Vehicle-mounted heterogeneous system resource scheduling method and device and vehicle

Abstract

The application provides a vehicle-mounted heterogeneous system resource scheduling method and device and a vehicle, and belongs to the technical field of vehicle intelligent control. The method comprises the following steps: receiving a registration request of a target service; according to a security level label, binding the target service to an isolated core group of a corresponding level, and allocating a memory partition and a network hardware priority queue of the corresponding level to the target service to generate a full-link resource configuration of the target service; based on a shared memory channel and an access token in the full-link resource configuration, reading and writing and checking interaction data of the target service between different security level domains to generate target interaction data residing in the shared memory channel; and mapping the shared memory channel to the network hardware priority queue to send the target interaction data. The above method can effectively realize unified scheduling and security isolation of vehicle full-link resources.

Description

Technical Field

[0001] This invention relates to the field of vehicle intelligent control technology, specifically to a method, device, and vehicle for scheduling resources in a heterogeneous vehicle system. Background Technology

[0002] In existing cockpit-driving integrated systems, services with different safety levels, such as QM-level cockpit applications and ASIL-D-level intelligent driving functions, run simultaneously on the same SoC, sharing CPU, memory, and network resources. Currently, these resources are typically managed through independent scheduling at three layers: CPU, memory, and network.

[0003] However, this independent scheduling method lacks a global label based on security level, resulting in a lack of unified security assurance and verification mechanism during cross-domain interaction. Furthermore, resource allocation cannot be dynamically coordinated, which can easily lead to high-security-level services being interfered with by low-security-level resources, or the use of static hard isolation to ensure security, resulting in low resource utilization.

[0004] Therefore, there is an urgent need for a method for scheduling resources in vehicle-mounted heterogeneous systems that can use security level as a global label across multiple layers of resources to achieve unified scheduling and security isolation across the entire link. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a resource scheduling method for heterogeneous in-vehicle systems, enabling unified scheduling and secure isolation of resources across the entire in-vehicle link. The technical solution is as follows: In a first aspect, the present invention provides a method for resource scheduling of a vehicle-mounted heterogeneous system, comprising: Receive the registration request from the target service. The registration request carries a security level label, which is a global label that represents the vehicle's safety integrity level. Based on the security level label, the target service is bound to the corresponding level of isolation core group, and the target service is allocated a corresponding level of memory partition and network hardware priority queue, generating the full-link resource configuration of the target service; Based on the shared memory channel and access token in the end-to-end resource configuration, the interaction data of the target service between different security level domains is read, written and verified to generate target interaction data residing in the shared memory channel. Map the shared memory channel to the network hardware priority queue to send data for the target interactive data.

[0006] Combining the first aspect and the above implementation methods, in some possible implementation methods, before receiving the registration request of the target service, the following steps are included: The vehicle-mounted heterogeneous central processing unit cores are divided into multiple hard-isolated core groups according to their security levels, and the computing power of low-security-level core groups in multiple hard-isolated core groups is prohibited from being preempted by high-security-level core groups. Divide global memory into multiple independent physical address spaces according to security level, and block memory access permissions between different security levels; The hardware priority queue of the vehicle network controller is allocated as a dedicated transmission channel according to the security level, and bandwidth resources are reserved for the high security level channel in the dedicated transmission channel; A basic mapping is established between the independent physical address space and the dedicated transmission channel. Based on the hard isolated core group, the independent physical address space, the dedicated transmission channel, and the basic mapping, a three-level static resource partitioning result is generated.

[0007] Combining the first aspect and the above implementation methods, in some possible implementations, based on the security level label, the target service is bound to the corresponding level of isolation core group, and a corresponding level of memory partition and network hardware priority queue is allocated to the target service to generate the full-link resource configuration of the target service, including: Based on the security level label, the tasks of the target service are bound to the corresponding level of the isolated core group. The isolated core group is a vehicle heterogeneous central processing unit core group where inter-group computing power preemption is prohibited. Allocate memory partitions of the corresponding level to the target service and bind the corresponding memory access flow identifier to the page table field of the system memory management unit; Assign a network hardware priority queue with the corresponding priority to the target service, update the mapping relationship between memory channel identifier, network flow identifier and network queue identifier, and generate the full-link resource configuration of the target service.

[0008] Combining the first aspect and the above implementation methods, in some possible implementation methods, based on the shared memory channel and access token in the end-to-end resource configuration, the interaction data of the target service between different security level domains is read, written, and verified to generate target interaction data residing in the shared memory channel, including: Write the interaction data to the shared memory channel, along with the completion flag and access token; Get the token verification result of the access token; When the token verification result indicates that the token verification is successful, increment the read reference count of the shared memory channel, and read the interactive data based on the mapped address and decrement the read reference count; After the read reference count reaches zero, the interaction data is marked as reused to generate the target interaction data residing in the shared memory channel.

[0009] Combining the first aspect and the above implementation methods, in some possible implementations, after obtaining the token verification result of the access token, the method further includes: When the token verification result indicates that the token verification has failed, the access request for the interaction data is intercepted, and the interaction error data is reported.

[0010] Combining the first aspect and the above implementation methods, in some possible implementations, the shared memory channel is mapped to a network hardware priority queue for sending target interactive data, including: Map the physical page frames of the shared memory channel to the transmit descriptor ring of the network controller; Based on the write pointer update of the send descriptor ring, the memory access engine is triggered to send the data frame in the shared memory channel into the network hardware priority queue of the corresponding time window in order to send the target interactive data.

[0011] Combining the first aspect and the above implementation methods, in some possible implementation methods, based on the security level label, the target service is bound to the corresponding level of isolation core group, and a corresponding level of memory partition and network hardware priority queue is allocated to the target service. After generating the full-link resource configuration of the target service, this includes: In response to a request to change the security level of a target service, determine the changed target security level label; Based on the target security level label, the modified isolated core group, memory partition and network hardware priority queue are pre-configured to generate a pre-configured full-link resource configuration; If the pre-configuration indicator indicates successful configuration, the service flow of the target service will be synchronously switched to the pre-configured end-to-end resource configuration. If the pre-configuration indication is that the configuration failed, the target service will be rolled back to the original end-to-end resource configuration.

[0012] In combination with the first aspect and the above implementation methods, some possible implementation methods also include: If overload of vehicle system resources is detected, the computing power quota, memory bandwidth, and network bandwidth of non-critical applications with the lowest security level will be revoked. If resources are still insufficient, non-safe path function resources that are allowed to be downgraded in the second lowest security level will be reclaimed. The downgrade reclamation follows the fault tolerance time interval constraint. The core functional resources with the highest security level are fixed, and abnormal events and resource adjustments are recorded in the audit log to obtain a fallback result for abnormal events.

