Interrupt controller isolation access control method and system based on virtual machine monitor
By parsing virtual machine access instructions to generate interrupt affinity parameters and register operation masks, dynamically verifying permissions and executing access instructions in an atomic manner, the problem of interrupt controller conflicts between virtual machines in automotive microcontrollers is solved, improving system stability and isolation effectiveness.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-03-31
AI Technical Summary
In automotive microcontroller units, multiple processor cores sharing the same physical interrupt controller can easily lead to register bit conflicts or operational interference when different virtual machines access the interrupt controller. Existing solutions rely on manual handling of isolation logic, making it difficult to guarantee stability.
By parsing the virtual machine's access instructions to the interrupt controller, interrupt affinity parameters and register operation masks are generated, access permissions are dynamically verified, and access instructions are executed in an atomic manner, thereby achieving automated interrupt controller isolation access control.
It achieves automated interrupt controller isolation access, reduces development complexity, improves system stability and isolation effectiveness, and avoids the influence of human factors.
Smart Images
Figure CN121764592A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of automotive electronics technology, specifically to a security isolation mechanism for virtualization technology in vehicle domain controllers, and in particular to an interrupt controller isolation access control method and system based on a virtual machine monitor. Background Technology
[0002] With the rapid development of automotive intelligence and connectivity technologies, the demand for integrated in-vehicle domain controllers is increasing. Virtual machine monitor technology, by creating multiple isolated virtual machines on the same physical controller, effectively integrates modules with different functional safety levels, becoming a key technology for addressing this need. However, in in-vehicle microcontroller units, multiple processor cores (such as Cortex-R52) typically share the same physical interrupt controller (such as GICv3), which can easily lead to register bit conflicts or operational interference when different virtual machines access the interrupt controller. For example, a restart operation of one virtual machine may accidentally disable the interrupt function of other virtual machines.
[0003] Existing solutions rely on the virtual machine monitor to branch based on the instruction source, which has significant drawbacks: developers need to manually handle the isolation logic for different virtual machines, increasing development complexity and making the isolation effectiveness susceptible to human factors, thus compromising stability. Therefore, there is an urgent need for a technical solution that can automatically achieve secure isolation access to the interrupt controller. Summary of the Invention
[0004] According to one aspect of this application, an interrupt controller isolation access control method based on a virtual machine monitor is provided. The method includes: parsing a virtual machine's access instruction to an interrupt controller to obtain operation attributes and a target address; querying a predefined mapping relationship based on a virtual machine identifier, processor core information, and the target address to generate interrupt affinity parameters; dynamically generating a register operation mask based on the interrupt affinity parameters and interrupt register configuration information corresponding to the target address; verifying the virtual machine's access permission to the target address based on the register operation mask; and, in response to the access permission being verified, applying the register operation mask to atomically execute the access instruction to access the interrupt controller.
[0005] The provided interrupt controller isolation access control method may optionally or additionally include generating interrupt affinity parameters by: extracting a corresponding configuration word from the affinity configuration word set as the interrupt affinity parameter in response to the target address satisfying the alignment condition; and generating the interrupt affinity parameter by calculating the offset and performing a displacement concatenation operation on adjacent configuration words in response to the target address not satisfying the alignment condition.
[0006] The provided interrupt controller isolation access control method may optionally or additionally include the following: the dynamic generation of the register operation mask includes: determining the bit width occupied by a single interrupt based on the interrupt register configuration information, and generating a base mask with a corresponding bit width; and combining each bit of the interrupt affinity parameter with the base mask, wherein, in response to the interrupt affinity being valid, the base mask is set at the corresponding position of the register operation mask, otherwise the inverse of the base mask is set.
[0007] The provided interrupt controller isolation access control method, optionally or additionally, includes the following steps for executing the access instruction in an atomic operation manner: acquiring an access lock; reading the current register data of the target address; performing a first bitwise AND operation on the data to be written and the register operation mask to obtain first temporary data; performing a second bitwise AND operation on the current register data and the inverse of the register operation mask to obtain second temporary data; performing a bitwise OR operation on the first temporary data and the second temporary data to generate final write data; writing the final write data to the target address; and releasing the access lock.
