit the target number of data in the first message and block the remaining data, so that the number of data actually received by the first functional module 110 meets the requirements of the first preset protocol, and thus no jamming occurs, thereby achieving good security isolation of different functional modules.

[0141] In combination with the second to fifth examples above, the first processing unit 312 can send related association messages, such as the first association message / the second association message, to the first functional module 110 when the number of data in the first message is different from the target number. The number of data in the first association message / the second association message is equal to the target number, so that the number of data received by the first functional module 110 meets the requirements of the first preset protocol, and thus no jamming occurs, thereby achieving a good security isolation of different functional modules.

[0142] In the sixth example, if the error type of the first message is that the data length of the data in the first message is less than the target data length in the first preset protocol, the first processing unit 312 can block the first message and complete the data length of the data in the first message to be equal to the target data length, obtain the first associated message, and send the first associated message to the first functional module 110.

[0143] Among them, the data length, such as the length of the data in the first message and the target data length, can be byte length or bit length. Of course, other ways of expressing data length can also be used. The embodiment of the present disclosure does not specifically limit the implementation method of data length.

[0144] For example, taking the data length as bit length as an example, if the first preset protocol is that the target data length of the first message is 32 bits, and the data length of the first message is only 20 bits, then it can be determined that the data length of the data in the first message is less than the target data length. In this case, the first processing unit 312 can block the first message, and on the basis of the 20-bit data length of the first message, supplement 12 bits of data, thereby obtaining a first associated message with a data length of 32 bits. Then, the first associated message is sent to the first functional module 110.

[0145] It should be noted here that each error type and the processing method or processing strategy for each error type can be pre-stored in the register 330. For example, the register 330 may include a correspondence table between error types and processing methods. The first processing unit 312 can query the corresponding processing method from the register 330 based on the error type to achieve control of the first message.

[0146] In some embodiments, the integrated circuit 10 may further include a third functional module 130. The third functional module 130 may be, for example, a microcontroller unit (MCU) with integrated security functions, such as a security island MCU. The third functional module 130 may include a hardware encryption engine, a secure storage area, an isolation mechanism, and a secure boot function, etc., to protect the system from various threats including software attacks and hardware attacks, and improve system security.

[0147] The third functional module 130 may establish a communication connection with the first isolation module 300 via a communication interface.

[0148] In an implementation, the first monitoring unit 311 may send first error information to the third function module 130 when the first message does not correspond to the first preset protocol.

[0149] The first error information may include the identifier of the second functional module 120, the error type and / or the time when the error occurred, etc. Exemplarily, the identifier of the second functional module 120 may be, for example, a module ID (such as a hardware domain ID), a serial number, a universal unique identification code, etc., which is not limited in the embodiment of the present application.

[0150] In one example, the first error information may include specific content of the error type of the first message. In this case, the amount of data sent by the first monitoring unit 311 to the third functional module 130 is large, which is not conducive to improving the communication efficiency between the first monitoring unit 311 and the third functional module 130.

[0151] In another example, in order to improve the communication efficiency between the first monitoring unit 311 and the third functional module 130, a corresponding error code may be set in advance for each error type. In this way, the first error message does not need to include the specific content of the error type of the first message, but only needs to include the error code corresponding to the error type of the first message, thereby reducing the amount of data sent and improving the communication efficiency between the first monitoring unit 311 and the third functional module 130.

[0152] For example, the corresponding relationship between the error type and the error code may be as shown in Table 1:

[0153] Table 1:

[0154] Error Code Error Type 0 The number of data is less than the target number 1 The number of data is greater than the target number 2 The data length of the data is smaller than the target data length 3 The data length of the data is greater than the target data length 4 time out … …

[0155] Exemplarily, the correspondence between the error type and the error code may be pre-stored in the register 330. When determining the error type of the first message, the first monitoring unit 311 may obtain the corresponding error code from the register 330 to generate the first error information.

[0156] For example, a first relationship table, such as Table 1, recording the correspondence between error types and error codes may be stored in the register 330 in advance, so that the first monitoring unit 311 can query the corresponding error code from the first relationship table when determining the error type of the first message. The first relationship table may be a relationship table associated with the first monitoring unit 311, that is, the first relationship table is used exclusively by the first monitoring unit 311. In addition, the first relationship table may also be a relationship table not associated with the first monitoring unit 311, that is, the first relationship table may be used by the first monitoring unit 311 as well as by other units and modules. The embodiment of the present disclosure does not specifically limit the association between the first relationship table and the first monitoring unit 311.

[0157] In another implementation, when the first message does not correspond to the first preset protocol, the first monitoring unit 311 may write the first error information into the register 330 and send a first interrupt signal to the third functional module 130. The first interrupt signal may be a hardware signal or a software signal.

[0158] Taking the first interrupt signal as a hardware signal as an example, the third functional module 130 may include a first hardware interface for receiving an external hardware interrupt signal, and the first monitoring unit 311 may be communicatively connected with the first hardware interface of the third functional module 130. In one example, the first interrupt signal may be a high-level signal, then, when the first interrupt signal is not sent, the first monitoring unit 311 inputs a low level to the first hardware interface of the third functional module 130, and when the first interrupt signal is sent, the first monitoring unit 311 inputs a high level to the first hardware interface of the third functional module 130. In another example, the first interrupt signal may be a low-level signal, then, when the first interrupt signal is not sent, the first monitoring unit 311 inputs a high level to the first hardware interface of the third functional module 130, and when the first interrupt signal is sent, the first monitoring unit 311 inputs a low level to the first hardware interface of the third functional module 130.

[0159] The embodiment of the present application does not specifically limit the implementation method of the first interrupt signal.

[0160] Next, the third functional module 130 obtains the first error information from the register 330 when receiving the first interrupt signal.

[0161] It is understandable that, in the case where the historical message (e.g., the first message) transmitted between the first functional module 110 and the second functional module 120 does not correspond to the first preset protocol, the register 330 may also include error information corresponding to the historical message. That is, when the third functional module 130 receives the first interrupt signal, it can obtain the first error information corresponding to the first message from the register 330, and can also obtain other error information corresponding to the historical message from the register 330. In this way, the error information obtained by the third functional module 130 is richer, which facilitates the third functional module to use the first error information and other error information corresponding to the historical message to comprehensively analyze the cause of the error, thereby improving the success rate of error location.

[0162] What specific information the third functional module 130 can obtain may depend on the strategy of obtaining information by the third functional module 130 and the configuration of the register 330, and this embodiment of the present application does not limit this.

[0163] In an example, when the third functional module 130 receives the first interrupt signal, it can obtain all error information from the register 330 .

[0164] In another example, the register 330 can store error information in a first-in-first-out queue. When the third functional module 130 receives the first interrupt signal, it can obtain the error information from the end of the first-in-first-out queue, that is, obtain the most recently written first information, that is, the first error information.

[0165] In this way, the first monitoring unit 311 does not need to send the first error information directly to the third functional module 130, but only needs to send the first interrupt signal to the third functional module 130, and the third functional module 130 obtains the first error information from the register 330, thereby reducing the amount of data sent between the first monitoring unit 311 and the third functional module 130 and improving the communication efficiency between the first monitoring unit 311 and the third functional module 130.