[0013] Secondly, the present invention also provides a vehicle-mounted heterogeneous system resource scheduling device, comprising: The service receiving unit is used to receive the registration request of the target service. The registration request carries a security level label, which is a global label that represents the vehicle's safety integrity level. The resource configuration unit is used to bind the target service to the corresponding level of isolation core group according to the security level label, and to allocate the corresponding level of memory partition and network hardware priority queue to the target service, thereby generating the full-link resource configuration of the target service. The data generation unit is used to read, write and verify the interaction data of the target service between different security level domains based on the shared memory channel and access token in the end-to-end resource configuration, and generate the target interaction data residing in the shared memory channel. The data interaction unit is used to map the shared memory channel to the network hardware priority queue for sending data to the target interaction data.

[0014] Thirdly, the present invention also provides a vehicle, including a request receiver, a memory, and a processor, wherein... The request receiver is used to receive registration requests for the target service. Memory, used to store executable program code; The processor is used to bind the target service to the corresponding level of isolation core group according to the security level label, allocate the corresponding level of memory partition and network hardware priority queue to the target service, and generate the full-link resource configuration of the target service; based on the shared memory channel and access token in the full-link resource configuration, it reads, writes and verifies the interaction data of the target service between different security level domains, generates target interaction data residing in the shared memory channel; and maps the shared memory channel to the network hardware priority queue to send the target interaction data.

[0015] Fourthly, the present invention also provides a computer-readable storage medium for storing a computer-readable program or instruction, which, when executed by a processor, can implement the steps of the vehicle heterogeneous system resource scheduling method in any of the above implementations.

[0016] The beneficial effects of this invention are as follows: By receiving the registration request of the target service, the security level tag is used as a global tag representing the vehicle's safety integrity level, overcoming the deficiency of the prior art in lacking a global tag throughout; the target service is bound to the corresponding level of isolation core group according to the security level tag, and a corresponding level of memory partition and network hardware priority queue are allocated to the target service, generating the full-link resource configuration of the target service, realizing dynamic coordination of computing power, memory and network resources, and avoiding the low resource utilization caused by static hard isolation; based on the shared memory channel and access token in the full-link resource configuration, the interactive data of the target service between different security level domains is read, written and verified, generating target interactive data residing in the shared memory channel, overcoming the problem of lack of security guarantee and verification mechanism in cross-domain interaction, and preventing low-level interference; the shared memory channel is mapped to the network hardware priority queue to send the target interactive data, ensuring the transparent transmission of security level from memory to network, and improving processing speed. Attached Figure Description To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic diagram of the architecture used in the vehicle heterogeneous system resource scheduling method provided by the present invention; Figure 2 This is a schematic diagram of the resource scheduling method for vehicle-mounted heterogeneous systems provided by the present invention; Figure 3 For the present invention Figure 2 A schematic diagram of an embodiment of S201; Figure 4 For the present invention Figure 2 A schematic diagram of an embodiment of S202; Figure 5 For the present invention Figure 2 A schematic diagram of an embodiment of S203; Figure 6 This is a timing diagram of a cross-domain copy provided by the present invention; Figure 7 For the present invention Figure 2 A schematic diagram of an embodiment of S204; Figure 8 This is a schematic diagram illustrating a scenario for handling exceptions provided by the present invention. Figure 9 This is a schematic diagram of the structure of the vehicle-mounted heterogeneous system resource scheduling device provided by the present invention; Figure 10 This is a structural schematic diagram of the vehicle provided by the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0019] In the description of the embodiments of the present invention, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0020] The terms "first," "second," etc., used in the embodiments of this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a technical feature defined with "first" or "second" may explicitly or implicitly include at least one of that feature.

[0021] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0022] This application provides a method for scheduling resources in a vehicle-mounted heterogeneous system. The subject executing this method is a device for scheduling resources in a vehicle-mounted heterogeneous system or a vehicle equipped with such a device. The following provides a detailed description. It should be noted that the order of description in the following embodiments is not intended to limit the preferred order of the embodiments.

[0023] Please see Figure 1 , Figure 1 This is a schematic diagram of the architecture used in the vehicle-mounted heterogeneous system resource scheduling method provided by this invention. (See diagram below.) Figure 1 As shown, the end-to-end ASIL unified orchestration module serves as the global control center, responsible for maintaining the mapping table of "ASIL level - core group - memory partition - TSN queue". It configures the three-layer resources at once during service registration and performs atomic switching when the level changes. It coordinates four core functional modules: the heterogeneous multi-core affinity scheduling module, which is responsible for binding tasks to the corresponding level core group and realizing dynamic load balancing within the group; the memory pool module, which is responsible for isolating memory through page table domains and managing cross-domain shared zero-copy channels and access tokens; the memory-TSN collaborative scheduling module, which is responsible for maintaining the ternary mapping from memory channel identifier to network queue identifier and configuring direct memory access (DMA) descriptor ring to realize direct connection; and the anomaly fallback and security monitoring module, which is responsible for monitoring resource overload and reclaiming resources in reverse according to ASIL level.

[0024] The lower layer is the hardware layer, which provides underlying physical support and hard isolation mechanisms. This includes configuring ASIL-D, ASIL-B, and QM core groups to disable computing power preemption through hardware isolation registers; blocking unauthorized access through page table fields and memory access stream identifiers (StreamID); and providing a time-sensitive network (TSN) controller that ensures high-level data transmission with low latency through hardware priority queues. All scheduling and isolation strategies in the software module layer ultimately rely on and are mapped to the corresponding hardware mechanisms in the hardware layer.

[0025] Please see Figure 2 , Figure 2 This is a schematic diagram of the resource scheduling method for vehicle-mounted heterogeneous systems provided by the present invention. Figure 2 As shown, the method in this application embodiment may include the following steps S201-S204: S201, Receive the registration request for the target service. The registration request carries a security level label, which is a global label that characterizes the vehicle's safety integrity level.

[0026] In this embodiment, the target service refers to an application or functional instance deployed in a heterogeneous vehicle system based on a service-oriented architecture. A registration request refers to the application information, including its own attributes and resource requirements, initiated by the target service to the end-to-end ASIL unified orchestration module when it starts up or accesses the system. A security level label refers to dimensional information used to identify the security criticality of the target service. The vehicle safety integrity level refers to the automotive safety integrity level defined in the international standard ISO 26262, including levels such as QM, ASIL-B, and ASIL-D. A global label refers to a uniquely corresponding level identifier that is uniformly effective across the three layers of resources—CPU core groups, memory partitions, and TSN queues—of the entire heterogeneous vehicle system.

