Integrated circuit and communication method thereof, electronic device, and storage medium

Abstract

To provide an integrated circuit, and a communication method thereof, an electronic device, and a storage medium.SOLUTION: An integrated circuit of the present invention includes a first functional module, a second functional module, an interconnection module, and a first isolation module. The first functional module and the second functional module are communicatively connected via the interconnection module, and the first isolation module is installed in a communication link between the first functional module and the interconnection module. The second functional module is disposed to send a first message to the first functional module, and the first isolation module is disposed to control transmission of the first message based on a correspondence between the first message and a first preset protocol.SELECTED DRAWING: Figure 1

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to a Chinese patent application filed on May 31, 2024 with the State Intellectual Property Office of the People's Republic of China, bearing application number 202410702680.5 and entitled "Integrated Circuit, Integrated Circuit System, and Communication Method", and to a Chinese patent application filed on September 11, 2024 with the State Intellectual Property Office of the People's Republic of China, bearing application number 202411275751.4 and entitled "Integrated Circuit, Integrated Circuit System, and Communication Method", the entire contents of which are incorporated herein by reference. [Technical field]

[0002] The present disclosure relates to the technical field of integrated circuits, and in particular to an integrated circuit and its communication method, electronic device, and storage medium. [Background technology]

[0003] With the evolution and development of intelligent vehicles, they usually integrate a series of operating systems with rich business functions, such as intelligent drive systems, intelligent cabin systems, in-vehicle infotainment systems and safety island systems.

[0004] Currently, multiple operating systems can run on one integrated circuit. For example, an integrated circuit may include multiple sub-integrated circuits, each of which functions as a functional module, and thus an integrated circuit may include multiple functional modules, each of which may run a respective operating system.

[0005] When multiple operating systems run simultaneously, data is exchanged between different functional modules of the integrated circuit. If one functional module sends abnormal data to another functional module, the functional module that receives the abnormal data will be unable to process the abnormal data, resulting in a stuck state, which reduces the operational reliability of the integrated circuit. Summary of the Invention [Problem to be solved by the invention]

[0006] SUMMARY OF THE DISCLOSURE Embodiments of the present disclosure provide an integrated circuit, an integrated circuit system, and a communication method that can improve the operational reliability of the integrated circuit. [Means for solving the problem]

[0007] A first aspect of the present disclosure provides an integrated circuit, the integrated circuit including a first functional module, a second functional module, an interconnection module, and a first isolation module, the first functional module and the second functional module being communicatively connected via the interconnection module, and the first isolation module being disposed in a communication link between the first functional module and the interconnection module, where the first isolation module is used to determine whether the first functional module communicates with the second functional module according to a preset protocol.

[0008] Exemplarily, the second functional module is configured to send a first message to the first functional module, and the first isolation module is used for controlling the transmission of the first message according to a corresponding relationship between the first message and a first preset protocol, where controlling the transmission of the first message may include controlling whether the first message continues to transmit, controlling the transmission time of the first message, or controlling the transmission carrier of the first message, etc.

[0009] In the integrated circuit provided in the present disclosure, when the second functional module sends a first message to the first functional module, the first isolation module can perform transmission control on the first message based on the correspondence between the first preset protocol and the first message, preventing the first functional module from receiving a first message that does not correspond to the first preset protocol, further avoiding the first functional module from getting stuck, and improving the reliability of the integrated circuit.

[0010] A second aspect of the present disclosure provides a communication method based on an integrated circuit, where the integrated circuit includes a first functional module and a second functional module, and the communication method based on the integrated circuit includes a step of detecting a first message sent by the second functional module to the first functional module, and a step of controlling transmission of the first message based on a correspondence between the first message and a first preset protocol.

[0011] The method provided in the present disclosure controls the transmission of a first message based on a correspondence between the first message and a first preset protocol when a second functional module sends a first message to a first functional module, thereby preventing the first functional module from receiving a first message that does not correspond to the first preset protocol and becoming stuck, and improving the reliability of the integrated circuit.

[0012] A third aspect of the present disclosure provides an integrated circuit system including an integrated circuit and a memory for storing instructions executable by the integrated circuit, the integrated circuit being adapted to read and execute the executable instructions from the memory to realize any of the methods described above.

[0013] A fourth aspect of the present disclosure provides an electronic device including the integrated circuit provided in the first aspect.

[0014] A fifth aspect of the present disclosure provides a computer-readable storage medium storing a computer program for executing the integrated circuit-based communication method of the second aspect. [Brief description of the drawings]

[0015] [Figure 1] 1 is a first structural schematic diagram of an integrated circuit provided in an exemplary embodiment of the present disclosure. [Diagram 2] FIG. 2 is a second structural schematic diagram of an integrated circuit provided in an exemplary embodiment of the present disclosure. [Diagram 3] FIG. 2 is a schematic diagram of data exchange between modules provided in an exemplary embodiment of the present disclosure. [Figure 4] FIG. 11 is a schematic diagram of a transmission control of a first message provided in an exemplary embodiment of the present disclosure. [Diagram 5] FIG. 2 is a third structural schematic diagram of an integrated circuit provided in an exemplary embodiment of the present disclosure. [Figure 6] FIG. 4 is a fourth structural schematic diagram of an integrated circuit provided in an exemplary embodiment of the present disclosure. [Figure 7] FIG. 5 is a schematic diagram of a fifth structure of an integrated circuit provided in an exemplary embodiment of the present disclosure. [Figure 8] 1 is a first schematic flowchart of a communication method based on an integrated circuit provided in an exemplary embodiment of the present disclosure. [Figure 9] 4 is a second schematic flowchart of a communication method based on an integrated circuit provided in an exemplary embodiment of the present disclosure. [Figure 10] 11 is a third schematic flowchart of a communication method based on an integrated circuit provided in an exemplary embodiment of the present disclosure. [Figure 11] 1 is a structural diagram of an integrated circuit system provided in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] In order to explain the present disclosure, exemplary embodiments of the present disclosure will be described in detail below with reference to the drawings. Obviously, the described embodiments are merely some embodiments of the present disclosure, and not all embodiments, and it is to be understood that the present disclosure is not limited to the exemplary embodiments.

[0017] Unless otherwise specified, the relative arrangement of parts and steps, formulas and numerical values ​​described in these examples do not limit the scope of the present disclosure.

[0018] Before describing the embodiments of the present disclosure in detail, nouns and terms related to the embodiments of the present disclosure will be explained, and the nouns and terms related to the embodiments of the present disclosure will be applied to the following interpretation.

[0019] 1. An operating system is a system for implementing the business functions of an intelligent vehicle. For example, an intelligent drive system, an intelligent cabin system, an in-vehicle infotainment system, and a safety island system are all operating systems with different business functions. The present disclosure is not limited to the above-mentioned operating systems, and may be other types and operating systems not mentioned in the present disclosure.

[0020] The operating systems are executed by processors within the integrated circuit. Different numbers of processors can be deployed for operating systems with different performance requirements. For operating systems with high performance requirements, more processors can be deployed. For operating systems with low performance requirements, fewer processors can be deployed.

[0021] 2. The integrated circuit includes hardware resources such as at least one processor, a communication link, multiple communication interfaces, memory, etc., and the processor may include different types such as a central processing unit and a graphics processor.

[0022] In the embodiments of the present disclosure, the integrated circuit may be, for example, a system on a chip (SoC), an application processor (AP), etc., but the embodiments of the present disclosure are not limited thereto.

[0023] To execute multiple operating systems simultaneously within an integrated circuit, the integrated circuit may include multiple sub-integrated circuits, each of which may include at least one processor and corresponding hardware resources such as communication links, multiple communication interfaces, memory, etc. That is, each sub-integrated circuit may function as a functional module, and each functional module may independently execute an operating system. In this manner, an integrated circuit may include multiple functional modules, thereby allowing multiple operating systems to run simultaneously.

[0024] In each functional module, at least one processor is used to execute a pre-assigned operating system, communication links and communication interfaces are used to realize communication between processors within the functional module or between the functional module and other external modules, and memory may be used to store information such as information to be processed, intermediate information during processing, and result information after processing.

[0025] In addition, the integrated circuit may further include interconnection modules and isolation modules to realize and control data exchange between the multiple functional modules.

[0026] The interconnection module is used to realize information transmission between multiple functional modules, where the interconnection module includes a communication link and multiple communication interfaces connected to the communication link. Information can be transmitted between the multiple communication interfaces in the interconnection module via the communication link. Each communication interface of the interconnection module is respectively connected to the communication interfaces of the multiple functional modules and is used to transmit information to different functional modules and to receive information transmitted by different functional modules. In some examples, the multiple functional modules of the integrated circuit can communicate between them via a bus, and accordingly the interconnection module may be a bus module in the integrated circuit.

[0027] The isolation module is a newly added module in the embodiment of the present disclosure. In the embodiment of the present disclosure, the isolation module is used to safely isolate modules that need to be protected in an integrated circuit, and the isolation module includes a functional circuit for realizing functions related to safe isolation and a communication interface. In the embodiment of the present application, the isolation module isolates modules that need to be protected to become a safe and independent physical area on hardware and form a security world, in which input or output information needs to go through inspection and verification to determine whether it can be transmitted to other modules.

[0028] In the embodiment of the present disclosure, the module that needs to be protected may be a functional module or an interconnection module.

[0029] For example, if the module that needs to be protected is a target functional module in an integrated circuit, the isolation module can be installed at the interface through which the target functional module communicates with other modules. For example, the isolation module can be installed between the communication interface of the target functional module and the communication interface of the interconnection module. In this way, when the information transmitted or received by the target functional module passes through the isolation module, the isolation module can check and verify the information and determine whether to continue transmitting the information.

[0030] 3. The security level is, for example, Automotive Safety Integrity Level (ASIL). The security level can be determined based on indicators such as severity, exposure probability, and controllability. For example, the security level can be classified into level QM (quality management), level A, level B, level C, and level D from low to high according to security requirements. Here, level QM indicates a level that does not cause any hazard to the safety of the vehicle.

[0031] The security level is used to evaluate the security requirements of each module in the integrated circuit: the higher the security requirements of the module, the higher the security level that needs to be placed on the module, and the lower the security requirements of the module, the lower the security level that needs to be placed on the module.

[0032] For example, the safety of an intelligent drive system is related to the safety of a driver, so the safety requirements for the functional module that operates the intelligent drive system are high. Therefore, a high security level can be set for the functional module that operates the intelligent drive system. Also, for example, the safety requirements for the functional module that operates the in-vehicle infotainment system are low, so a low security level can be set for the functional module that operates the in-vehicle infotainment system. The above descriptions of the security levels of each module are merely examples and do not specifically limit the security levels of each module.

[0033] In addition, in the embodiment of the present application, since each module (e.g., each functional module, interconnection module, and isolation module) includes a processor, a functional circuit, a communication link, a communication interface, etc. for realizing each function, each module may correspond to one hardware area in the integrated circuit, and this hardware area may be called a hardware domain. Illustratively, the functional module may be called a hardware domain, the interconnection module may be called an interconnection domain, and the isolation module may be called an isolation domain.

[0034] Overview of the Application Current intelligent vehicles typically integrate a series of operating systems with rich business functions, such as an intelligent drive system, an intelligent cabin system, an in-vehicle infotainment system and a safety island system.

[0035] Currently, multiple operating systems can run on one integrated circuit. For example, an integrated circuit may include multiple sub-integrated circuits, each of which may function as a function (or business function) module, and thus, an integrated circuit may include multiple functional modules, each of which may run one operating system. For example, a first sub-integrated circuit may realize an intelligent drive function, and a second sub-integrated circuit may realize a cabin infotainment function. The first sub-integrated circuit may also be referred to as a first functional module or a first hardware domain, and the second sub-integrated circuit may also be referred to as a second functional module or a second hardware domain.