[0166] Next, when the third functional module 130 obtains the first error information, it can execute a corresponding processing strategy based on the first error information, for example, restarting or resetting the second functional module 120, so that the second functional module 120 is restored from an abnormal state to a normal state, so as to avoid the error from occurring again or reduce the frequency of the error. In some implementations, the processing strategy of the third functional module 130 can also be set by the user, which is not limited in the embodiments of the present disclosure.

[0167] In one embodiment, the protocol checking submodule 310 may further include a first recovery unit 313. After the protocol checking submodule 310 completes the transmission control of the first message, the first recovery unit 313 recovers the first monitoring unit 311 and the first processing unit 312 to an enabled state, so that the protocol checking submodule 310 starts a new round of monitoring and processing functions.

[0168] The protocol checking submodule 310 may complete the transmission control of the first message by:

[0169] The first processing unit 312 blocks the first message when the first message does not correspond to the first preset protocol. Alternatively, the first processing unit 312 transparently transmits the first message when the first message corresponds to the first preset protocol. Alternatively, the first processing unit 312 sends the first association message to the first functional module 110 when the number of data in the first message is different from the target number. Alternatively, the first monitoring unit 311 sends the first error message to the third functional module 130 when the first message does not correspond to the first preset protocol.

[0170] That is, after the various units of the protocol checking submodule 310 complete their respective functions based on the correspondence between the first message and the first preset protocol, it can be determined that the protocol checking submodule 310 completes the transmission control of the first message.

[0171] It should be noted here that while the various units of the protocol checking submodule 310 are performing their respective functions based on the correspondence between the first message and the first preset protocol, the protocol checking submodule 310 will not monitor and control the transmission of other messages. That is to say, during this period, the various units of the protocol checking submodule 310 are in a disabled state, or in a busy state.

[0172] After the protocol check submodule 310 completes the transmission control of the first message, in order to enable the protocol check submodule 310 to perform transmission control on other subsequent messages, the first recovery unit 313 can restore each unit in the protocol check submodule 310, such as the first monitoring unit 311 and the first processing unit 312, to an enable state, or to an idle state, or to reset each unit. In this way, if there is a message that needs to be processed by the protocol check submodule 310 later, the protocol check submodule 310 can continue to perform the corresponding function to achieve transmission control of the message.

[0173] In an embodiment of the present application, when the first message does not correspond to the first preset protocol, the first monitoring unit 311 may send a first error message or a first interrupt signal to the third functional module 130. Then, if the third functional module 130 never receives the first error message or the first interrupt signal, it usually means that the first message does not correspond to the first preset protocol, but it may also be due to the functional abnormality of the protocol check submodule 310. Among them, the functional abnormality of the protocol check submodule 310 may include, for example: the first monitoring unit 311 cannot monitor the first message, or the first monitoring unit 311 does not send the first error message or the first interrupt signal normally. However, the third functional module 130 is not clear about the specific reason why it did not receive the first error message or the first interrupt signal, that is, the third functional module 130 is not clear whether the function of the protocol check submodule 310 is normal.

[0174] In one embodiment, in order for the third functional module 130 to know whether the function of the first monitoring unit 311 is normal, the protocol checking submodule 310 further includes a first testing unit 314 .

[0175] The first test unit 314 may send a first test message to the first monitoring unit 311 . For example, the first test unit 314 may periodically send the first test message to the first monitoring unit 311 .

[0176] Exemplarily, the sending period of the first test message may be pre-configured in the register 330, or may be configured by software. The sending period of the first test message may be several milliseconds, several microseconds, or several seconds, for example: 10 milliseconds, 100 milliseconds, 300 milliseconds, 800 milliseconds, 10 microseconds, 200 microseconds, 500 microseconds, etc., which is not limited in the embodiment of the present application.

[0177] The first test message does not correspond to the first preset protocol. For example, the number of data in the first test message may be different from the target number in the first preset protocol, and the data length of the first test message may be different from the target data length in the first preset protocol. In other words, the first test message may be regarded as a first message simulated or preset by the first test unit 314 that does not correspond to the first preset protocol.

[0178] Since the first test message is sent periodically, when the first monitoring unit 311 functions normally, the first monitoring unit 311 will periodically monitor the first test message and periodically send the first error message or the first interrupt signal to the third functional module 130. In other words, if the third functional module 130 can periodically receive the first error message or the first interrupt signal, it means that the first monitoring unit 311 functions normally, or in other words, the first monitoring unit 311 operates normally. On the contrary, if the third functional module 130 cannot periodically receive the first error message or the first interrupt signal, it means that the first monitoring unit 311 functions abnormally, or in other words, the first monitoring unit 311 operates abnormally.

[0179] In another implementation, the third functional module 130 may output the first alarm information when receiving the first error information or the first interrupt signal, so as to indicate through the first alarm information that the function of the first monitoring unit 311 is normal. Then, if the third functional module 130 can periodically output the first alarm information, it means that the function of the protocol checking submodule 310 is normal, and if the third functional module 130 does not periodically output the first alarm information, it means that the function of the protocol checking submodule 310 is abnormal.

[0180] In another implementation, the third functional module 130 outputs second alarm information when the first error information or the first interrupt signal is not periodically received, so as to indicate that the protocol check submodule 310 (eg, the first monitoring unit 311 ) is operating abnormally through the second alarm information.

[0181] Exemplarily, the second alarm information may be, for example, an error message output to the operating system, an error log, an alarm message, etc. This embodiment of the present application does not specifically limit this.

[0182] In the above embodiments, the first isolation module 300 controls the transmission of the first message based on the correspondence between the first message and the first preset protocol when monitoring the first message sent by the second functional module 120 to the first functional module 110. However, when the first functional module 110 sends a first access request message to the second functional module 120, and the first message is a response message corresponding to the first access request message, the second functional module 120 may not be able to send the first message normally due to some reasons. For example: the second functional module 120 operates abnormally, and after receiving the first access request message, it cannot send the first message normally. For another example: the communication between the first functional module 110 and the second functional module 120 is abnormal, resulting in the second functional module 120 being unable to receive the first access request message, and thus not sending the first message.

[0183] Exemplarily, the first access request message includes but is not limited to any one or more of the following: a write request message, a read request message, a synchronization request message, a lock request message, etc. Correspondingly, the first message includes but is not limited to any one or more of the following: a write response message, a read response message, a synchronization response message, a lock response message, etc.

[0184] Generally speaking, after the first functional module 110 sends the first access request message to the second functional module 120, it will wait for the second functional module 120 to return a response message. If the response message is still not received after waiting for the preset maximum waiting time, it can be considered that the first functional module 110 is stuck. Among them, the maximum waiting time can be pre-configured in the register 330, or can be configured by software. The maximum waiting time can be, for example, several milliseconds, several microseconds, several seconds, etc., which is not limited in the embodiment of the present application.