[0027] In one feasible implementation, when a service-oriented architecture (SAE) service registers, it declares the corresponding vehicle safety integrity level and service quality requirements in its metadata. The end-to-end ASIL unified orchestration module receives and verifies the registration request in the security domain. After successful verification, it generates a corresponding security level label for the target service. This security level label serves as a global label and will be used as a unified scheduling and isolation basis in subsequent CPU scheduling, memory allocation, and network transmission.

[0028] S202, based on the security level label, binds the target service to the corresponding level of isolation core group, allocates the corresponding level of memory partition and network hardware priority queue to the target service, and generates the full-link resource configuration of the target service.

[0029] In this embodiment, an isolated core group refers to a set of heterogeneous onboard CPU cores that are divided according to vehicle security integrity levels and where inter-group preemption is prohibited. A memory partition refers to an independent physical address space in global physical memory that is divided according to vehicle security integrity levels and is hardware isolated by the system memory management unit. A network hardware priority queue refers to a hardware queue in the time-sensitive network controller that is reserved according to vehicle security integrity levels and has different transmission priorities. Full-link resource configuration refers to the complete set of resource mapping relationships obtained by allocating computing power, memory, and network resources for the target service based on the same security level label.

[0030] In one feasible implementation, after the end-to-end ASIL unified orchestration module verifies the registration request within the security domain, it configures all three layers of resources at once: the heterogeneous multi-core affinity scheduling module binds the target service's tasks to the corresponding level of isolated core groups; the ASIL hierarchical unified memory pool module allocates the corresponding level of memory partitions for the target service, binds the corresponding memory access flow identifier to the page table field of the system memory management unit, configures address access permissions, and if the target service needs cross-domain interaction, it pre-allocates a shared zero-copy channel and generates a one-time access token; the memory-TSN collaborative scheduling module allocates the corresponding priority network hardware priority queue for the target service, updates the mapping relationship between memory channel identifier, network flow identifier, and network queue identifier, and configures the direct memory access descriptor ring, thereby generating the end-to-end resource configuration for the target service.

[0031] S203, based on the shared memory channel and access token in the end-to-end resource configuration, reads, writes and verifies the interaction data of the target service between different security level domains, and generates target interaction data residing in the shared memory channel.

[0032] In this embodiment, a shared memory channel refers to a zero-copy data exchange channel pre-allocated between different security level domains, protected by the system memory management unit page table isolation, and only open to memory pages within a specified offset range. An access token is a temporary credential generated by the sender, containing validity, permission scope, and validity period, used to authorize the receiver to access the shared memory channel. A security level domain refers to a logically isolated area based on the vehicle safety integrity level, such as a QM domain, ASIL-B domain, or ASIL-D domain. Interaction data refers to the original business data written by the sender to the shared memory channel. Target interaction data refers to data that, after read / write and verification, resides in the shared memory channel, has a zero read reference count, and is marked as reusable.

[0033] It should be noted that the vehicle safety integrity level classification refers to the classification of safety requirements into QM (Quality Management) and four progressively higher safety levels: ASIL A, ASIL B, ASIL C, and ASIL D, based on the three dimensions of the severity, probability of exposure, and controllability of potential failures in automotive electronic and electrical systems, according to the ISO 26262 Road Vehicle Functional Safety Standard. This classification aims to quantify failure risk. The higher the level (e.g., ASIL-D represents the highest safety level), the more severe the harm caused by failure. The system must take more stringent measures in development processes, hardware reliability, and safety mechanisms to avoid danger. The QM level, on the other hand, indicates that risk management objectives can be met without special safety function requirements.

[0034] In one feasible implementation, when data is transferred between the cabin domain QM application and the driving domain ASIL function, a pre-allocated shared memory channel is used. The sender writes the interaction data into the shared memory channel, executes a write memory barrier to ensure data persistence, and sets a completion flag and an access token. Upon receiving the notification, the receiver first verifies the validity, permission scope, and validity period of the access token. After successful verification, the receiver atomically increments the read reference count of the shared memory channel and directly reads the interaction data through the mapped address. The entire process involves zero copying. After reading, the read reference count is decremented. Once the read reference count reaches zero, the interaction data is marked as reused to generate the target interaction data residing in the shared memory channel.

[0035] S204 maps the shared memory channel to a network hardware priority queue to send data for the target interactive data.

[0036] In one feasible implementation, the physical page frames of the memory channel are mapped to the Direct Memory Access (DMI) send descriptor ring of the time-sensitive network controller via the system memory management unit. After the application finishes writing data, it updates the write pointer of the DMI descriptor ring. The DMI engine directly retrieves data frames from memory and sends them to the network hardware priority queue corresponding to the time window. The security level label and service quality priority of the target service are transparently transmitted from memory to the network without being reordered by the protocol stack. After DMI sends data, it updates the descriptor status, and the memory block reclamation status is synchronously fed back to the memory pool module.

[0037] Please refer to the following charts, which provide a comparison of this solution with traditional static partitioning and Hypervisor isolation solutions:

[0038] Based on the table data, it can be seen that in the traditional static partitioning scheme, rigid resource allocation results in a CPU utilization rate of only 58%, cross-domain transmission requires multiple copies leading to a latency of up to 18ms, and adding a new service configuration takes 30 minutes. In the Hypervisor isolation scheme, although the latency is reduced to 12ms through virtual machine copying, there is a 7% cross-level resource interference rate, and configuration still takes 15 minutes. In contrast, the service configuration time of this solution is less than 10 seconds, cross-domain interaction achieves zero copy through shared memory channels and access tokens, significantly reducing the latency to 1.5ms. At the same time, memory pass-through TSN queues result in an end-to-end jitter of only 30μs. It not only achieves 0% cross-level resource interference rate through hardware-level isolation, but also improves the CPU utilization rate to 82% through dynamic allocation within the same level.

[0039] In summary, this application overcomes the deficiency of existing technologies in lacking a global label by receiving the registration request of the target service and using the security level label as a global label representing the vehicle's safety integrity level. Based on the security level label, the application binds the target service to the corresponding level of isolation core group and allocates corresponding level memory partitions and network hardware priority queues to the target service, generating a full-link resource configuration for the target service. This achieves dynamic coordination of computing power, memory, and network resources, avoiding the low resource utilization caused by static hard isolation. Based on the shared memory channel and access token in the full-link resource configuration, the application reads, writes, and verifies the interaction data of the target service between different security level domains, generating target interaction data residing in the shared memory channel. This overcomes the problem of lack of security guarantees and verification mechanisms in cross-domain interactions and prevents low-level interference. Mapping the shared memory channel to the network hardware priority queue for sending target interaction data ensures the transparent transmission of security levels from memory to network, improving processing speed.