[0008] Optionally or additionally, the interrupt controller isolation access control method further includes: in response to the access permission verification failing, executing an error handling process, wherein the error handling process includes at least one of the following operations: terminating the current operation, recording an error log, and performing system state rollback.
[0009] According to another aspect of this application, an interrupt controller isolation access control system based on a virtual machine monitor is provided. The control system is integrated into the virtual machine monitor and includes: an instruction decoding module configured to parse virtual machine access instructions to the interrupt controller to obtain operation attributes and a target address; an interrupt affinity mapping module configured to query a predefined mapping relationship based on the virtual machine identifier, processor core information, and the target address to generate interrupt affinity parameters; a dynamic mask generation module configured to dynamically generate a register operation mask based on the interrupt affinity parameters and interrupt register configuration information corresponding to the target address; a dynamic permission verification module configured to verify the virtual machine's access permission to the target address based on the register operation mask; and an instruction atomic operation proxy module configured to, in response to successful access permission verification, apply the register operation mask to execute the access instruction to the interrupt controller in an atomic operation manner.
[0010] The provided interrupt controller isolation access control system may optionally or additionally include an interrupt affinity mapping module configured to generate the interrupt affinity parameters by a shift splicing operation in response to the target address not meeting the alignment condition.
[0011] Optionally or additionally, the provided interrupt controller isolation access control system may include a dynamic mask generation module comprising: a base mask unit configured to generate a base mask based on the interrupt register configuration information; and a mask combination unit configured to combine the interrupt affinity parameter bitwise with the base mask to generate the register operation mask.
[0012] The provided interrupt controller isolation access control system may optionally or additionally include an instruction atomic operation proxy module configured to ensure the atomicity of the atomic operation by executing a read-modify-write sequence and utilizing a semaphore mechanism.
[0013] The provided interrupt controller isolation access control system may optionally or additionally include: an error handling module connected to the dynamic permission verification module and the instruction atomic operation agent module, and configured to perform an error handling operation in response to the access permission verification failing or the atomic operation mode execution being abnormal.
[0014] According to another aspect of this application, a program product is also provided, the program product comprising program instructions that, when executed, implement any of the methods described above.
[0015] A non-temporary storage medium is also provided, which includes program instructions that, when executed, can implement any of the methods described above. Attached Figure Description
[0016] The above and / or other aspects and advantages of this application will become clearer and more readily understood from the following description taken in conjunction with the accompanying drawings, in which the same or similar elements are denoted by the same reference numerals. In the drawings: Figure 1 A schematic flowchart of an interrupt controller isolation access control method 100 according to an embodiment of this application is shown; and Figure 2 A schematic block diagram of an interrupt controller isolation access control system 200 according to an embodiment of this application is shown. Detailed Implementation
[0017] The following detailed description is merely exemplary in nature and is not intended to limit the disclosed technology or its application and use. Furthermore, it is not intended to be bound by any express or implied theory presented in the foregoing technical fields, background art, or the following detailed description.
[0018] In the following detailed description of the embodiments, numerous specific details are set forth in order to provide a more thorough understanding of the disclosed technology. However, it will be apparent to those skilled in the art that the disclosed technology can be practiced without these specific details. In other instances, well-known features have not been described in detail to avoid unnecessarily complicating the description.
[0019] Terms such as “comprising” and “including” indicate that, in addition to the units and steps that are directly and explicitly stated in the specification, the technical solution of this application does not exclude the presence of other units and steps that are not directly or explicitly stated.
[0020] In the following, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings.
