Multi-interface device

Abstract

An apparatus includes a plurality of interfaces, each interface being coupleable to a respective one of a plurality of processing circuitry in a higher criticality compliance state or a lower criticality compliance state. Each interface may receive an interrupt signal from its respective processing circuitry destined for a target processing circuitry of the plurality of processing circuitry, and transmit an interrupt signal emitted by a source processing circuitry of the plurality of processing circuitry to its respective processing circuitry. The control circuitry monitors the interrupt signal flow and determines whether there is a difference in the interrupt signal flow relative to an expected interrupt signal flow, and performs mitigation measures for the difference to avoid violating a higher critical compliance state.

Description

[0001] The present invention relates to a data processing apparatus. In particular, the present invention relates to providing an apparatus comprising a plurality of interfaces, each interface being configured to be coupled to a respective processing circuitry of a plurality of processing circuitry.

[0002] Modern data processing systems typically include multiple instances of processing circuit systems, each of which operates relatively independently of other processing circuit systems, although they may frequently communicate with them. For example, a dedicated processing circuit system may be provided, each of which has a specialized function, and a combination of a group of such heterogeneous processing circuit systems can then provide a data processing system with a range of practical functions. In some such data processing systems, at least one of the processing circuit systems may be required to meet strict safety rules in terms of operational reliability and consistency. Such processing circuit systems may be referred to herein as being able to operate or operate in a more critical compliance state. Due to the nature of the specific data processing performed by other processing circuit systems, other processing circuit systems themselves may not be required to meet the same safety rules. Such processing circuit systems may be referred to herein as being able to operate or operate in a less critical compliance state.

[0003] At least some examples provide an apparatus comprising:

[0004] a plurality of interfaces, each interface being capable of coupling to a respective one of the plurality of processing circuitry, wherein each processing circuitry is in a higher criticality compliance state or a lower criticality compliance state, each interface being configured to:

[0005] receiving an interrupt signal from its corresponding processing circuitry to a target processing circuitry among the plurality of processing circuitry; and

[0006] transmitting an interrupt signal issued by a source processing circuitry among the plurality of processing circuitries to its corresponding processing circuitry; and

[0007] A control circuit system, the control circuit system being configured to:

[0008] monitoring the interrupt signal flow;

[0009] determining whether there is a difference in the interrupt signal flow between a first processing circuitry in the plurality of processing circuitry and a second processing circuitry in the plurality of processing circuitry relative to an expected interrupt signal flow; and

[0010] In response to determining that the discrepancy exists, mitigation measures for the discrepancy are performed to avoid violating the higher criticality compliance state.

[0011] At least some examples provide a data processing system comprising:

[0012] the plurality of processing circuit systems; and

[0013] The above device.

[0014] At least some examples provide a system comprising:

[0015] The above device or the above data processing system is implemented in at least one packaged chip;

[0016] at least one system component; and

[0017] plate,

[0018] The at least one packaged chip and the at least one system component are assembled on the board.

[0019] At least some examples provide a chip-containing product that includes the system described above assembled on a separate board with at least one other product component.

[0020] At least some examples provide a method of operating an apparatus, wherein the apparatus includes a plurality of interfaces, the method comprising:

[0021] coupling the plurality of interfaces to respective ones of the plurality of processing circuitry, wherein each processing circuitry is in a higher criticality compliance state or a lower criticality compliance state;

[0022] At each interface:

[0023] receiving an interrupt signal from its corresponding processing circuitry to a target processing circuitry among the plurality of processing circuitry; and

[0024] transmitting an interrupt signal issued by a source processing circuit system among the plurality of processing circuit systems to its corresponding processing circuit system;

[0025] In this device:

[0026] monitoring the interrupt signal flow;

[0027] determining whether there is a difference in the interrupt signal flow between a first processing circuitry in the plurality of processing circuitry and a second processing circuitry in the plurality of processing circuitry relative to an expected interrupt signal flow; and

[0028] When it is determined that the discrepancy exists, mitigation measures for the discrepancy are performed to avoid violating the higher criticality compliance state.

[0029] The present technology will be further described, by way of example only, with reference to embodiments of the invention as illustrated in the accompanying drawings, read in conjunction with the following description, in which:

[0030] Figure 1 schematically illustrates a data processing system according to some examples;

[0031] Figure 2 is a flow chart showing the sequence of steps taken by some example methods;

[0032] Figure 3 schematically illustrates a data processing system according to some examples;

[0033] Figure 4 schematically illustrates a data processing system according to some examples;

[0034] Figure 5 schematically illustrates some components of an apparatus according to some examples;

[0035] Figure 6 is a flow chart showing the sequence of steps taken by some example methods;

[0036] Figure 7 is a flow chart showing the sequence of steps taken by some example methods;

[0037] Figure 8 schematically illustrates some components of an apparatus according to some examples; and

[0038] Fig. 9 Specific implementations of a data processing system in a packaged chip assembled on a board according to some examples, and a chip-containing product including a data processing system assembled on another board with at least one other product component according to some examples are schematically shown.

