WO2021052017A1 - 通信方法、装置、计算机可读存储介质和芯片 - Google Patents

通信方法、装置、计算机可读存储介质和芯片 Download PDF

Info

Publication number
WO2021052017A1
WO2021052017A1 PCT/CN2020/105344 CN2020105344W WO2021052017A1 WO 2021052017 A1 WO2021052017 A1 WO 2021052017A1 CN 2020105344 W CN2020105344 W CN 2020105344W WO 2021052017 A1 WO2021052017 A1 WO 2021052017A1
Authority
WO
WIPO (PCT)
Prior art keywords
security level
subsystem
memory
interrupt
computer system
Prior art date
Application number
PCT/CN2020/105344
Other languages
English (en)
French (fr)
Inventor
耿东久
杨传龙
桑琰
林强敏
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CA3111427A priority Critical patent/CA3111427A1/en
Priority to AU2020343994A priority patent/AU2020343994A1/en
Priority to EP20859621.3A priority patent/EP3835988A4/en
Publication of WO2021052017A1 publication Critical patent/WO2021052017A1/zh
Priority to US17/369,520 priority patent/US11941259B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0622—Securing storage systems in relation to access
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
    • G06F12/1425—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block
    • G06F12/1441—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block for a range
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
    • G06F12/1491—Protection against unauthorised use of memory or access to memory by checking the subject access rights in a hierarchical protection system, e.g. privilege levels, memory rings
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0655—Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/0671—In-line storage system
    • G06F3/0673—Single storage device
    • G06F3/0679—Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4812—Task transfer initiation or dispatching by interrupt, e.g. masked
    • G06F9/4818—Priority circuits therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1032—Reliability improvement, data loss prevention, degraded operation etc
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1052—Security improvement
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/17—Embedded application
    • G06F2212/173—Vehicle or other transportation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2105—Dual mode as a secondary aspect
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2113—Multi-level security, e.g. mandatory access control

Definitions

  • This application relates to the field of automatic driving technology, and more specifically, to a communication method, device, computer-readable storage medium, and chip.
  • hazard analysis and risk assessment of the autonomous driving system are generally carried out in the design stage of automobile products to identify the hazards of different systems. If the safety risk of the system is greater, The corresponding security requirement level is higher.
  • ISO 26262 Road Vehicle Functional Safety
  • ASIL automotive safety integrity level
  • ASIL D is the highest safety integrity
  • ASIL A is the lowest safety integrity.
  • QM there is no need for corresponding security requirements.
  • One solution is to stack a large number of electronic control units (ECUs) to deploy security domain systems with different security levels on different hardware devices to achieve the purpose of resource isolation.
  • ECUs electronice control units
  • Different security domain systems are CAN/ UART low-speed bus for communication.
  • different security domain systems are equivalent to being executed by different devices separately.
  • resource isolation is achieved, a large amount of hardware stacking is required, and the communication delay between different security domain systems is also relatively high. high.
  • VMM virtual machine monitor
  • VM virtual machine
  • This application provides a communication method, computer system, device, computer-readable storage medium, and chip to realize the isolation of systems with different security levels in a computer system.
  • a communication method is provided, which is applied to a computer system, the computer system includes a first subsystem and a second subsystem, the security level of the first subsystem is higher than the security level of the second subsystem, The CPU core of the first subsystem, the CPU core of the second subsystem, and the memory access checker are integrated on the same chip.
  • the computer system includes an interrupt controller, the interrupt controller is shared by the first subsystem and the second subsystem, the interrupt routing configuration information saved in the interrupt controller is configured by the CPU core of the first subsystem, and the interrupt The routing configuration information is used to indicate the CPU core that responds to each interrupt.
  • the first subsystem also includes a memory access checker.
  • the communication method specifically includes: the memory access checker receives a memory access request from the memory access initiator; the memory access check The device divides the information according to the pre-configured memory security level, and determines whether the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator; when the memory security level to be accessed by the memory access initiator matches the memory security level of the memory access initiator When the security level matches, the memory access initiator is allowed to access the memory.
  • the memory access request carries the memory address to be accessed by the memory access initiator and the security level information of the memory access initiator, and the memory security level division information is used to indicate the security level of the memory in different address segments in the computer system.
  • the above-mentioned computer system is a system in an unmanned driving system.
  • the driving of the unmanned driving system can be controlled through the computer system.
  • the above method further includes: when the memory security level to be accessed by the memory access initiator does not match the security level of the memory access initiator, not allowing the memory access initiator to access the memory.
  • the computer system may also include other subsystems than the first subsystem and the second subsystem, and the number of subsystems included in the computer system is not limited in this application.
  • the security level configuration of the other subsystems can be performed in a similar manner to the first subsystem or the second subsystem.
  • the second sub-system can also be subdivided into at least two micro-systems, and then the at least two micro-systems can be configured by configuring the first sub-system and the second sub-system.
  • the second sub-system can be subdivided into the first micro-system and the second micro-system, and the security level of the first micro-system and the second micro-system can be configured using the above-mentioned method of configuring the first sub-system and the second sub-system. , So that the security level of the first micro system is higher than the security level of the second micro system.
  • the above method further includes: the IO device receives an access request from the access device, and the access request carries the security level information of the access device; When the security level of the device matches, the IO device allows the access device to access the IO device.
  • the above-mentioned IO device is any IO device in the first subsystem or the second subsystem.
  • the IO device can accept access from the access device, and if the security level of the access device does not match the IP device, the IO device does not accept IO The access of the device, thus a certain degree of isolation between the access device and the IO device, prevents the access device whose security level does not match the IO device from accessing the IO device.
  • the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.
  • the access device is allowed to access the IO device, that is to say, a device with a high security level can access a device with the same security level or a lower security level , So that devices with lower security levels cannot access devices with higher security levels, thereby achieving a certain degree of isolation between access devices and IO devices.
  • the above method further includes: the interrupt controller receives an interrupt request from the interrupt initiator, the interrupt request carries security level information of the interrupt initiator; the interrupt controller is configured according to the configuration The security level information and interrupt request to determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and when the security level of the interrupt initiator matches the security level of the interrupt receiver, Allow interrupt receivers to accept interrupt requests.
  • the interrupt controller can be used to process interrupt requests, so that when the security level of the interrupt initiator matches the security level of the interrupt receiver, the interrupt receiver accepts the interrupt request, and the interrupt request can be processed normally. Under the circumstances, the isolation between the interrupt initiator and the interrupt receiver is realized.
  • the match between the security level of the interrupt initiator and the security level of the interrupt receiver includes: both the interrupt initiator and the interrupt receiver belong to the first subsystem; the interrupt initiator Both the interrupt receiver and the interrupt receiver belong to the second subsystem; or, the interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.
  • the interrupt receiver When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, so as to avoid the high security level device from receiving or processing the interrupt request initiated by the low security level device. In this way, as far as possible to avoid the impact of safety-level equipment on high-safety-level equipment when abnormalities occur.
  • the mismatch between the security level of the interrupt initiator and the security level of the interrupt receiver includes: the interrupt initiator belongs to the second subsystem, and the interrupt receiver belongs to the first sub-system. system.
  • the interrupt receiver When the security level of the interrupt initiator is lower than the security level of the interrupt receiver, the interrupt receiver does not accept the interrupt request from the interrupt initiator, so that it can avoid as much as possible to the high security system when the equipment of the low security system fails.
  • the device is interfering.
  • the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the memory access initiator has a high security level It is equal to or equal to the security level of the memory to be accessed by the memory access initiator.
  • the memory access initiator can only access the memory with the same or lower security level, it is possible to avoid devices with a low security system from accessing the memory with a higher security level as much as possible, and to achieve isolation of the memory to a certain extent.
  • the security level of the memory access initiator when the security level of the memory access initiator is lower than the memory security level to be accessed by the memory access initiator, determine the memory security level to be accessed by the memory access initiator and The security level of the memory access initiator does not match.
  • the first subsystem includes a partition manager, and the method further includes: the partition manager configures the first subsystem and the second subsystem according to the security level configuration file of the computer system.
  • the equipment in the second subsystem carries out the configuration of the safety level.
  • the security level configuration file of the computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the used memory.
  • the partition manager can realize the configuration of the security level of the first subsystem and the second subsystem, so as to realize the isolation of the first subsystem and the second subsystem.
  • the partition manager configures the security level of the first subsystem and the second subsystem, it may first obtain and parse the security level configuration file of the computer system, and then obtain the security level configuration file of the first subsystem and the second subsystem. After the security level of the equipment and the memory used, the security level configuration of the first subsystem and the second subsystem are performed.
  • the above-mentioned security level configuration file is a pre-configured file.
  • the aforementioned security level configuration file may be determined in advance according to the equipment situation and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system. It is convenient for the subsequent partition management area to obtain and parse the security level configuration file.
  • the aforementioned security level configuration file is obtained from the cloud.
  • the aforementioned security level configuration file may be downloaded from the cloud by the computer system.
  • security level configuration file can be updated or upgraded regularly or irregularly.
  • the above-mentioned partition manager performs security level configuration for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager is in the CPU
  • the security level configuration module corresponding to the core writes the security level information of the CPU core.
  • the security level information of the CPU core is used to indicate the security level of the CPU core.