[0040] Please see Figure 3 , Figure 3 For the present invention Figure 2 A schematic diagram of an embodiment of S201. (See attached diagram.) Figure 3 As shown, the method in this application embodiment may include the following steps S301-S304: S301 divides the heterogeneous central processing unit cores of the vehicle into multiple hard-isolated core groups according to their security levels, and prohibits the low-security-level core groups from preempting the computing power of the high-security-level core groups.

[0041] In this embodiment, the vehicle-mounted heterogeneous central processing unit (CPU) core refers to the processing cores of multiple architectures included in the system-on-a-chip. A hard-isolated core group refers to a set of CPU cores categorized according to vehicle safety integrity levels and with completely isolated computing power between groups.

[0042] In one feasible implementation, the end-to-end ASIL unified orchestration module divides the heterogeneous automotive central processing unit cores into three hard-isolated core groups according to the vehicle's safety integrity level during system startup: QM core group, ASIL-B core group, and ASIL-D core group. Through ARM memory system resource partitioning and monitoring, or through hardware isolation registers integrated into the on-chip system, it configures a mechanism to prevent preemption of computing power between core groups, ensuring that higher-level core groups are not preempted by lower-level tasks.

[0043] S302 divides global memory into multiple independent physical address spaces according to security levels and blocks memory access permissions between different security levels.

[0044] In this embodiment, global memory refers to the overall physical memory resources available to the on-chip system. Independent physical address spaces refer to memory regions that are isolated from each other according to vehicle safety integrity levels and are not visible to each other. Memory access permissions refer to read and write access permissions for a specific physical address space.

[0045] In one feasible implementation, the memory pool module divides the global memory into three independent physical address spaces according to the vehicle's safety integrity level, and pre-configures system memory management unit page table fields. Each vehicle safety integrity level corresponds to an independent system memory management unit page table field and memory access flow identifier range. The memory access flow identifier of the lower-level domain does not have access permissions to the physical addresses of the higher-level domain. When a lower-level domain attempts to access memory without authorization, the system memory management unit hardware directly intercepts and blocks the memory access permission.

[0046] S303 allocates the hardware priority queue of the vehicle network controller to dedicated transmission channels according to security level, and reserves bandwidth resources for high-security-level channels in the dedicated transmission channels.

[0047] In this embodiment, the vehicular network controller refers to an Ethernet communication controller that supports Time-Sensitive Networking Protocol (TSP). A dedicated transmission channel refers to a network data transmission path with specific priorities, categorized according to the vehicle's safety integrity level. Bandwidth resources refer to the rate capacity available for data transmission on a network link.

[0048] In one feasible implementation, the collaborative scheduling module reserves dedicated transmission channels for the hardware priority queues of the time-sensitive network controller according to the vehicle safety integrity level. High-priority queues are allocated to dedicated transmission channels for ASIL-D and ASIL-B levels, while low-priority queues are allocated to dedicated transmission channels for QM level. Sufficient bandwidth resources are reserved for high-security-level channels to ensure low-latency transmission of high-level data.

[0049] S304 establishes a basic mapping between the independent physical address space and the dedicated transmission channel, and generates a three-level static resource partitioning result based on the hard isolated core group, the independent physical address space, the dedicated transmission channel, and the basic mapping.

[0050] In this embodiment, the basic mapping refers to the initial association between memory channel identifiers, network flow identifiers, and network queue identifiers. The level-three resource static partitioning result refers to the security boundary configuration result established during system startup, including computing power partitions, memory partitions, and network partitions, and their basic mappings.

[0051] In one feasible implementation, a pre-configured direct memory access send descriptor ring and the underlying mapping of memory channels at each level are used to generate a three-level static resource partitioning result. This three-level static resource partitioning result only defines security boundaries and does not fix resource quotas; resources within the same level can be dynamically allocated.

[0052] In summary, this application establishes a hard-isolated security boundary by statically partitioning CPU, memory, and network resources at system startup, preventing low-security-level tasks from preempting and accessing high-security-level resources without authorization. At the same time, it provides underlying support for subsequent dynamic end-to-end configuration through basic mapping, thus ensuring the basic security of the system.

[0053] Please see Figure 4 , Figure 4 For the present invention Figure 2 A schematic diagram of an embodiment of S202. (See attached diagram.) Figure 4 As shown, the method in this application embodiment may include the following steps S401-S403: S401, based on the security level label, binds the task of the target service to the corresponding level of the isolated core group. The isolated core group is a vehicle heterogeneous central processing unit core group where inter-group computing power preemption is prohibited.

[0054] In the embodiments of this application, the task of the target service refers to the process or thread instance generated when the target service runs.

[0055] In one feasible implementation, the heterogeneous multi-core affinity scheduling module binds the tasks of the target service to the corresponding level of isolated core groups based on the security level label of the target service. Tasks can only be scheduled within the isolated core group corresponding to their own level and cannot be migrated across groups. Dynamic load balancing is supported within the same group, migrating tasks according to the load of each core.

[0056] S402 allocates a memory partition of the corresponding level to the target service and binds the corresponding memory access flow identifier to the page table field of the system memory management unit.

[0057] In this embodiment, the memory access stream identifier is a unique identifier used by the system memory management unit to identify and distinguish the sources of different memory access requests. The system memory management unit refers to the system memory management unit itself. The page table field refers to the set of page tables in the system memory management unit used to define different address translation and access permission rules.

[0058] In one feasible implementation, the memory pool module allocates a memory partition of the corresponding level to the target service, binds the corresponding memory access flow identifier to the page table field of the system memory management unit, and configures the address access permissions. If the target service needs to interact across domains, a shared zero-copy channel is pre-allocated, and a one-time access token is generated, which is bound to an expiration date and permissions.

[0059] S403: Assign a network hardware priority queue with the corresponding priority to the target service, update the mapping relationship between memory channel identifier, network flow identifier and network queue identifier, and generate the full-link resource configuration of the target service.

[0060] In this embodiment, a memory channel identifier refers to a unique identifier for a channel within a memory partition used for data interaction. A network flow identifier refers to an identifier used in time-sensitive networking to distinguish different data flows. A network queue identifier refers to a unique identifier for a hardware priority queue in a time-sensitive network controller.

[0061] In one feasible implementation, the collaborative scheduling module allocates a network hardware priority queue with the corresponding priority to the target service, updates the ternary mapping table (memory channel identifier - network flow identifier - network queue identifier), and configures a direct memory access descriptor ring, thereby generating the full-link resource configuration of the target service.

[0062] In summary, this application achieves automatic configuration of end-to-end resources during service registration by binding CPU core groups, memory partitions, and network queues in one go based on security level labels. This avoids inconsistencies in multi-layer configurations and ensures secure isolation and resource determinism during service runtime.