[0039] In one example herein, there is an apparatus, the apparatus comprising:

[0040] a plurality of interfaces, each interface being capable of coupling to a respective one of the plurality of processing circuitry, wherein each processing circuitry is in a higher criticality compliance state or a lower criticality compliance state, each interface being configured to:

[0041] receiving an interrupt signal from its corresponding processing circuitry to a target processing circuitry among the plurality of processing circuitry; and

[0042] transmitting an interrupt signal issued by a source processing circuitry among the plurality of processing circuitries to its corresponding processing circuitry; and

[0043] A control circuit system, the control circuit system being configured to:

[0044] monitoring the interrupt signal flow;

[0045] determining whether there is a difference in the interrupt signal flow between a first processing circuitry in the plurality of processing circuitry and a second processing circuitry in the plurality of processing circuitry relative to an expected interrupt signal flow; and

[0046] In response to determining that the discrepancy exists, mitigation measures for the discrepancy are performed to avoid violating the higher criticality compliance state.

[0047] The present invention recognizes that in a data processing system having multiple processing circuit systems, which are heterogeneous in terms of criticality compliance, there is a risk that a higher criticality compliance state of one processing circuit system may be compromised due to the communication of the processing circuit system with another processing circuit system operating in a lower criticality compliance state. Specifically, the present invention solves this problem in the context of interrupt signals exchanged between multiple processing circuit systems. A device is provided, which includes multiple interfaces, each of which can be coupled to a corresponding processing circuit system in the multiple processing circuit systems. The interface receives interrupt signals from the processing circuit system and transmits interrupt signals to the processing circuit system. The control circuit system of the device monitors the interrupt signals and determines whether a difference occurs relative to the expected interrupt signal flow. When this occurs, the control circuit system performs mitigation measures for the difference to avoid violating the higher criticality compliance state. In the case where the criticality compliance of the entire data processing system depends on the criticality compliance of its participating components, the method ensures that the components (lower security level components) included in the components operating in the lower criticality compliance state do not reduce the security of the entire system.

[0048] In some examples, each of the processing circuitry is switchable between a higher criticality compliance state and a lower criticality compliance state.

[0049] In some examples, a first plurality of processing circuit systems in a higher criticality compliance state can be used as a single multi-core lockstep processing unit; and / or a second plurality of processing circuit systems in a lower criticality compliance state can be used as independent units. Providing a multi-core lockstep processing unit is a technique for improving the reliability of data processing, so that processing circuit systems performing mission-critical data processing operations can not only be linked in lockstep, but can also be configured to operate in a higher criticality compliance state. In contrast, processing circuit systems performing non-critical data processing operations can operate independently because the errors that can conceivably occur in the results they generate are considered acceptable in terms of risk, and these processing circuit systems can also be configured to operate in a lower criticality compliance state.

[0050] The difference relative to the expected interrupt signal flow can take a variety of forms. In some examples, the interrupt signal flow has an associated communication protocol; and the difference is determined as a violation of the communication protocol. In some examples, the interrupt signal flow includes a data packet flow; and the difference is a deviation from at least one expected attribute of the data packet flow.

[0051] The deviation from the expected properties of the packet flow can take many forms, but in some examples, the difference includes the presence of unexpected packets in the packet flow. Mitigation measures can take various forms, but in some examples, mitigation measures include at least one of the following:

[0052] discarding the unexpected data packet so that the unexpected data packet is not transmitted to the second processing circuit system; and

[0053] The unintended data packet is modified before being transmitted to the second processing circuitry.

[0054] In some examples, the difference is a lack of an expected packet in the packet stream. The expected packet may be expected in a variety of contexts, but in some examples, the expected packet is an expected response from the first processing circuit system to a premature transmission from the second processing circuit system to the first processing circuit system. In some examples, the mitigation includes replacing the expected packet in the packet stream with a pseudo expected packet.

[0055] In some examples, the apparatus further comprises:

[0056] An interrupt controller interface, the interrupt controller interface being capable of being coupled to an interrupt controller, the interrupt controller being configured to:

[0057] receiving the interrupt signal from the plurality of processing circuit systems;

[0058] Prioritize the interrupt signal;

[0059] And the interrupt signal is forwarded to a corresponding target processing circuit system among the plurality of processing circuit systems.

[0060] In some of these examples, the mitigation includes invoking a recovery mode where:

[0061] The control circuit system sends a signal to the interrupt controller according to the expected interrupt signal flow; and

[0062] The control circuitry sends a restart signal to at least one processing circuitry of the plurality of processing circuitry.

[0063] In some such examples, the control circuitry is configured to generate an emulated data packet corresponding to the expected data packet to send to the interrupt controller, wherein the emulated data packet is not sent to the second processing circuitry.

[0064] In some examples, the difference is a lack of the expected data packet within a given time period. In some examples, the difference includes a difference between a data packet of the data packet stream and an expectation for the data packet. In some examples, the difference corresponds to corruption of the data packet.

[0065] In some examples, mitigation measures include at least one of the following:

[0066] discarding the data packet so that the data packet is not transmitted to the second processing circuit system; and

[0067] The data packet is modified prior to transmitting the data packet to the second processing circuitry.