[0021] Now for reference Figure 1 , Figure 1 This is a schematic flowchart of an interrupt controller isolation access control method 100 according to an embodiment of this application. Figure 1 As shown, the interrupt controller isolation access control method 200 includes the following steps: S110: Parse the virtual machine's access instruction to the interrupt controller to obtain the operation attributes and target address. Specifically, when the virtual machine monitor captures an interrupt controller access instruction from the virtual machine, it calls the instruction decoding module. This module is responsible for parsing the access instruction and extracting its valid information. The valid information includes, but is not limited to: instruction operation type (read or write), target register address, operation range, operation data information, and sign extension flag. For example, in a specific scenario, when the virtual machine is shut down, its interrupts need to be disabled, which triggers a write operation to the GICD_ICENABLER register. The instruction decoding module will parse out the operation type as "write", the target address as the physical address of GICD_ICENABLER, the data to be written (e.g., 0xFFFFFFFF), and the sign extension flag as 0.
[0022] S120: Based on the virtual machine identifier, processor core information, and the target address, a predefined mapping relationship is queried to generate interrupt affinity parameters; specifically, the virtual machine monitor calls the interrupt affinity mapping module. This module performs a multi-dimensional matching query operation in the pre-built VM-Core-Interrupt three-dimensional mapping relationship table based on the current virtual machine identifier, processor core number, and interrupt address information to obtain the interrupt affinity configuration word set. Then, bit-width alignment detection is performed on the target interrupt base address.
[0023] In some embodiments, S120 further includes: in response to the target address satisfying the alignment condition, extracting the corresponding configuration word from the core affinity configuration word set as the interrupt core affinity parameter; and in response to the target address not satisfying the alignment condition, generating the interrupt core affinity parameter by calculating the offset and performing a displacement concatenation operation on adjacent configuration words. Specifically, in response to the target interrupt base address satisfying the word alignment condition, directly extracting the first configuration word corresponding to the current interrupt index value from the core affinity configuration word set, and setting the first configuration word as the final core affinity parameter CoreAffinity. Each bit of CoreAffinity controls the core affinity of an interrupt, with 1 representing valid core affinity (i.e., the interrupt belongs to the current VM-core pair) and 0 representing invalid core affinity. Furthermore, in response to the target interrupt base address not satisfying the word alignment condition, activating the non-alignment processing unit to perform a cross-word concatenation operation. Specifically, the process is as follows: First, calculate the bit offset of the interrupt base address relative to the word alignment. Then, extract the first configuration word and the adjacent second configuration word corresponding to the current interrupt index value from the above set of core affinity configuration words. Finally, perform a bitwise OR operation on the result of shifting the first configuration word to the right by offset bits and shifting the second configuration word to the left by (register size - offset) bits to obtain the final core affinity parameter CoreAffinity.
[0024] S130: Based on the interrupt affinity parameter and the interrupt register configuration information corresponding to the target address, a register operation mask is dynamically generated. Specifically, the virtual machine monitor calls the dynamic mask generation module. This module receives the affinity parameter CoreAffinity generated by the interrupt affinity mapping module and dynamically generates the operation mask GidRegMask by combining it with the configuration information of the currently accessed target interrupt controller register.
[0025] In some embodiments, dynamically generating a register operation mask includes: determining the bit width occupied by a single interrupt based on the interrupt register configuration information, and generating a base mask with a corresponding bit width; and combining each bit of the interrupt affinity parameter with the base mask, wherein, in response to interrupt affinity being valid, the base mask is set at the corresponding position of the register operation mask, otherwise the inverse of the base mask is set.
[0026] Specifically, dynamically generating register operation masks includes: The interrupt configuration quantity IrqPerReg parameter is obtained based on the target register type. Then, based on the register size size and IrqPerReg, the register width IrqSize occupied by each interrupt is calculated by dividing size by IrqPerReg.