[0185] Figure 5 is a third structural diagram of an integrated circuit 10 provided by an exemplary embodiment of the present disclosure.

[0186] like Figure 5As shown, in some embodiments, in order to prevent the first functional module 110 from being stuck due to long-term waiting for the response message, the first isolation module 300 may further include a response monitoring submodule 320. The response monitoring submodule 320 is used, for example, to monitor the message passing through the first isolation module 300, and resend the request message to the module that should send the response message when the response message is monitored to be timed out. The response monitoring submodule 320 may include a functional circuit and a communication interface for implementing its functions. When the first access request message sent by the first functional module 110 to the second functional module 120 passes through the first isolation module 300, the response monitoring submodule 320 may monitor the first access request message, and determine whether the first message sent by the second functional module 120 is monitored within a first time period after the first access request message is monitored. The first message here is a response message sent by the second functional module 120 to the first functional module 110 when the first access request message sent by the first functional module 110 is received. If the first message is not monitored, the response monitoring submodule 320 resends the first access request message to the second functional module 120. If the first message is monitored, the response monitoring submodule 320 sends the first message to the protocol checking submodule 310 for processing.

[0187] Further Figure 5 As shown, in one embodiment, the response monitoring submodule 320 may include a second monitoring unit 321 and a message retransmission unit 322. In one example, each unit in the response monitoring submodule 320, such as the second monitoring unit 321 and the message retransmission unit 322, may be two different sub-functional circuits in the response monitoring submodule 320, and the second monitoring unit 321 and the message retransmission unit 322 may be communicatively connected via a communication interface in the response monitoring submodule 320. In another example, each unit in the response monitoring submodule 320, such as the second monitoring unit 321 and the message retransmission unit 322, may also be two different software units in a software program for implementing the function of the response monitoring submodule 320. The embodiment of the present application does not limit the implementation of the second monitoring unit 321 and the message retransmission unit 322.

[0188] In one implementation, the second monitoring unit 321 may determine whether the first message is monitored within a first time period after the first access request message is monitored. If the first message is not monitored, the second monitoring unit 321 sends a second error message to the message retransmission unit 322. The first time period may be less than the maximum waiting time period, and the second error message may include an error type, for example, including an error type of timeout.

[0189] Exemplarily, the first duration may be pre-configured in register 330 or may be configured by software. The first duration may be several milliseconds, several microseconds, or several seconds, for example: 50 milliseconds, 100 milliseconds, 300 milliseconds, 1000 milliseconds, 100 microseconds, 500 microseconds, 800 microseconds, etc., which is not limited in the embodiment of the present application.

[0190] In one example, the second error information may include specific content of the error type, such as: response timeout. In this case, the amount of data sent by the second monitoring unit 321 to the message retransmission unit 322 is large, which is not conducive to improving the communication efficiency between the second monitoring unit 321 and the message retransmission unit 322.

[0191] In another example, in order to improve the communication efficiency between the second monitoring unit 321 and the message retransmission unit 322, if a corresponding error code is set in advance for each error type, the second error information does not need to include the specific content of the error type, but only needs to include the error code corresponding to the error type, thereby reducing the amount of data sent and improving the communication efficiency between the second monitoring unit 321 and the message retransmission unit 322.

[0192] Exemplarily, the second monitoring unit 321 can determine the error code to be included in the second error information by looking up a table. For example, in the case where the first relationship table is pre-stored in the register 330, the second monitoring unit 321 can query the error code to be included in the second error information from the first relationship table. For example, if the error type is timeout, and the error code of the error type timeout in the first relationship table is 4, then the second monitoring unit 321 can determine that the error code included in the second error information is 4 by querying the first relationship table.

[0193] In addition, the register 330 may also include a second relationship table. The second relationship table may be a relationship table associated with the second monitoring unit 321, that is, the second relationship table may be used exclusively by the second monitoring unit 321. The second relationship table may also record the correspondence between the error type and the error code, so that the second monitoring unit 321 can determine the error code to be included in the second error information by querying the second relationship table. Of course, the second relationship table may also be a relationship table not associated with the second monitoring unit 321, that is, the second relationship table may also be provided to other units and modules for use. The embodiment of the present disclosure does not specifically limit the association between the second relationship table and the second monitoring unit 321.

[0194] It can be understood that when the first relationship table is associated with the first monitoring unit 311 and the second relationship table is associated with the second monitoring unit 321, the contents in each relationship table can be flexibly and differentiatedly configured according to the functions of the corresponding monitoring units (for example: the content of monitoring, the content of error information to be reported, etc.) without affecting each other.

[0195] In one implementation, when the second monitoring unit 321 monitors the first access request message, it can also record the time t1 when the second functional module 120 sends the first access request message, and determine the time t2 when the first functional module 110 ends waiting (i.e., the time when the first functional module 110 enters the stuck state) based on the longest waiting time of the first functional module 110. In this way, the second monitoring unit 321 can configure the time t1 and the time t2 in the second error information and send it to the message resending unit 322 for use when the message resending unit 322 performs its function.

[0196] Next, when receiving the second error information, the message resending unit 322 may resend the first access request message to the second functional module 120. In this way, if the second functional module 120 receives the resent first access request message, it may respond to the first access request message and send the first message, thereby increasing the possibility that the first functional module 110 receives the first message and reducing the possibility that the first functional module 110 is stuck.

[0197] In one implementation, when the second monitoring unit 321 monitors the first access request message, the message retransmission unit 322 may cache the first access request message in the register 330 for backup. Thus, if the message retransmission unit 322 receives the second error information, the message retransmission unit 322 may read the cached first access request message from the register 330, and then retransmit the first access request message to the second functional module 120.

[0198] In one implementation, in order to further increase the possibility that the first functional module 110 receives the first message, the message retransmission unit 322 may retransmit the first access request message to the second functional module 120 multiple times within the longest waiting time after the first functional module 110 sends the first access request message.

[0199] For example, it is assumed that the longest waiting time is 600 milliseconds and the first time is 100 milliseconds. When the second monitoring unit 321 monitors the first access request message sent at time t1, it waits for the first time (100 milliseconds). If the first message is not detected, it sends a second error message to the message retransmission unit 322. The message retransmission unit 322 receives the second error message, retransmits the first access request message to the second functional module 120, and waits for a second time, which can be the same as or different from the first time, for example, the second time is also 100 milliseconds. If the first message is still not monitored, the message retransmission unit 322 sends the first access request message to the second functional module 120 again, and continues to wait for the second time, and so on, until the second monitoring unit 321 monitors the first message, or until the time reaches time t2 (i.e., time t1 + 600 milliseconds).

[0200] Thus, before the first functional module 110 ends waiting, the message retransmission unit 322 can periodically send the first access request message to the second functional module 120 multiple times, thereby increasing the possibility of the first functional module 110 receiving the first message and reducing the possibility of the first functional module 110 being stuck.