[0068] In some examples, the modifying includes performing a revision on the data packet that identifies the data packet as erroneous.

[0069] In some examples, the control circuitry sends a signal that a difference exists in response to determining that the difference exists.

[0070] In some examples, the control circuitry triggers a mitigation measure for the first processing circuitry in response to determining that there is a discrepancy. In some examples, the mitigation measure includes causing the first processing circuitry to reboot.

[0071] In some examples, the first processing circuitry is in a lower criticality compliance state and the second processing circuitry is in a higher criticality compliance state.

[0072] In some examples, a given interrupt signal corresponds to multiple transfers within the stream; and

[0073] The control circuitry is configured to determine that the difference exists based on one of the plurality of transmissions.

[0074] In one example herein, there is a data processing system, the data processing system comprising:

[0075] the plurality of processing circuit systems; and

[0076] An apparatus according to any of the preceding examples.

[0077] In one example herein, there is a system, the system comprising:

[0078] An apparatus according to any of the preceding examples or a data processing system according to the preceding examples implemented in at least one packaged chip;

[0079] at least one system component; and

[0080] plate,

[0081] The at least one packaged chip and the at least one system component are assembled on the board.

[0082] In one example herein, there is a chip-containing product, which includes the system of the aforementioned example, which is assembled on another board with at least one other product component.

[0083] In one example herein, there is a method of operating a device, wherein the device includes a plurality of interfaces, the method comprising:

[0084] coupling the plurality of interfaces to respective ones of the plurality of processing circuitry, wherein each processing circuitry is in a higher criticality compliance state or a lower criticality compliance state;

[0085] At each interface:

[0086] receiving an interrupt signal from its corresponding processing circuitry to a target processing circuitry among the plurality of processing circuitry; and

[0087] transmitting an interrupt signal issued by a source processing circuit system among the plurality of processing circuit systems to its corresponding processing circuit system;

[0088] In this device:

[0089] monitoring the interrupt signal flow;

[0090] determining whether there is a difference in the interrupt signal flow between a first processing circuitry in the plurality of processing circuitry and a second processing circuitry in the plurality of processing circuitry relative to an expected interrupt signal flow; and

[0091] When it is determined that the discrepancy exists, mitigation measures for the discrepancy are performed to avoid violating the higher criticality compliance state.

[0092] Some specific embodiments will now be described with reference to the accompanying drawings.

[0093] Figure 1 The data processing system 10 according to some examples is schematically shown. The device 12 includes a plurality of interfaces 14, 15, 16, 17, wherein each interface is configured to couple the device to a corresponding processing circuit system in a plurality of processing circuit systems (PEs) 18, 19, 20, 21. It should be noted that these PEs and their connections are shown as dashed lines in the figure to indicate that Figure 1The specific subject matter shown is the device 12 to which such a PE can be coupled. These processing circuit systems 18, 19, 20, 21 can be arranged to perform a range of data processing tasks, and the nature of these tasks is not closely related to the present invention, except that there is heterogeneity between the processing circuit systems in terms of their criticality compliance. In some contexts, this criticality compliance can be referred to as the safety level of the corresponding component. Specifically, here, the processing circuit systems are each operated in a higher criticality compliance state or a lower criticality compliance state. Here, the terms "higher" and "lower" do not need to be associated with any specific criticality compliance scale, and should be understood as relative terms, for example, it is envisaged that (at least) two criticality compliance levels (or safety levels) are higher than the other. However, a specific risk classification system that defines such criticality compliance levels (safety levels) is certainly within the scope of the present invention, such as the ASIL (Automotive Safety Integrity Level) risk classification system for functional safety of road vehicles defined by the ISO 26262 standard. The system defines four levels A, B, C and D, where A represents the lowest criticality and ASIL D represents the highest criticality. Safety-critical systems such as anti-lock brake systems and airbags require ASIL-D level, while other components can be C level, B level or A level, depending on their safety / risk classification. The device 12 also includes a control circuit system 22. Specifically, the interfaces 14, 15, 16, and 17 are each configured to receive an interrupt signal from its corresponding coupled processing circuit system, wherein the interrupt signal has a target processing circuit system (PE) in multiple processing circuit systems 18, 19, 20, and 21. Therefore, each of the interfaces 14, 15, 16, and 17 is also configured to transmit an interrupt signal issued by another source processing circuit system in multiple processing circuit systems to its corresponding processing circuit system. The interrupt signal is monitored by the control circuit system 22, and specifically, the control circuit system 22 determines whether there is a difference in the expected interrupt signal flow. When such a difference occurs, the control circuit system 22 performs mitigation measures for the difference. The mitigation measures specifically involve ensuring that the compliance of the higher criticality compliance (safety) state of the corresponding processing circuit system is not violated. Other details of the nature of such mitigation measures are described elsewhere in this article.