[0063] Please see Figure 5 , Figure 5 For the present invention Figure 2 A schematic diagram of an embodiment of S203. (See attached diagram.) Figure 5 As shown, the method in this application embodiment may include the following steps S501-S504: S501 writes the interactive data to the shared memory channel and writes the completion flag and access token.

[0064] In this embodiment, the completion flag is an identifier signal used to indicate that the sender has completely written the interactive data into the shared memory channel.

[0065] In one feasible implementation, the sender writes the interactive data to a shared memory channel, which is isolated and protected by the system memory management unit's page table, granting access to memory pages only within a specified offset range. After writing is complete, the sender executes a write memory barrier to ensure the data is persisted and sets a completion flag and an access token.

[0066] S502, obtain the token verification result of the access token.

[0067] In this embodiment of the application, the token verification result refers to the conclusion obtained after verifying the validity, permission scope and validity period of the access token.

[0068] In one feasible implementation, after receiving the notification, the recipient first verifies the validity, permission scope, and expiration date of the access token and obtains the token verification result. If the access token expires, the recipient's access request will be intercepted by the system memory management unit hardware and reported to the end-to-end ASIL unified orchestration module. The security domain then decides whether to reissue the token or trigger an exception fallback mechanism, and silent degradation access is not allowed.

[0069] S503, when the token verification result indicates that the token verification is successful, increments the read reference count of the shared memory channel, reads the interaction data based on the mapped address, and decrements the read reference count.

[0070] In this embodiment, the read reference count refers to an atomic counter used to record the number of receivers currently reading data within the shared memory channel. The mapped address refers to the mapped virtual address of the shared memory channel in the receiver's address space.

[0071] In one feasible implementation, when the token verification result indicates that the token verification passed, the receiver atomically increments the read reference count of the shared memory channel and directly reads the interactive data through the mapped address, with zero copying throughout the process. After reading is complete, the read reference count is decremented.

[0072] S504, after the read reference count is zeroed, marks the interaction data as reused to generate target interaction data residing in the shared memory channel.

[0073] In this embodiment, the reuse state refers to the state in which the interaction data has been read by all receivers and the memory block is allowed to be written with new data by the sender.

[0074] In one feasible implementation, after the read reference count reaches zero, the interactive data is marked as reused, and the sender can write new data to generate the target interactive data residing in the shared memory channel.

[0075] Please refer to the following: Figure 6 , Figure 6 This is a timing diagram of a cross-domain copy provided by the present invention. For example... Figure 6 As shown, after the sender writes the interactive data to the shared memory, it executes a write memory barrier to ensure the data is persisted, sets the completion flag and access token, and then sends a data ready notification to the receiver. Upon receiving the notification, the receiver first verifies the access token. After the verification passes, it directly reads the data in the shared memory (achieving zero copy) and decrements the read reference count after reading is complete. When the read reference count reaches zero, it indicates that all receivers have finished reading. At this time, the memory pool module marks the memory block as reusable and sends a recycling notification to the sender, thereby allowing the sender to write new data to the memory block, completing the safe and efficient recycling of the entire memory channel.

[0076] Please refer to the following charts, which provide a comparison of this solution with pure TSN networks, traditional static partitioning, and hypervisor isolation solutions:

[0077] Based on the data in the table above, it can be seen that this solution achieves hardware-level end-to-end isolation and three-dimensional scheduling of "computing power + memory + network", far exceeding other solutions' lack of isolation / software-level / virtual machine-level isolation and single or dual-dimensional scheduling. It also achieves optimal cross-domain interaction performance with zero copy, achieving strong end-to-end determinism and high resource utilization throughout the entire link. It completely overcomes the limitations of traditional partitions and hypervisors, such as large copy overhead, weak or moderate determinism, and low utilization. It also makes up for the lack of strong determinism in pure TSN only on the network side. In terms of security compliance and deployment, this solution achieves ASIL-level end-to-end coverage and atomic security switching of dynamic levels at runtime. Traditional partitions and hypervisors do not support dynamic changes and the level only stays at the boundary division. Although pure TSN supports changes, it lacks security verification. At the same time, this solution achieves low business deployment costs by automatically completing the end-to-end configuration, which is better than the high-cost mode of configuring multiple modules separately, such as pure TSN. Overall, it shows advantages in hybrid critical systems.

[0078] In summary, this application introduces access token verification and read reference counting mechanisms into the shared memory channel, ensuring efficient cross-domain interaction with zero copy while guaranteeing the security of cross-domain access through dual verification of hardware and security domains, preventing unauthorized access and data tampering.

[0079] In one feasible implementation, after obtaining the token verification result of the access token in the execution step, the following is further executed: When the token verification result indicates that the token verification has failed, the access request for the interaction data is intercepted, and the interaction error data is reported.

[0080] In this embodiment, an access request refers to a receiver's request to read interactive data in the shared memory channel. Interaction error data refers to error record information describing the reason for token verification failure, the access source, and the accessed resource.

[0081] In one feasible implementation, when the token verification result indicates that the token verification has failed, the system memory management unit hardware intercepts the access request for the interactive data and reports the abnormal interactive data to the end-to-end ASIL unified orchestration module. The security domain decides whether to reissue the token or trigger an exception fallback, and silent degradation access is not allowed.

[0082] In summary, this application eliminates the possibility of silent downgraded access by having the hardware directly intercept and report the exception when the token expires, thus ensuring the bottom line of security for cross-domain interactions.

[0083] In one feasible implementation, when executing the step of mapping the shared memory channel to a network hardware priority queue for sending target interactive data, the following is also specifically performed: Map the physical page frames of the shared memory channel to the transmit descriptor ring of the network controller.

[0084] Based on the write pointer update of the send descriptor ring, the memory access engine is triggered to send the data frame in the shared memory channel into the network hardware priority queue of the corresponding time window in order to send the target interactive data.

[0085] In this embodiment, a physical page frame refers to a memory page frame corresponding to the smallest allocation and mapping unit in physical memory. A send descriptor ring refers to a circular buffer used by the direct memory access engine to describe the address and length information of data packets to be sent. A write pointer is a pointer to the next available write location in the send descriptor ring. A memory access engine refers to the hardware module in the direct memory access controller responsible for handling data. A data frame refers to a data packet conforming to a network protocol format to be sent.

[0086] In one feasible implementation, the physical page frames of the shared memory channel are mapped to the direct memory access send descriptor ring of the time-sensitive network controller via the system memory management unit. After the application finishes writing data and updates the write pointer of the send descriptor ring, it triggers the direct memory access engine to directly fetch data frames from memory and send them to the network hardware priority queue for the corresponding time window.