[0201] It is understandable that, when the second functional module 120 operates abnormally, such as being stuck, even if the message retransmission unit 322 sends the first access request message to the second functional module 120 multiple times, the second functional module 120 will not return the first message. In this case, continuing to send the first access request message is an invalid operation. In order to avoid such invalid operation, in one implementation, a maximum number of retransmissions can also be set for the message retransmission unit 322. For example, the maximum number of retransmissions is 3 times. Then, after the message retransmission unit 322 retransmits the first access request message to the first functional module 110 three times, even if the first message is not monitored or the time does not reach the moment t2, the message retransmission unit 322 will not continue to send the first access request message to the first functional module 110.

[0202] Among them, the second duration and the maximum number of retransmissions can be pre-configured in the register 330, or can be configured by software, and the embodiment of the present application does not limit this.

[0203] It is understandable that when the message retransmission unit 322 retransmits the first access request message to the second functional module 120 once or multiple times, if the first functional module 110 still does not receive the first message, the first functional module 110 will enter a stuck state at time t2 when the waiting ends.

[0204] In one implementation, in order to avoid the first functional module 110 from getting stuck, if the second processing unit 323 does not monitor the first message within a second period of time after resending the first access request message, the second processing unit 323 may send a preset response message corresponding to the first access request message to the first functional module 110.

[0205] Among them, if the second processing unit 323 sends the first access request message to the first functional module 110 multiple times, then if the second processing unit 323 does not monitor the first message within the second time period after the last time the first access request message was sent, the second processing unit 323 can send a preset response message to the first functional module 110.

[0206] In an example, the preset response message may be a default response message, which may be pre-configured in the register 330 , so that the second processing unit 323 may read the default response message from the register 330 and send the default response message to the first functional module 110 .

[0207] The default response message may be a message corresponding to the first preset protocol, so that the first functional module 110 will not get stuck after receiving the default response message. For example, the number of data in the default response message may be the same as the target number in the first preset protocol.

[0208] It is understandable that, since the second processing unit 323 does not know the correct content of the data in the first message, the data in the default response message is not the response data expected by the first functional module 110 in terms of content. However, since the first preset protocol defines the target number of data in the message, but does not define the specific content of the message, based on the first preset protocol, when the first functional module 110 receives a response message, as long as the target number of data is received, it will be considered that a response message that complies with the first preset protocol has been received from the second functional module 120. Therefore, the first functional module 110 will release the suspended state of waiting to receive the response message, and will not get stuck, thus achieving a good security isolation of different functional modules.

[0209] In another example, the preset response message may be a preset error response message, and the error response message is used to report an error response status (response error) to the first functional module 110. In this way, when the first functional module 110 receives the error response message, it can determine that the second functional module 120 has a response error, thereby releasing the suspended state of waiting to receive the response message, and thus preventing a stuck state, thereby well achieving safe isolation of different functional modules.

[0210] In an implementation, if the second processing unit 323 does not monitor the first message within a second period of time after resending the first access request message, the second processing unit 323 may send a second error message to the third function module 130 .

[0211] In one example, the second error information may include specific content of the error type, such as: response timeout. In this case, the amount of data sent by the second processing unit 323 to the third functional module 130 is large, which is not conducive to improving the communication efficiency between the second processing unit 323 and the third functional module 130.

[0212] In another example, in order to improve the communication efficiency between the second processing unit 323 and the third functional module 130, if a corresponding error code is set in advance for each error type, the second error information does not need to include the specific content of the error type, but only needs to include the error code corresponding to the error type, thereby reducing the amount of data sent and improving the communication efficiency between the second processing unit 323 and the third functional module 130.

[0213] The second processing unit 323 can determine the error code that should be included in the second error information by looking up a table. For example, the second processing unit 323 can query the error code that should be included in the second error information from the first relationship table or the second relationship table. For example, if the error type is timeout, and the error code of the error type timeout is defined as 4 in the second relationship table, then the second processing unit 323 can determine that the error code included in the second error information is 4 by querying the second relationship table.

[0214] In another implementation, if the second monitoring unit 321 does not monitor the first message within the first time period after monitoring the first access request message, the second monitoring unit 321 may write the second error information into the register 330. Thereafter, after resending the first access request message, if the second processing unit 323 does not monitor the first message within the second time period, it may send a second interrupt signal to the third functional module 130. The second interrupt signal may be a hardware signal or a software signal.

[0215] Taking the second interrupt signal as a hardware signal as an example, the third functional module 130 may include a second hardware interface for receiving an external hardware interrupt signal, and the second hardware interface and the first hardware interface may be the same interface or different interfaces. The second processing unit 323 may be connected to the second hardware interface of the third functional module 130 for communication. In one example, the second interrupt signal may be a high-level signal, so when the second interrupt signal is not sent, the second processing unit 323 inputs a low level to the second hardware interface of the third functional module 130, and when the second interrupt signal is sent, the second processing unit 323 inputs a high level to the second hardware interface of the third functional module 130. In another example, the second interrupt signal may be a low-level signal, so when the second interrupt signal is not sent, the second processing unit 323 inputs a high level to the second hardware interface of the third functional module 130, and when the second interrupt signal is sent, the second processing unit 323 inputs a low level to the second hardware interface of the third functional module 130.

[0216] The embodiment of the present application does not specifically limit the implementation method of the second interrupt signal.

[0217] Next, the third functional module 130 obtains the second error information from the register 330 when receiving the second interrupt signal.

[0218] It is understandable that, when the historical message transmitted between the first functional module 110 and the second functional module 120 does not correspond to the first preset protocol, the register 330 may also include error information corresponding to the historical message. In other words, when the third functional module 130 receives the second interrupt signal, it can obtain the second error information from the register 330, and can also obtain other error information corresponding to the historical message from the register 330.

[0219] What specific information the third functional module 130 can obtain may depend on the strategy of obtaining information by the third functional module 130 and the configuration of the register 330, and this embodiment of the present application does not limit this.

[0220] In an example, when the third functional module 130 receives the second interrupt signal, it can obtain all error information from the register 330 .

[0221] In an example, the register 330 may store the error information in a first-in-first-out queue. When the third functional module 130 receives the second interrupt signal, it may obtain the latest error information, ie, the second error information, from the end of the first-in-first-out queue.

[0222] In this way, the second processing unit 323 does not need to send the second error information directly to the third functional module 130, but only needs to send the second interrupt signal to the third functional module 130, and the third functional module 130 obtains the second error information from the register 330, thereby reducing the amount of data sent between the second processing unit 323 and the third functional module 130 and improving the communication efficiency between the second processing unit 323 and the third functional module 130.

[0223] Next, when the third functional module 130 obtains the second error information, it can execute a corresponding processing strategy based on the second error information, for example, restarting or resetting the second functional module 120, so that the second functional module 120 is restored from an abnormal state to a normal state, so as to avoid the error from happening again or reduce the frequency of the error. In some implementations, the processing strategy of the third functional module 130 can also be set by the user, which is not limited in the embodiments of the present disclosure.

[0224] In one embodiment, the response monitoring submodule 320 may further include a second recovery unit 324. The second recovery unit 324 may restore the second monitoring unit 321, the message retransmission unit 322, and the second processing unit 323 to an enabled state after the response monitoring submodule 320 completes the timeout response to the first message, thereby enabling the response monitoring submodule 320 to start a new round of monitoring processing functions.