[0094] Figure 2 is a flowchart showing the sequence of steps taken in some example methods, showing examples such as Figure 112 shown. The process can be viewed as starting at step 50, where the process repeats a loop until the device receives an interrupt signal from or directed to a specific processing element (circuitry). The process then continues to step 52, where it is determined whether the interrupt signal meets expectations (i.e., whether it is consistent with the rules defined by the protocol of such interrupt signal flow - these rules may define or constrain the format of the interrupt signals, the order in which they should be exchanged, their semantic content, etc.). When the received interrupt signal meets, the process continues to step 54, and without further intervention, the interrupt signal is simply forwarded. The process then returns to step 50. However, when the received interrupt signal does not meet, that is, when there is a difference from expectations, the process continues to step 56, where mitigation measures are performed to avoid violating the higher criticality compliance of the relevant processing element.

[0095] Figure 3A data processing system 100 according to some examples is schematically shown. In this exemplary configuration, a plurality of processing circuit systems (cores) are shown, wherein these are presented as two types. A first group of cores 101, 102, 103 is configured to function as a single multi-core lock-step processing unit 105. That is, the three cores 101, 102, 103 perform data processing that is exactly the same as each other, and a synchronization unit 106 continuously checks whether the results of the data processing are the same. If the results are completely different, mitigation measures, warning signals, etc. may be triggered. It should also be noted that, in relation to the present invention, interrupt signals received from or sent to the rest of the data processing system 100 are distributed / combined by an interrupt distribution / combination unit 107. Therefore, in terms of interacting with other components of the data processing system, the processing unit 105 appears to be a single device. In contrast, the second group of cores 108, 109, 110 are each configured to function as an independent unit. Therefore, in this example, the device 112 is provided with a total of four interrupt interfaces 114, 115, 116, 117. The device 112 also includes a control circuit system 118. It should be understood that the multi-core lock-step processing unit 105 is configured in this manner because of the criticality of the data processing tasks it performs. On the other hand, the second group of cores 108, 109, and 110 perform less critical data processing tasks. Therefore, in terms of the criticality compliance state, the multi-core lock-step processing unit 105 is configured to operate in a higher criticality compliance state (at a higher safety level, for example, ASIL-D), while the second group of cores 108, 109, 110, and 105 are configured to operate in a lower criticality compliance state (at a lower safety level, for example, ASIL-B). As described in more detail elsewhere herein, interrupt signals received by interfaces 114, 115, 116, and 117 and to these interfaces are monitored by the control circuit system 118. If the control circuit system 118 determines that there is already a difference in the expected interrupt signal flow, it performs mitigation measures for the difference. The mitigation measures specifically involve ensuring that the compliance of the higher criticality compliance (safety) state of the corresponding processing circuit system is not violated.

[0096] Figure 4A data processing system 150 according to some examples is schematically shown. In this exemplary configuration, four CPUs (processing circuit systems) 151, 152, 153, 154 are explicitly shown (although as indicated by the ellipse in the figure, any number of CPUs can be set). During the data processing they perform, these CPUs send interrupt signals to each other. In order to correctly prioritize the various interrupt signals exchanged and allow the system operator to configure which CPUs can interrupt which CPUs at any given time, the system is also provided with an interrupt controller 157. Typically, a general interrupt controller (GIC) like this receives interrupts from various system components (peripheral devices), prioritizes them, and delivers them to the appropriate processor core. A set of interfaces and arbitration logic components 155 are also provided, which receive interrupt signals incoming from peripheral devices (here a set of CPUs 151 to 154), and also forward outgoing interrupt signals to corresponding devices. Therefore, the device provided by the present invention can be regarded as represented by a protocol verifier module 156 in the accompanying drawings, which is inserted between the interrupt controller 157 and a set of interfaces and arbitration logic components 155. Although the protocol verifier module 156 is shown in the figures as having only one upstream and downstream path for its interrupt controller side and its interface / arbitration logic component side, it should be understood that these are multiple signal paths configured to carry multiple interrupt signals. In the context of the present invention, it should be understood that at least one of the CPUs 151 to 154 is running (or can be switched to) a higher criticality compliance state, while at least another CPU of the CPUs 151 to 154 is running (or can be switched to) a lower criticality compliance state. For example, CPU 151 can be at least one CPU running in a higher criticality compliance state (e.g., compliant with ASIL-D), while CPU 154 can be a CPU running in a lower criticality compliance state (e.g., compliant with ASIL-B). The insertion protocol verifier module 156 ensures that faults that may occur (and can be tolerated there) in the lower criticality CPU 154 will not propagate to the higher criticality CPU 151, and in particular will not cause a violation of the higher criticality compliance state. Furthermore, depending on the point in the transaction at which the violation occurs, the protocol validator module 156 may be required to generate one or more expected other signals (commands) to the interrupt controller so that the interrupt controller itself is not also left waiting for the transaction to complete.