[0036] When multiple operating systems run simultaneously, data is exchanged between different functional modules of the integrated circuit. If one functional module sends abnormal data to another functional module, the functional module that received the abnormal data will be unable to recognize the abnormal data and will become stuck. As a result, the operating system on the functional module that received the abnormal data will be unable to operate normally, reducing the operational reliability of the integrated circuit.

[0037] To solve the above problems, embodiments of the present disclosure provide an integrated circuit, an integrated circuit system, and a communication method, which can prevent a functional module in an integrated circuit from becoming stuck due to receiving abnormal data, and can improve the reliability of the operation of the integrated circuit.

[0038] Exemplary System 1 is a first structural schematic diagram of an integrated circuit provided in an exemplary embodiment of the present disclosure, in which the integrated circuit 10 in FIG. 1 includes a first functional module 110, a second functional module 120, an interconnection module 200, and a first isolation module 300. The first functional module 110 and the second functional module 120 are communicatively connected via the interconnection module 200, and the first isolation module 300 is disposed in the communication link between the first functional module 110 and the interconnection module 200.

[0039] Illustratively, the interconnection module 200 and the first isolation module 300 may be one physical module or may be two different modules.

[0040] Here, the first functional module 110 may realize a first business function by executing software code corresponding to the first business function, and the second functional module 120 may realize a second business function by executing software code corresponding to the second business function.

[0041] For example, the first business function may be an intelligent driving function, and the software code corresponding to the first business function may be software code of an intelligent driving system. The second business function may be an in-vehicle infotainment function, and the software code corresponding to the second business function may be software code of an in-vehicle infotainment system.

[0042] In some embodiments, the first functional module 110 and the second functional module 120 may have a preset security level. Here, the security levels of the first functional module 110 and the second functional module 120 may be the same or different. The security levels of the first functional module 110 and the second functional module 120 may be statically invariant or dynamically adjusted based on the business functions performed by each of them. The embodiments of the present application do not limit the security levels of the first functional module 110 and the second functional module 120.

[0043] In some embodiments, the isolation module can provide security protection, e.g., safety isolation functions such as message inspection, message blocking, etc., to one or more of the first functional module 110, the second functional module 120, and / or the interconnection module 200.

[0044] In some implementations, the isolation modules and the protected modules may have a one-to-one correlation, i.e., one isolation module is installed for each protected module. For example, if the protected module is the first functional module 110, one isolation module is installed for the first functional module 110, e.g., the first isolation module 300. If the interconnection module 200 also needs to be protected, one isolation module needs to be installed for the interconnection module 200, and so on.

[0045] In some other implementations, the isolation module and the protected module may have a one-to-many correlation. That is, one isolation module may provide protection to multiple modules. Illustratively, in the structure shown in FIG. 1, the first isolation module 300 may provide protection to the first functional module 110, or may provide protection to the interconnection module 200. The specific module or modules to which the first isolation module 300 provides protection may be determined based on a pre-set decision-making mechanism, for example, based on the security level, protection priority, business demand, and / or system configuration of each module, and the embodiment of the present application is not limited thereto.

[0046] In some embodiments, the isolation module provides preferential security protection to functional modules with higher security levels to ensure that the functional modules with higher security levels do not become stuck due to receiving abnormal data.

[0047] Exemplarily, the first functional module 110 has a high security level for implementing an intelligent drive system, for example, the security level of the first functional module 110 is ASIL D. The second functional module 120 has a low security level for implementing an in-vehicle infotainment system, for example, the security level of the second functional module 120 is ASIL B. That is, the security level of the first functional module 110 is higher than the security level of the second functional module 120.

[0048] 1, since the security level of the first functional module 110 is high, a first isolation module 300 can be arranged for the first functional module 110. Since the security level of the second functional module 120 is low, there is no need to arrange an isolation module for the second functional module 120.

[0049] In addition, since the interconnection module 200 needs to realize communication between the first functional module 110 and the second functional module 120, and its function is also very important, a high security level can be set for the interconnection module 200, for example, the security level of the interconnection module 200 can be set to ASIL C.

[0050] Accordingly, an isolation module may be disposed relative to the interconnection module 200. For example, the interconnection module 200 may share the first isolation module 300 with the first functional module 110. Alternatively, one isolation module may be disposed separately relative to the interconnection module 200, and the embodiment of the present application is not limited thereto.

[0051] Hereinafter, referring to FIG. 1, a manner in which the first isolation module 300 provides security protection to the first functional module 110 will be described by way of example, taking the second functional module 120 sending a first message to the first functional module 110.

[0052] Here, the first message may be an access request message sent by the second functional module 120 to the first functional module 110. Illustratively, the first message may include, but is not limited to, one or more of a write request message, a read request message, a synchronization request message, a lock request message, and the like.

[0053] Or, the first message may be a response message sent by the second functional module 120 to the first functional module 110 after the second functional module 120 receives an access request message sent by the first functional module 110. Illustratively, the first message includes, but is not limited to, one or more of a write response message, a read response message, a synchronization response message, a lock response message, and the like.

[0054] Take the first message as an example, an access request message; if the first isolation module 300 is not installed, the first message is sent from the second functional module 120 and then sent to the first functional module 110 via the interconnection module 200. If the first message conforms to the first preset protocol, the first functional module 110 will send a response message to the second functional module 120, so that the mutual communication between the first functional module 110 and the second functional module 120 can be completed.

[0055] Taking the first message as an example, when the first isolation module 300 is not installed, after the first message is sent from the second functional module 120, it is sent to the first functional module 110 via the interconnection module 200, thereby completing the mutual communication between the first functional module 110 and the second functional module 120.

[0056] However, regardless of whether the first message is an access request message or a response message, as long as the first message received by the first functional module 110 does not conform to the first preset protocol, the first functional module 110 may become stuck.

[0057] Here, a supplementary explanation is required: the first message conforming to the first preset protocol may be described as the first message corresponding to the first preset protocol, or the first message being a valid message, the request corresponding to the first message being a valid request, and the response corresponding to the first message being a valid response. Correspondingly, the first message not conforming to the first preset protocol may be described as the first message not conforming to the first preset protocol, or the first message being an invalid message, the request corresponding to the first message being an invalid request, and the response corresponding to the first message being an invalid response.

[0058] In one example, the first preset protocol may define a manner of data transmission between modules. For example, in the first preset protocol, the number of data in the first message may be preset to be equal to a target number (or target number). For example, the first preset protocol specifically has the number of data in the first message as N, where N≧1. Here, data is transmitted in a beat manner, and each beat may include data of a specified length, and each data transmission may include multiple beats. Each beat may be one piece of data, that is, the number of beats is the number of data. For example, before the second functional module 120 transmits the first message to the first functional module 110, the second functional module 120 may transmit an instruction message to the first functional module 110, and the instruction message may include the number of beats to be included in the first message to be transmitted, i.e., the target number of data, and the data length of each beat. After receiving the instruction message, the first functional module 110 may enter a hold state and wait to receive data. The second functional module 120 may transmit a first message to the first functional module 110 in beat units. Next, if the first functional module 110 receives a target number of beats, i.e., if the number of data in the first message is equal to the target number, it indicates that the first message complies with the first preset protocol. If the number of beats received by the first functional module 110 is different from the target number, i.e., if the number of data in the first message is different from or not equal to the target number, it indicates that the first message does not complies with the first preset protocol.

[0059] In order to prevent the first functional module 110 from getting stuck due to receiving a message that does not conform to the first preset protocol, the embodiment of the present application installs a first isolation module 300 between the first functional module 110 and the interconnection module 200. When receiving a first message, i.e., before the first message is delivered to the first functional module 110, the first isolation module 300 can control the transmission of the first message based on the correspondence between the first message and the first preset protocol.

[0060] Specifically, if the first message does not correspond to the first preset protocol, the first isolation module 300 can block the first message. In this way, the first functional module 110 does not receive the first message, thereby avoiding the stacking of the first functional module 110, and well realizing the safe isolation of different functional modules.

[0061] Also, if the first message corresponds to the first preset protocol, the first isolation module 300 may continue to transmit the first message, for example, pass through the first message or perform a preset process on the first message and then transmit it to the first functional module 110. Here, the preset process may include, for example, timing control, flow control, priority control, arbitration, etc., and the embodiment of the present disclosure is not limited thereto. In this way, the first functional module 110 can receive the first message to complete the subsequent mutual communication. Here, "pass through" means that the first isolation module 300 does not make any changes to the first message and only transmits the first message to the first functional module 110.

[0062] In an embodiment of the present disclosure, a preset protocol (e.g., a first preset protocol or a second preset protocol) is related to a bus architecture specification used for communication between functional modules (e.g., between the first functional module 110 and the second functional module 120). For example, the first preset protocol may conform to the bus architecture specification used between the first functional module 110 and the second functional module 120, or the first preset protocol may be designed based on the bus architecture specification used between the first functional module 110 and the second functional module 120.

[0063] Illustratively, taking the advanced microcontroller bus architecture (AMBA) specification as an example between the first functional module 110 and the second functional module 120, the first preset protocol may conform to any of the advanced peripheral bus (APB) specification, the advanced high-performance bus (AHB) specification, or the advanced extensible interface (AXI) specification.

[0064] Illustratively, based on the difference in the bus architecture specification used between the first functional module 110 and the second functional module 120, the contents of the bus architecture specification include, but are not limited to, at least one of the following: Data amount requirements of the message: The number of data items, for example the number of beats, and / or the data length, for example the byte length, bit length, etc. Message timeout mechanism: Includes timeout period etc. Timing requirements for the message: Includes constraints on the number of clock cycles a message may have, signal delays, etc. Error Handling: Defines the error types and handling mechanisms for errors that may occur during message transmission.

[0065] Exemplarily, when the bus architecture specification used between the first functional module 110 and the second functional module 120 includes a data amount requirement of a message, the first preset protocol may be such that the number of data in the first message is equal to a target number N, where N≧1. If the number of data in the first message is not equal to the target number in the first preset protocol, it indicates that the first message does not correspond to the first preset protocol, and if the number of data in the first message is equal to the target number in the first preset protocol, it indicates that the first message corresponds to the first preset protocol. Here, the target number may be fixed or may be dynamically changed for each transmission based on factors such as the requirement of the data amount to be transmitted, and the embodiment of the present disclosure is not limited thereto.

[0066] Exemplarily, when the bus architecture specification used between the first functional module 110 and the second functional module 120 includes a clock cycle number limit for a message, the first preset protocol may be such that the number of clock cycles continued for transmitting the first message is equal to or less than a maximum number of clock cycles M, where M is equal to or greater than 1. If the number of clock cycles continued for transmitting the first message is greater than the maximum number of clock cycles, it indicates that the first message does not comply with the first preset protocol, and if the number of clock cycles continued for transmitting the first message is equal to or less than the maximum number of clock cycles, it indicates that the first message complies with the first preset protocol.

[0067] In some embodiments, the first preset protocol may be stored in a pre-configured register 330, and thus the first isolation module 300 can read the first preset protocol from the register 330, determine the contents in the first preset protocol, and further determine whether the first message corresponds to the first preset protocol.

[0068] Here, the register 330 may be located inside the integrated circuit 10 and may form a part of the integrated circuit 10, or the register 330 may be an external register 330 located outside the integrated circuit 10. When the register 330 is located inside the integrated circuit 10, the register 330 may be a register 330 exclusively used by the first isolation module 300, or may be a register 330 shared with other modules, for example, shared with the first functional module 110, the second functional module 120 and / or the interconnection module 200. The present application does not limit the implementation manner of the register 330.

[0069] Also, when the register 330 is located inside the integrated circuit 10, the register 330 may be located inside the first isolation module 300 so as to be a part of the first isolation module 300. The register 330 may not belong to any module and may be located separately in the integrated circuit 10. Also, the register 330 may be located in another module, for example, in the first functional module 110, in the second functional module 120, in the interconnection module 200, or in another isolation module, and the embodiment of the present disclosure does not limit the location of the register 330.