  • the security level configuration module corresponding to the CPU core can be located either inside the CPU or outside the CPU.
  • the security level configuration module corresponding to the above CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.
  • the aforementioned partition manager When the aforementioned partition manager writes the security level information of the CPU core in the security level configuration module corresponding to the CPU core, it can specifically write the security level information of the CPU core into the register corresponding to the security level module corresponding to the CPU core. After entering, the security level module corresponding to the CPU core can obtain the security level information of the CPU core from this register.
  • the CPU core and the security level configuration module are in a one-to-one correspondence, and each security level configuration module is used to indicate the safety of the corresponding CPU core grade.
  • each CPU core can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU core.
  • each security level configuration module is used to indicate the security level of the corresponding CPU core.
  • the security level configuration module corresponding to the CPU core is provided inside the CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core is set inside the CPU core, it is convenient to process the signal output by the CPU core, so that the processed signal contains the security level information of the CPU core.
  • the CPU cluster has a one-to-one correspondence with the security level configuration module, the CPU cluster includes multiple CPU cores, and the security level configuration module is used to indicate The security level of multiple CPU cores in the corresponding CPU cluster.
  • Each CPU cluster can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • the security level configuration module corresponding to the CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to the CPU cluster.
  • the above-mentioned partition manager performs security level configuration for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager is in The memory security level division information is written in the memory access checker.
  • the memory security level division information is written in the memory access checker through the partition manager, so that the memory access checker can check and manage memory access according to the written memory security level division information, and facilitate subsequent memory isolation.
  • the above-mentioned partition manager performs security level configuration for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager in the IO
  • the security level configuration and detection module corresponding to the device writes the security level information of the IO device.
  • the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine the device that initiated the access request. Whether the security level matches the security level of the IO device.
  • the security level configuration of the IO device can be realized, and the security level configuration of the configured IO device and the detection module can be realized to initiate access requests.
  • the safety level of the equipment is checked, so as to realize the isolation between the equipment of different safety levels.
  • the above method further includes: starting the first CPU core of the first subsystem, so that the partition manager is on the first CPU core of the first subsystem Run; the partition manager starts the other CPU cores of the first subsystem; after completing the startup of the CPU core of the first subsystem, the partition manager sequentially starts the CPU cores of the second subsystem.
  • the memory of the second subsystem includes shared memory, and the shared memory is used to transfer data between the first subsystem and the second subsystem
  • the above method further includes: The CPU core of the first subsystem stores the first communication data generated by the first subsystem into the shared memory, and initiates the first interrupt, so that the CPU core of the second subsystem receives the first interrupt from the shared memory Read the first communication data; or, the CPU core of the second subsystem stores the second communication data generated by the first and second subsystems into the shared memory, and initiates a second interrupt so that the CPU core of the first subsystem After receiving the second interrupt, read the second communication data from the shared memory.
  • the shared memory of the second sub-system can realize the data transmission between the first sub-system and the second sub-system, so that the first sub-system and the second sub-system are isolated while ensuring that the first sub-system and the second sub-system are isolated from each other. Normal and communication between the second subsystem.
  • a communication method is provided.
  • the communication method is applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip.
  • the communication method includes: obtaining a security level configuration file of the computer system;
  • the security level of the system is configured so that the security level of the CPU core of the first subsystem is higher than the security level of the CPU core of the second subsystem, and the security level of the IO device of the first subsystem is higher than the IO of the second subsystem.
  • the security level of the device, the security level of the memory used by the first subsystem is higher than the security level of the memory of the second subsystem.
  • the security level configuration file of the aforementioned computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the memory used by the first subsystem and the second system.
  • the method of the second aspect described above may be executed by a partition manager in a computer system, and the partition manager may be a module (software module or virtual module) implemented by software in the computer system.
  • the above-mentioned computer system is a system in an unmanned driving system.
  • the driving of the unmanned driving system can be controlled through the computer system.
  • the security level configuration of the first subsystem and the second subsystem can be performed according to the security level configuration file of the computer system, so as to realize the configuration of the first subsystem and the second subsystem.
  • the safety isolation of the two subsystems can try to avoid affecting the normal operation of the first subsystem when the second subsystem is abnormal.
  • the above-mentioned security level configuration file is a pre-configured file.
  • the above-mentioned security level configuration file can be determined in advance according to the equipment situation and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system to facilitate subsequent partitioning. The management area obtains and parses the security level configuration file.
  • the aforementioned security level configuration file is obtained from the cloud.
  • the aforementioned security level configuration file may be downloaded from the cloud by the computer system.
  • security level configuration file can be updated or upgraded regularly or irregularly.
  • the configuration of the security level of the first subsystem and the second subsystem according to the security level configuration file includes: the security level corresponding to the CPU core of the computer system
  • the security level information of the CPU core of the computing system is written in the configuration module.
  • the security level information of the CPU core is used to indicate the security level of the CPU core.
  • the security level configuration module corresponding to the CPU core can be located either inside the CPU or outside the CPU.
  • the security level configuration module corresponding to the above CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core writes the security level information of the CPU core, the security level information of the CPU core can be written into the register corresponding to the security level module corresponding to the CPU core. After the writing is completed , The security level module corresponding to the CPU core can obtain the security level information of the CPU core from this register.
  • the CPU core and the security level configuration module in the computer system have a one-to-one correspondence, and each security level module is used to indicate the security level of the corresponding CPU core.
  • each CPU core corresponds to a security level configuration module
  • the corresponding security level can be configured for each CPU core more flexibly.
  • the security level configuration module corresponding to each CPU core in the computer system is set inside each CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core is set inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.
  • the CPU cluster and the security level configuration module are in a one-to-one correspondence.
  • the CPU cluster includes multiple CPU cores, and each security level configuration module uses To indicate the security level of multiple CPU cores in the corresponding CPU cluster.
  • Each CPU cluster can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • the security level configuration module corresponding to each CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to each CPU cluster.
  • the first subsystem includes a memory access checker
  • the configuration of the security levels of the first subsystem and the second subsystem according to the security level configuration file includes : Write memory security level division information in the memory access checker.
  • the memory access checker can check and manage memory access according to the written memory security level division information, which is convenient for subsequent memory isolation.
  • the security level of the first subsystem and the second subsystem is configured according to the security level configuration file, including: the security level corresponding to the IO device
  • the configuration and detection module writes the security level information of the IO device.
  • the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine the security level of the device that initiated the access request and the IO device Whether the security level matches.
  • the security level configuration of the IO device can be realized, and the security level configuration of the configured IO device and the detection module can be realized to initiate access requests.
  • the safety level of the equipment is checked, so as to realize the isolation between the equipment of different safety levels.
  • a communication method is provided.
  • the communication method is applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip, and the communication method includes:
  • the security level configuration information of the first system and the second subsystem can be implemented according to the security level configuration information, so as to realize the configuration of the security level of the first system and the second subsystem.
  • the safety isolation between the first subsystem and the second subsystem can try to avoid affecting the normal operation of the first subsystem when the second subsystem is abnormal.
  • the configuration information of the security level of the first subsystem and the second subsystem is received as described above, so as to realize the security level of the first subsystem and the second subsystem.
  • the configuration includes: receiving the security level information of each CPU core in the computer system.
  • the configuration of the security level of each CPU core in the computer system is also realized.
  • the CPU core and the security level configuration module in the above-mentioned computer system have a one-to-one correspondence, and each security level module is used to indicate the security level of the corresponding CPU core.
  • each CPU core can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU core.
  • each security level configuration module is used to indicate the security level of the corresponding CPU core.
  • the security level configuration module corresponding to each CPU core is located inside each CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core is set inside the CPU core, it is convenient to process the signal output by the CPU core, so that the processed signal contains the security level information of the CPU core.
  • the CPU cluster in the computer system has a one-to-one correspondence with the security level configuration module, and the security level configuration module is used to indicate multiple CPU cores in the corresponding CPU cluster. Security level.
  • Each CPU cluster can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • the security level configuration module corresponding to any CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to any CPU cluster.
  • the configuration information of the security level of the first subsystem and the second subsystem is received to implement the configuration of the security level of the first subsystem and the second subsystem , Including: receiving memory security level division information, which is used to indicate the security levels of memory in different address segments in the computer system.
  • the configuration of the security level of the memory in different address segments in the computer system can be realized by receiving the information of the memory security level division.
  • the configuration information of the security level of the first subsystem and the second subsystem is received to implement the configuration of the security level of the first subsystem and the second subsystem ,include:
  • the security level information of the IO device in the computer system is received, and the access request received by the IO device is detected to determine whether the security level of the access device that initiated the access request matches the security level of the IO device.
  • the above method further includes: receiving an interrupt request initiated by the interrupt initiator, the interrupt request carrying security level information of the interrupt initiator;
  • the configured security level information and interrupt request determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and if the security level of the interrupt initiator matches the security level of the interrupt receiver To allow interrupt receivers to accept interrupt requests.
  • the interrupt controller can be used to process interrupt requests, so that when the security level of the interrupt initiator matches the security level of the interrupt receiver, the interrupt receiver accepts the interrupt request, and the interrupt request can be processed normally. Under the circumstances, the isolation between the interrupt initiator and the interrupt receiver is realized.