[0087] The security level label and service quality priority of the target service are transparently transmitted from memory to the network without being reordered by the protocol stack. High ASIL-level driving control data directly enters the highest priority queue. After direct memory access completes data transmission, the descriptor status is updated, and the memory block reclamation status is synchronously fed back to the memory pool module.

[0088] In summary, this application achieves hardware-level transparent transmission of data from memory to the network through a memory channel pass-through mapping mechanism for time-sensitive network queues, avoiding latency and jitter caused by the central processing unit's involvement in protocol stack processing, and ensuring the real-time performance of high-security data.

[0089] Please see Figure 7 , Figure 7 For the present invention Figure 2 A schematic diagram of an embodiment of S204. (See attached diagram.) Figure 6 As shown, the method in this application embodiment may include the following steps S701-S704: S701, in response to a request to change the level of a target service, determines the changed target security level label.

[0090] In this embodiment, a security level change request refers to a request from a target service to upgrade or downgrade its vehicle safety integrity level due to a change in its business status. The target security level label refers to the label corresponding to the new vehicle safety integrity level to which the security level change request is expected to be applied.

[0091] In one feasible implementation, when a target service needs to be upgraded (e.g., from QM to ASIL-B), a level change request is sent to the end-to-end ASIL unified orchestration module. The end-to-end ASIL unified orchestration module first verifies the trustworthiness of the request source and whether it complies with the security policy within the security domain. After the verification is passed, the module determines the changed target security level label.

[0092] S702 pre-configures the changed isolated core group, memory partition and network hardware priority queue according to the target security level label, and generates a pre-configured full-link resource configuration.

[0093] In this embodiment of the application, the pre-configured end-to-end resource configuration refers to the three-layer resources that are pre-allocated in the background for the target service according to the target security level label, and the business flow has not yet been actually switched.

[0094] In one feasible implementation, the end-to-end ASIL unified orchestration module initiates a two-stage switch. First, it pre-configures the isolation core group resources, memory partition permissions, and network hardware priority queues corresponding to the target security level label in the background, generating a pre-configured end-to-end resource configuration.

[0095] S703 If the pre-configuration indication is successful, the service flow of the target service will be synchronously switched to the pre-configured full-link resource configuration.

[0096] In this embodiment, "business flow" refers to the data processing flow actually running in the target service. Synchronous switching refers to the atomic operation of simultaneously switching all three layer resources from their original configuration level to a new configuration level.

[0097] In one feasible implementation, when the isolation core group, memory partition and network hardware priority queue are all ready, the pre-configuration indicator is successful, and the service flow of the target service is synchronously switched to the pre-configured full-link resource configuration without leaving any intermediate state.

[0098] S704 If the pre-configuration indication is configuration failure, the target service will be rolled back to the original end-to-end resource configuration.

[0099] In this embodiment, rollback refers to the operation of revoking the pre-configuration and restoring the service to its state before the change. The original end-to-end resource configuration refers to the end-to-end resource configuration used by the target service before the grade change request.

[0100] In one feasible implementation, if any layer pre-configuration fails (e.g., a time-sensitive network queue is not ready within 200 milliseconds), the pre-configuration indicator is marked as configuration failure, and the entire system is rolled back to the original level to restore the original end-to-end resource configuration without leaving any intermediate states.

[0101] For example, taking the dynamic escalation of fatigue warning as an example, a cockpit fatigue warning function normally operates at QM level, only providing alerts. When continuous driver fatigue is detected, it is temporarily escalated to ASIL-B level, requiring deterministic execution. Under normal circumstances, it is bound to the QM core group, consuming minimal resources. When a severe fatigue warning is triggered, the unified orchestration module verifies the credibility of the warning signal and the escalation permission within the safety domain. After successful verification, a two-stage atomic switch is initiated: the background pre-allocates ASIL-B core group resources, memory partition permissions, and a high-priority TSN queue. Once all three layers are fully ready, the business flow is switched synchronously. If the TSN queue allocation does not complete readiness confirmation within 200ms, the entire process is rolled back, QM resource configuration is restored, and an error log is reported. After the warning is cleared, it automatically reverts to QM, and resources are released back to the shared pool.

[0102] In summary, this application employs a two-stage atomic switching mechanism, which pre-configures and then synchronously switches during level changes, ensuring the security and integrity of the change process, avoiding security vulnerabilities caused by intermediate states, and providing a safe rollback in case of failure, thus guaranteeing system stability.

[0103] In one feasible implementation, the following is also specifically performed: If overload of vehicle system resources is detected, the computing power quota, memory bandwidth, and network bandwidth of non-critical applications with the lowest security level will be revoked.

[0104] In this embodiment, in-vehicle system resource overload refers to a state where the system's CPU load, memory usage, or network congestion exceeds a preset threshold. Non-critical applications refer to applications with a vehicle safety integrity level of QM that do not involve safety functions.

[0105] If resources are still insufficient, non-safe path function resources that are allowed to be downgraded in the second lowest security level will be reclaimed. The downgrade reclamation follows the fault tolerance time interval constraint.

[0106] The core functional resources with the highest security level are fixed, and abnormal events and resource adjustments are recorded in the audit log to obtain a fallback result for abnormal events.

[0107] In this application embodiment, computing power quota refers to the amount of computing resources allocated to a specific application or level. Memory bandwidth refers to the amount of data read and written to memory per unit time. Network bandwidth refers to the amount of data transmitted over the network per unit time. Degradation and reclamation refers to the operation of lowering the security level of a specific function and reclaiming some of its resources. Non-safe path function resources refer to auxiliary resources that do not affect core security functions. Fault tolerance time interval constraint refers to the time limit requirement for the system to maintain a safe state within a specified time when a fault occurs. Core function resources refer to the resources occupied by driving control functions with a vehicle safety integrity level of ASIL-D. Audit log refers to a log file with security verification that records abnormal system events and resource adjustment operations. Anomaly fallback result refers to the resource protection state obtained after reclaiming resources in reverse order according to the system level when it is overloaded.

[0108] In one feasible implementation, when the system experiences overload, insufficient memory, or network congestion, the anomaly fallback and security monitoring module triggers a tiered fallback mechanism. First, it reclaims the computing power quota, memory bandwidth, and network bandwidth of QM-level non-critical applications. If resources are still insufficient, it further downgrades and reclaims non-secure path function resources at ASIL-B level, which have been confirmed by security analysis to be degradeable. The downgrade operation strictly adheres to the corresponding function's fault tolerance time interval constraints and does not affect ASIL-B core security functions; ASIL-D level core control functions are not downgraded in any way; abnormal events and resource adjustment records are written to the security audit log, resulting in the anomaly fallback outcome.