[0070] In addition, the number of the registers 330 may be one or more. When the number of the registers 330 is more than one, the multiple registers 330 may have multiple installation methods. For example, the multiple registers 330 may all be installed in the first isolation module 300. Alternatively, the multiple registers 330 may all be installed in other modules. Alternatively, the multiple registers 330 may exist independently in the integrated circuit 10 without belonging to any module. Alternatively, the multiple registers 330 may be partly installed in the first isolation module 300, and the other part may be installed in other modules or may exist independently. That is, when the number of the registers 330 is more than one, the embodiment of the present disclosure does not limit the installation method of the registers 330.

[0071] As can be seen from the above technical solutions, in the integrated circuit 10 provided in the present disclosure, when the second functional module 120 sends a first message to the first functional module 110, for example, before the first functional module 110 receives the first message, the first isolation module 300 performs transmission control on the first message based on the correspondence between the first preset protocol and the first message, so as to prevent the first functional module 110 from receiving the first message that does not correspond to the first preset protocol, thereby avoiding the first functional module 110 from being stuck, successfully realizing safe isolation for different functional modules, and improving the reliability of the integrated circuit 10.

[0072] It should be noted that the integrated circuit 10 shown in FIG. 1 is merely illustrative, and the number of functional modules, the number of isolation modules, and whether an operating system runs within the functional module may be set according to actual circumstances. The circuit structure of the integrated circuit 10 in FIG. 1 is merely an example, and FIG. 1 does not limit the scope of protection of the present disclosure.

[0073] Exemplary Apparatus FIG. 2 is a second structural schematic diagram of an integrated circuit 10 provided in an exemplary embodiment of the present disclosure.

[0074] As shown in FIG. 2, in some embodiments, the first isolation module 300 may include a protocol inspection submodule 310. Here, the protocol inspection submodule 310 may, for example, perform message monitoring on messages passing through the first isolation module 300, perform protocol inspection on the monitored messages, and / or perform transmission control on the messages based on the protocol inspection results. The protocol inspection submodule 310 may include a functional circuit and a communication interface for realizing its function. When a first message sent by the second functional module 120 to the first functional module 110 passes through the first isolation module 300, the protocol inspection submodule 310 monitors the first message and continues to transmit or blocks the first message based on the correspondence between the first message and the first preset protocol, so that the first functional module 110 does not receive the first message that does not correspond to the first preset protocol, thereby avoiding the first functional module 110 from being stuck. Here, continuing to transmit may be passing through the first message or transmitting the first message to the first functional module 110 after performing a preset process on the first message. In this context, “pass-through” means that the protocol inspection sub-module 310 does not perform any modification / processing on the first message, but simply forwards the first message to the first function module 110 .

[0075] 2 , in one embodiment, the protocol inspection submodule 310 may include a first monitoring unit 311 and a first processing unit 312. In one example, each unit in the protocol inspection submodule 310, such as the first monitoring unit 311 and the first processing unit 312, may be two different sub-function circuits in the protocol inspection submodule 310, and the first monitoring unit 311 and the first processing unit 312 may be communicatively connected via a communication interface in the protocol inspection submodule 310. The embodiment of the present application does not limit the implementation manner of the first monitoring unit 311 and the first processing unit 312.

[0076] Here, the first monitoring unit 311 can monitor messages passing through the first quarantine module 300 according to a first preset protocol.

[0077] In one implementation, the first monitoring unit 311 can obtain the first preset protocol from the register 330 in advance to determine a monitoring policy for a message. Here, the first monitoring unit 311 may obtain the first preset protocol from the register 330 when the power is turned on, or the first monitoring unit 311 may obtain the first preset protocol from the register 330 periodically, or the first monitoring unit 311 may obtain the first preset protocol from the register 330 based on a control signal or instruction information input from the outside. The embodiment of the present application is not limited thereto.

[0078] In one example, the monitoring policy of the first monitoring unit 311 for messages may include monitoring one or more channels of a bus architecture specification to which the first preset protocol conforms, where a channel may refer to a logical path for transmission of different types of data during bus transmission.

[0079] Illustratively, the AXI specification may include a master channel, a slave channel, a write data channel, a read data channel, a write address channel, a read address channel, a write response channel, and a read response channel.

[0080] Here, the host interface may be the communication interface of the first functional module 110, and the peripheral interface may be the communication interface of the second functional module 120. Or, the peripheral interface may be the communication interface of the first functional module 110, and the host interface may be the communication interface of the second functional module 120. Specifically, they can be flexibly arranged in the register 330 according to the design of the bus, and the embodiment of the present application is not limited thereto.

[0081] Illustratively, when the security level of the first functional module 110 is higher than that of the second functional module 120, the host interface may be the communication interface of the second functional module 120, and the peripheral interface may be the communication interface of the first functional module 110.

[0082] Next, when the first monitoring unit 311 detects the first message sent by the second functional module 120, it can determine the corresponding relationship between the first message and the first preset protocol.

[0083] For example, taking the first message as an example, when the first monitoring unit 311 detects the write request message sent by the second functional module 120 to the first functional module 110 in the write data channel, the first monitoring unit 311 may detect whether the number of data to be written is the same as the target number in the first preset protocol. If the number is the same, it determines that the first message corresponds to the first preset protocol. If the number is not the same, it determines that the first message does not correspond to the first preset protocol.

[0084] Below, a method in which the first monitoring unit 311 determines the correspondence between the first message and the first preset protocol will be described by taking as an example a case in which the first message is a write request message and the first preset protocol complies with the AXI specification.

[0085] Here, the contents of the AXI specification may include at least the following: Address of the first beat of the burst: The address of the first beat in one write / read operation. If it is write data, this address is the write address, if it is read data, this address is the read address. Number of beats (transfers) inside the burst: The target number of beats during one write / read operation, i.e. the target number of data. Size of each beat: The data length of each beat.

[0086] FIG. 3 is a schematic diagram of data exchange between modules provided in an exemplary embodiment of the present disclosure.

[0087] Hereinafter, referring to FIG. 3, the first message is a write request message, and the first preset protocol complies with the AXI specification. For example, the first preset protocol is such that the number of data items in the first message is equal to 5 beats. The manner in which the second functional module 120 transmits the first message to the first functional module 110 will be described.

[0088] Exemplarily, before the second functional module 120 sends the first message to the first functional module 110, the second functional module 120 may send a write instruction message to the first functional module 110 on the write address channel.

[0089] Here, the write instruction message may include a write address (starting address) of the first beat in the first message to be written, a data length (transfers size) of each beat in the first message, and a number of beats (transfers length) in the first message. Exemplarily, the write instruction message may specifically include the following parameters: starting address:0x1004 / / The write address of the first beat is 0x1004. transfers size: 4 Bytes / / The data length of each beat is 4 bytes. transfers length:5 beats / / The number of beats is 5 (i.e. the target number).

[0090] That is, the first preset protocol may be carried in the write instruction message. For example, when the write instruction message includes "transfers length: 5 beats", the first preset protocol indicates that the transfers length of the first message is equal to 5, that is, the first preset protocol indicates that the number of data pieces of the first message is equal to 5 beats.

[0091] After the first functional module 110 receives the write instruction message, it can enter a pending state and wait to receive data.

[0092] The second functional module 120 may then send the first message to the first functional module 110 on the write data channel.

[0093] For example, if the second function module 120 sends a first message conforming to the first preset protocol, the first message includes 5 beats, and the data length of each beat is 4 bytes. If the second function module 120 sends a first message not conforming to the first preset protocol, the first message may include only 3 beats or even fewer beats, or the data length of each beat may not be 4 bytes.

[0094] Next, the first functional module 110 can detect the number of beats received and determine whether all the beats in the first message have been received based on the transfers length parameter in the write instruction message. If all the beats in the first message have been received, the first functional module 110 can release the hold state and send a response message to the second functional module 120 on the write response channel. If all the beats in the first message have not been received, the first functional module 110 can continue the hold state and wait to receive the remaining beats.

[0095] For example, when the transfers length is 5 beats, if the first functional module 110 receives data of 5 beats, the first functional module 110 may determine that all beats in the first message have been received. If the first functional module 110 receives data of only 3 beats, the first functional module 110 may determine that all beats in the first message have not been received.

[0096] Accordingly, the first monitoring unit 311 can monitor the write address channel and the write data channel of the AXI specification. By monitoring the write address channel, the write instruction message sent by the second functional module 120 can be monitored, and the specific value of the transfers length parameter corresponding to the first message, that is, the target number can be determined. By monitoring the write data channel, the first message sent by the second functional module 120 can be monitored, and the correspondence between the first message and the first preset protocol can be determined based on the monitored transfers length parameter and the number of beats in the monitored first message.

[0097] Exemplarily, when the transfers length is 5 beats, if the first monitoring unit 311 detects that the first message includes data of 5 beats, the first monitoring unit 311 may determine that the first message corresponds to the first preset protocol. If the first monitoring unit 311 detects that the number of beats in the first message is not 5, for example, when the first message includes data of 3 beats, the first monitoring unit 311 may determine that the first message does not correspond to the first preset protocol.

[0098] Next, when the first monitoring unit 311 has already determined the correspondence relationship between the first message and the first preset protocol, the first processing unit 312 performs transmission control on the first message based on the correspondence relationship between the first message and the first preset protocol.

[0099] In one implementation, the first processing unit 312 can transmit (e.g., pass through) the first message to the first functional module 110 if the first message corresponds to the first preset protocol. In this manner, the first functional module 110 can receive the first message corresponding to the first preset protocol and process the first message.

[0100] In one implementation manner, the first processing unit 312 can block the first message if the first message does not correspond to the first preset protocol. In this way, the first functional module 110 will not receive the first message that does not correspond to the first preset protocol, thereby avoiding the first functional module 110 from being stuck, and well realizing the safe isolation of different functional modules.

[0101] In one implementation, if the first message does not correspond to the first preset protocol, the first monitoring unit 311 may further determine an error type of the first message. Exemplarily, if the number of data written by the first message is less than the target number, the error type may be a mismatch in the number of data, for example, the error type is a shortage of the number of data. If the number of data written by the first message is more than the target number, the error type may be a mismatch in the number of data, for example, the error type is an excessive number of data. If the data length of the first message is different from the target data length in the first preset protocol, the error type may be a mismatch in the data length. If the first message is a response message, if the first message is not received within a first time after sending the request message, the error type may be a timeout.

[0102] In the embodiment of the present application, the error types may be pre-configured in the register 330, and the embodiment of the present application does not limit the number and contents of the error types.

[0103] In one implementation, if the first message does not correspond to the first preset protocol, the first processing unit 312 can process the first message using different policies based on different error types of the first message.

[0104] In a first example, for any error type, the first processing unit 312 may block the first message.

[0105] In a second example, when the number of data in the first message is different from the preset target number in the first preset protocol, the first processing unit 312 determines a first association message according to the first preset protocol, and sends the first association message to the first functional module, where the number of data in the first association message is equal to the preset target number in the first preset protocol. For example, when the error type of the first message is that the number of data in the first message is less than the target number, the first processing unit 312 can block the first message, complement the number of data in the first message to the target number, obtain a first association message, and send the first association message to the first functional module 110.

[0106] For example, assuming that the target number of the first message is 10 pieces of data, but the first message only contains 5 pieces of data, the first preset protocol can determine that the number of pieces of data in the first message is less than the target number. In this case, the first processing unit 312 can block the first message, and complement another 5 pieces of data based on the 5 pieces of data in the first message, thereby obtaining a first association message containing 10 pieces of data. Then, send the first association message to the first functional module 110.

[0107] FIG. 4 is a schematic diagram of a transmission control of a first message provided in an exemplary embodiment of the present disclosure.

[0108] Hereinafter, with reference to FIG. 4, a manner in which the first processing unit 312 sends the first association message will be illustratively described, taking as an example that the first message is a write request message and the first preset protocol complies with the AXI specification.