[0027] Generate a base mask IrqMask of equal width, consisting entirely of 1s, based on IrqSize. For example, if the bit width is 8, IrqMask = 0xFF; if the bit width is 16, IrqMask = 0xFFFF; and if the bit width is 32, IrqMask = 0xFFFFFFFF. The actual calculation method is not limited to using a single for loop. It can iterate IrqSize times starting from 0, shifting 0x01 left by the loop number of bits in each iteration, then performing a bitwise OR operation with IrqMask to update IrqMask. After the loop completes, IrqMask is obtained.
[0028] Each bit of the interrupt affinity parameter CoreAffinity is combined with the base mask IrqMask to generate the final register operation mask GidRegMask. Specifically: when the bit of CoreAffinity corresponding to the interrupt is 1 (affinity is valid), the corresponding interrupt configuration bit in GidRegMask is set to IrqMask; otherwise, it is set to ~IrqMask (i.e., the inverse of IrqMask).
[0029] Its specific implementation steps may include: Initialize a mask variable GicdRegMask with all zeros and the same bit width as the target register; A loop counter, i, is used, starting from 0, and the loop count is IrqPerReg times. In each loop, the i-th bit of CoreAffinity is taken as the core affinity flag CoreAffiFlag for the current interrupt. After padding the base mask IrqMask with 0s to the width of the target register, shift it left by (IrqSize * i) bits to obtain IrqOffset; If CoreAffiFlag is 1, then IrqOffset and GicdRegMask are bitwise ORed, and the result is updated in GicdRegMask; if CoreAffiFlag is 0, then GicdRegMask remains unchanged. After the loop ends, the final dynamic mask GidRegMask will be obtained.
[0030] For example, in one specific embodiment, for the GICD_ICENABLER register, its IrqPerReg is 32, so IrqSize=1, IrqMask=0x1, and the final value of GicdRegMask is equal to CoreAffinity.
[0031] S140: Based on the register operation mask, verify the virtual machine's access rights to the target address; specifically, the virtual machine monitor calls the dynamic permission verification module. This module determines whether the kernel in the current virtual machine has the right to access data in the interrupt controller address range based on the register range accessed by the instruction and the mask GidRegMask generated by the dynamic mask generation module.
[0032] The specific judgment steps are as follows: Based on the instruction's access register range (e.g., BYTE-8bit, WORD-32bit, etc.), check if the corresponding value in the mask GicdRegMask is all 0s. If it is all 0s, it is determined that there is no access permission, and the error handling module can be called for error handling; otherwise, it is determined that there is access permission, and the process continues to the next step. For example, if the operation range of the GICD_ICENABLER register is WORD (32bit), then check if GicdRegMask is 0x00000000.
[0033] S150: In response to the access permission being verified, the register operation mask is applied to atomically execute the access instruction to the interrupt controller.
[0034] In some embodiments, the virtual machine monitor invokes an instruction atomic operation proxy module. This module performs corresponding atomic operations on the interrupt controller registers using a mask, based on the read / write attributes of the instructions.
[0035] In some embodiments, executing the access instruction atomically includes: acquiring an access lock; reading the current register data of the target address; performing a first bitwise AND operation on the data to be written and the register operation mask to obtain first temporary data; performing a second bitwise AND operation on the current register data and the inverse of the register operation mask to obtain second temporary data; performing a bitwise OR operation on the first temporary data and the second temporary data to generate final write data; writing the final write data to the target address; and releasing the access lock.
[0036] The following example illustrates this: For a write operation, first acquire the semaphore or mutex, then perform the write operation on the register in a read-modify-write sequence: Read the current register data at the target address and store it in the variable data_org; Perform a bitwise AND operation between the data to be written (data) and the generated mask (GicdRegMask) to obtain temporary data (data_tmp1) (i.e., data_tmp1 = data&GicdRegMask). Perform a bitwise AND operation between the read data_org and the inverse of the mask ~GicdRegMask to obtain temporary data data_tmp2 (i.e., data_tmp2 = data_org&~GicdRegMask). Perform a bitwise OR operation between data_tmp1 and data_tmp2 to generate the final written data data_src (i.e., data_src = data_tmp1 | data_tmp2). Write data_src to the destination register; Release the semaphore or mutex; If it is a read operation, the data is read using the mask GidRegMask according to the access size, and then the data bits are extended accordingly based on the data size and whether extension is required.