[0097] Figure 5 Some components of the apparatus 200 according to some examples are schematically shown. This may be a configuration of any of the following: Figure 1 The exemplary device 10 in Figure 3 The exemplary device 112 or Figure 4The apparatus 200 is shown to include four interfaces 201, 202, 203, 204, via which interrupt signals are received or transmitted. As an example of an exemplary use configuration, the interface 201 may be arranged to receive an interrupt signal issued by one of the processing circuit systems in a wider system (not shown), and the interface 202 may be arranged to transmit such an interrupt signal (possibly modified) to a processor such as a processor. Figure 4 157 in . In contrast, interface 203 may be arranged to receive an interrupt signal issued by an interrupt controller for one of the processing circuit systems, and interface 204 may be arranged to transmit such an interrupt signal to the corresponding processing circuit system. Typically, when the system components exchanging interrupt signals operate normally, the interrupt signal passes through the device 200 transparently, that is, without any modification. However, the device 200 monitors the signals it passes, and the supervision of this process is managed by the control circuit system 205. Each of the input interfaces 201, 203 has an associated decoder module 206, 207, which is each configured to extract relevant semantic information from the received interrupt signal and pass it to the control circuit system 205. Depending on the system configuration, the decoders 206, 207 may only check a portion of each data packet based on the knowledge of which portions of the data packet will be used (by the interrupt controller or by the receiving core), and thus may perform less processing-intensive decoding (rather than processing the entire data packet). The control circuit system maintains a set of transaction records 208 indicating interrupt interactions between the participating processing circuit systems. In addition, the violation detection circuit system 209 determines whether the semantic information received from the relevant decoders 206, 207, combined with the current stage of the interrupt interaction indicated by the transaction record 208, is consistent with the expected interrupt signal flow, and in particular, whether those signals are consistent with the communication protocol that defines the signals being sent by the participating devices. Thus, by way of example, a given exchange of interrupt signals between two devices in the system may be defined as following a given sequence consistent with the communication protocol. In addition, the signals exchanged may be in the form of data packets, wherein each data packet is characterized by an opcode (defining the type of signal or data packet) and some associated data fields. Thus, for a given transaction, there may be an expected sequence of exchanged data packet types (e.g., the first CPU sends data packet type A, the second CPU confirms receipt with data packet type B, the first CPU sends another data packet type C, and the second CPU confirms receipt with data packet type D). Thus, the transaction record 208 enables the violation detection circuit system 209 to determine whether the expected sequence has been followed. Likewise, each of these data packet types may be accompanied by associated data, and these data may also have expected content and / or form, depending on the data packet type.

[0098] The violation detection circuitry 209 is arranged to determine whether each packet type carries expected content and / or data form. In the event that the violation detection circuitry 209 determines that the expected signal flow has not been followed, the protocol implementation circuitry 210 is initiated to perform mitigation measures for the observed violation of the expected signal flow. The mitigation measures may vary depending on the nature of the observed difference, but the key goal is to ensure that the signal is not passed to the CPU operating in a higher criticality compliance state, which may compromise that state. Similarly, mitigation measures may also or alternatively focus on interrupt controllers (such as Figure 5 157 in), so that the interrupt controller can be restored to the clean state of the transaction (without waiting for the unfinished truncation). Mitigation measures can also vary with the stage of the transaction as part of the observed difference. For example, in the case where a difference is observed as the first signal in a transaction between two CPUs, in particular in the case where a signal is first received from a CPU in a lower criticality state whose target is a higher criticality state, the security mitigation measure may simply prohibit the signal. It should be noted that, in addition, the control circuit system 205 can still report that a difference is observed, and a signal line 211 is shown, through which the report can be transmitted. Then, due to the signal, additional remedial measures may be triggered, such as restarting the CPU that produced the difference. However, other measures may be taken and may actually be required, such as in the case of a difference in the middle of a transaction. Here, it may occur, for example, that a transaction is executed between a lower criticality state CPU and a higher criticality state CPU, wherein, as the next stage in the transaction, the higher criticality state CPU expects to receive a signal from the lower criticality state CPU. If a situation occurs subsequently in which the lower criticality state CPU fails, and the expected signal is not sent or a signal in the wrong form is sent, the failure may affect the higher criticality state CPU. In such cases, the protocol implementation circuitry 210 may then replace the expected signal with some known safe format or modify the content of the signal. In practice, the opcode that replaces the signal may be selected to end the transaction with the higher criticality state CPU as cleanly and quickly as possible, since there may be no beneficial effect in trying to maintain a partially ongoing transaction where the next step for the lower criticality state CPU may be a reboot.

[0099] Figure 6 1 is a flowchart showing a sequence of steps taken by some example methods. Specifically, these steps can be provided by the present invention such as Figure 1 Device 10, Figure 3 Device 112, Figure 4 Protocol Validator 156 in or Figure 5200 in . When a new incoming interrupt signal (data packet) is received from a lower criticality core whose target is a higher criticality core, these steps begin at step 250. At step 251, the data packet opcode is decoded, and at step 252, it is determined whether the opcode (i.e., its semantic content) conforms to the protocol. If so, the process continues to step 253, at which it is determined whether the associated data forming part of the data packet is also consistent with the communication protocol. When the data content also conforms to the protocol, the process continues and ends at step 254, at which the data packet is passed without intervention. However, if there is a negative determination in either step 252 or step 253, that is, the opcode or data content of the data packet does not conform to the protocol, the process continues to step 255, at which step (in this example), the data packet is prohibited from being further transmitted to the target higher criticality core. Finally, at step 256, a signal is sent to notify the remedial action (e.g., restart) for the lower criticality core.