[0225] The response monitoring submodule 320 completing the timeout response to the first message may include:

[0226] After the message retransmission unit 322 retransmits the first access request message, the second monitoring unit 321 monitors the first message. In the case where the second monitoring unit 321 does not monitor the first message, the second processing unit 323 completes sending a preset response message corresponding to the first access request message to the first functional module 110. Alternatively, in the case where the second monitoring unit 321 does not monitor the first message, the second processing unit 323 completes sending the second error information to the third functional module 130. Alternatively, in the case where the second monitoring unit 321 does not monitor the first message, the second processing unit 323 completes sending the second interrupt signal to the third functional module 130.

[0227] That is, in the case where the first message times out, if each unit of the response monitoring submodule 320 completes its own function, it can be determined that the response monitoring submodule 320 completes the timeout response to the first message.

[0228] It should be noted here that when the first message times out, the various units of the response monitoring submodule 320 will not respond to the timeout of other messages while executing their respective functions. That is to say, during this period, the various units of the response monitoring submodule 320 are in a disabled state, or in a busy state.

[0229] After the response monitoring submodule 320 completes the timeout response to the first message, in order to enable the response monitoring submodule 320 to respond to the subsequent timeout of other messages, the second recovery unit 324 can restore each unit in the response monitoring submodule 320, such as the second monitoring unit 321, the message retransmission unit 322 and the second processing unit 323, to an enable state, or to an idle state, or to reset each unit. In this way, if a message timeout is detected later, the response monitoring submodule 320 can continue to execute the corresponding function to achieve the timeout response to the message.

[0230] In the embodiment of the present application, after the second monitoring unit 321 monitors the timeout of the first message, and the message retransmission unit 322 retransmits the first access request message to the second functional module 120, if the second monitoring unit 321 still fails to monitor the first message, the second processing unit 323 may send a second error message or a second interrupt signal to the third functional module 130. Then, if the third functional module 130 never receives the second error message or the second interrupt signal, it usually means that the first message has not timed out, or the function of the response monitoring submodule 320 is abnormal. The function abnormality of the response monitoring submodule 320 may include, for example: the second monitoring unit 321 cannot monitor the timeout of the first message, or the second processing unit 323 cannot normally send the second error message or the second interrupt signal. However, the third functional module 130 is not clear about the specific reason why it has never received the second error message or the second interrupt signal, that is, the third functional module 130 is not clear about whether the function of the response monitoring submodule 320 is normal.

[0231] In one embodiment, in order for the third functional module 130 to know whether the function of the response monitoring submodule 320 is normal, the response monitoring submodule 320 further includes a second testing unit 325 .

[0232] The second test unit 325 may send a second test message to the second monitoring unit 321 , for example, the second test unit 325 may periodically send a second test message to the second monitoring unit 321 .

[0233] Exemplarily, the sending period of the second test message may be pre-configured in the register 330, or may be configured by software. The sending period of the second test message may be several milliseconds, several microseconds, or several seconds, for example: 10 milliseconds, 100 milliseconds, 300 milliseconds, 800 milliseconds, 10 microseconds, 200 microseconds, 500 microseconds, etc., which is not limited in the embodiment of the present application.

[0234] In the embodiment of the present application, the second monitoring unit 321 can be configured to monitor the response message corresponding to the second test message within the first time period after receiving the second test message. This function can be configured by hardware (for example, in the register 330) or software. However, in order to test the function of the response monitoring submodule 320, the second test unit 325 does not send the response message corresponding to the second test message to the second monitoring unit 321. In other words, the second test unit 325 creates a timeout scenario to test whether the function of the response monitoring submodule 320 is normal.

[0235] Since the second test message is sent periodically, when the second monitoring unit 321 functions normally, the second monitoring unit 321 will periodically monitor the second test message and periodically monitor whether a response message corresponding to the second test message is received.

[0236] It is understandable that, since the second test unit 325 does not send a response message corresponding to the second test message to the second monitoring unit 321, the second monitoring unit 321 will not monitor the response message corresponding to the second test message in each cycle. Therefore, if the function of the second monitoring unit 321 is normal, the second monitoring unit 321 will periodically send an error message including an error type of timeout to the second processing unit 323, such as the second error message.

[0237] If the function of the second processing unit 323 is normal, after receiving the error information, the second processing unit 323 will send the second error information or the second interrupt signal to the third functional module 130. In other words, if the second monitoring unit 321 does not periodically monitor the response message corresponding to the second test message, the second processing unit 323 will periodically send the second error information or the second interrupt signal to the third functional module 130.

[0238] That is, if the third functional module 130 can periodically receive the second error information or the second interrupt signal, it means that the functions of the second monitoring unit 321 and the second processing unit 323 are normal. On the contrary, if the third functional module 130 cannot periodically receive the second error information or the second interrupt signal, it means that the functions of the second monitoring unit 321 and / or the second processing unit 323 are abnormal.

[0239] In one implementation, the third functional module 130 may output the third alarm information when receiving the second error information or the second interrupt signal, so as to indicate through the third alarm information that the second monitoring unit 321 has detected a message that does not conform to the first preset protocol. In this way, if the third functional module 130 can periodically output the third alarm information, it means that the function of the response monitoring submodule 320 is normal, and if the third functional module 130 cannot periodically output the third alarm information, it means that the function of the response monitoring submodule 320 is abnormal.

[0240] In another implementation, the third function module 130 may output fourth alarm information when the second error information or the second interrupt signal is not periodically received, so as to indicate the function abnormality of the response monitoring submodule 320 through the second alarm information.

[0241] Exemplarily, the fourth alarm information may be, for example, an error message output to the operating system, an error log, an alarm message, etc. This embodiment of the present application does not specifically limit this.

[0242] The above embodiments take the first isolation module 300 as an example to perform security protection on the first functional module 110, and describe in detail the security protection method of the functional module by the isolation module. It is understandable that in some embodiments, more isolation modules can be set to protect other functional modules in the integrated circuit 10 based on actual needs and factors such as the security level of the functional module. For example, an isolation module can be set between the second functional module 120 and the interconnection module 200 to perform security protection on the second functional module 120. The specific implementation method can refer to the above embodiments, and is not specifically limited here.

[0243] In addition, since the interconnection module 200 is responsible for the communication between the various modules in the integrated circuit 10, it sometimes needs to have a higher security level. Therefore, it also needs to be securely protected to ensure that the interconnection module 200 will not be affected by illegal access and timeout response.

[0244] Figure 6 is a fourth structural diagram of an integrated circuit 10 provided by an exemplary embodiment of the present disclosure.

[0245] like Figure 6 As shown, in one embodiment, the integrated circuit 10 may further include a second isolation module 400 .

[0246] The second isolation module 400 may be arranged on the communication link between the interconnection module 200 and the second functional module 120. Thus, before the first message sent by the second functional module 120 to the first functional module 110 reaches the interconnection module 200, the second isolation module 400 may control the transmission of the first message based on the correspondence between the first message and the second preset protocol.