  • the security level of the interrupt initiator and the interrupt to be accessed by the interrupt device are determined according to the configuration information and interrupt request of the security level of the first subsystem and the second subsystem Whether the security level of the target device matches, including:
  • the interrupt receiver When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, so as to avoid the high security level device from receiving or processing the interrupt request initiated by the low security level device. In this way, as far as possible to avoid the impact of safety-level equipment on high-safety-level equipment when abnormalities occur.
  • the security level of the memory access initiator when the security level of the memory access initiator is lower than the memory security level to be accessed by the memory access initiator, determine the memory security level to be accessed by the memory access initiator and The security level of the memory access initiator does not match.
  • the above method further includes: receiving a memory access request from the memory access initiator, the memory access request carrying the memory address to be accessed by the memory access initiator and the memory access initiator Security level information; in the case that the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, the memory access initiator is allowed to access the memory address to be accessed by the memory access initiator, and the memory security level division information Used to indicate the security level of different segments of memory.
  • the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the memory access initiator has a security level higher than or Equal to the security level of the memory to be accessed by the memory access initiator.
  • the memory access initiator can only access the memory with the same or lower security level, it is possible to avoid devices with a low security system from accessing the memory with a higher security level as much as possible, and to achieve isolation of the memory to a certain extent.
  • a communication method is provided.
  • the communication method is applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the same chip.
  • the communication method includes: an IO device receives an access request from an access device, and the access request carries security level information of the access device, where the IO device It is any IO device in the first subsystem or the second subsystem; when the security level of the access device matches the security level of the IO device, the IO device allows the access device to access the IO device.
  • the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.
  • a computer system in a fifth aspect, includes a first subsystem and a second subsystem, and the first subsystem and the second subsystem are used to execute the method in the above-mentioned first aspect.
  • a processing device in a sixth aspect, includes each module used to execute the method in the second aspect.
  • a processing device in a seventh aspect, includes each module configured to execute the method in the third aspect.
  • a processing device including the modules used to execute the method in the fourth aspect.
  • the processing device in the sixth aspect, the seventh aspect, and the eighth aspect described above may be a chip in the computer system in the first aspect described above.
  • a computer-readable storage medium stores program code, and the program code includes instructions for executing steps in any one of the methods in the second aspect.
  • a tenth aspect provides a computer program product containing instructions, when the computer program product runs on a computer, the computer executes any one of the methods in the second aspect.
  • a chip in an eleventh aspect, includes a processor and a data interface.
  • the processor reads instructions stored in a memory through the data interface and executes any one of the methods in the second aspect.
  • the chip may further include a memory in which instructions are stored, and the processor is configured to execute instructions stored on the memory.
  • the processor is used to execute any one of the methods in the second aspect described above.
  • the above-mentioned chip may specifically be a field programmable gate array FPGA or an application-specific integrated circuit ASIC.
  • Figure 1 is a schematic diagram of an automatic driving system
  • FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a process of processing a memory access request of the memory access checker
  • FIG. 4 is a schematic diagram of a process in which the IO device determines whether to accept the access of the access device
  • Figure 5 is a schematic diagram of an IO device accessing memory
  • Figure 6 is a schematic diagram of a security level configuration module corresponding to each CPU core
  • Figure 7 is a schematic diagram of a security level configuration module corresponding to each CPU cluster
  • FIG. 8 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • Figure 11 is a schematic diagram of the structure of an automatic driving system
  • FIG. 12 is a schematic diagram of the process of configuring the memory access checker by the partition manager
  • FIG. 13 is a schematic block diagram of a computer system according to an embodiment of the present application.
  • FIG. 14 is a schematic block diagram of a processing device according to an embodiment of the present application.
  • FIG. 15 is a schematic block diagram of a processing device according to an embodiment of the present application.
  • FIG. 16 is a schematic block diagram of a processing device according to an embodiment of the present application.
  • Figure 17 is a schematic diagram of the interrupt configuration in the automatic driving system
  • Figure 18 is a schematic diagram of the interrupt handling process
  • Figure 19 is a schematic diagram of starting the computer system
  • Figure 20 is a schematic diagram of shared communication between different subsystems.
  • the computer system in this application may specifically be located in the automatic driving system.
  • the (zoning) isolation of different subsystems of the computer system is essentially the isolation of different subsystems in the automatic driving system. .
  • the autonomous driving system for the subsystems of different safety levels in the system, it is necessary to realize the complete isolation of the subsystems of different safety levels, and also to realize the communication between the different subsystems during normal operation.
  • the partition isolation of the autonomous driving system will be described below in conjunction with Figure 1.
  • the autonomous driving system includes a first subsystem and a second subsystem.
  • the first subsystem is used to identify objects, and the second subsystem is used to control the vehicle (control the vehicle's braking, acceleration, and turning, etc.) ). If the first subsystem finds an obstacle in front of the vehicle, it informs the second subsystem to control the vehicle to brake. After the notification command is issued, if the first subsystem fails, the failure may cause the second subsystem to fail to work normally, so that the brake command of the second subsystem is not executed correctly, and it may cause the vehicle in the end. Hit an obstacle and cause a traffic accident.
  • the first subsystem and the second subsystem need to be isolated, so that when one of the subsystems fails, the other subsystem can still work normally.
  • the communication method of the embodiment of the present application will be described in detail below with reference to FIG. 2.
  • the communication method shown in FIG. 2 can be executed by a device in a computer system.
  • the method shown in Figure 2 can be applied to a computer system that includes a first subsystem and a second subsystem, wherein the security level of the first subsystem is higher than the security level of the second subsystem, and the first The CPU core of the subsystem, the CPU core of the second subsystem, and the memory access checker are integrated on the same chip.
  • the computer system includes an interrupt controller, the interrupt controller is shared by the first subsystem and the second subsystem, the interrupt routing configuration information saved in the interrupt controller is configured by the CPU core of the first subsystem, and the interrupt The routing configuration information is used to indicate the CPU core that responds to each interrupt, and the first subsystem also includes a memory access checker.
  • the method shown in FIG. 2 includes steps 1001 and 1002, and steps 1001 and 1002 are described in detail below.
  • Memory access This sends a memory access request to the memory access checker, and the memory access checker receives the memory access request from the memory access initiator.
  • the aforementioned memory access request carries the memory address to be accessed by the memory access initiator and the security level information of the memory access initiator.
  • the memory access checker divides the information according to the pre-configured memory security level, determines whether the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, and determines whether the memory access initiator is allowed according to the matching result Make a visit.
  • the memory access initiator when the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, the memory access initiator is allowed to access the memory; and when the memory access initiator wants to access the memory security level and the memory access initiator When the security level does not match, the memory access initiator is not allowed to access the memory.
  • the foregoing memory security level classification information is used to indicate the security levels of the memory in different address segments in the computer system.
  • the above-mentioned computer system is a system in an unmanned driving system.
  • the driving of the unmanned driving system can be controlled through the computer system.
  • the above method further includes: when the memory security level to be accessed by the memory access initiator does not match the security level of the memory access initiator, not allowing the memory access initiator to access the memory.
  • the computer system may also include other subsystems besides the first subsystem and the second subsystem, and the number of subsystems included in the computer system is not limited in this application.
  • the security level configuration of the other subsystems can be performed in a similar manner to the first subsystem or the second subsystem.
  • the second sub-system can also be subdivided into at least two micro-systems, and then the at least two micro-systems can be configured by configuring the first sub-system and the second sub-system.
  • the second sub-system can be subdivided into the first micro-system and the second micro-system, and the security level of the first micro-system and the second micro-system can be configured using the above-mentioned method of configuring the first sub-system and the second sub-system. , So that the security level of the first micro system is higher than the security level of the second micro system.
  • the devices of the first subsystem and the devices of the second subsystem may also be isolated.
  • the access request of the CPU or IO device will carry the security level signal.
  • the access request will first reach the address decoder for decoding, thereby obtaining the memory access address and The security level signal carried in the access request.
  • the memory access checker will verify the security level of the security level signal carried in the access request. Only memory access requests with a matching security level are allowed to access the memory, otherwise a security interrupt is reported. .
  • the IO device can also determine whether the security level of the access device matches the security level of the IO device according to the access request of the access device, and then allow access to the access device if it matches.
  • the following is a detailed description with reference to Figure 4 .
  • the process for the IO device to determine whether to accept the access of the access device specifically includes steps 2001 to 2003, which are described below.
  • the IO device receives an access request from the access device.
  • the aforementioned access request carries security level information of the access device, and the aforementioned IO device is any IO device in the first subsystem or the second subsystem.
  • the IO device allows the access device to access the IO device.
  • the IO device allows the access device to access the IO device.
  • the IO device executes step 2002 or 2003.
  • the process shown in FIG. 4 may further include step 2004.
  • the IO device may obtain the security level of the access device according to the access request of the access device, and then determine the security level of the access device and the security of the IO device according to the security level of the access device and the security level of the IO device Whether the level matches.
  • the IO device can accept access from the access device, and if the security level of the access device does not match the IP device, the IO device does not accept IO The access of the device, thus a certain degree of isolation between the access device and the IO device, prevents the access device whose security level does not match the IO device from accessing the IO device.
  • the security level of the aforementioned access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.