[0100] Figure 7 is a flowchart showing a sequence of steps taken by some example methods. These steps can also be performed by methods such as those provided according to the present invention. Figure 1 Device 10, Figure 3 Device 112, Figure 4 Protocol Validator 156 in or Figure 5200 in . In this example, at a first step 300, the situation is that an interrupt data packet is received from a lower criticality core in the middle of a transaction between the lower criticality core and another higher criticality core. At step 301, the data packet opcode is decoded, and at step 302, it is determined whether the opcode (i.e., its semantic content) conforms to the protocol. If so, the process continues to step 303, at which step it is determined whether the associated data forming part of the data packet is also consistent with the communication protocol. When the data content also conforms to the protocol, the process continues and ends at step 304, at which step the data packet is passed without intervention. However, if there is a negative determination in either step 302 or step 303, i.e., the opcode or data content of the data packet does not conform to the protocol, the process continues to step 305, at which step it is determined whether the higher criticality core needs to receive the data packet as part of the ongoing transaction. If not, flow continues to step 306, where the data packet is inhibited from further transmission to the target higher criticality core, and remedial action (e.g., reboot) is signaled for the lower criticality core at step 307. If, however, at step 305, it is determined that the higher criticality core does need to receive the (expected) data packet as part of an ongoing transaction, flow continues to step 308, where the data packet is modified or replaced as appropriate (and in particular according to the protocol), and finally, at step 309, the modified data packet is forwarded to the higher criticality core. Nevertheless, the occurrence of a discrepancy may still result in remedial action (e.g., reboot) being signaled for the lower criticality core.

[0101] Figure 8 Some components of the apparatus 350 according to some examples are schematically shown. The apparatus 350 is Figure 5 The device 350 is a variation of the device 200 of FIG. 1 and for comparison, reference may be made to its description. The device 350 is shown to include four interfaces 351, 352, 353, 354, via which interrupt signals are received or sent. Figure 5 In the case of the apparatus 200 of FIG. 1 , these interfaces are respectively arranged to receive an interrupt signal issued by one of the processing circuit systems, send such interrupt signal (possibly modified) to an interrupt controller, receive an interrupt signal issued by the interrupt controller for one of the processing circuit systems, and send such interrupt signal to the corresponding processing circuit system. Here, decoders 355, 356 also decode incoming data packets and compare information derived from the decoding update with a set of transaction records 357. It should be noted that the protocol violation circuit system is not explicitly shown in FIG. Figure 8 However, it can be considered as existing. Figure 5In the manner described, a protocol violation is detected and a signal is sent to the protocol implementation circuit system 358 which performs any necessary remedial actions to notify the protocol violation. In addition, the device 350 also includes two timer modules 359, 360, which enable the timeliness of the interaction to be verified. Specifically, the communication protocol used to exchange interrupt signals may itself define specific time windows within which transactions must be executed and / or within which participating components must respond to a given signal. Therefore, violation of any of these types of restrictions may also result in deviations from the expected interrupt signal flow, and the device 350 may subsequently intervene. It should also be noted that in Figure 8 In the example of , the device 350 is also provided with a protocol implementation circuit system 361 in the path of the signal, the direction of which is opposite to the direction of which the protocol implementation circuit system 358 may intervene. Therefore, in this example, data packets heading in any direction can be prohibited, modified or replaced. Figure 5 In the case of the apparatus 200 of FIG. 3 , a signaling path 362 is provided by which a violation of the communication protocol can be reported. In addition, recovery signals 363 can be exchanged with relevant system components so that recovery can be triggered when a violation of the relevant transaction record 357 is observed, and so that when such recovery is performed, the transaction record 357 can be updated, for example, so that a transaction tracked as "pending" (i.e., partially completed) is updated to "completed" or "canceled" when a signal is sent that a restart of the relevant system component has been triggered, i.e., the transaction will not be completed normally.

[0102] The concepts described herein may be embodied in a system including at least one packaged chip. The above-described means are implemented in the at least one packaged chip (implemented in a specific chip of the system, or distributed on more than one packaged chip). The at least one packaged chip is assembled on a board together with at least one system component. A chip-containing product may include a system assembled on another board with at least one other product component. The system or chip-containing product may be assembled into a housing or assembled onto a structural support (such as a frame or blade). Fig. 9As shown, one or more packaged chips 400 are manufactured by a semiconductor chip manufacturer, wherein the above-mentioned device is implemented on one chip or distributed on two or more of these chips. In some examples, the chip product 400 manufactured by the semiconductor chip manufacturer can be provided as a semiconductor package, which includes a protective housing (for example, made of metal, plastic, glass or ceramic) for accommodating a semiconductor device that implements the above-mentioned device and a connector such as a pad, solder ball or pin for connecting the semiconductor device to the external environment. In the case of providing more than one chip 400, these chips can be provided as separate integrated circuits (provided as separate packages), or can be packaged into a multi-chip semiconductor package by a semiconductor provider (for example, using an interposer, or by using three-dimensional integration to provide a multi-layer chip product including two or more vertically stacked integrated circuit layers).