[0109] For example, when the transfer length is 5 beats, that is, the target number is 5 pieces of data, if the first monitoring unit 311 detects that the number of beats in the first message is less than 5, for example, when the first message contains 3 beats of data, the first processing unit 312 can block the first message, and complement the 2 beats of data based on the 3 beats of the first message, thereby obtaining a first association message containing 5 beats of data, and sending the first association message containing the 5 beats of data to the first functional module 110.

[0110] That is, the first processing unit 312 can replace the first message having a smaller number of data pieces than the target number with the first association message having a number of data pieces equal to the target number in order to meet the requirement of the target number in the first preset protocol. In this way, the first functional module 110 receives the first association message having a number of data pieces that conforms to the first preset protocol, so that the first functional module 110 does not get stuck, thereby successfully realizing safe isolation of different functional modules and improving the reliability of the integrated circuit 10.

[0111] Here, the first processing unit 312 does not know the exact contents of the five pieces of data missing from the first message. In this case, the first processing unit 312 may complement the missing data according to a preset content, for example, by using meaningless data previously arranged in the register 330 to perform the complement, and the complemented content is blank data that is all 0. The embodiment of the present application does not limit the specific content of the data complemented by the first processing unit 312.

[0112] As can be understood, the first preset protocol defines a target number of data in a message but does not define the specific content of the message, so when the first functional module 110 receives data based on the first preset protocol, as long as it receives the target number of data, it is considered that it has received all data that conforms to the first preset protocol from the second functional module 120, and therefore the first functional module 110 releases the pending state waiting to receive data, thereby preventing stacking and successfully realizing safe isolation for different functional modules.

[0113] For example, if the target number is 10 pieces of data, when the first functional module 110 receives a first association message containing 10 pieces of data, it is considered that all data conforming to the first preset protocol has been received, and therefore the first functional module 110 will release the pending state, so that no stacking will occur, and safe isolation for different functional modules is well realized.

[0114] In a third example, if the error type of the first message is that the number of data in the first message is less than the target number, the first processing unit 312 may not block the first message, but may first pass through the first message, and after passing through the first message, may further send a certain number of complementary data to the first functional module 110 so that the sum of the number of data in the first message and the number of data in the complementary data is the target number. Here, the complementary data may be meaningless data pre-arranged in the register 330, such as blank data whose contents are all 0, and the embodiment of the present application is not limited thereto. In this way, the number of data received by the first functional module 110 can be made to meet the requirements of the first preset protocol, so that stacking does not occur, and safe isolation of different functional modules is well realized.

[0115] In a fourth example, if the error type of the first message is that the number of data in the first message is greater than a target number, the first processing unit 312 may block the first message, extract the target number of data from the first message, obtain a first association message, and send the first association message to the first functional module 110.

[0116] Exemplarily, the first processing unit 312 may extract a target number of data from the first message from the front based on the order of each data in the first message, or may extract a target number of data from the first message from the back, or may extract a target number of data from the first message from the middle. Alternatively, the first processing unit 312 may select a target number of data from the first message based on a certain rule, for example, dynamically variable or at a certain interval, or randomly extract a target number of data from the first message. The embodiment of the present disclosure does not limit the manner of extracting a target number of data from the first message.

[0117] In this way, after receiving the first association message, the first functional module 110 is considered to have received all data conforming to the first preset protocol from the second functional module 120, and therefore the first functional module 110 releases the pending state waiting to receive data, thereby preventing stacking and providing good safe isolation for different functional modules.

[0118] In the fifth example, if the error type of the first message is that the number of data in the first message is greater than the target number, the first processing unit 312 passes through the target number of data in the first message and blocks the remaining data, so that the number of data actually received by the first functional module 110 conforms to the requirements of the first preset protocol, thereby preventing stuckness and successfully realizing safe isolation for different functional modules.

[0119] Referring to the above second to fifth examples, the first processing unit 312 may send a related association message, such as a first association message, to the first functional module 110 when the number of data in the first message is different from the target number, where the number of data in the first association message is equal to the target number, so that the number of data received by the first functional module 110 meets the requirement of the first preset protocol, so that no stuck occurs and the safe isolation of different functional modules is well realized.

[0120] In a sixth example, if the error type of the first message is that the data length of the data in the first message is less than the target data length in the first preset protocol, the first processing unit 312 may block the first message, complement the data length of the data in the first message to be equal to the target data length, obtain a first association message, and send the first association message to the first functional module 110.

[0121] Here, the data length, for example the data length in the first message and the target data length, may be a byte length, a bit length, or other methods of expressing data length may be adopted, and the embodiments of the present disclosure do not limit the method of realizing the data length.

[0122] For example, taking the data length as an example, if the first preset protocol has a target data length of 32 bits, but the data length of the first message is only 20 bits, it can determine that the data length of the data in the first message is less than the target data length. In this case, the first processing unit 312 blocks the first message, and complements 12 bits of data based on the data length of 20 bits of the first message, thereby obtaining a first association message with a data length of 32 bits. Then, it sends the first association message to the first functional module 110.

[0123] In addition, each error type and the processing method or processing policy for each error type may be pre-stored in the register 330. For example, the register 330 may include a correspondence table between the error type and the processing method. The first processing unit 312 can inquire about the corresponding processing method from the register 330 based on the error type to realize the control of the first message.

[0124] In some embodiments, the integrated circuit 10 may further include a third functional module 130. The third functional module 130 may be, for example, a microcontroller unit (MCU) (e.g., a safety island MCU) with integrated security functions. The third functional module 130 may include a hardware encryption engine, a secure storage area, an isolation mechanism, a secure boot function, and the like, to protect the system from various threats, including software attacks and hardware attacks, and to improve system safety.

[0125] The third functional module 130 can establish a communication connection with the first isolation module 300 via the communication interface.

[0126] In one implementation, the first monitoring unit 311 can send first error information to the third function module 130 if the first message does not correspond to the first preset protocol.

[0127] Here, the first error information may include an identifier of the second functional module 120, an error type, and / or an error occurrence time, etc. Exemplarily, the identifier of the second functional module 120 may be, for example, a module ID (e.g., a hardware domain ID), a serial number, a universally unique identifier, etc., and the embodiment of the present application is not limited thereto.

[0128] In one example, the first error information may include a specific content of the error type of the first message, in which case the amount of data sent from the first monitoring unit 311 to the third functional module 130 is large, which is disadvantageous to improving the communication efficiency between the first monitoring unit 311 and the third functional module 130.

[0129] In another example, an error code corresponding to each error type may be preset to improve the communication efficiency between the first monitoring unit 311 and the third functional module 130. In this way, the first error information does not need to include the specific content of the error type of the first message, but only needs to include the error code corresponding to the error type of the first message, thereby reducing the amount of data transmission and improving the communication efficiency between the first monitoring unit 311 and the third functional module 130.

[0130] Illustratively, the correspondence between the error type and the error code is as shown in Table 1.

[0131] [Table 1]

[0132] Exemplarily, the correspondence between the error type and the error code may be pre-stored in the register 330, and when the first monitoring unit 311 determines the error type of the first message, it can obtain the corresponding error code from the register 330 and generate the first error information.

[0133] For example, a first relationship table, e.g., Table 1, which records the correspondence between the error type and the error code, is pre-stored in the register 330, and thus, when the first monitoring unit 311 determines the error type of the first message, it can inquire the corresponding error code from the first relationship table. Here, the first relationship table may be a relationship table associated with the first monitoring unit 311, that is, the first relationship table is exclusively used by the first monitoring unit 311. Also, the first relationship table may be a relationship table not associated with the first monitoring unit 311, that is, the first relationship table may be used by the first monitoring unit 311 or may be used by other units and modules. The embodiment of the present disclosure does not particularly limit the association relationship between the first relationship table and the first monitoring unit 311.

[0134] In another implementation manner, the first monitoring unit 311 may write first error information to the register 330 and send a first interrupt signal to the third functional module 130 when the first message does not correspond to the first preset protocol. Here, the first interrupt signal may be a hardware signal or a software signal.

[0135] For example, taking the first interrupt signal as a hardware signal, the third functional module 130 may include a first hardware interface for receiving an external hardware interrupt signal, and the first monitoring unit 311 may be communicatively connected to the first hardware interface of the third functional module 130. In one example, the first interrupt signal may be a high level signal, and thus, when not sending the first interrupt signal, the first monitoring unit 311 inputs a low level to the first hardware interface of the third functional module 130, and when sending the first interrupt signal, the first monitoring unit 311 inputs a high level to the first hardware interface of the third functional module 130. In another example, the first interrupt signal may be a low level signal, and thus, when not sending the first interrupt signal, the first monitoring unit 311 inputs a high level to the first hardware interface of the third functional module 130, and when sending the first interrupt signal, the first monitoring unit 311 inputs a low level to the first hardware interface of the third functional module 130.

[0136] The embodiment of the present application does not limit the implementation method of the first interrupt signal.

[0137] Next, when the third functional module 130 receives the first interrupt signal transmitted by the first monitoring unit, it obtains the first error information from the register 330 in response to the first interrupt signal.

[0138] As can be understood, when a history message (e.g., a first message) transmitted between the first functional module 110 and the second functional module 120 does not correspond to the first preset protocol, the register 330 may include error information corresponding to the history message. That is, when the third functional module 130 receives a first interrupt signal, the register 330 may obtain first error information corresponding to the first message, and may also obtain other error information corresponding to the history message from the register 330. In this way, the error information obtained by the third functional module 130 becomes more abundant, and it becomes easier for the third functional module to comprehensively analyze the cause of the error using the first error information and other error information corresponding to the history message, thereby improving the success rate of identifying the error location.

[0139] The specific information that the third functional module 130 can obtain may depend on the policy by which the third functional module 130 obtains information and the configuration of the register 330, and the embodiments of the present application are not limited thereto.

[0140] In one example, the third functional module 130 may obtain all the error information from the register 330 when it receives the first interrupt signal.

[0141] In another example, the register 330 may store the error information in a first-in, first-out queue manner, and when the third functional module 130 receives the first interrupt signal, it may obtain the error information from the end of the first-in, first-out queue, that is, obtain the most recently written first information, i.e., the first error information.

[0142] As can be seen from the above, in one implementation, the first monitoring unit 311 may directly send the first error information to the third functional module 130, and allow the third functional module 130 to directly receive the first error information. In another implementation, the first monitoring unit 311 may not directly send the first error information to the third functional module 130, but may send a first interrupt signal to the third functional module 130, and the third functional module 130 may obtain the first error information from the register 330, thereby reducing the amount of data transmission between the first monitoring unit 311 and the third functional module 130, and improving the communication efficiency between the first monitoring unit 311 and the third functional module 130.

[0143] Next, when the third functional module 130 obtains the first error information, it may determine a corresponding processing policy according to the error type of the first error information, and execute the corresponding processing policy, for example, reboot or reset the second functional module 120, so as to recover the second functional module 120 from the abnormal state to the normal state, and prevent the recurrence of the error or reduce the frequency of the error occurrence. In some implementations, the processing policy of the third functional module 130 may be set by a user himself, and the embodiments of the present disclosure are not limited thereto.

[0144] In one embodiment, the protocol inspection sub-module 310 may further include a first recovery unit 313. The first recovery unit 313 restores the first monitoring unit 311 and the first processing unit 312 to an enabled state after the protocol inspection sub-module 310 completes the transmission control for the first message, for example, after the first processing unit blocks the first message or transmits the first message to the first function module, so that the protocol inspection sub-module 310 starts a new monitoring processing function.

[0145] Here, the protocol inspection submodule 310 completing the transmission control for the first message may include: The first processing unit 312 completes blocking the first message when the first message does not correspond to the first preset protocol; or the first processing unit 312 completes passing through the first message when the first message corresponds to the first preset protocol; or the first processing unit 312 completes sending a first association message to the first function module 110 when the number of data in the first message is different from a target number; or the first monitoring unit 311 completes sending first error information to the third function module 130 when the first message does not correspond to the first preset protocol.