[0109] For example, taking ASIL-D fallback under high load as an example, when the vehicle is in motion, a large 3D game (QM level) on the cockpit side is running at full load, consuming a large amount of CPU and memory bandwidth, which may cause scheduling delays in the driver domain steering control (ASIL-D). The anomaly monitoring module detects that the ASIL-D task scheduling delay exceeds the threshold and automatically triggers a tiered fallback. First, the CPU quota and memory bandwidth of the game are limited. Then, the TSN queue corresponding to the game is moved from the high-priority time window to the low-priority BE queue, freeing up the high-priority window bandwidth for ASIL-D steering control data. The entire process is completed automatically, and the resources of the ASIL-D function are exclusively used throughout.

[0110] Please refer to the following: Figure 8 , Figure 8 This is a schematic diagram illustrating a scenario for exception fallback provided by the present invention, such as... Figure 8As shown, the system monitors whether the vehicle system resources are overloaded. If not, the process ends directly. If overload occurs, the system first reclaims the computing power quota, memory bandwidth, and network bandwidth of non-critical applications at the lowest security level. After the initial reclamation, the system monitors whether the resources are still insufficient. If they are still insufficient, the system further downgrades and reclaims non-security path functional resources that are allowed to be downgraded in the next lowest security level. This downgrade operation must strictly adhere to the fault tolerance time interval constraint. Throughout the reclamation process, the core functional resources of the highest security level remain fixed and unaffected. Finally, abnormal events and resource adjustment records are written to the audit log to obtain the anomaly fallback result and end the process.

[0111] In summary, this application prioritizes the exclusive use and stable operation of high-security-level core functions by reclaiming resources in reverse order according to the vehicle's safety integrity level when the system is overloaded. This effectively prevents low-priority applications from crowding out high-security-level functions and improves the overall security and robustness of the system.

[0112] This application, based on existing mainstream mass-produced SoC hardware without requiring additional chips, constructs end-to-end hardware-level isolation across three layers—CPU scheduling, memory access, and network transmission—to meet the independence requirements of ISO26262 hybrid critical systems. Simultaneously, by combining multi-core affinity scheduling, unified memory zero-copy, and memory-TSN hardware direct mapping technology, it significantly enhances end-to-end determinism and low transmission latency. While ensuring isolation, the system improves overall CPU utilization to over 80% through dynamic scheduling and memory pooling management, breaking through the static partition fragmentation bottleneck. It also supports runtime ASIL-level security dynamic adjustment and three-terminal atomic switching rollback mechanisms. Furthermore, the solution possesses automatic fallback capabilities for anomalies, with resource reclamation based on ASIL levels, and SOA services only need to declare parameters to automatically complete end-to-end configuration. Ultimately, it achieves a highly secure, highly deterministic, highly resource-utilized, flexible, compliant, and low-cost cockpit system foundation.

[0113] The following will combine Figure 9 This application provides a detailed description of the vehicle-mounted heterogeneous system resource scheduling device provided in its embodiments. It should be noted that... Figure 9 The vehicle-mounted heterogeneous system resource scheduling device in the present application is used to execute the resource scheduling device of the present application. Figures 1-8 The methods shown in the embodiments are for illustrative purposes only, illustrating the parts relevant to the embodiments of this application. For specific technical details not disclosed, please refer to this application. Figures 1-8 In the embodiment shown, the in-vehicle heterogeneous system resource scheduling device 900 may include a service receiving unit 901, a resource configuration unit 902, a data generation unit 903, and a data interaction unit 904, as detailed below: The service receiving unit 901 is used to receive the registration request of the target service. The registration request carries a security level label, which is a global label that represents the vehicle's safety integrity level. Resource configuration unit 902 is used to bind the target service to the corresponding level of isolation core group according to the security level label, and to allocate the corresponding level of memory partition and network hardware priority queue to the target service, thereby generating the full-link resource configuration of the target service. The data generation unit 903 is used to read, write and verify the interaction data of the target service between different security level domains based on the shared memory channel and access token in the end-to-end resource configuration, and generate target interaction data residing in the shared memory channel. The data interaction unit 904 is used to map the shared memory channel to the network hardware priority queue for sending data to the target interaction data.

[0114] The vehicle-mounted heterogeneous system resource scheduling device 10 provided in the above embodiments can realize the technical solutions described in the above embodiments of the vehicle-mounted heterogeneous system resource scheduling method. The specific implementation principles of each module or unit can be found in the corresponding content in the above embodiments of the vehicle-mounted heterogeneous system resource scheduling method, which will not be repeated here.

[0115] like Figure 10 As shown, the present invention also provides a vehicle 10. The vehicle 10 includes a processor 11, a memory 12, a display 13, and a request receiver 14. Figure 10 Only some of the components of vehicle 10 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0116] In some embodiments, processor 11 may be a central processing unit (CPU), microprocessor or other data processing chip, used to run program code stored in memory 12 or process data, such as the vehicle heterogeneous system resource scheduling method of the present invention.

[0117] In some embodiments, memory 12 may be an internal storage unit of vehicle 10, such as a hard disk or memory of vehicle 10. In other embodiments, memory 12 may also be an external storage device of vehicle 10, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on vehicle 10.

[0118] Furthermore, the memory 12 may include both internal storage units of the vehicle 10 and external storage devices. The memory 12 is used to store application software and various types of data installed on the vehicle 10.

[0119] Display 13 may be an LED display, a liquid crystal display, a touch-screen liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen in some embodiments. Display 13 is used to display information in vehicle 10 and to display a visual user interface. Request receiver 14 is used to receive registration requests for target services. Components 11-14 of vehicle 10 communicate with each other via a system bus.

[0120] In one embodiment, when the processor 11 executes the vehicle heterogeneous system resource scheduling program in the memory 12, the following steps can be implemented: Receive the registration request from the target service. The registration request carries a security level label, which is a global label that represents the vehicle's safety integrity level. Based on the security level label, the target service is bound to the corresponding level of isolation core group, and the target service is allocated a corresponding level of memory partition and network hardware priority queue, generating the full-link resource configuration of the target service; Based on the shared memory channel and access token in the end-to-end resource configuration, the interaction data of the target service between different security level domains is read, written and verified to generate target interaction data residing in the shared memory channel. Map the shared memory channel to the network hardware priority queue to send data for the target interactive data.

[0121] It should be understood that when the processor 11 executes the vehicle heterogeneous system resource scheduling program in the memory 12, in addition to the functions mentioned above, it can also perform other functions, as can be found in the description of the corresponding method embodiments above.