[0103] In some examples, a collection of chiplets (i.e., small modular chips with specific functionality) may themselves be referred to as a chip. A chiplet may be packaged individually in a semiconductor package and / or packaged with other chiplets into a multi-chiplet semiconductor package (e.g., using an interposer, or by using three-dimensional integration to provide a multi-layer chiplet product including two or more vertically stacked integrated circuit layers).

[0104] One or more packaged chips 400 are assembled on board 402 together with at least one system component 404 to provide system 406. For example, the board may include a printed circuit board. The board substrate may be made of any of a variety of materials, for example, plastic, glass, ceramic, or a flexible substrate material such as paper, plastic, or textile material. At least one system component 404 includes one or more external components that are not part of the one or more packaged chips 400. For example, at least one system component 404 may include, for example, any one or more of the following: another packaged chip (e.g., provided by a different manufacturer or produced at a different process node), an interface module, a resistor, a capacitor, an inductor, a transformer, a diode, a transistor, and / or a sensor.

[0105] A chip-containing product 416 is manufactured, which includes a system 406 (including board 402, one or more chips 400, and at least one system component 404) and one or more product components 412. Product component 412 includes one or more additional components that are not part of system 406. As a non-exhaustive list of examples, one or more product components 412 may include user input / output devices such as keyboards, touch screens, microphones, speakers, display screens, haptic devices, etc.; wireless communication transmitters / receivers; sensors; actuators for actuating mechanical movement; thermal control devices; additional packaged chips; interface modules; resistors; capacitors; inductors; transformers; diodes; and / or transistors. System 406 and one or more product components 412 can be assembled onto an additional board 414.

[0106] Plate 402 or additional plates 414 may be disposed on or within a device housing or other structural support (eg, a frame or blade) to provide a product that is manipulable by a user and / or intended for operational use by a person or company.

[0107] System 406 or chip-containing product 416 may be at least one of an end-user product, a machine, a medical device, a computing or telecommunications infrastructure product, or an automated control system. For example, as a non-exhaustive list of examples, the chip-containing product may be any of the following: telecommunications equipment, mobile phones, tablet computers, laptops, computers, servers (e.g., rack servers or blade servers), infrastructure equipment, networking equipment, vehicles or other automotive products, industrial machines, consumer devices, smart cards, credit cards, smart glasses, avionics equipment, robotic equipment, cameras, televisions, smart TVs, DVD players, set-top boxes, wearable devices, home appliances, smart meters, medical devices, heating / lighting control equipment, sensors, and / or control systems for controlling public infrastructure equipment (such as smart highways or traffic lights).

[0108] In a brief general overview, an apparatus is disclosed that includes a plurality of interfaces, each interface being capable of coupling to a respective one of a plurality of processing circuit systems in a higher criticality compliance state or a lower criticality compliance state. Each interface is capable of receiving an interrupt signal from its respective one of the processing circuit systems to a target one of the plurality of processing circuit systems, and transmitting an interrupt signal from a source one of the plurality of processing circuit systems to its respective one of the processing circuit systems. A control circuit system monitors an interrupt signal flow and determines whether the interrupt signal flow has a difference relative to an expected interrupt signal flow, and performs mitigation measures for the difference to avoid violating the higher criticality compliance state.

[0109] In this application, the words "configured to..." are used to mean that elements of a device have a configuration that enables the performance of a defined operation. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not mean that the device elements need to be changed in any way in order to provide the defined operation.

[0110] Although exemplary embodiments have been described in detail herein in conjunction with the accompanying drawings, it should be understood that the present invention is not limited to those precise embodiments, and that various changes, additions and modifications may be implemented therein by those skilled in the art without departing from the scope of the present invention as defined in the appended claims. For example, the features of the dependent claims may be combined in various ways with the features of the independent claims without departing from the scope of the present invention.

Claims

1. A device, comprising: a plurality of interfaces, each interface being capable of coupling to a respective one of the plurality of processing circuitry, wherein each processing circuitry is in a higher criticality compliance state or a lower criticality compliance state, each interface being configured to: receiving an interrupt signal from its corresponding processing circuitry to a target processing circuitry among the plurality of processing circuitry; and transmitting an interrupt signal issued by a source processing circuit system among the plurality of processing circuit systems to its corresponding processing circuit system; and A control circuit system, the control circuit system being configured to: monitoring the interrupt signal flow; determining whether there is a difference in the interrupt signal flow between a first processing circuitry in the plurality of processing circuitry and a second processing circuitry in the plurality of processing circuitry relative to an expected interrupt signal flow; and In response to determining that the discrepancy exists, mitigation measures for the discrepancy are performed to avoid violating the higher criticality compliance state. 2 . The apparatus of claim 1 , wherein each of the processing circuitry is switchable between the higher criticality compliance state and the lower criticality compliance state.