  • the access device is allowed to access the IO device, that is to say, a device with a high security level can access a device with the same security level or a lower security level , So that devices with lower security levels cannot access devices with higher security levels, thereby achieving a certain degree of isolation between access devices and IO devices.
  • a configuration register can be added to store the security level of the IO device.
  • the security level information of the IO device will follow.
  • the hardware signal is transmitted on the address bus.
  • the memory access checker will check the security level of the hardware signal.
  • the IO device when the CPU core accesses an IO device, the IO device will check the security level of the access request of the CPU core. Only when the security level of the CPU core matches the security level of the IO device is allowed The CPU core accesses the IO device.
  • interrupt requests can also be isolated.
  • the method shown in FIG. 2 further includes: the interrupt controller receives an interrupt request from the interrupt initiator, the interrupt request carries security level information of the interrupt initiator; the interrupt controller according to the configured security level information and the interrupt request, Determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and allow the interrupt receiver to accept the interrupt request when the security level of the interrupt initiator matches the security level of the interrupt receiver.
  • the interrupt controller can be used to process interrupt requests, so that when the security level of the interrupt initiator matches the security level of the interrupt receiver, the interrupt receiver accepts the interrupt request, and the interrupt request can be processed normally. Under the circumstances, the isolation between the interrupt initiator and the interrupt receiver is realized.
  • matching the security level of the interrupt initiator with the security level of the interrupt receiver includes: both the interrupt initiator and the interrupt receiver belong to the first subsystem; the interrupt initiator and the interrupt receiver belong to the second subsystem; or , The interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.
  • the interrupt receiver When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, so as to avoid the high security level device from receiving or processing the interrupt request initiated by the low security level device. In this way, as far as possible to avoid the impact of safety-level equipment on high-safety-level equipment when abnormalities occur.
  • the mismatch between the security level of the interrupt initiator and the security level of the interrupt receiver includes: the interrupt initiator belongs to the second subsystem, and the interrupt receiver device belongs to the first subsystem.
  • the interrupt receiver When the security level of the interrupt initiator is lower than the security level of the interrupt receiver, the interrupt receiver does not accept the interrupt request from the interrupt initiator, so that it can avoid as much as possible to the high security system when the equipment of the low security system fails.
  • the device is interfering.
  • the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the security level of the memory access initiator is higher than or equal to the memory access initiator Security Level.
  • the memory access initiator can only access the memory with the same or lower security level, it is possible to avoid devices with a low security system from accessing the memory with a higher security level as much as possible, and to achieve isolation of the memory to a certain extent.
  • the security level of the memory access initiator is lower than the memory security level to be accessed by the memory access initiator, it is determined that the memory security level to be accessed by the memory access initiator does not match the security level of the memory access initiator.
  • the above-mentioned first subsystem further includes a partition manager
  • the method shown in FIG. 2 further includes: the partition manager performs security level classification for the devices in the above-mentioned first subsystem and the above-mentioned second subsystem according to the security level configuration file of the computer system. Configuration.
  • the security level configuration file of the computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the used memory.
  • the partition manager can realize the configuration of the security level of the first subsystem and the second subsystem, so as to realize the isolation of the first subsystem and the second subsystem.
  • the partition manager configures the security level of the first subsystem and the second subsystem, it may first obtain and parse the security level configuration file of the computer system, and then obtain the security level configuration file of the first subsystem and the second subsystem. After the security level of the equipment and the memory used, the security level configuration of the first subsystem and the second subsystem are performed.
  • the above-mentioned security level configuration file is a pre-configured file.
  • the aforementioned security level configuration file may be determined in advance according to the equipment situation and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system. It is convenient for the subsequent partition management area to obtain and parse the security level configuration file.
  • the aforementioned security level configuration file is obtained from the cloud.
  • the aforementioned security level configuration file may be downloaded from the cloud by the computer system.
  • security level configuration file can be updated or upgraded regularly or irregularly.
  • the above-mentioned partition manager performs security level configuration for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager is in the CPU
  • the security level configuration module corresponding to the core writes the security level information of the CPU core.
  • the security level information of the CPU core is used to indicate the security level of the CPU core.
  • the security level configuration module corresponding to the CPU core can be located either inside the CPU or outside the CPU.
  • the security level configuration module corresponding to the above CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.
  • the aforementioned partition manager When the aforementioned partition manager writes the security level information of the CPU core in the security level configuration module corresponding to the CPU core, it can specifically write the security level information of the CPU core into the register corresponding to the security level module corresponding to the CPU core. After entering, the security level module corresponding to the CPU core can obtain the security level information of the CPU core from this register.
  • the CPU core and the security level configuration module have a one-to-one correspondence, and each security level configuration module is used to indicate the security level of the corresponding CPU core.
  • each CPU core can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU core.
  • each security level configuration module is used to indicate the security level of the corresponding CPU core.
  • the security level configuration module corresponding to the CPU core is set inside the CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core is set inside the CPU core, it is convenient to process the signal output by the CPU core so that the processed signal contains the security level information of the CPU core.
  • each CPU core is provided with a security level configuration module, so that after the configuration is completed, the signal sent by each CPU core carries corresponding security level information.
  • the safety level configuration module of the CPU core on the left side of Figure 6 is configured to ASIL-D level
  • the safety level configuration of the CPU core on the right side of Figure 6 The module is configured to ASIL-B level, then the signal of the CPU on the left carries the high security level information of ASIL-D, and the signal of the CPU on the right carries the low security level information of ASIL-B.
  • the security level configuration module corresponding to each CPU core can also be located outside the CPU core. At this time, the signal sent by the CPU core can also pass through the security level module corresponding to the CPU core. The security level module corresponding to the CPU core is in the CPU core. The safety level information of the CPU core is added to the signal sent by the core.
  • the security level of the CPU can also be configured with the CPU cluster as the granularity.
  • the CPU cluster and the security level configuration module have a one-to-one correspondence
  • the CPU cluster includes multiple CPU cores
  • the security level configuration module is used to indicate the security of multiple CPU cores in the corresponding CPU cluster. grade.
  • Each CPU cluster can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • the security level configuration module corresponding to the CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to the CPU cluster.
  • the aforementioned partition manager performs security level configuration for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager writes memory security level classification information in the memory access checker .
  • the memory security level division information is written in the memory access checker through the partition manager, so that the memory access checker can check and manage memory access according to the written memory security level division information, and facilitate subsequent memory isolation.
  • a hardware module can be added to the L3_TAG module in the L3 cache (L3Cache) outside the CPU cluster (L3_TAG is the protocol processing module of L3Cache, which includes all other functions except data storage). This module can configure the security level of the CPU inside the CPU cluster.
  • one CPU cluster corresponds to one L3_TAG, and a security level configuration module is added to L3_TAG.
  • a security level configuration module is used to indicate the security level of multiple CPU cores in the corresponding CPU cluster.
  • each CPU signal when the security level module in L3_TAG in Figure 7 is configured to ASIL-D level, each CPU signal will carry ASIL-D high security level information after passing through the L3_TAG; similarly, when the security level module in L3_TAG When configured as ASIL-B or QM, each CPU signal will carry ASIL-B or QM low security level information after passing through the L3_TAG.
  • the aforementioned partition manager performs security level configuration for the devices in the first subsystem and the second subsystem according to the security level configuration file, including: the partition manager configures the security level corresponding to the IO device and the detection module writes IO
  • the security level information of the device, the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine whether the security level of the device that initiated the access request matches the security level of the IO device.
  • the security level configuration of the IO device can be realized, and the security level configuration of the configured IO device and the detection module can be realized to initiate access requests.
  • the safety level of the equipment is checked, so as to realize the isolation between the equipment of different safety levels.
  • the method shown in FIG. 2 further includes: starting the first CPU core of the first subsystem, so that the partition manager runs on the first CPU core of the first subsystem; and the partition manager starts the first CPU core.
  • Other CPU cores of the subsystem after completing the startup of the CPU core of the first subsystem, the partition manager sequentially starts the CPU core of the second subsystem.
  • the memory of the second subsystem includes shared memory, and the shared memory is used to transfer data between the first subsystem and the second subsystem.
  • the above method further includes: the CPU core of the first subsystem transfers the first subsystem to the shared memory.
  • the generated first communication data is stored in the shared memory, and the first interrupt is initiated, so that after the CPU core of the second subsystem receives the first interrupt, the first communication data is read from the shared memory; or, the second sub
  • the CPU core of the system stores the second communication data generated by the first and second subsystems into the shared memory, and initiates a second interrupt, so that the CPU core of the first subsystem can read from the shared memory after receiving the second interrupt Take the second communication data.
  • the shared memory of the second sub-system can realize the data transmission between the first sub-system and the second sub-system, so that the first sub-system and the second sub-system are isolated while ensuring that the first sub-system and the second sub-system are isolated from each other. Normal and communication between the second subsystem.
  • FIG. 8 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • the communication method shown in Figure 8 is applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core and the CPU core of the second subsystem are integrated on the same chip.
  • the method shown in FIG. 8 includes steps 3001 and 3002, which are described in detail below.
  • the security level configuration file of the aforementioned computer system is used to indicate the security level of the devices in the first subsystem and the second subsystem and the memory used by the first subsystem and the second system.