[0037] Additionally, in some embodiments, in response to the access permission verification failing, an error handling process is executed, wherein the error handling process includes at least one of the following operations: terminating the current operation, logging an error log, performing system state rollback (run level return), etc., to ensure system stability.
[0038] Now for reference Figure 2 , Figure 2 A schematic block diagram of an interrupt controller isolation access control system 200 according to an embodiment of this application is shown. Figure 2 As shown, the interrupt controller isolation access control system 200 includes: The instruction decoding module 202 is configured to parse the virtual machine's access instructions to the interrupt controller in order to obtain the operation attributes and target address; the operation attributes include read / write type, and the target address information includes register address, operation range, etc.
[0039] The interrupt affinity mapping module 204 is configured to query a predefined mapping relationship (such as a VM-Core-Interrupt three-dimensional mapping table) based on the virtual machine identifier, processor core information, and the target address to generate the interrupt affinity parameter CoreAffinity. In some embodiments, the interrupt affinity mapping module 204 is further configured to: in response to the target address not meeting the alignment condition, generate the interrupt affinity parameter by calculating the offset and performing a displacement concatenation operation (i.e., cross-word concatenation) on adjacent configuration words.
[0040] The dynamic mask generation module 206 is configured to dynamically generate a register operation mask GidRegMask based on the interrupt affinity parameter and the interrupt register configuration information corresponding to the target address. Specifically, the dynamic mask generation module 206 may further include: The base mask unit is configured to determine the bit width IrqSize occupied by a single interrupt based on the interrupt register configuration information (such as IrqPerReg) and generate a base mask IrqMask of all 1s for the corresponding bit width.
[0041] The mask combination unit is configured to combine the interrupt affinity parameter CoreAffinity with the base mask IrqMask bit by bit to generate the register operation mask GidRegMask. Specifically, the combination logic is as follows: for each bit of CoreAffinity, if it is 1, IrqMask is set for that interrupt configuration bit; if it is 0, ~IrqMask is set.
[0042] The dynamic permission verification module 208 is configured to verify the current virtual machine's access rights to the target address based on the register operation mask GidRegMask. Specifically, this module checks whether the corresponding bits in the mask are all zeros according to the address range accessed by the instruction, in order to determine the permission.
[0043] Instruction atomic operation proxy module 210 is configured to, in response to the successful access permission verification, apply the register operation mask GidRegMask to atomically execute the access instruction to the interrupt controller. In some embodiments, instruction atomic operation proxy module 210 is further configured to ensure the atomicity of write operations by executing a read-modify-write sequence and utilizing a semaphore mechanism, and to apply a mask for data reading and bit expansion for read operations.
[0044] Furthermore, the interrupt controller isolation access control system 200 may also include an error handling module 212, which is connected to the dynamic permission verification module 208 and the instruction atomic operation proxy module 210, and configured to perform error handling operations in response to the access permission verification failing or the atomic operation method execution being abnormal. The error handling operations include, but are not limited to, terminating the current operation, recording an error log, and performing system state rollback.
[0045] This application also provides a program product including program instructions that, when executed, can implement any of the examples described above.
[0046] This application also provides a non-temporary storage medium storing program instructions that, when executed, can implement any of the examples described above.
[0047] The technical features in the various embodiments of this application can be combined with each other to form new implementation methods without departing from the spirit of this application and without conflicting with each other. Although specific embodiments of this application have been shown and described in detail to illustrate the principles of this application, it should be understood that this application can be implemented in other ways without departing from such principles.