[0122] Furthermore, this embodiment of the invention does not specifically limit the type of vehicle 10 mentioned. Vehicle 10 can be a portable vehicle such as a tablet computer, personal digital assistant (PDA), wearable device, or laptop computer. Exemplary embodiments of portable vehicles include, but are not limited to, portable vehicles running iOS, Android, Microsoft, or other operating systems. The aforementioned portable vehicle can also be other portable vehicles, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the invention, vehicle 10 may not be a portable vehicle, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0123] Accordingly, this application also provides a computer-readable storage medium for storing computer-readable programs or instructions. When the programs or instructions are executed by a processor, they can implement the steps or functions of the vehicle heterogeneous system resource scheduling method provided in the above-described method embodiments.

[0124] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.), and the computer program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0125] The above provides a detailed description of the vehicle-mounted heterogeneous system resource scheduling method, device, and vehicle provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A resource scheduling method for a vehicle-mounted heterogeneous system, characterized in that, include: Receive a registration request for the target service, the registration request carrying a security level tag, the security level tag being a global tag characterizing the vehicle's safety integrity level; Based on the security level label, the target service is bound to the corresponding level of isolation core group, and a corresponding level of memory partition and network hardware priority queue is allocated to the target service to generate the full-link resource configuration of the target service; Based on the shared memory channel and access token in the full-link resource configuration, the interaction data of the target service between different security level domains is read, written and verified to generate target interaction data residing in the shared memory channel. The shared memory channel is mapped to the network hardware priority queue to send the target interactive data.

2. The method according to claim 1, characterized in that, Before receiving the registration request for the target service, the method further includes: The vehicle-mounted heterogeneous central processing unit cores are divided into multiple hard-isolated core groups according to their security levels, and the low-security-level core groups are prohibited from preempting the computing power of the high-security-level core groups. Divide global memory into multiple independent physical address spaces according to security level, and block memory access permissions between different security levels; The hardware priority queue of the vehicle network controller is allocated as a dedicated transmission channel according to the security level, and bandwidth resources are reserved for the high security level channel in the dedicated transmission channel; The basic mapping between the independent physical address space and the dedicated transmission channel is established, and a three-level static resource partitioning result is generated based on the hard isolated core group, the independent physical address space, the dedicated transmission channel, and the basic mapping.

3. The method according to claim 1, characterized in that, The step of binding the target service to an isolation core group of the corresponding security level based on the security level label, allocating a memory partition and network hardware priority queue of the corresponding security level to the target service, and generating the full-link resource configuration of the target service includes: Based on the security level label, the task of the target service is bound to the corresponding level of the isolated core group, which is an in-vehicle heterogeneous central processing unit core group with inter-group computing power preemption prohibited; Allocate memory partitions of the corresponding level to the target service and bind the corresponding memory access flow identifier to the page table field of the system memory management unit; Assign a network hardware priority queue with the corresponding priority to the target service, update the mapping relationship between memory channel identifier, network flow identifier and network queue identifier, and generate the full-link resource configuration of the target service.

4. The method according to claim 1, characterized in that, Based on the shared memory channel and access token in the full-link resource configuration, the process of reading, writing, and verifying the interaction data of the target service across different security level domains, and generating target interaction data residing in the shared memory channel, includes: Write the interaction data into the shared memory channel, and write the completion flag and the access token into it; Obtain the token verification result of the access token; When the token verification result indicates that the token verification is successful, the read reference count of the shared memory channel is incremented, and the interactive data is read based on the mapped address and the read reference count is decremented. After the read reference count is reduced to zero, the interaction data is marked as reused to generate target interaction data residing in the shared memory channel.

5. The method according to claim 4, characterized in that, After obtaining the token verification result of the access token, the method further includes: When the token verification result indicates that the token verification has failed, the access request for the interaction data is intercepted, and the interaction error data is reported.

6. The method according to claim 1, characterized in that, The step of mapping the shared memory channel to the network hardware priority queue for sending the target interactive data includes: Map the physical page frames of the shared memory channel to the transmit descriptor ring of the network controller; Based on the write pointer update of the send descriptor ring, the memory access engine is triggered to send the data frames in the shared memory channel into the network hardware priority queue of the corresponding time window to send the target interactive data.

7. The method according to claim 1, characterized in that, After binding the target service to the corresponding level of isolation core group according to the security level label, allocating the target service with the corresponding level of memory partition and network hardware priority queue, and generating the full-link resource configuration of the target service, the method further includes: In response to the target service's level change request, determine the changed target security level label; Based on the target security level label, the modified isolated core group, memory partition and network hardware priority queue are pre-configured to generate a pre-configured full-link resource configuration; If the pre-configuration indication is successful, the service flow of the target service will be synchronously switched to the pre-configured full-link resource configuration. If the pre-configuration indication indicates configuration failure, the target service will be rolled back to the original end-to-end resource configuration.

8. The method according to claim 1, characterized in that, The method further includes: If overload of vehicle system resources is detected, the computing power quota, memory bandwidth, and network bandwidth of non-critical applications with the lowest security level will be revoked. If resources are still insufficient, non-safe path function resources that are allowed to be downgraded in the second lowest security level are reclaimed, and the downgrade reclamation follows the fault tolerance time interval constraint. The core functional resources with the highest security level are fixed, and abnormal events and resource adjustments are recorded in the audit log to obtain a fallback result for abnormal events.

9. A vehicle-mounted heterogeneous system resource scheduling device, characterized in that, The device includes: A service receiving unit is used to receive a registration request for a target service, wherein the registration request carries a security level tag, and the security level tag is a global tag that characterizes the vehicle's safety integrity level; The resource configuration unit is used to bind the target service to the corresponding level of isolation core group according to the security level label, and to allocate the corresponding level of memory partition and network hardware priority queue to the target service, thereby generating the full-link resource configuration of the target service. The data generation unit is used to read, write and verify the interaction data of the target service between different security level domains based on the shared memory channel and access token in the full-link resource configuration, and generate target interaction data residing in the shared memory channel. The data interaction unit is used to map the shared memory channel to the network hardware priority queue to send the target interaction data.

10. A vehicle, characterized in that, The vehicle includes a request receiver, a memory, and a processor, wherein... The request receiver is used to receive registration requests for the target service; The memory is used to store executable program code; The processor is configured to bind the target service to an isolation core group of the corresponding security level according to the security level label, allocate a memory partition and a network hardware priority queue of the corresponding security level to the target service, and generate a full-link resource configuration for the target service; based on the shared memory channel and access token in the full-link resource configuration, read, write and verify the interaction data of the target service between different security level domains, and generate target interaction data residing in the shared memory channel; and map the shared memory channel to the network hardware priority queue to send the target interaction data.

Images