  • 3002 Configure the security levels of the first subsystem and the second subsystem according to the security level configuration file, so that the security level of the CPU core of the first subsystem is higher than the security level of the CPU core of the second subsystem, the first The security level of the IO device of the subsystem is higher than the security level of the IO device of the second subsystem, and the security level of the memory used by the first subsystem is higher than the security level of the memory of the second subsystem.
  • the method shown in FIG. 8 may be executed by a partition manager in a computer system, and the partition manager may be a module (software module or virtual module) implemented by software in the computer system.
  • the above-mentioned computer system is a system in an unmanned driving system.
  • the driving of the unmanned driving system can be controlled through the computer system.
  • the security level configuration of the first subsystem and the second subsystem can be performed according to the security level configuration file of the computer system, so as to realize the configuration of the first subsystem and the second subsystem.
  • the safety isolation of the two subsystems can try to avoid affecting the normal operation of the first subsystem when the second subsystem is abnormal.
  • the above-mentioned security level configuration file is a pre-configured file.
  • the above-mentioned security level configuration file can be determined in advance according to the equipment situation and application requirements of the computer system. After the security level configuration file is determined, the security level configuration file can be written into the cache of the computer system to facilitate subsequent partitioning. The management area obtains and parses the security level configuration file.
  • the aforementioned security level configuration file is obtained from the cloud.
  • the aforementioned security level configuration file may be downloaded from the cloud by the computer system.
  • security level configuration file can be updated or upgraded regularly or irregularly.
  • step 3002 specifically includes:
  • the security level information of the CPU core is used to indicate the security level of the CPU core.
  • the security level configuration module corresponding to the CPU core can be located either inside the CPU or outside the CPU.
  • the security level configuration module corresponding to the above CPU core may be a hardware module, which may be specifically implemented by a hardware circuit, and is used to process the signal output by the CPU core so that the processed signal includes the security level information of the CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core writes the security level information of the CPU core, the security level information of the CPU core can be written into the register corresponding to the security level module corresponding to the CPU core. After the writing is completed , The security level module corresponding to the CPU core can obtain the security level information of the CPU core from this register.
  • the CPU core and the security level configuration module in the foregoing computer system have a one-to-one correspondence, and each security level module is used to indicate the security level of the corresponding CPU core.
  • each CPU core corresponds to a security level configuration module
  • the corresponding security level can be configured for each CPU core more flexibly.
  • the security level configuration module corresponding to each CPU core in the foregoing computer system is provided inside each CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core is set inside the CPU core, it is convenient to process the signal output by the CPU core, so that the processed signal contains the security level information of the CPU core.
  • the CPU cluster and the security level configuration module have a one-to-one correspondence
  • the CPU cluster includes multiple CPU cores
  • each security level configuration module is used to indicate multiple CPU cores in the corresponding CPU cluster.
  • Security level is used to indicate multiple CPU cores in the corresponding CPU cluster.
  • Each CPU cluster can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • the security level configuration module corresponding to each CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to each CPU cluster.
  • the foregoing first subsystem includes a memory access checker
  • the foregoing step 3002 specifically includes:
  • the memory access checker can check and manage memory access according to the written memory security level division information, which is convenient for subsequent memory isolation.
  • step 3002 specifically includes:
  • the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to determine the initiation of access Whether the security level of the requested device matches the security level of the IO device.
  • the security level configuration of the IO device can be realized, and the security level configuration of the configured IO device and the detection module can be realized to initiate access requests.
  • the safety level of the equipment is checked, so as to realize the isolation between the equipment of different safety levels.
  • FIG. 9 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • the communication method shown in Figure 9 is applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core and the CPU core of the second subsystem are integrated on the same chip.
  • the method shown in FIG. 9 includes steps 4001 and 4002, which are described in detail below.
  • the safety level of the CPU core of the first subsystem can be higher than the safety level of the CPU core of the second subsystem, and the safety level of the IO device of the first subsystem is higher than that of the IO device of the second subsystem.
  • the security level of the memory used by the first subsystem is higher than the security level of the memory used by the second subsystem.
  • the security level configuration information of the first system and the second subsystem can be implemented according to the security level configuration information, so as to realize the configuration of the security level of the first system and the second subsystem.
  • the safety isolation between the first subsystem and the second subsystem can try to avoid affecting the normal operation of the first subsystem when the second subsystem is abnormal.
  • step 4001 specifically includes:
  • the configuration of the security level of each CPU core in the computer system is also realized.
  • the CPU core and the security level configuration module in the foregoing computer system have a one-to-one correspondence, and each security level module is used to indicate the security level of the corresponding CPU core.
  • each CPU core corresponds to a security level configuration module
  • the corresponding security level can be configured for each CPU core more flexibly.
  • the security level configuration module corresponding to each CPU core is located inside each CPU core.
  • the security level configuration module corresponding to the CPU core When the security level configuration module corresponding to the CPU core is set inside the CPU core, it is convenient to process the signal output by the CPU core, so that the processed signal contains the security level information of the CPU core.
  • the CPU cluster in the computer system and the security level configuration module have a one-to-one correspondence
  • the security level configuration module is used to indicate the security levels of multiple CPU cores in the corresponding CPU cluster.
  • Each CPU cluster can correspond to a security level configuration module, and each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • each security level configuration module is used to indicate the security level of the corresponding CPU cluster.
  • the security level configuration module corresponding to any CPU cluster is set in the protocol processing module L3_TAG of the L3 cache corresponding to any CPU cluster.
  • step 4001 specifically includes:
  • the configuration of the security level of the memory in different address segments in the computer system can be realized by receiving the information of the memory security level division.
  • step 4001 specifically includes:
  • the method shown in FIG. 9 further includes:
  • the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and the security level of the interrupt initiator matches the security level of the interrupt receiver In the case, the interrupt receiver is allowed to accept the interrupt request.
  • the interrupt controller can be used to process interrupt requests, so that when the security level of the interrupt initiator matches the security level of the interrupt receiver, the interrupt receiver accepts the interrupt request, and the interrupt request can be processed normally. Under the circumstances, the isolation between the interrupt initiator and the interrupt receiver is realized.
  • the security level information configured in step 4004 includes the security level information of the two subsystems of the first subsystem and the second system.
  • step 4004 specifically includes:
  • the interrupt receiver When the security level of the interrupt initiator is greater than or equal to the security level of the interrupt receiver, the interrupt receiver is allowed to receive the interrupt request initiated by the interrupt initiator, so as to avoid the high security level device from receiving or processing the interrupt request initiated by the low security level device. In this way, as far as possible to avoid the impact of safety-level equipment on high-safety-level equipment when abnormalities occur.
  • the security level of the memory access initiator is lower than the memory security level to be accessed by the memory access initiator, it is determined that the memory security level to be accessed by the memory access initiator does not match the security level of the memory access initiator.
  • the method shown in FIG. 9 further includes:
  • the memory access initiator When the memory security level to be accessed by the memory access initiator matches the security level of the memory access initiator, the memory access initiator is allowed to access the memory address to be accessed by the memory access initiator, and the memory security level division information is used to indicate The security level to which different segments of memory belong.
  • the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including: the security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator .
  • the memory access initiator can only access the memory with the same or lower security level, it is possible to avoid devices with a low security system from accessing the memory with a higher security level as much as possible, and to achieve isolation of the memory to a certain extent.
  • FIG. 10 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • the communication method shown in FIG. 10 is applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core and the CPU core of the second subsystem are integrated on the same chip.
  • the method shown in FIG. 10 includes steps 5001 and 5002, which are described in detail below.
  • the IO device receives an access request from the access device
  • the aforementioned access request carries security level information of the access device
  • the aforementioned IO device is any IO device in the first subsystem or the second subsystem.
  • the IO device allows the access device to access the IO device.
  • the method shown in FIG. 10 may further include step 5003.
  • the IO device does not allow the access device to access the IO device.
  • the security level of the access device matches the security level of the IO device, including: the security level of the access device is greater than or equal to the security level of the IO device.
  • the computer system to which the communication method of the embodiment of the present application is applied may specifically be an automatic driving system (or it may also be considered that the computer system is located in an automatic driving system).
  • the specific structure of the automatic driving system will be described in detail below with reference to FIG. 11.
  • Fig. 11 is a schematic diagram of the structure of an automatic driving system.
  • the automatic driving system can be divided into a high-safety operation subsystem and a low-safety operation subsystem in software.
  • the ASIL of the high-safety operation subsystem is higher than that of the low-safety subsystem, for example, the high-safety sub-system.
  • the ASIL of the system can be ASIL-D, and the ASIL of the low-safety subsystem can be any of QM, ASIL-A, ASIL-B and ASIL-C.
  • the first subsystem in the embodiment of the present application may be equivalent to the high-security operating system shown in FIG. 11, and the second subsystem may be equivalent to the second subsystem shown in FIG. 11.
  • the autonomous driving system shown in Figure 11 can be divided into a hardware layer and a software layer.
  • the hardware layer provides security attribute configuration, security detection and security error reporting, etc.
  • the software layer provides a partition manager for resource isolation and interrupt management based on the platform.
  • the hardware layer and software layer are described in detail below.
  • the logic of security configuration and detection is added to the hardware layer to detect whether the operating system software and device direct memory access (DMA) access is legal.