Claims
1. A method for isolating access control of an interrupt controller based on a virtual machine monitor, characterized in that, The method includes: Parse the virtual machine's access instructions to the interrupt controller to obtain the operation attributes and target address; Based on the virtual machine identifier, processor core information and the target address, a predefined mapping relationship is queried to generate interrupt affinity parameters. Based on the interrupt affinity parameter and the interrupt register configuration information corresponding to the target address, a register operation mask is dynamically generated. Based on the register operation mask, verify the virtual machine's access rights to the target address; and In response to the access permission being verified, the register operation mask is applied to atomically execute the access instruction to the interrupt controller.
2. The method according to claim 1, characterized in that, The generated interrupt nucleophilicity parameters include: In response to the target address satisfying the alignment condition, the corresponding configuration word is extracted from the affinity configuration word set as the interrupt affinity parameter; and In response to the target address not meeting the alignment condition, the interrupt affinity parameter is generated by calculating the offset and performing a displacement concatenation operation on adjacent configuration words.
3. The method according to claim 1, characterized in that, The dynamically generated register operation mask includes: The bit width occupied by a single interrupt is determined based on the interrupt register configuration information, and a base mask with the corresponding bit width is generated; and Each bit of the interrupt affinity parameter is combined with the base mask, wherein, in response to interrupt affinity being valid, the base mask is set at the corresponding position of the register operation mask; otherwise, the inverse of the base mask is set.
4. The method according to claim 1, characterized in that, The execution of the access instruction in an atomic manner includes: Acquire access lock; Read the current register data at the target address; Perform a first bitwise AND operation between the data to be written and the register operation mask to obtain the first temporary data; Perform a second bitwise AND operation between the current register data and the inverse of the register operation mask to obtain the second temporary data; Perform a bitwise OR operation between the first temporary data and the second temporary data to generate the final write data; Write the final data to the target address; and Release the access lock.
5. The method according to claim 1, characterized in that, The method further includes: In response to the access permission verification failure, an error handling process is executed, wherein the error handling process includes at least one of the following operations: terminating the current operation, recording an error log, and performing system state rollback.
6. An interrupt controller isolation access control system based on a virtual machine monitor, characterized in that, The control system is integrated into the virtual machine monitor and includes: The instruction decoding module is configured to parse the virtual machine's access instructions to the interrupt controller in order to obtain the operation attributes and target address; The interrupt affinity mapping module is configured to query a predefined mapping relationship based on the virtual machine identifier, processor core information and the target address, and generate interrupt affinity parameters. The dynamic mask generation module is configured to dynamically generate a register operation mask based on the interrupt affinity parameter and the interrupt register configuration information corresponding to the target address. A dynamic permission verification module, configured to verify the virtual machine's access rights to the target address based on the register operation mask; and An instruction atomic operation proxy module is configured to, in response to the successful access permission verification, apply the register operation mask to atomically execute the access instruction to the interrupt controller.
7. The control system according to claim 6, characterized in that, The interrupt nucleophilic mapping module is also configured to: In response to the target address not meeting the alignment condition, the interrupt affinity parameter is generated through a shift splicing operation.
8. The control system according to claim 6, characterized in that, The dynamic mask generation module includes: A base mask unit, configured to generate a base mask based on the interrupt register configuration information; and A mask combining unit configured to bitwise combine the interrupt affinity parameter with the base mask to generate the register operation mask.
9. The control system according to claim 6, characterized in that, The instruction atomic operation proxy module is also configured to ensure the atomicity of the atomic operation by executing a read-modify-write sequence and using a semaphore mechanism.
10. The control system according to claim 6, characterized in that, The control system further includes: An error handling module is connected to the dynamic permission verification module and the instruction atomic operation proxy module, and is configured to perform error handling operations in response to the access permission verification failing or the atomic operation method execution being abnormal.
11. A program product, characterized in that, The program product includes program instructions that, when executed, can implement the method according to any one of claims 1 to 5.
12. A non-temporary storage medium, characterized in that, The storage medium stores program instructions that, when executed, can implement the method according to any one of claims 1 to 5.