[0146] That is, after each unit of the protocol inspection sub-module 310 completes its respective function based on the correspondence between the first message and the first preset protocol, the protocol inspection sub-module 310 can determine to complete transmission control for the first message.

[0147] Here, while each unit of the protocol inspection submodule 310 performs its respective function based on the correspondence between the first message and the first preset protocol, the protocol inspection submodule 310 does not monitor or control transmission of other messages; that is, during this time, each unit of the protocol inspection submodule 310 is in a disabled state or a busy state.

[0148] After the protocol inspection submodule 310 completes the transmission control for the first message, the first recovery unit 313 can restore each unit in the protocol inspection submodule 310, such as the first monitoring unit 311 and the first processing unit 312, to an enable state, or restore each unit to an idle state, or reset each unit, so as to enable the protocol inspection submodule 310 to perform transmission control for other subsequent messages after the protocol inspection submodule 310 has completed the transmission control for the first message. In this way, if there is a message that needs to be processed by the protocol inspection submodule 310 after that, the protocol inspection submodule 310 can continue to perform the corresponding function to realize the transmission control of the message.

[0149] In the embodiment of the present application, when the first message does not correspond to the first preset protocol, the first monitoring unit 311 may send the first error information or the first interrupt signal to the third functional module 130. When the third functional module 130 does not receive the first error information or the first interrupt signal, it usually means that the situation where the first message does not correspond to the first preset protocol does not occur, but it may also be caused by the malfunction of the protocol inspection sub-module 310. Here, the malfunction of the protocol inspection sub-module 310 may include, for example, that the first monitoring unit 311 cannot monitor the first message, or that the first monitoring unit 311 cannot normally send the first error information or the first interrupt signal. However, the third functional module 130 does not know the specific reason why the first error information or the first interrupt signal is not received, that is, the third functional module 130 does not know whether the function of the protocol inspection sub-module 310 is normal or not.

[0150] In one embodiment, the protocol checking sub-module 310 further includes a first test unit 314 to inform the third function module 130 whether the function of the first monitoring unit 311 is normal or not.

[0151] The first test unit 314 may send a first test message to the first monitoring unit 311, for example, the first test unit 314 may send the first test message to the first monitoring unit 311 periodically.

[0152] Exemplarily, the transmission period of the first test message may be preset in the register 330 or may be set by software. The transmission period of the first test message may be several milliseconds, several microseconds, or several seconds, for example, 10 milliseconds, 100 milliseconds, 300 milliseconds, 800 milliseconds, 10 microseconds, 200 microseconds, 500 microseconds, etc., and the embodiment of the present application is not limited thereto.

[0153] Here, the first test message does not correspond to the first preset protocol. For example, the number of data in the first test message may be different from the target number in the first preset protocol, and the data length of the first test message may be different from the target data length in the first preset protocol. That is, the first test message can be regarded as a first message that does not correspond to the first preset protocol, which is simulated or preset by the first test unit 314.

[0154] Since the first test message is periodically transmitted, if the first monitoring unit 311 functions normally, the first monitoring unit 311 periodically detects the first test message and periodically transmits the first error information or the first interrupt signal to the third functional module 130. That is, if the third functional module 130 can periodically receive the first error information or the first interrupt signal, it indicates that the first monitoring unit 311 functions normally or that the first monitoring unit 311 operates normally. Conversely, if the third functional module 130 cannot periodically receive the first error information or the first interrupt signal, it indicates that the first monitoring unit 311 functions abnormally or that the first monitoring unit 311 operates abnormally.

[0155] In another implementation manner, the third functional module 130 may output first alarm information when receiving the first error information or the first interrupt signal, and indicate through the first alarm information that the function of the first monitoring unit 311 is normal. If the third functional module 130 can periodically output the first alarm information, it indicates that the function of the protocol inspection sub-module 310 is normal, and if the third functional module 130 does not periodically output the first alarm information, it indicates that the functional operation of the protocol inspection sub-module 310 is abnormal.

[0156] In another implementation manner, when the third functional module 130 does not periodically receive the first error information or the first interrupt signal, it outputs second alarm information, and indicates through the second alarm information that the operation of the protocol inspection submodule 310 (e.g., the first monitoring unit 311) is abnormal.

[0157] For example, the second warning information may be an error message, an error log, a warning message, etc., output to an operating system, but the embodiment of the present application is not limited thereto.

[0158] In each of the above embodiments, when the first isolation module 300 detects the first message transmitted by the second functional module 120 to the first functional module 110, the first isolation module 300 controls the transmission of the first message based on the correspondence between the first message and the first preset protocol. However, when the first functional module 110 transmits the first access request message to the second functional module 120 and the first message is a response message corresponding to the first access request message, the second functional module 120 may not be able to transmit the first message normally for some reason. For example, the operation of the second functional module 120 is abnormal, and after receiving the first access request message, the second functional module 120 may not be able to transmit the first message normally. Also, for example, the communication between the first functional module 110 and the second functional module 120 is abnormal, and the second functional module 120 may not be able to receive the first access request message, and thus does not transmit the first message.

[0159] Illustratively, the first access request message includes, but is not limited to, any one or more of a write request message, a read request message, a sync request message, a lock request message, etc. Accordingly, the first message includes, but is not limited to, any one or more of a write response message, a read response message, a sync response message, a lock response message, etc.

[0160] In general, after the first functional module 110 sends a first access request message to the second functional module 120, it waits for the second functional module 120 to return a response message, and after a preset maximum waiting time has elapsed, if the response message has not yet been received, the first functional module 110 may be considered to be in a stuck state. Here, the maximum waiting time may be preset in the register 330 or may be set by software. The maximum waiting time may be, for example, several milliseconds, several microseconds, several seconds, etc., and the embodiment of the present application is not limited thereto.

[0161] FIG. 5 is a third structural schematic diagram of an integrated circuit 10 provided in an exemplary embodiment of the present disclosure.

[0162] As shown in FIG. 5, in some embodiments, the first isolation module 300 may further include a response monitoring submodule 320 to avoid the first functional module 110 getting stuck by waiting for a response message for a long time. Here, the response monitoring submodule 320 is used, for example, to monitor messages passing through the first isolation module 300, and when it detects that the response message times out, to resend the request message to the module that should send the response message. The response monitoring submodule 320 may include a functional circuit and a communication interface for realizing its function. When the first access request message sent by the first functional module 110 to the second functional module 120 passes through the first isolation module 300, the response monitoring submodule 320 can detect the first access request message and determine whether or not it has detected the first message sent by the second functional module 120 within a first time after detecting the first access request message. Here, the first message is a response message sent to the first functional module 110 when the second functional module 120 receives the first access request message sent by the first functional module 110. If the first message is not detected, the response monitoring sub-module 320 resends the first access request message to the second function module 120. If the first message is detected, the response monitoring sub-module 320 transmits the first message to the protocol inspection sub-module 310 for processing.

[0163] 5, in one embodiment, the response monitoring submodule 320 may include a second monitoring unit 321 and a message retransmission unit 322. In one example, each unit in the response monitoring submodule 320, such as the second monitoring unit 321 and the message retransmission unit 322, may be two different sub-function circuits in the response monitoring submodule 320, and the second monitoring unit 321 and the message retransmission unit 322 may be communicatively connected through a communication interface in the response monitoring submodule 320. In another example, each unit in the response monitoring submodule 320, such as the second monitoring unit 321 and the message retransmission unit 322, may be two different software units in a software program for realizing the function of the response monitoring submodule 320. The embodiment of the present application does not limit the realization manner of the second monitoring unit 321 and the message retransmission unit 322.

[0164] In one implementation, the second monitoring unit 321 determines whether the first message is detected within a first time after detecting the first access request message. If the first message is not detected, the second monitoring unit 321 sends second error information to the message retransmitting unit 322. Here, the first time may be less than the longest waiting time, and the second error information may include an error type, for example, the error type is timeout.

[0165] Exemplarily, the first time may be pre-configured in the register 330 or configured by software. The first time may be a few milliseconds, a few microseconds, or a few seconds, such as 50 milliseconds, 100 milliseconds, 300 milliseconds, 1000 milliseconds, 100 microseconds, 500 microseconds, 800 microseconds, etc., and the embodiment of the present application is not limited thereto.

[0166] In one example, the second error information may include specific content of the error type, such as response timeout, in which case the amount of data sent by the second monitoring unit 321 to the message resending unit 322 is large, which is disadvantageous to improving the communication efficiency between the second monitoring unit 321 and the message resending unit 322.

[0167] In another example, a corresponding error code is pre-set for each error type in order to improve the communication efficiency between the second monitoring unit 321 and the message re-sending unit 322. The second error information does not need to include the specific content of the error type, but only needs to include the error code corresponding to the error type, thereby reducing the amount of data transmission and improving the communication efficiency between the second monitoring unit 321 and the message re-sending unit 322.

[0168] Exemplarily, the second monitoring unit 321 can determine the error code to be included in the second error information by querying a table. For example, when the first relationship table is pre-stored in the register 330, the second monitoring unit 321 can query the error code to be included in the second error information from the first relationship table. For example, when the error type is timeout and the error code of the error type timeout in the first relationship table is 4, the second monitoring unit 321 can determine that the error code to be included in the second error information is 4 by querying the first relationship table.

[0169] In addition, the register 330 may further include a second relationship table. Here, the second relationship table may be a relationship table associated with the second monitoring unit 321, that is, the second relationship table may be used exclusively by the second monitoring unit 321. The second relationship table may record a correspondence between an error type and an error code, and thus the second monitoring unit 321 can determine an error code to be included in the second error information by querying the second relationship table. The second relationship table may be a relationship table not associated with the second monitoring unit 321, that is, the second relationship table may be provided to other units and modules for use. The embodiment of the present disclosure does not limit the association relationship between the second relationship table and the second monitoring unit 321.

[0170] As can be understood, when the first relationship table is associated with the first monitoring unit 311 and the second relationship table is associated with the second monitoring unit 321, the contents in each relationship table can realize flexible and differentiated configurations based on the functions of the monitoring units corresponding to each relationship table (e.g., the contents of monitoring, the contents of error information to be reported, etc.) without affecting each other.

[0171] In one implementation, when the second monitoring unit 321 detects the first access request message, it may record the time t1 at which the second functional module 120 sends the first access request message, and may also determine the time t2 at which the first functional module 110 stops waiting (i.e., the time at which the first functional module 110 enters a stuck state) based on the longest waiting time of the first functional module 110. In this manner, the second monitoring unit 321 may place the time t1 and the time t2 in the second error information and send it to the message retransmission unit 322 for use in the message retransmission unit 322 performing its function.

[0172] Then, the message resending unit 322 may resend the first access request message to the second functional module 120 when receiving the second error information. In this way, when the second functional module 120 receives the resent first access request message, it may send the first message in response to the first access request message, thereby improving the possibility that the first functional module 110 receives the first message and reducing the possibility of the first functional module 110 getting stuck.

[0173] In one implementation, when the second monitoring unit 321 detects the first access request message, the message resending unit 322 can cache the first access request message in the register 330 for use. In this way, when the first access request message is cached in the register 330, when the message resending unit 322 receives the second error information, the message resending unit 322 can read the cached first access request message from the register 330 and resend the first access request message to the second functional module 120.

[0174] In one implementation, in order to further improve the possibility that the first functional module 110 has received the first message, the message retransmission unit 322 can retransmit the first access request message to the second functional module 120 multiple times within the longest waiting time after the first functional module 110 has sent the first access request message. Illustratively, assume that the longest waiting time is 600 milliseconds and the first time is 100 milliseconds. If the second monitoring unit 321 detects the first access request message sent at time t1, it waits for the first time (100 milliseconds), and if the first message is not detected, it sends second error information to the message retransmission unit 322. The message retransmission unit 322 receives the second error information, retransmits the first access request message to the second functional module 120, and waits for the second time, where the second time may be the same as or different from the first time, for example, the second time is also 100 milliseconds. If the first message is still not detected, the message retransmission unit 322 retransmits the first access request message to the second functional module 120, and then waits for a second time, repeating the same operation until the second monitoring unit 321 detects the first message or the time reaches time t2 (i.e., time t1 + 600 milliseconds).