[0247] The second preset protocol may be the same as or different from the first preset protocol, and may be specifically determined by the bus protocol standard used between the interconnection module 200 and the second functional module 120 , which is not limited in the embodiment of the present application.

[0248] Specifically, when the first message does not correspond to the second preset protocol, the second isolation module 400 can block the first message. In this way, neither the interconnection module 200 nor the first functional module 110 will receive the first message, thereby avoiding the interconnection module 200 and the first functional module 110 from getting stuck, thereby achieving a good security isolation of different functional modules.

[0249] In addition, when the first message corresponds to the second preset protocol, the second isolation module 400 can continue to transmit the first message, for example, transparently transmit the first message or perform preset processing on the first message before transmitting it to the first isolation module 300. In this way, the first message can be sent to the first isolation module 300 via the interconnection module 200. The first isolation module 300 can continue to control the transmission of the first message based on the correspondence between the first message and the second preset protocol.

[0250] The specific implementation of the second isolation module 400 may refer to the first isolation module 300 and will not be described in detail here.

[0251] It can be seen that in the integrated circuit 10 provided by the embodiment of the present disclosure, a first isolation module 300 is provided between the first functional module 110 and the interconnection module 200, and a second isolation module 400 is provided between the second functional module 120 and the second isolation module 400. When the second functional module 120 sends a first message to the first functional module 110, before the first message reaches the interconnection module 200, the second isolation module 400 can control the transmission of the first message based on the correspondence between the first message and the second preset protocol, so as to ensure that the interconnection module 200 will not be affected by illegal access and timeout response, and protect the interconnection module 200. Before the first message reaches the first functional module 110, the first isolation module 300 can continue to control the transmission of the first message based on the correspondence between the first message and the second preset protocol, so as to ensure that the first functional module 110 will not be affected by illegal access and timeout response, and protect the first functional module 110.

[0252] That is to say, the integrated circuit 10 provided in the embodiment of the present disclosure can achieve dual control of the first message by setting the first isolation module 300 and the second isolation module 400, which can not only protect the interconnection module 200, but also achieve dual protection of the first functional module 110, thereby improving the reliability of the integrated circuit 10.

[0253] In one embodiment, the first isolation module 300 may also be used to provide protection for the interconnection module 200 , and the second isolation module 400 may also be used to provide protection for the second functional module 120 .

[0254] For example, before the second message sent by the first functional module 110 to the second functional module 120 reaches the interconnection module 200, the first isolation module 300 can control the transmission of the first message based on the correspondence between the second message and the second preset protocol. The second message can be an access request message sent by the first functional module 110 to the second functional module 120, or a response message, which is not limited in the embodiment of the present application.

[0255] Exemplarily, when the second message is an access request message, the second message includes but is not limited to any one or more of the following: a write request message, a read request message, a synchronization request message, a lock request message, etc. When the first message is a response message, the first message includes but is not limited to any one or more of the following: a write response message, a read response message, a synchronization response message, a lock response message, etc.

[0256] Specifically, when the first message does not correspond to the second preset protocol, the first isolation module 300 can block the second message. In this way, neither the interconnection module 200 nor the second functional module 120 will receive the second message, thereby avoiding the interconnection module 200 and the second functional module 120 from getting stuck, thereby achieving safe isolation of different functional modules.

[0257] In addition, when the second message corresponds to the second preset protocol, the first isolation module 300 can transparently transmit the second message, so that the second message is sent to the second isolation module 400 via the interconnection module 200. The second isolation module 400 can continue to control the transmission of the second message based on the correspondence between the first message and the second preset protocol.

[0258] It can be seen that in the integrated circuit 10 provided by the embodiment of the present disclosure, when the first functional module 110 sends the second message to the second functional module 120, before the second message reaches the interconnection module 200, the first isolation module 300 can control the transmission of the second message based on the correspondence between the second message and the second preset protocol, so as to ensure that the interconnection module 200 will not be affected by illegal access and timeout response, and protect the interconnection module 200. Before the second message reaches the second functional module 120, the second isolation module 400 can continue to control the transmission of the second message based on the correspondence between the second message and the second preset protocol, so as to ensure that the second functional module 120 will not be affected by illegal access and timeout response, and protect the second functional module 120.

[0259] That is to say, the integrated circuit 10 provided in the embodiment of the present disclosure can achieve dual control of the second message by setting the first isolation module 300 and the second isolation module 400, which can not only protect the interconnection module 200, but also achieve dual protection of the second functional module 120, thereby improving the reliability of the integrated circuit 10.

[0260] In addition, the first isolation module 300 and the second isolation module 400 implement bidirectional transmission control of messages between the first functional module 110 and the second functional module 120, thereby improving the flexibility of message transmission control.

[0261] Figure 7 is a fifth structural diagram of an integrated circuit 10 provided by an exemplary embodiment of the present disclosure.

[0262] like Figure 7 As shown, in one embodiment, the second isolation module 400 can be set on the communication link between the interconnection module 200 and the second functional module 120 , and can also be set on the communication link between the interconnection module 200 and the first isolation module 300 .

[0263] In this way, when the second functional module 120 sends a second message to the first functional module 110, the second isolation module 400 can control the transmission of the second message before the second message reaches the interconnection module 200; when the first functional module 110 sends a first message to the second functional module 120, the second isolation module 400 can control the transmission of the first message before the first message reaches the interconnection module 200. In this way, the second isolation module 400 can be used to control the bidirectional transmission of messages passing through the interconnection module 200.

[0264] Further Figure 7As shown, in one implementation, the second isolation module 400 can be set on the communication link between the interconnection module 200 and other multiple modules. For example, in addition to the first functional module 110 and the second functional module 120, the integrated circuit 10 can also include at least one other module, such as a fourth functional module 140, a fifth functional module 150, etc. The second isolation module 400 can be set on the communication link between the first functional module 110 and the interconnection module 200, and / or, can be set on the communication link between the second functional module 120 and the interconnection module 200, and / or, can be set on the communication link between the fourth functional module 140 and the interconnection module 200, and / or, can be set on the communication link between the fifth functional module 150 and the interconnection module 200. In this way, the second isolation module 400 can realize circuit isolation between the interconnection module 200 and other multiple modules. That is to say, messages from other modules, such as messages from the fourth functional module 140 and messages from the fifth functional module 150, will first pass through the second isolation module 400 before being sent to the interconnection module 200. The second isolation module 400 can control the transmission of the message based on the correspondence between the message and the second preset protocol to determine whether to send the message to the interconnection module 200.

[0265] It should be noted that in the embodiment of the present disclosure, the second isolation module 400 is arranged on the communication link between the interconnection module 200 and other multiple modules, and realizes the isolation of the interconnection module 200 from other modules in the circuit. Figure 7 The multiple patterns of the second isolation module 400 illustrated in various directions of the interconnection module 200 are only used to express the circuit isolation between the interconnection module 200 and other different modules by the second isolation module 400, and do not represent the actual number and distribution of the second isolation modules 400, that is, they do not constitute a limitation on the physical structure of the second isolation module 400. For example, the multiple second isolation modules 400 can be physically implemented as one module, or as multiple physical modules. The actual number and distribution of the second isolation modules 400 can be reasonably designed according to factors such as the line layout of the communication link on the integrated circuit 10, and the embodiments of the present disclosure do not limit this.