  • the logic of these security configurations and detections includes the security level configuration of the CPU core, the security detection of memory access by the memory access checker, the security configuration and inspection of input and output (input and output, IO) devices, and the interrupt configuration security check. The following is a detailed introduction to these security configurations and detection logics.
  • the security level configuration of the CPU core used to configure the corresponding security level for the CPU core (the CPU core in the high security subsystem is configured as a high security level, and the CPU core in the low security subsystem is configured as a low security level). After the core is configured with the corresponding security level, the signal sent by the CPU core can carry the corresponding security level information and transmit it on the bus.
  • the security level of the CPU core when configuring the security level of the CPU core, it can be implemented by configuring the security level information for the security level configuration module corresponding to the CPU core.
  • Memory access checker Perform security check on the address access sent to the memory DDR, and only allow access if the security level matches, otherwise it will be rejected.
  • Interrupt configuration security check Check the interrupt security level to ensure that only high-security CPUs can operate the high-security interrupt configuration, otherwise access is denied.
  • IO device security configuration and inspection used to configure the corresponding IO device to different security levels. After the security level configuration is completed, the address access sent by the IO device will carry the security level signal. In addition, the module also The security level check can be performed on the access request to the current device initiated by other devices to confirm whether the security level matches.
  • the software layer mainly adds a partition manager for resource isolation and division, and shared memory communication between different functional security partitions.
  • the partition manager mainly includes the following modules: isolation and division of CPU cores, isolation and division of memory resources, IO device security level configuration, isolation and configuration of interrupt resources, safe startup of multiple operating systems, and data communication based on shared memory. The function of each module is described in detail below.
  • This module is used to divide the safety levels of the CPU cores used by each operating system.
  • the CPUs used by the high-safety operating system and the low-safety operating system can be written in the configuration file. They are not shared with each other (a CPU core will not belong to both a high safety system and a low safety system at the same time).
  • the CPU used by the high-safety operating system can be configured in lockstep mode and the functional safety level is ASIL-D
  • the CPU used by the low-safety operating system can be configured in normal mode and the functional safety level is ASIL-B.
  • QM level QM level.
  • This module is used to divide the memory used by different operating systems and is not shared with each other. High-security operating systems use ASIL-D level memory, and low-security operating systems use ASIL-B or QM level memory. In addition, the module can also write memory layout information (memory allocation information) to the memory access checker through registers.
  • IO device safety level configuration used to configure the functional safety level of each IO device, such as ASIL-D, ASIL-B or QM level.
  • Isolation and configuration of interrupt resources used to manage global sharing and critical high-safety interrupt configuration, and can also handle operation requests for high-interrupt configuration sent by the low-safety operating system. If the request is legal, perform the operation on its behalf , Otherwise refuse.
  • Multi-operating system safe boot This module is used to pull up the operating system of the corresponding functional safety level on the high-safety CPU and the low-safety CPU respectively.
  • a section of shared memory is opened in the low-functional safety memory for data transmission between operating systems with different functional safety levels.
  • an interrupt is used to notify The other party fetches the data, and the high-functional safety system will check the legality of the shared memory data sent by the low-functional safety system.
  • the safety configuration and inspection of the safety device in FIG. 11 may specifically be a safety configuration and detection module
  • the safety level configuration of the CPU core may specifically be a safety level configuration module of the CPU core.
  • the above-mentioned security configuration and detection module, security level configuration module, interrupt controller and memory access checker can be integrated in the same chip (the chip is not shown in the figure).
  • Figure 12 shows a schematic diagram of the partition manager configuring the memory access checker. The process shown in FIG. 12 includes steps 6001 to 6003, and these steps are described in detail below.
  • the above-mentioned memory configuration file can be carried in a device tree source (DTS) file.
  • DTS device tree source
  • the foregoing memory configuration file may divide the memory address range used by subsystems of different security levels.
  • the foregoing memory configuration file may contain the following configuration information:
  • the above configuration information indicates that the memory in the range of 0 to 0x40000000 is allocated to the ASIL-D security level subsystem, and the memory in the range of 0x40000000 to 0x80000000 is allocated to the ASIL-B security level subsystem.
  • 6002 Determine the memory division information according to the memory configuration file.
  • the partition manager After obtaining the memory configuration file, the partition manager determines the memory division information by analyzing the memory configuration file.
  • the partition manager determines that the memory in the range of 0 ⁇ 0x40000000 is assigned to the ASIL-D security level subsystem, and the memory in the range of 0x40000000 ⁇ 0x80000000 is assigned to the ASIL-B security level subsystem .
  • the partition manager can configure the memory partition to the memory access checker, so that the memory access checker can perform security checks on the memory address access initiated by each operating system or other IO devices.
  • the memory access checker will detect that the security level does not match, intercept the memory address access, and report a safety interrupt and notify The application software has now encountered a safety (Safety) error of out-of-bounds access.
  • Fig. 13 is a schematic block diagram of a computer system according to an embodiment of the present application.
  • the computer system 8000 shown in FIG. 13 includes a first subsystem 8010 and a second subsystem 8020, and the first subsystem 8010 includes a memory access checker 8011.
  • the security level of the first subsystem 8010 is higher than the security level of the second subsystem 8020, and the CPU core of the first subsystem 8010, the CPU core of the second subsystem 8020, and the memory access checker 8011 are integrated on the same chip.
  • the memory access checker 8011 is configured to receive a memory access request from a memory access initiator, the memory access request carrying the memory address to be accessed by the memory access initiator and the security level information of the memory access initiator;
  • the memory access checker 8011 is also configured to divide information according to the pre-configured memory security level to determine whether the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, and to determine whether the security level of the memory access initiator matches the security level of the memory access initiator.
  • the memory access initiator is allowed to access the memory address, wherein the memory security level division information is used to indicate different information in the computer system The security level of the memory in the address segment.
  • the computer system 8000 further includes:
  • the IO device is used to receive an access request from an access device, the access request carries security level information of the access device, where the IO device is any one of the first subsystem or the second subsystem. equipment;
  • the IO device is further configured to allow the access device to access the IO device when the security level of the access device matches the security level of the IO device.
  • that the security level of the access device matches the security level of the IO device includes: the security level of the access device is greater than or equal to the security level of the IO device.
  • the aforementioned computer system 8000 further includes:
  • An interrupt controller wherein the first subsystem and the second subsystem share the interrupt controller, and the interrupt routing configuration information saved in the interrupt controller is configured by the CPU core of the first subsystem ,
  • the interrupt routing configuration information is used to indicate the CPU core that responds to each interrupt
  • the interrupt controller is used for:
  • the interrupt request carrying security level information of the interrupt initiator
  • the configured security level information and the interrupt request determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and determine whether the security level of the interrupt initiator matches the security level of the interrupt receiver. If the security level of the interrupt receiver matches, the interrupt receiver is allowed to accept the interrupt request.
  • the matching of the security level of the interrupt initiator with the security level of the interrupt receiver includes:
  • Both the interrupt initiator and the interrupt receiver belong to the first subsystem
  • Both the interrupt initiator and the interrupt receiver belong to the second subsystem; or,
  • the interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.
  • the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including:
  • the security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.
  • the first subsystem further includes:
  • Partition manager the partition manager is used to:
  • the partition manager is used to:
  • the security level configuration module corresponding to the CPU core of the computer system writes the security level information of the CPU core of the computer system.
  • the security level information of the CPU core of the computer system is used to indicate the status of the CPU core of the computer system. Security Level.
  • the partition manager is configured to write the memory security level division information in the memory access checker.
  • the partition manager is used to:
  • the security level configuration and detection module corresponding to the IO device writes the security level information of the IO device, and the security level configuration and detection module corresponding to the IO device is used to detect the access request received by the IO device to It is determined whether the security level of the device that initiated the access request matches the security level of the IO device, where the IO device is any IO device in the first subsystem or the second subsystem.
  • the computer system further includes:
  • An initial startup module configured to start the first CPU core of the first subsystem, so that the partition manager runs on the first CPU core of the first subsystem;
  • the partition manager is used to start other CPU cores of the first subsystem
  • the partition manager is further configured to sequentially activate the CPU cores of the second subsystem.
  • the memory of the second subsystem includes shared memory, and the shared memory is used to transfer data between the first subsystem and the second subsystem, and the CPU core of the first subsystem uses The first communication data generated by the first subsystem is stored in the shared memory, and a first interrupt is initiated so that the CPU core of the second subsystem receives the first interrupt from the shared memory. Read the first communication data from the memory; or
  • the CPU core of the second subsystem is used to store the second communication data generated by the second subsystem into the shared memory and initiate a second interrupt so that the CPU core of the first subsystem can receive After the second interruption, the second communication data is read from the shared memory.
  • Fig. 14 is a schematic block diagram of a processing device according to an embodiment of the present application.
  • the processing device 9000 shown in FIG. 14 includes a memory 9001 and a processor 9002.
  • the processing device 9000 shown in FIG. 14 can be applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core of the CPU core and the CPU core of the second subsystem are integrated on the same chip, and the processing device is located in the first subsystem.
  • the above-mentioned memory 9001 is used to store programs.
  • the processing 9002 is used for each step in the method shown in FIG. 8.
  • FIG. 15 is a schematic block diagram of a processing device according to an embodiment of the present application.