[0175] In this way, before the first functional module 110 finishes waiting, the message retransmission unit 322 periodically sends the first access request message to the second functional module 120 multiple times, thereby improving the possibility that the first functional module 110 has received the first message and reducing the possibility of the first functional module 110 getting stuck.

[0176] As can be understood, when the operation of the second functional module 120 is abnormal, for example, stuck, even if the message retransmission unit 322 sends the first access request message to the second functional module 120 multiple times, the second functional module 120 will not return the first message. In this case, it is an invalid operation to continue sending the first access request message. In order to avoid such an invalid operation, in one implementation, a maximum retransmission number may be set for the message retransmission unit 322, for example, the maximum retransmission number is 3 times, and thus, after the message retransmission unit 322 sends the first access request message to the first functional module 110 three times, even if the first message is not detected or the time has not reached time t2, the message retransmission unit 322 will not continue sending the first access request message to the first functional module 110.

[0177] Here, the second time and the maximum number of retransmissions may be preset in the register 330 or may be set by software, and the embodiment of the present application is not limited thereto.

[0178] As can be understood, when the message resending unit 322 resends the first access request message to the second functional module 120 one or more times, if the first functional module 110 still does not receive the first message, the first functional module 110 enters a stuck state at time t2, which ends the waiting.

[0179] In one implementation manner, in order to avoid the first functional module 110 getting stuck, if the second processing unit 323 does not detect the first message within a second time after resending the first access request message, the second processing unit 323 may send a preset response message corresponding to the first access request message to the first functional module 110.

[0180] Here, when the message re-sending unit 322 sends the first access request message to the second functional module 120 multiple times, if the second processing unit 323 does not detect the first message within a second time after sending the final first access request message, the second processing unit 323 may send a preset response message to the first functional module 110.

[0181] In one example, the preset response message may be a default response message, which may be pre-stored in the register 330, and thus the second processing unit 323 may read the default response message from the register 330 and send the default response message to the first functional module 110.

[0182] Here, the default response message may be a message corresponding to the first preset protocol, in this way, the first functional module 110 does not get stuck after receiving the default response message. For example, the number of data in the default response message may be the same as the target number in the first preset protocol.

[0183] It can be understood that the second processing unit 323 does not know the exact content of the data in the first message, and therefore, from the content perspective, the data in the default response message is not the response data desired by the first functional module 110. However, since the first preset protocol defines the target number of data in a message but does not define the specific content of the message, when the first functional module 110 receives a response message based on the first preset protocol, as long as the target number of data is received, it is considered that the first functional module 110 has already received a response message conforming to the first preset protocol from the second functional module 120, so the first functional module 110 releases the pending state of waiting for the reception of the response message, thereby preventing stacking and successfully realizing safe isolation of different functional modules.

[0184] In another example, the preset response message may be a pre-defined error response message, which is used to report an error response status (response error) to the first functional module 110. In this way, when the first functional module 110 receives the error response message, the second functional module 120 can determine that a response error occurs, and thereby release the pending state of waiting for the reception of the response message, so that no stuck occurs, and the safe isolation of different functional modules is well realized.

[0185] In one implementation, if the second processing unit 323 does not detect the first message within a second time after resending the first access request message, the second processing unit 323 may send second error information to the third functional module 130.

[0186] In one example, the second error information may include specific content of the error type, such as a response timeout, in which case the amount of data sent by the second processing unit 323 to the third functional module 130 is large, which is disadvantageous to improving the communication efficiency between the second processing unit 323 and the third functional module 130.

[0187] In another example, a corresponding error code is pre-set for each error type in order to improve the communication efficiency between the second processing unit 323 and the third functional module 130. The second error information does not need to include the specific content of the error type, but only needs to include the error code corresponding to the error type, thereby reducing the amount of data transmission and improving the communication efficiency between the second processing unit 323 and the third functional module 130.

[0188] The second processing unit 323 can determine the error code to be included in the second error information by querying a table. For example, the second processing unit 323 can query the error code to be included in the second error information from the first relationship table or the second relationship table. For example, if the error type is timeout, and the second relationship table defines that the error code of the error type timeout is 4, the second processing unit 323 can determine that the error code to be included in the second error information is 4 by querying the second relationship table.

[0189] In another implementation, if the second monitoring unit 321 does not detect the first message within a first time after detecting the first access request message, the second monitoring unit 321 may write second error information to the register 330. Then, if the first message is not detected within a second time after resending the first access request message, the second processing unit 323 may send a second interrupt signal to the third functional module 130. Here, the second interrupt signal may be a hardware signal or a software signal.

[0190] For example, the second interrupt signal is a hardware signal, and the third functional module 130 may include a second hardware interface for receiving an external hardware interrupt signal, and the second hardware interface and the first hardware interface may be the same interface or different interfaces. The second processing unit 323 may be communicatively connected to the second hardware interface of the third functional module 130. In one example, the second interrupt signal may be a high level signal, and thus, when not sending the second interrupt signal, the second processing unit 323 inputs a low level to the second hardware interface of the third functional module 130, and when sending the second interrupt signal, the second processing unit 323 inputs a high level to the second hardware interface of the third functional module 130. In another example, the second interrupt signal may be a low level signal, and thus, when not sending the second interrupt signal, the second processing unit 323 inputs a high level to the second hardware interface of the third functional module 130, and when sending the second interrupt signal, the second processing unit 323 inputs a low level to the second hardware interface of the third functional module 130.

[0191] The embodiment of the present application does not limit the implementation method of the second interrupt signal.

[0192] Next, when the third functional module 130 receives the second interrupt signal, it obtains the second error information from the register 330 in response to the second interrupt signal.

[0193] It is understood that, when the history message transmitted between the first functional module 110 and the second functional module 120 does not correspond to the first preset protocol, the register 330 may contain error information corresponding to the history message. That is, when the third functional module 130 receives a second interrupt signal, the third functional module 130 may obtain the second error information from the register 330, and may also obtain other error information corresponding to the history message from the register 330.

[0194] The specific information that the third functional module 130 can obtain may depend on the policy by which the third functional module 130 obtains information and the configuration of the register 330, and the embodiments of the present application are not limited thereto.

[0195] In one example, the third functional module 130 may obtain all the error information from the register 330 when it receives the second interrupt signal.

[0196] In one example, the register 330 may store the error information in a first-in, first-out queue manner, and when the third functional module 130 receives the second interrupt signal, it may obtain the latest error information, i.e., the second error information, from the end of the first-in, first-out queue.

[0197] It can be seen from the above that in one implementation, the second processing unit 323 may directly send the second error information to the third functional module 130, and allow the second processing unit 323 to directly receive the second error information. In another implementation, the second processing unit 323 may not directly send the second error information to the third functional module 130, but may send a second interrupt signal to the third functional module 130, and the third functional module 130 may obtain the second error information from the register 330, thereby reducing the amount of data transmission between the second processing unit 323 and the third functional module 130, and improving the communication efficiency between the second processing unit 323 and the third functional module 130.

[0198] Next, when the third functional module 130 obtains the second error information, it may determine a corresponding processing policy according to the error type of the second error information, and execute the corresponding processing policy, for example, reboot or reset the second functional module 120, so as to recover the second functional module 120 from the abnormal state to the normal state, and prevent the recurrence of the error or reduce the frequency of the error occurrence. In some implementations, the processing policy of the third functional module 130 may be set by a user himself, and the embodiments of the present disclosure are not limited thereto.

[0199] In one embodiment, the response monitoring submodule 320 may further include a second recovery unit 324. The second recovery unit 324 restores the second monitoring unit 321, the message retransmission unit 322 and the second processing unit 323 to an enabled state after the response monitoring submodule 320 completes the timeout response to the first message, so that the response monitoring submodule 320 starts a new monitoring processing function.

[0200] Here, the response monitoring submodule 320 completing a timeout response to the first message may include: After the message retransmission unit 322 retransmits the first access request message, the second monitoring unit 321 detects the first message. If the second monitoring unit 321 does not detect the first message, the second processing unit 323 completes sending a preset response message corresponding to the first access request message to the first functional module 110. Or, if the second monitoring unit 321 does not detect the first message, the second processing unit 323 completes sending second error information to the third functional module 130. Or, if the second monitoring unit 321 does not detect the first message, the second processing unit 323 completes sending a second interrupt signal to the third functional module 130.

[0201] That is, when the first message times out, if each unit of the response monitoring sub-module 320 completes its respective function, it can be determined that the response monitoring sub-module 320 completes the timeout response to the first message.

[0202] Here, when each unit of the response monitoring submodule 320 performs its respective function when the first message times out, the response monitoring submodule 320 does not respond to the timeout of other messages, that is, during this time, each unit of the response monitoring submodule 320 is in a disabled state or a busy state.

[0203] After the response monitoring submodule 320 completes the timeout response to the first message, the second recovery unit 324 can restore each unit in the response monitoring submodule 320, such as the second monitoring unit 321, the message retransmission unit 322 and the second processing unit 323, to an enable state, or restore each unit to an idle state, or reset each unit, so as to enable the response monitoring submodule 320 to respond to the timeout of other subsequent messages after the first message is completed. In this way, when a timeout message is detected later, the response monitoring submodule 320 can continue to execute the corresponding function to realize the timeout response to the message.

[0204] In the embodiment of the present application, after the second monitoring unit 321 detects the timeout of the first message and the message retransmission unit 322 retransmits the first access request message to the second functional module 120, if the second monitoring unit 321 still does not detect the first message, the second processing unit 323 may send the second error information or the second interrupt signal to the third functional module 130. If the third functional module 130 never receives the second error information or the second interrupt signal, it usually means that the first message does not time out or the function of the response monitoring sub-module 320 is abnormal. Here, the abnormal function of the response monitoring sub-module 320 may include, for example, that the second monitoring unit 321 cannot monitor the timeout of the first message or that the second processing unit 323 cannot normally send the second error information or the second interrupt signal. However, the third functional module 130 does not know the specific reason why the second error information or the second interrupt signal has not been received, that is, the third functional module 130 does not know whether the response monitoring sub-module 320 is functioning normally or not.

[0205] In one embodiment, the response monitoring sub-module 320 further includes a second test unit 325 to inform the third functional module 130 whether the response monitoring sub-module 320 is functioning normally or not.

[0206] The second test unit 325 may send a second test message to the second monitoring unit 321, for example, the second test unit 325 may send the second test message to the second monitoring unit 321 periodically.

[0207] Exemplarily, the transmission period of the second test message may be preset in the register 330 or may be set by software. The transmission period of the second test message may be several milliseconds, several microseconds, or several seconds, for example, 10 milliseconds, 100 milliseconds, 300 milliseconds, 800 milliseconds, 10 microseconds, 200 microseconds, 500 microseconds, etc., and the embodiment of the present application is not limited thereto.

[0208] In an embodiment of the present application, the second monitoring unit 321 may be configured to monitor a response message corresponding to the second test message within a first time after receiving the second test message, and this function may be configured by hardware (e.g., in the register 330) or software. However, to test the function of the response monitoring sub-module 320, the second test unit 325 does not send a response message corresponding to the second test message to the second monitoring unit 321. That is, the second test unit 325 creates a timeout scenario, thereby testing whether the function of the response monitoring sub-module 320 is normal.

[0209] Since the second test message is sent periodically, when the second monitoring unit 321 functions normally, the second monitoring unit 321 periodically detects the second test message and periodically monitors whether a response message corresponding to the second test message is received.

[0210] As can be understood, since the second test unit 325 does not send a response message corresponding to the second test message to the second monitoring unit 321, the second monitoring unit 321 cannot detect the response message corresponding to the second test message in each period. Therefore, if the second monitoring unit 321 functions normally, the second monitoring unit 321 periodically sends error information, for example, second error information, including that the error type is timeout, to the second processing unit 323.