[0266] Exemplary Methods

[0267] The method flow of this embodiment can be applied to the integrated circuit 10, and can be specifically implemented by an isolation module in the integrated circuit 10. The isolation module can be, for example, the first isolation module 300, the second isolation module 400 and / or other isolation modules in the above embodiment.

[0268] Figure 8This is a first flowchart of a communication method based on an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0269] like Figure 8 As shown, the method comprises the following steps:

[0270] S101, monitoring a first message sent by a second functional module to a first functional module.

[0271] S102: Control the transmission of the first message based on the correspondence between the first message and the first preset protocol.

[0272] Specifically, before the first message is delivered to the first functional module, the transmission of the first message may be controlled based on the corresponding relationship between the first message and the first preset protocol.

[0273] Fig. 9 1 is a second flow chart of a communication method based on an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0274] like Fig. 9 As shown, in one implementation, step S102, i.e., controlling the transmission of the first message based on the correspondence between the first message and the first preset protocol, may specifically include:

[0275] Step S1021: When the first message does not correspond to the first preset protocol, the first message is blocked.

[0276] Step S1022: When the first message corresponds to the first preset protocol, continue to transmit the first message.

[0277] Continuing to transmit the first message may include, for example: transparently transmitting the first message or performing a preset process on the first message and then transmitting it to the first functional module.

[0278] In one implementation, the first message does not correspond to the first preset protocol, including that the number of data in the first message is different from the preset target number. After step S1021, the method may further include:

[0279] Step S1031: When the number of data in the first message is different from the target number, a first association message is sent to the first functional module, and the number of data in the first association message is equal to the target number.

[0280] Wherein, when the number of data in the first message is less than the target number, the number of data in the first message can be supplemented to the target number to obtain the first associated message. And, when the number of data in the first message is greater than the target number, the target number of data can be intercepted from the first message to obtain the first associated message.

[0281] In one implementation, after step S1021, the method may further include:

[0282] Step S1032: Send first error information to the third functional module, where the first error information includes an identifier of the second functional module and an error type of the first message.

[0283] In another implementation, after step S1021, the first error information may also be written into a register, and then a first interrupt signal may be sent to the third functional module. The first error information includes an identifier of the second functional module and an error type of the first message, so that the third functional module obtains the first error information from the register when receiving the first interrupt signal.

[0284] In one implementation, after step S1031 and / or step S1032, the method may further include:

[0285] Step S104, restoring the isolation module to an enabled state.

[0286] In this way, the isolation module can start a new round of monitoring and processing functions. The specific operations of each step in this embodiment refer to the above-mentioned device embodiment, which will not be repeated here.

[0287] It can be seen from the above technical solution that the method provided in this embodiment, when the second functional module sends a first message to the first functional module, for example, before the first message is delivered to the first functional module, the transmission of the first message can be controlled based on the correspondence between the first message and the first preset protocol, thereby avoiding the first functional module from receiving the first message that does not correspond to the first preset protocol and getting stuck, thereby realizing the safe isolation of different functional modules and improving the reliability of the integrated circuit.

[0288] Fig.10 3 is a third flow chart of a communication method based on an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0289] like Fig.10 As shown, the method comprises the following steps:

[0290] Step S201: monitoring a first access request message sent by a first functional module to a second functional module.

[0291] Step S202: if the first message is not monitored within a first period of time after the first access request message is monitored, resend the first access request message to the second functional module.

[0292] The first message includes a response message sent by the second functional module to the first functional module when the second functional module receives the first access request message sent by the first functional module.

[0293] In one implementation, the monitored first access request message may be cached in a register, and, in the case of receiving the second error information, the first access request message cached in the register may be resent to the second functional module.

[0294] In one implementation, after step S202, the method may further include:

[0295] Step S2031: If the first message is not monitored within a second period of time after the first access request message is resent, a preset response message corresponding to the first access request message is sent to the first functional module.

[0296] In one implementation, after step S202, the method may further include:

[0297] Step S2032: If the first message is not monitored within a second period of time after the first access request message is resent, a second error message is sent to the third functional module.

[0298] In another implementation, after step S202, the second error information may also be cached in a register, and if the first message is not monitored within a second period of time after the first access request message is resent, a second interrupt signal may be sent to the third functional module, so that the third functional module obtains the second error information from the register when the second interrupt signal is received.

[0299] Step S2033: if the first message is monitored within the second time period after the first access request message is resent, continue to transmit the first message.

[0300] In one implementation, after step S2031 and / or step S2032, the method may further include:

[0301] Step S204, restoring the isolation module to an enabled state.

[0302] In this way, the isolation module starts a new round of monitoring and processing functions.

[0303] The specific operations of each step in this embodiment refer to the aforementioned device embodiment and will not be repeated here.

[0304] It can be seen from the above technical solution that the method provided in this embodiment, after the first functional module sends a first access request message to the second functional module, if the first message is not monitored within a first time period, the first access request message is resent to the second functional module, thereby avoiding the first functional module being stuck due to being in a suspended state for a long time due to not receiving a response message from the second functional module, thereby achieving good security isolation of different functional modules and improving the reliability of the integrated circuit.

[0305] Exemplary integrated circuit system

[0306] Fig.11 A structural diagram of an integrated circuit system 100 provided in an embodiment of the present disclosure includes at least one integrated circuit 10 and a memory 20 .

[0307] Integrated circuit 10 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in integrated circuit system 100 to perform desired functions.

[0308] The memory 20 may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the integrated circuit 10 may run one or more computer program instructions to implement the communication method based on the integrated circuit and / or other desired functions of the various embodiments of the present disclosure described above.

[0309] In one example, the integrated circuit system 100 may further include: an input device 30 and an output device 40 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0310] The input device 30 may also include, for example, a touch screen, a button, a voice input device, etc.

[0311] The output device 40 can output various information to the outside, and may include, for example, a display, a speaker, a communication network and a remote output device connected thereto, and the like.

[0312] Of course, to simplify, Fig.11 Only some of the components related to the present disclosure in the integrated circuit system 100 are shown, and components such as buses, input / output interfaces, etc. are omitted. In addition, according to specific application scenarios, the integrated circuit system 100 may also include any other appropriate components.

[0313] Exemplary computer program products and computer-readable storage media

[0314] In addition to the above-mentioned methods and devices, embodiments of the present disclosure may also provide a computer program product, including computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the integrated circuit-based communication method of various embodiments of the present disclosure described in the above-mentioned "Exemplary Method" section.

[0315] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0316] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, enables the processor to execute the steps of the integrated circuit-based communication method of various embodiments of the present disclosure described in the above “Exemplary Method” section.

[0317] Computer readable storage media can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium is, for example, but not limited to, a system, device or device including electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0318] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and cannot be considered as necessary for each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, rather than limitation, and the above details do not limit the present disclosure to being implemented by adopting the above specific details.