  • the processing device 10000 shown in FIG. 15 includes a memory 10001 and a processor 10002.
  • the processing device 10000 shown in FIG. 15 can be applied to a computer system.
  • the processing device 10000 is applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem Different from the operating system of the second subsystem, the CPU core of the first subsystem and the CPU core of the second subsystem are integrated on the processing device 10000, and the processing device 10000 is located in the first In the subsystem, the processing device 10000 includes:
  • the security level configuration module 10001 is configured to receive security level configuration information of the first subsystem and the second subsystem;
  • the security level configuration module 10001 is further configured to configure the security level of the first subsystem and the second subsystem according to the received security level configuration file, and the memory used by the first subsystem The security level is higher than the security level of the memory of the second subsystem.
  • the aforementioned processing device 10000 may be a chip in a computer system.
  • the security level configuration module 10001 is used to:
  • the security level information of each CPU core in the computer system is received to implement the configuration of the security level of each CPU core in the computer system.
  • the processing device further includes:
  • the memory access checker 10002 is configured to receive memory security level division information, where the memory security level division information is used to indicate the security levels of memory in different address segments in the computer system.
  • the processing device further includes:
  • the security level configuration and detection module 10003 is used to receive the security level information of the IO device in the computer system;
  • the security level configuration and detection module 10003 is also used to detect the access request received by the IO device in the computer system to determine the security level of the access device that initiated the access request and the IO in the computer system. Whether the security level of the device matches.
  • the processing device further includes:
  • the interrupt controller 10004 is configured to determine, according to the configured security level information and the interrupt request, whether the security level of the interrupt initiator matches the security level of the interrupt receiver corresponding to the interrupt initiator, and the interrupt If the security level of the initiator matches the security level of the interrupt receiver, the interrupt receiver is allowed to accept the interrupt request.
  • the matching of the security level of the interrupt initiator with the security level of the interrupt receiver includes:
  • Both the interrupt initiator and the interrupt receiver belong to the first subsystem
  • Both the interrupt initiator and the interrupt receiver belong to the second subsystem; or,
  • the interrupt initiator belongs to the first subsystem, and the interrupt receiver belongs to the second subsystem.
  • the security level configuration module 10001 is used to:
  • the memory access request carrying a memory address to be accessed by the memory access initiator and security level information of the memory access initiator;
  • the memory security level classification information is used to indicate the security level to which different segments of memory belong.
  • the security level of the memory to be accessed by the memory access initiator matches the security level of the memory access initiator, including:
  • the security level of the memory access initiator is higher than or equal to the security level of the memory to be accessed by the memory access initiator.
  • Fig. 16 is a schematic block diagram of a processing device according to an embodiment of the present application.
  • the processing device 11000 shown in FIG. 16 includes a receiver 11001 and a processor 11002.
  • the processing device 11000 shown in FIG. 16 can be applied to a computer system.
  • the computer system includes a first subsystem and a second subsystem.
  • the operating system of the first subsystem is different from the operating system of the second subsystem.
  • the CPU core of the CPU core and the CPU core of the second subsystem are integrated on the same chip, and the processing device 11000 is located in the first subsystem.
  • the receiver 11001 and the processor 11002 in the foregoing processing device 11000 may be used to execute each step in the method shown in FIG. 10.
  • the foregoing apparatus 11000 may be a device in a computer system, for example, an IO device.
  • the interrupt controller configuration can be divided into two parts.
  • the core and shared interrupt configuration are designed to be ASIL-D. Only the safety lockstep core can be operated. Avoid malicious changes to the interrupt when the low-security operating system on the non-lockstep core fails, so as to avoid the impact on the high-security operating system.
  • the interrupt configuration includes interrupt enable, interrupt shutdown, interrupt routing and so on. If an ordinary CPU core (non-lockstep core) wants to operate this configuration, it must send a request to the lockstep core, and let the lockstep core perform the operation on its behalf.
  • the configuration of Per-Core and some low-security configurations do not distinguish the security level.
  • Every CPU can operate, including the ordinary CPU where the low-security operating system is located, because the high-security operating system will not use this part of the configuration, even if the low-security operating system is out If the problem is solved, it will not affect the operation of the high-security operating system.
  • GIC_STREAMBUS in FIG. 17 represents a bus
  • GICD represents an interrupt distributor (distrubitor)
  • GICR represents an interrupt redistributor (REdistrubitor)
  • ITS represents an interrupt translation service component (ITS).
  • DEVICE_ASILD represents a device with security level ASILD
  • DEVICE_ASILB represents a device with security level ASILB
  • DEVICE_QM represents a device with security level QM
  • OS ASILD represents an operating system with security level ASILD
  • OS ASILB represents operations with security level ASILB system.
  • the partition manager is located in the high-security operating system. During the system startup, the interrupt controller driver will be called according to the configuration of the high-security operating system configuration file to configure the global shared ASIL-D resources, including those used by the high-security operating system. Non-ASIL-D resources (configuration).
  • the high-security operating system will check whether the operation is legal. For example, the interrupt number to be operated belongs to a device managed by the high-security operating system, and the high-security operating system will reject it. Because the managed devices of the two operating systems are independent and not shared.
  • the high-security operating system will also reject it, because the high-security operating system has been initialized by the partition management during the startup process and does not need to be reinitialized.
  • the above process is shown in Figure 18. Shown. For performance considerations, a low-security operating system will reduce the interrupt configuration for operating ASIL-D at runtime.
  • the high-function security operating system isolates the used CPUs and configures them in the configuration file in advance.
  • the configuration file is DTS (Device Tree Source), and the OS kernel can know which CPUs to use by parsing the DTS configuration file. And establish the CPU topology.
  • the partition manager will notify the BIOS or ATF (ARM64 platform) in turn according to the configuration file, configure the CPU to be started in lockstep or normal state, and pull up the corresponding CPU Run, the process is shown in Figure 19.
  • the partition manager After the local SMP of the high-security operating system is started, the partition manager will pull up the first core of the low-security operating system. After the first core of the low-security operating system is pulled up, it will jump into the interior of the low-security operating system. The kernel entry address is then initialized. Which CPUs the low-security operating system uses are also divided in advance in the configuration file. The low-security operating system divides the CPUs in its configuration file and pulls up the CPUs allocated to it in turn. Because it is a low-security operating system, there is no need to configure its own CPU in a lockstep state.
  • the memory can be divided into different functional safety areas, such as ASIL-D and ASIL-B.
  • Different functional safety OSs use different levels of memory areas.
  • high-safety OS uses ASIL-D memory.
  • ASIL-B memory for functional safety OS.
  • IRQ Notifier/Handler After an OS puts data in the shared memory, it calls IRQ Notifier to notify another OS to fetch data from the shared memory. After the other OS receives the interrupt, it enters the IRQ Handler, and looks at the Handler where it needs to go from Get data from the block shared memory and notify the target app to get the data.
  • Driver hmem driver This driver provides the function of allocating a shared memory area, and the mapped memory is used in user mode.
  • Interface 1 is Libshmem, which is an encapsulation interface provided to the upper user mode, and the operation of shared memory is completed through interfaces such as open and mmap.
  • the guest OS When the guest OS is running on the low-security OS through the Hypervisor, the guest OS provides the shmem FE driver that communicates with the low-security Host OS. The driver communicates with the shemem BE driver to complete the guest OS's reading and writing of shared memory.
  • Shmem FE driver The shared memory front-end program, which provides the address mapping function of the Guest OS's own Stage1, and also connects with the Host OS Shmem BE driver back-end driver.
  • Shmem BE driver Shared memory back-end program, handles the exit of shared memory front-end program, calls libshmem to complete the stage2 mapping, and calls IRQ Notifier to notify the other OS to receive data; when receiving data from the opposite OS, share The memory back-end program injects interrupts to the Guest OS. After receiving the injected interrupt, the shared memory front-end program notifies the corresponding App in the Guest to read the data.
  • End-to-end (E2E): End-to-end protection.