[0211] If the function of the second processing unit 323 is normal, after receiving the error information, the second processing unit 323 sends second error information or a second interrupt signal to the third functional module 130. That is, when the second monitoring unit 321 does not periodically detect a response message corresponding to the second test message, the second processing unit 323 periodically sends the second error information or a second interrupt signal to the third functional module 130.

[0212] That is, if the third functional module 130 can periodically receive the second error information or the second interrupt signal, it indicates that the second monitoring unit 321 and the second processing unit 323 function normally. Conversely, if the third functional module 130 cannot periodically receive the second error information or the second interrupt signal, it indicates that the second monitoring unit 321 and / or the second processing unit 323 function abnormally.

[0213] In one implementation, the third functional module 130 may output third alarm information when receiving the second error information or the second interrupt signal, and indicate through the third alarm information that the second monitoring unit 321 has detected a message that does not conform to the first preset protocol. In this way, if the third functional module 130 can periodically output the third alarm information, it indicates that the response monitoring sub-module 320 functions normally, and if the third functional module 130 cannot periodically output the third alarm information, it indicates that the response monitoring sub-module 320 functions abnormally.

[0214] In another implementation manner, when the third functional module 130 does not periodically receive the second error information or the second interrupt signal, the third functional module 130 may output fourth alarm information to indicate that the function of the response monitoring sub-module 320 is abnormal through the second alarm information.

[0215] For example, the fourth warning information may be an error message, an error log, a warning message, etc., that are output to an operating system, but the embodiment of the present application is not limited thereto.

[0216] The above embodiments have taken the first isolation module 300 to provide security protection for the first functional module 110 as an example to describe in detail the security protection method for the functional module by the isolation module. It should be understood that in some embodiments, more isolation modules may be installed to protect other functional modules in the integrated circuit 10 based on factors such as actual needs and the security level of the functional module, for example, an isolation module is installed between the second functional module 120 and the interconnection module 200 to provide security protection for the second functional module 120. The specific implementation manner may refer to the above embodiments, and is not particularly limited herein.

[0217] Also, since the interconnection module 200 is responsible for communication between each module in the integrated circuit 10, it may require a high level of security and therefore it is also necessary to provide security protection for the interconnection module 200, thereby ensuring that the interconnection module 200 is not susceptible to unauthorized access and timeout responses.

[0218] FIG. 6 is a fourth structural schematic diagram of an integrated circuit 10 provided in an exemplary embodiment of the present disclosure.

[0219] As shown in FIG. 6, in one embodiment, the integrated circuit 10 may further include a second isolation module 400 .

[0220] The second isolation module 400 may be disposed in a communication link between the interconnection module 200 and the second functional module 120. In this manner, before the first message sent by the second functional module 120 to the first functional module 110 reaches the interconnection module 200, the second isolation module 400 may control the transmission of the first message based on the correspondence between the first message and the second preset protocol.

[0221] Here, the second preset protocol and the first preset protocol may be the same or different, and specifically, may be determined by the specifications of the bus protocol adopted between the interconnection module 200 and the second functional module 120, and the embodiments of the present application are not limited thereto.

[0222] Specifically, if the first message does not correspond to the second preset protocol, the second isolation module 400 can block the first message, and in this way, neither the interconnection module 200 nor the first functional module 110 receives the first message, thereby avoiding the occurrence of stacking of the interconnection module 200 and the first functional module 110, and successfully realizing safe isolation for different functional modules.

[0223] Also, if the first message corresponds to the second preset protocol, the second isolation module 400 may continue to transmit the first message, for example, pass through the first message or perform a preset process on the first message and then transmit it to the first isolation module 300. In this way, the first message may be sent to the first isolation module 300 via the interconnection module 200. The first isolation module 300 may continue to control the transmission of the first message based on the correspondence between the first message and the second preset protocol.

[0224] The specific implementation of the second isolation module 400 may refer to the first isolation module 300, and detailed description thereof will be omitted here.

[0225] As can be seen from the above, in the integrated circuit 10 provided in the embodiment of the present disclosure, a first isolation module 300 is installed between the first functional module 110 and the interconnection module 200, and a second isolation module 400 is installed between the second functional module 120 and the interconnection module 200. When the second functional module 120 sends a first message to the first functional module 110, and before the first message reaches the interconnection module 200, the second isolation module 400 controls the transmission of the first message based on the corresponding relationship between the first message and the second preset protocol, so as to ensure that the interconnection module 200 is not affected by unauthorized access and timeout response, and to protect the interconnection module 200. Before the first message reaches the first functional module 110, the first isolation module 300 continues to control the transmission of the first message based on the corresponding relationship between the first message and the second preset protocol, so as to ensure that the first functional module 110 is not affected by unauthorized access and timeout response, and to protect the first functional module 110.

[0226] In other words, the integrated circuit 10 provided in the embodiment of the present disclosure can realize dual control over the first message by installing the first isolation module 300 and the second isolation module 400, which can not only protect the interconnection module 200, but also realize dual protection for the first functional module 110, thereby improving the reliability of the integrated circuit 10.

[0227] In one embodiment, the first isolation module 300 may be used to provide protection to the interconnect module 200 and the second isolation module 400 may be used to provide protection to the second functional module 120.

[0228] For example, before the second message sent by the first functional module 110 to the second functional module 120 reaches the interconnection module 200, the first isolation module 300 may control the transmission of the first message based on the correspondence between the second message and the second preset protocol. Here, the second message may be an access request message or a response message sent by the first functional module 110 to the second functional module 120, and the embodiment of the present application is not limited thereto.

[0229] Exemplarily, if the second message is an access request message, the second message includes, but is not limited to, any one or more of a write request message, a read request message, a synchronization request message, a lock request message, etc. If the first message is a response message, the first message includes, but is not limited to, any one or more of a write response message, a read response message, a synchronization response message, a lock response message, etc.

[0230] Specifically, if the second message does not correspond to the second preset protocol, the first isolation module 300 can block the second message, and in this way, neither the interconnection module 200 nor the second functional module 120 will receive the second message, thereby avoiding the occurrence of stacking of the interconnection module 200 and the second functional module 120, and successfully realizing safe isolation for different functional modules.

[0231] Also, if the second message corresponds to the second preset protocol, the first isolation module 300 can pass through the second message, and thus the second message is sent to the second isolation module 400 via the interconnection module 200. The second isolation module 400 may continue to control the transmission of the second message based on the correspondence between the second message and the second preset protocol.

[0232] As can be seen from the above, in the integrated circuit 10 provided in the embodiment of the present disclosure, when the first functional module 110 sends a second message to the second functional module 120, before the second message reaches the interconnection module 200, the first isolation module 300 controls the transmission of the second message based on the corresponding relationship between the second message and the second preset protocol, so as to ensure that the interconnection module 200 is not affected by unauthorized access and timeout response, and to protect the interconnection module 200. Before the second message reaches the second functional module 120, the second isolation module 400 continues to control the transmission of the second message based on the corresponding relationship between the second message and the second preset protocol, so as to ensure that the second functional module 120 is not affected by unauthorized access and timeout response, and to protect the second functional module 120.

[0233] In other words, the integrated circuit 10 provided in the embodiment of the present disclosure can realize dual control over the second message by installing the first isolation module 300 and the second isolation module 400, and can not only protect the interconnection module 200, but also realize dual protection for the second functional module 120, thereby improving the reliability of the integrated circuit 10.

[0234] In addition, the first isolation module 300 and the second isolation module 400 realize bidirectional transmission control of messages between the first functional module 110 and the second functional module 120, thereby improving the flexibility of message transmission control.

[0235] FIG. 7 is a fifth structural schematic diagram of an integrated circuit 10 provided in an exemplary embodiment of the present disclosure.

[0236] As shown in FIG. 7, in one embodiment, the second isolation module 400 may be installed in the communication link between the interconnect module 200 and the second functional module 120, or may be installed in the communication link between the interconnect module 200 and the first isolation module 300.

[0237] In this way, when the second functional module 120 transmits a first message to the first functional module 110, the second isolation module 400 can perform transmission control on the first message based on the correspondence between the first message and the second preset protocol before the first message reaches the interconnection module 200, and when the first functional module 110 transmits a second message to the second functional module 120, the second isolation module 400 can perform transmission control on the second message based on the correspondence between the second message and the second preset protocol before the second message reaches the interconnection module 200. In this way, by using the second isolation module 400, bidirectional transmission control can be performed on messages that pass through the interconnection module 200 in both directions.

[0238] 7, in one implementation, the second isolation module 400 may be disposed in the communication link between the interconnection module 200 and other modules. For example, in addition to the first functional module 110 and the second functional module 120, the integrated circuit 10 may further include at least one other module, such as the fourth functional module 140, the fifth functional module 150, etc. The second isolation module 400 may be disposed in the communication link between the first functional module 110 and the interconnection module 200, and / or may be disposed in the communication link between the second functional module 120 and the interconnection module 200, and / or may be disposed in the communication link between the fourth functional module 140 and the interconnection module 200, and / or may be disposed in the communication link between the fifth functional module 150 and the interconnection module 200. In this way, the second isolation module 400 can realize circuit isolation between the interconnection module 200 and other modules. In other words, before a message from another module, such as a message from the fourth functional module 140 or a message from the fifth functional module 150, is sent to the interconnection module 200, it passes through the second isolation module 400, and the second isolation module 400 performs transmission control on the message based on the correspondence between the message and the second preset protocol, and determines whether to send the message to the interconnection module 200.

[0239] Here, in the embodiment of the present disclosure, the second isolation module 400 is installed in the communication link between the interconnection module 200 and other modules to realize circuit isolation between the interconnection module 200 and other modules. Therefore, the multiple patterns of the second isolation module 400 shown in each direction of the interconnection module 200 in FIG. 7 are only used to represent the circuit isolation between the interconnection module 200 and other different modules by the second isolation module 400, and do not represent the actual number or distribution of the second isolation module 400, that is, do not limit the physical structure of the second isolation module 400. Illustratively, the multiple second isolation modules 400 may be physically realized in one module, or may be respectively realized in multiple physical modules. The actual number and distribution of the second isolation modules 400 can be reasonably designed based on factors such as the layout of the communication link of the integrated circuit 10, and the embodiment of the present disclosure does not limit this.

[0240] Exemplary Methods The method of this embodiment can be applied to the integrated circuit 10, and specifically, may be realized by an isolation module in the integrated circuit 10, which may be, for example, the first isolation module 300, the second isolation module 400 and / or other isolation modules in the above embodiments.

[0241] FIG. 8 is a first schematic flowchart of a communication method based on an integrated circuit provided in an exemplary embodiment of the present disclosure.

[0242] As shown in Figure 8, the method A step S101 in which a first message sent by a second functional module to a first functional module is detected; The method includes a step S102 of controlling transmission of the first message based on a correspondence relationship between the first message and the first preset protocol.

[0243] Specifically, before the first message is delivered to the first functional module, the transmission of the first message is controlled based on the corresponding relationship between the first message and the first preset protocol.

[0244] FIG. 9 is a second schematic flowchart of a communication method based on an integrated circuit provided in an exemplary embodiment of the present disclosure.

[0245] As shown in FIG. 9, in one implementation, the step S102 of controlling the transmission of the first message based on the correspondence between the first message and the first preset protocol specifically includes: Step S1021 of blocking the first message if the first message does not correspond to the first preset protocol; If the first message corresponds to the first preset protocol, then continuing to transmit the first message S1022.

[0246] Here, the step of continuing to transmit the first message may include, for example, passing through the first message or performing a preset process on the first message before transmitting it to the first functional module.

[0247] In one implementation, the first message not corresponding to the first preset protocol includes that the number of data in the first message is different from the preset target number in the first preset protocol. After step S1021, the method further includes: If the first message does not correspond to the first preset protocol, the method may include a step S1031 of determining a first association message based on the first preset protocol and sending the first association message to the first functional module, in which the number of data in the first association message is equal to a target number.