[0319] Those skilled in the art may make various changes and modifications to the present disclosure without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present disclosure claims and their equivalents, the present disclosure is also intended to include these modifications and variations.

Claims

1. An integrated circuit, comprising: A first functional module, a second functional module, an interconnection module and a first isolation module; The first functional module is communicatively connected with the second functional module via the interconnection module; the first isolation module is arranged on the communication link between the first functional module and the interconnection module; The second functional module is configured to send a first message to the first functional module; The first isolation module is configured to control the transmission of the first message based on the corresponding relationship between the first message and the first preset protocol.

2. The integrated circuit according to claim 1, wherein: The first isolation module includes a protocol checking submodule; The protocol checking submodule is configured to continue transmitting or block the first message based on a corresponding relationship between the first message and the first preset protocol.

3. The integrated circuit according to claim 2, wherein: The protocol checking submodule comprises a first monitoring unit: The first monitoring unit is configured to determine a correspondence between the first message and the first preset protocol when the first message is monitored.

4. The integrated circuit according to claim 3, wherein: The protocol checking submodule further includes a first processing unit, The first processing unit is configured to block the first message if the first message does not correspond to the first preset protocol; or The first processing unit is configured to, when the first message corresponds to the first preset protocol, continue to transmit the first message to the first functional module.

5. The integrated circuit according to claim 4, wherein: The first message does not correspond to the first preset protocol, including: the number of data in the first message is different from the preset target number; The first processing unit is configured to send a first association message to the first functional module when the number of data in the first message is different from the target number, and the number of data in the first association message is equal to the target number.

6. The integrated circuit according to claim 5, wherein: The first processing unit is configured to, when the number of data in the first message is less than the target number, complete the number of data in the first message to the target number, so as to obtain the first associated message; or the first processing unit is configured to, when the number of data in the first message is greater than the target number, intercept the target number of data from the first message, so as to obtain the first associated message.

7. The integrated circuit according to claim 4, wherein: The integrated circuit also includes a third functional module: The third functional module is configured to receive first error information from the first monitoring unit when the first message does not correspond to the first preset protocol, wherein the first error information includes an identifier of the second functional module and an error type of the first message; or The third functional module is configured to receive a first interrupt signal from the first monitoring unit when the first message does not correspond to the first preset protocol; The third functional module is further configured to obtain first error information when the first interrupt signal is received, where the first error information includes an identifier of the second functional module and an error type of the first message.

8. The integrated circuit according to claim 7, wherein: The third functional module is configured to execute a processing strategy corresponding to the first error information.

9. The integrated circuit of claim 8, wherein: The third functional module is configured to output first alarm information when the first error information is received.

10. The integrated circuit of claim 4, wherein: The protocol checking submodule also includes a first recovery unit; The first restoring unit is configured to restore the first monitoring unit and the first processing unit to an enabled state after the protocol checking submodule completes transmission control of the first message.

11. The integrated circuit of claim 4, wherein: The protocol checking submodule also includes a first testing unit; The first test unit is configured to send a first test message to the first monitoring unit, where the first test message does not correspond to the preset protocol.

12. The integrated circuit of claim 1, wherein: The first isolation module also includes a response monitoring submodule; The response monitoring submodule includes a second monitoring unit and a message retransmission unit; The first message includes a response message sent by the second functional module to the first functional module when the second functional module receives the first access request message sent by the first functional module; The second monitoring unit is configured to send a second error message to the message retransmission unit if the first message is not monitored within a first time period after the first access request message is monitored, wherein the second error message includes an error type of timeout; The message resending unit is configured to resend the first access request message to the second functional module when the second error information is received.

13. The integrated circuit of claim 12, wherein: The message resending unit is configured to, when the first access request message is buffered in a register and, upon receiving the second error information, resend the first access request message buffered in the register to the second functional module.

14. The integrated circuit of claim 13, wherein: The response monitoring submodule also includes a second processing unit; The second processing unit is configured to send a preset response message corresponding to the first access request message to the first functional module if the first message is not monitored within a second period of time after the first access request message is resent.

15. The integrated circuit of claim 14, wherein: The integrated circuit further includes a third functional module: the third functional module is configured to receive the second error information from the second processing unit if the first message is not monitored within a second time period after the first access request message is resent; or The third functional module is configured to receive a second interrupt signal from the second processing unit if the first message is not monitored within a second period of time after the second processing unit resends the first access request message; the third functional module is also configured to obtain the second error information from the register if the second interrupt signal is received, wherein the second error information is cached in the register.

16. The integrated circuit of claim 15, wherein: The third functional module is configured to execute a processing strategy corresponding to the second error information.

17. The integrated circuit of claim 16, wherein: The third functional module is configured to output third alarm information when the second error information is received.

18. The integrated circuit of claim 14, wherein: The response monitoring submodule also includes a second recovery unit; The second recovery unit is configured to restore the second monitoring unit, the message retransmission unit and the second processing unit to an enabled state after the response monitoring submodule completes the timeout processing of the first message.

19. The integrated circuit of claim 16, wherein: The response monitoring submodule also includes a second testing unit; The second test unit is configured to send a second test message to the second monitoring unit; The second monitoring unit is configured to monitor a response message corresponding to the second test message within the first time period after receiving the second test message; The second processing unit is configured to send a second interrupt signal to the third functional module when the second monitoring unit fails to monitor a response message corresponding to the second test message.

20. The integrated circuit of claim 1, wherein: Also includes: a second isolation module, the second isolation module being arranged on a communication link between the interconnection module and the second functional module; The second isolation module is configured to control the transmission of the first message based on the correspondence between the first message and the second preset protocol before the first message reaches the interconnection module.

21. The integrated circuit of claim 1, further comprising, a second isolation module, the second isolation module being further arranged on a communication link between the interconnection module and the first isolation module; The second isolation module is configured to control the transmission of the second message sent by the first functional module to the second functional module based on the correspondence between the second message and the second preset protocol before the second message reaches the interconnection module.

22. The integrated circuit of claim 1, wherein: The security level of the first functional module is higher than the security level of the second functional module.

23. A communication method based on an integrated circuit, wherein: The integrated circuit includes a first functional module and a second functional module, and the method includes: monitoring a first message sent by the second functional module to the first functional module; Based on the correspondence between the first message and the first preset protocol, the transmission of the first message is controlled.

24. The method according to claim 23, wherein: The controlling the transmission of the first message based on the correspondence between the first message and the first preset protocol includes: If the first message does not correspond to the first preset protocol, blocking the first message; or In a case where the first message corresponds to the first preset protocol, the first message continues to be transmitted.

25. The method according to claim 23, wherein: The first message not corresponding to the first preset protocol includes that the number of data in the first message is different from the preset target number; In a case where the number of data in the first message is different from the target number, a first association message is sent to the first functional module, and the number of data in the first association message is equal to the target number.

26. An integrated circuit system, comprising the integrated circuit according to any one of claims 1 to 22 and a memory.

Images