3. The device according to claim 2, wherein: the first plurality of processing circuitry in the higher criticality compliance state is operable as a single multi-core lockstep processing unit; and / or The second plurality of processing circuitry in the lower criticality compliance state is capable of functioning as a standalone unit.

4. An apparatus according to any preceding claim, wherein: The interrupt signal stream has an associated communication protocol; and The discrepancy is determined to be a violation of the communication protocol.

5. An apparatus according to any preceding claim, wherein: The interrupt signal flow includes a data packet flow; and The difference is a deviation from at least one expected attribute of the packet flow.

6. The apparatus of claim 5, wherein the discrepancy comprises the presence of unexpected packets in the packet stream.

7. The apparatus of claim 6, wherein the mitigation measure comprises at least one of the following: discarding the unexpected data packet so that the unexpected data packet is not transmitted to the second processing circuit system; and The unintended data packet is modified prior to transmitting the unintended data packet to the second processing circuitry.

8. An apparatus according to any one of claims 5 to 7, wherein the difference is the absence of an expected data packet in the data packet stream.

9. The apparatus of claim 8, wherein the expected data packet is an expected response from the first processing circuitry to a premature transmission from the second processing circuitry to the first processing circuitry.

10. An apparatus according to claim 8 or claim 9, wherein the mitigation measure comprises replacing the expected data packet in the data packet flow with a pseudo expected data packet.

11. The apparatus according to any preceding claim, further comprising: An interrupt controller interface, the interrupt controller interface being capable of being coupled to an interrupt controller, the interrupt controller being configured to: receiving the interrupt signal from the plurality of processing circuit systems; Prioritizing the interrupt signals; And forwarding the interrupt signal to a corresponding target processing circuit system among the plurality of processing circuit systems.

12. The apparatus of claim 11, wherein the mitigation comprises invoking a recovery mode in which: The control circuit system sends a signal to the interrupt controller according to the expected interrupt signal flow; and The control circuitry sends a restart signal to at least one of the plurality of processing circuitry.

13. An apparatus as claimed in claim 12 when dependent on claim 8, wherein the control circuit system is configured to generate an emulated data packet corresponding to the expected data packet to send to the interrupt controller, wherein the emulated data packet is not sent to the second processing circuit system.

14. An apparatus according to any one of claims 8 to 13, wherein the difference is a lack of the expected data packet within a given time period.

15. Apparatus as claimed in claim 5, or as claimed in any one of claims 6 to 14 when dependent on claim 5, wherein the difference comprises a difference between packets of the packet flow and an expectation of the packets. The apparatus of claim 15 , wherein the difference corresponds to corruption of the data packet.

17. The apparatus of claim 16, wherein the mitigation measure comprises at least one of the following: discarding the data packet so that the data packet is not transmitted to the second processing circuit system; and The data packet is modified prior to transmitting the data packet to the second processing circuitry.

18. Apparatus according to claim 7, or any one of claims 8 to 17 when dependent on claim 7, wherein said modifying comprises performing a revision on said data packet which identifies said data packet as erroneous.

19. An apparatus as claimed in any preceding claim, wherein the control circuitry, in response to determining that the difference exists, signals the existence of the difference.

20. An apparatus as claimed in any preceding claim, wherein the control circuitry triggers mitigation measures for the first processing circuitry in response to determining that the discrepancy exists.

21. The apparatus of claim 20, wherein the mitigation measure comprises causing the first processing circuitry to reboot.

22. An apparatus as claimed in any preceding claim, wherein the first processing circuitry is in the lower criticality compliance state and the second processing circuitry is in the higher criticality compliance state.

23. An apparatus according to any preceding claim, wherein: a given interrupt signal corresponds to multiple transfers within the stream; and The control circuitry is configured to determine that the difference exists based on one of the plurality of transmissions.

24. A data processing system, comprising: the plurality of processing circuit systems; and Apparatus as claimed in any preceding claim.

25. A system, comprising: The device according to any one of claims 1 to 23 or the data processing system according to claim 24, wherein the device or the data processing system is implemented in at least one packaged chip; at least one system component; and plate, The at least one packaged chip and the at least one system component are assembled on the board.

26. A chip-containing product, comprising the system according to claim 25, the system being assembled on a separate board with at least one other product component.

27. A method of operating a device, wherein the device comprises a plurality of interfaces, the method comprising: coupling the plurality of interfaces to respective ones of a plurality of processing circuitry, wherein each processing circuitry is in a higher criticality compliance state or a lower criticality compliance state; At each interface: receiving an interrupt signal from its corresponding processing circuitry to a target processing circuitry among the plurality of processing circuitry; and transmitting an interrupt signal issued by a source processing circuit system among the plurality of processing circuit systems to its corresponding processing circuit system; In the device: monitoring the interrupt signal flow; determining whether there is a difference in the interrupt signal flow between a first processing circuitry in the plurality of processing circuitry and a second processing circuitry in the plurality of processing circuitry relative to an expected interrupt signal flow; and When it is determined that the discrepancy exists, mitigation measures for the discrepancy are performed to avoid violating the higher criticality compliance state.

Images