[0248] Here, if the first message does not correspond to the first preset protocol, that is, if the number of pieces of data in the first message is less than the target number, the number of pieces of data in the first message can be complemented to the target number to obtain the first association message. If the number of pieces of data in the first message is greater than the target number, the target number of pieces of data can be extracted from the first message to obtain the first association message.

[0249] In one implementation, after step S1021, the method further comprises: The method may include a step S1032 of sending first error information to a third functional module, where the first error information includes an identifier of the second functional module and an error type of the first message.

[0250] In another implementation manner, after step S1021, the first error information may be written to a register and a first interrupt signal may be sent to the third functional module, where the first error information includes an identifier of the second functional module and an error type of the first message, so that the third functional module obtains the first error information from the register when it receives the first interrupt signal.

[0251] In one implementation, after step S1031 and / or step S1032, the method further comprises: This may include a step S104 of restoring the isolation module to an enabled state.

[0252] In this way, the isolation module can start a new monitoring processing function. The specific operations of each step in this embodiment can be referred to the above-mentioned device embodiment, and detailed description is omitted here.

[0253] As can be seen from the above technical solutions, the method provided in this embodiment controls the transmission of a first message when the second functional module sends a first message to the first functional module, for example, before the first message is delivered to the first functional module, based on the correspondence between the first message and a first preset protocol, thereby avoiding the first functional module receiving a first message that does not correspond to the first preset protocol and becoming stuck, thereby well realizing safe isolation of different functional modules, and improving the reliability of the integrated circuit.

[0254] FIG. 10 is a third schematic flowchart of a communication method based on an integrated circuit provided in an exemplary embodiment of the present disclosure.

[0255] As shown in Figure 10, the method A step S201 of detecting a first access request message sent by a first functional module to a second functional module; S202. if the first message is not detected within a first time period after the first access request message is detected, resending the first access request message to the second functional module;

[0256] Here, the first message includes a response message to be transmitted to the first functional module when the second functional module receives the first access request message transmitted by the first functional module.

[0257] In one implementation, the detected first access request message may be cached in a register, and when second error information is received, the first access request message cached in the register is resent to the second functional module.

[0258] In one implementation, after step S202, the method further comprises: The method may include a step S2031 of sending a preset response message corresponding to the first access request message to the first functional module if the first message is not detected within a second time period after resending the first access request message.

[0259] In one implementation, after step S202, the method may further include steps S2032 and S2033.

[0260] In step S2032, if the first message is not detected within a second time period after resending the first access request message, send second error information to the third functional module.

[0261] In another implementation, after step S202, the second error information may be cached in a register, and if the first message is not detected within a second time after resending the first access request message, a second interrupt signal is sent to a third functional module, so that the third functional module obtains the second error information from the register when it receives the second interrupt signal.

[0262] In step S2033, if the first message is detected within a second time period after resending the first access request message, continue transmitting the first message.

[0263] In one implementation, after step S2031 and / or step S2032, the method further comprises: This may include a step S204 of restoring the isolation module to an enabled state.

[0264] Thus, the quarantine module initiates a new monitoring process function.

[0265] For the specific operations of each step in this embodiment, please refer to the embodiment of the above-mentioned device, and detailed explanations will be omitted here.

[0266] As can be seen from the above technical solutions, the method provided in this embodiment is to resend the first access request message to the second functional module if the first message is not detected within a first time after the first functional module sends a first access request message to the second functional module, thereby avoiding the first functional module not receiving the response message from the second functional module and being stuck in a pending state for a long period of time, which well realizes safe isolation for different functional modules and improves the reliability of the integrated circuit.

[0267] Exemplary Integrated Circuit System FIG. 11 is a structural diagram of an integrated circuit system 100 provided in an embodiment of the present disclosure, which includes at least one integrated circuit 10 and a memory 20. As shown in FIG.

[0268] Integrated circuit 10 may be a central processing unit (CPU) or other type of processing unit having data processing and / or instruction execution capabilities, which can control other components in integrated circuit system 100 to perform desired functions.

[0269] The memory 20 may include various computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache. The non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc. The computer-readable storage medium may store one or more computer program instructions, and the integrated circuit 10 operates the one or more computer program instructions to realize the communication method based on the integrated circuit of each embodiment of the present disclosure described above and / or other desired functions.

[0270] In one example, integrated circuit system 100 may further include input devices 30 and output devices 40, with these components interconnected by a bus system and / or other form of connection (not shown).

[0271] The input device 30 may include, for example, a touch screen, buttons, a voice input device, and the like.

[0272] The output device 40 can output various information to the outside, and may include, for example, a display, a speaker, a communication network, and remote output devices connected thereto.

[0273] 11 shows only some components of the integrated circuit system 100 that are relevant to the present disclosure, and omits components such as buses, input / output interfaces, etc. Furthermore, depending on a particular application, the integrated circuit system 100 may include any other suitable components.

[0274] Exemplary Computer Program Products and Computer-Readable Storage Media In addition to the above methods and apparatus, embodiments of the present disclosure further provide a computer program product including computer program instructions that, when executed by a processor, cause the processor to perform steps in the integrated circuit-based communication methods of each embodiment of the present disclosure described in the "Exemplary Method" section above.

[0275] The computer program product may be written with program code for carrying out operations of the disclosed embodiments in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and traditional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, as separate software packages, partly on the user's computing device and partly on a remote computing device, or entirely on a remote computing device or server.

[0276] Furthermore, an embodiment of the present disclosure may be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, cause the processor to perform steps in the integrated circuit-based communication method of each embodiment of the present disclosure described in the "Exemplary Method" section above.

[0277] The computer readable storage medium may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may include, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0278] Although the basic principles of the present disclosure have been described above with reference to specific embodiments, the advantages, advantages, effects, etc. mentioned in the present disclosure are not limited but merely illustrative, and these advantages, advantages, effects, etc. are not necessarily possessed by each embodiment of the present disclosure. In addition, the specific details disclosed above are not limited but merely serve to serve as examples and to facilitate understanding, and the above details do not necessarily limit the present disclosure to be realized by the above specific details.

[0279] Those skilled in the art can make various modifications and variations to the present disclosure without departing from the spirit and scope of the present disclosure. Thus, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and its equivalent technology, the present disclosure is also intended to include these modifications and variations.

Claims

1. a first functional module, a second functional module, an interconnection module, and a first isolation module, the first functional module and the second functional module being communicatively connected via the interconnection module, the first isolation module being disposed in a communication link between the first functional module and the interconnection module; the second functional module is configured to send a first message to the first functional module; The first isolation module is configured to control transmission of the first message based on a correspondence between the first message and a first preset protocol.

2. The first quarantine module includes a response monitoring sub-module and a protocol inspection sub-module; the response monitoring sub-module is configured to monitor the first message and transmit the first message to the protocol inspection sub-module; The integrated circuit of claim 1 , wherein the protocol inspection submodule is configured to transmit or block the first message based on a correspondence between the first message and the first preset protocol.

3. The protocol inspection submodule includes: a first monitoring unit, a first processing unit, and a first recovery unit; the first monitoring unit is configured to determine a correspondence between the first message and the first preset protocol; the first processing unit is configured to block the first message if the first message does not correspond to the first preset protocol, and to transmit the first message to the first functional module if the first message corresponds to the first preset protocol; 3. The integrated circuit of claim 2, wherein the first recovery unit is configured to restore the first monitoring unit and the first processing unit to an enabled state after the first processing unit blocks the first message or transmits the first message to the first functional module.

4. The first message not corresponding to the first preset protocol includes that a number of data in the first message is different from a preset target number in the first preset protocol; 4. The integrated circuit of claim 3, wherein the first processing unit is configured to determine a first association message based on the first preset protocol and send the first association message to the first functional module when the first message does not correspond to the first preset protocol, and a number of pieces of data in the first association message is equal to the target number.

5. The first processing unit is configured to determine a first association message based on the first preset protocol if the first message does not correspond to the first preset protocol.

5. The integrated circuit of claim 4, wherein the first processing unit is configured to: complement a number of data in the first message to the target number based on the first preset protocol when a number of data in the first message is smaller than the target number, to obtain the first association message; and to trim the target number of data from the first message based on the first preset protocol when a number of data in the first message is larger than the target number, to obtain the first association message.

6. the first monitoring unit is further configured to send a first error information or a first interrupt signal when the first message does not correspond to the first preset protocol; the integrated circuit further includes a third functional module; the third functional module is arranged to receive the first error information sent by the first monitoring unit or to obtain the first error information from a register of the integrated circuit in response to the first interrupt signal sent by the first monitoring unit, where the first error information includes an error type of the first message; 4. The integrated circuit according to claim 3, wherein the third functional module is further configured to determine a corresponding processing policy based on an error type of the first error information, restart or reset the second functional module based on the processing policy, and output first alarm information.

7. The response monitoring submodule includes: a second monitoring unit, a message retransmission unit, a second processing unit, and a second recovery unit; the first message includes a response message that the second functional module transmits to the first functional module when the second functional module receives a first access request message transmitted by the first functional module; the second monitoring unit is configured to send second error information to the message retransmission unit when the first message is not detected within a first time after the first access request message is detected, the second error information including that an error type is a timeout; the message retransmission unit is configured to retransmit the first access request message to the second functional module when receiving the second error information; the second processing unit is configured to send a preset response message corresponding to the first access request message to the first functional module when the first message is not detected within a second time after the message retransmission unit retransmits the first access request message; 3. The integrated circuit of claim 2, wherein the second recovery unit is configured to restore the second monitoring unit, the message retransmission unit and the second processing unit to an enabled state after the response monitoring submodule completes a timeout process of the first message.

8. 8. The integrated circuit of claim 7, wherein the message retransmission unit is configured to, when the first access request message is cached in a register of the integrated circuit and the second error information is received, retransmit the first access request message cached in the register to the second functional module.

9. the second processing unit is further configured to send the second error information or a second interrupt signal if the first message is not detected within a second time after resending the first access request message; the integrated circuit further includes a third functional module; the third functional module is arranged to receive the second error information sent by the second processing unit or to obtain the second error information from a register of the integrated circuit in response to the second interrupt signal sent by the second processing unit, the second error information including an error type of the first message; 8. The integrated circuit of claim 7, wherein the third functional module is further configured to determine a corresponding processing policy based on an error type of the second error information, restart or reset the second functional module based on the processing policy, and output third alarm information.

10. Further comprising a second isolation module; the second isolation module is disposed in a communication link between the interconnection module and the second functional module, and is configured to control transmission of the first message based on a correspondence between the first message and a second preset protocol before the first message arrives at the interconnection module; and / or 2. The integrated circuit of claim 1, wherein the second isolation module is installed in a communication link between the interconnection module and the first isolation module, and is configured to control transmission of a second message sent by the first functional module to the second functional module based on a correspondence between the second message and a second preset protocol before the second message reaches the interconnection module.

11. The integrated circuit of claim 1 , wherein a security level of the first functional module is higher than a security level of the second functional module.

12. detecting a first message sent by a second functional module of an integrated circuit to a first functional module of said integrated circuit; and controlling transmission of the first message based on a correspondence between the first message and a first preset protocol.

13. 13. The communication method of claim 12, wherein the step of controlling the transmission of the first message based on the correspondence between the first message and a first preset protocol includes: blocking the first message if the first message does not correspond to the first preset protocol; and transmitting the first message if the first message corresponds to the first preset protocol.

14. The first message not corresponding to the first preset protocol includes that a number of data in the first message is different from a preset target number in the first preset protocol; The integrated circuit communication method further includes:

14. The communication method of claim 13, further comprising: if the first message does not correspond to the first preset protocol, determining a first association message based on the first preset protocol and sending the first association message to the first functional module, wherein a number of data in the first association message is equal to the target number.

15. An electronic device comprising the integrated circuit according to any one of claims 1 to 11.

16. A computer-readable storage medium storing a computer program for executing the integrated circuit communication method according to any one of claims 12 to 14.

Images