  • CRC End-to-end
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disks or optical disks and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Human Computer Interaction (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Hardware Redundancy (AREA)

Abstract

本申请提供了通信方法、装置、计算机可读存储介质和芯片，涉及自动驾驶技术领域。该通信方法应用于计算机系统，该计算机系统包括第一子系统和第二子系统，该第一子系统的安全等级高于第二子系统的安全等级，第一子系统包括内存访问检查器，该方法包括：内存访问检查器接收来自内存访问发起者的内存访问请求，并根据预先配置的内存安全等级划分信息，确定内存访问发起者要访问的内存的安全等级与内存访问发起者的安全等级是否匹配，并在内存地址的安全等级与内存访问发起者的安全等级匹配时，允许内存访问发起者访问内存地址。本申请能够实现对计算机系统的不同子系统实现较好的隔离。

Description

通信方法、装置、计算机可读存储介质和芯片
本申请要求于2019年09月18日提交中国专利局、申请号为201910883765.7、申请名称为“通信方法、装置、计算机可读存储介质和芯片”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及自动驾驶技术领域，并且更具体地，涉及一种通信方法、装置、计算机可读存储介质和芯片。
背景技术
随着计算机系统的复杂程度越来越高，如何保证计算机系统中各个子系统的正常运行，并在其中的部分子系统发生异常之后避免对其他正常工作的子系统产生干扰是一个比较重要的问题。
以自动驾驶领域为例，为了对汽车的安全风险进行评估，一般会在汽车产品的设计阶段对自动驾驶系统进行危害分析和风险评估，识别出不同系统的危害，如果系统的安全风险越大，则对应的安全要求级别也就越高。为了对汽车的安全等级进行评估，ISO 26262《道路车辆功能安全》引入了车辆安全完整性等级(automotive safety integrity level，ASIL)的概念，并定义了四种不同的ASIL：ASIL A、ASIL B、ASIL C和ASIL D。其中，ASIL D是最高的安全完整性，而ASIL A是最低的安全完整性。另外，若是识别为QM的风险，则不需要有对应的安全需求。
在自动驾驶领域中，这些具备安全等级的系统必须可靠地保证人身安全，即使一个ASIL域系统分区发生故障或事故的情况下也不能影响另一个ASIL域的系统正常运行。这就要求不同的ASIL安全等级域之间要进行严格的隔离，如果隔离不干净就会造成灾难性的后果。同时还要确保不同功能安全分区之间的通信还有具有低时延和高可靠性。
一种方案是通过堆叠大量的电子控制单元(electronic control unit，ECU)将不同安全级别的安全域系统分别部署在不同的硬件设备上，以达到资源隔离的目的，不同的安全域系统分别CAN/UART低速总线进行通信。在这种方案中，不同安全域系统相当于是由不同的设备单独来执行的，虽然实现了了资源的隔离，但是需要大量的硬件堆叠，并且不同安全域系统之间进行通信的时延也比较高。
另一种方案是采用虚拟化技术将物理设备虚拟化，然后将不同安全级别的安全域系统部署在不同的虚拟设备上，整个系统的硬件采用虚拟机监视器(virtual machine monitor，VMM)(也可以称为hypervisor)进行统一管理，硬件设备以共享或者直通的方式被某个虚拟机(virtual machine，VM)共享或者独占使用。在该方案中，不同安全域的系统虽然被分配的是不同的虚拟机，但是这些虚拟机会共享一些底层硬件，因此，该方案并没有做到资源的彻底隔离，使得系统的可靠性受到一定的影响。
发明内容
本申请提供一种通信方法、计算机系统、装置、计算机可读存储介质和芯片，以实现计算机系统中不同安全等级系统的隔离。
第一方面，提供了一种通信方法，该方法应用于计算机系统中，该计算机系统包括第一子系统和第二子系统，第一子系统的安全等级高于第二子系统的安全等级，第一子系统的CPU核、第二子系统的CPU核以及所述内存访问检查器集成在同一芯片上。该计算机系统包括中断控制器，该中断控制器由第一子系统和第二子系统共用，该中断控制器中的保存的中断路由配置信息是由第一子系统的CPU核配置的，该中断路由配置信息用于指示响应每个中断的CPU核，第一子系统还包括内存访问检查器，该通信方法具体包括：内存访问检查器接收来自内存访问发起者的内存访问请求；该内存访问检查器根据预先配置的内存安全等级划分信息，确定内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级是否匹配；当内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级匹配时，允许内存访问发起者访问内存。
其中，上述内存访问请求携带内存访问发起者要访问的内存地址以及内存访问发起者的安全等级信息，上述内存安全等级划分信息用于指示计算机系统中不同地址段的内存的安全等级。
可选地，上述计算机系统为无人驾驶系统中的系统。
当上述计算机系统为无人驾驶系统中的系统时，通过该计算机系统能够控制无人驾驶系统的行驶。
应理解，在本申请中，安全等级越高安全程度也就越高。
可选地，上述方法还包括：当内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级不匹配时，不允许内存访问发起者访问内存。
本申请中，通过将内存访问检查器设置在高安全等级的子系统中，并将计算机系统的内存按照安全等级进行划分，能够实现对计算机系统的不同子系统实现较好的隔离，尽可能的避免一个子系统出现异常后影响其他子系统的正常工作。
应理解，在本申请中，计算机系统还可以包括第一子系统和第二子系统之外的其他子系统，本申请中对计算机系统中包含的子系统的个数不做限定。当计算机系统包含其他子系统时，可以按照与第一子系统或者第二子系统类似的方式为其他子系统进行安全等级的配置。
本申请中，还可以将第二子系统再划分成至少两个微系统，然后再采用配置第一子系统和第二子系统的方式对该至少两个微系统进行配置。
例如，可以将第二子系统再划分成第一微系统和第二微系统，并采用上述配置第一子系统和第二子系统的方式来配置第一微系统和第二微系统的安全等级，使得第一微系统的安全等级高于第二微系统的安全等级。
结合第一方面，在第一方面的某些实现方式中，上述方法还包括：IO设备接收来自访问设备的访问请求，该访问请求携带访问设备的安全等级信息；在访问设备的安全等级与IO设备的安全等级相匹配时，IO设备允许访问设备对IO设备的访问。
其中，上述IO设备为第一子系统或者第二子系统中的任意一个IO设备。
本申请中，只有在访问设备的安全等级与IO设备的安全等级匹配的情况下，IO设备 才接受访问设备的访问，而如果访问设备的安全等级与IP设备不匹配时，IO设备不接受IO设备的访问，从而在访问设备与IO设备之间进行了一定程度的隔离，避免安全等级与IO设备不匹配的访问设备访问IO设备。
结合第一方面，在第一方面的某些实现方式中，上述访问设备的安全等级与IO设备的安全等级相匹配，包括：访问设备的安全等级大于或者等于IO设备的安全等级。
本申请中，当访问设备的安全等级高于或者等于IO设备的安全等级时，才允许访问设备访问IO设备，也就是说，安全等级高的设备可以访问安全等级相同或者安全等级较低的设备，使得安全等级较低的设备无法访问安全等级较高的设备，从而在访问设备和IO设备之间实现一定程度的隔离。
具体地，由于低安全等级的设备无法访问高安全等级的设备，从而能够避免低安全等级的设备出现异常时对高安全等级设备的影响。
结合第一方面，在第一方面的某些实现方式中，上述方法还包括：中断控制器接收来自中断发起者的中断请求，该中断请求携带中断发起者的安全等级信息；中断控制器根据配置的安全等级信息和中断请求，确定中断发起者的安全等级与中断发起者对应的中断接收者的安全等级是否匹配，并在中断发起者的安全等级与中断接收者的安全等级匹配的情况下，允许中断接收者接受中断请求。
本申请中，通过中断控制器能够实现对中断请求的处理，使得中断发起者的安全等级与中断接收者的安全等级的匹配下再由中断接收者接受该中断请求，能够在正常处理中断请求的情况下实现中断发起者和中断接收者之间的隔离。
结合第一方面，在第一方面的某些实现方式中，上述中断发起者的安全等级与中断接收者的安全等级匹配包括：中断发起者与中断接收者均属于第一子系统；中断发起者与中断接收者均属于第二子系统；或者，中断发起者属于第一子系统，中断接收者属于第二子系统。
当中断发起者的安全等级大于或者等于中断接收者的安全等级时，允许中断接收者接收中断发起者发起的中断请求，从而避免高安全等级的设备接收或者处理低安全等级设备发起的中断请求，从而尽可能的避免安全等级的设备出现异常时对高安全等级设备的影响。
结合第一方面，在第一方面的某些实现方式中，上述中断发起者的安全等级与中断接收者的安全等级不匹配包括：中断发起者属于第二子系统，中断接收设备属于第一子系统。
当中断发起者的安全等级低于中断接收者的安全等级时，中断接收者不接受中断发起者的中断请求，从而能够在低安全系统的设备出现故障时尽可能的避免对高安全系统中的设备产生干扰。
结合第一方面，在第一方面的某些实现方式中，上述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：内存访问发起者的安全等级高于或者等于内存访问发起者要访问的内存的安全等级。
由于内存访问发起者只能访问安全等级相同或者安全等级更低的内存，能够尽可能的避免低安全系统的设备访问较高安全等级的内存，能够在一定程度上实现对内存的隔离。
结合第一方面，在第一方面的某些实现方式中，在内存访问发起者的安全等级低于内存访问发起者要访问的内存安全等级时，确定内存访问发起者要访问的内存安全等级与内 存访问发起者的安全等级不匹配。
结合第一方面，在第一方面的某些实现方式中，上述第一子系统包括分区管理器，方法还包括：分区管理器根据计算机系统的安全等级配置文件为上述第一子系统和上述第二子系统中的设备进行安全等级的配置。
上述计算机系统的安全等级配置文件用于指示上述第一子系统和第二子系统中的设备以及所使用的内存的安全等级。
通过分区管理器能够实现对第一子系统和第二子系统的安全等级的配置，从而实现对第一子系统和第二子系统的隔离。
应理解，分区管理器在对第一子系统和第二子系统进行安全等级的配置之前，可以先获取并解析计算机系统的安全等级配置文件，在获取到第一子系统和第二子系统中的设备以及所使用的内存的安全等级之后，再对第一子系统和第二子系统进行安全等级的配置。
可选地，上述安全等级配置文件是预先配置好的文件。
具体地，上述安全等级配置文件可以是预先根据计算机系统的设备情况和应用需求来确定的，在确定了该安全等级配置文件之后，可以将该安全等级配置文件写入到计算机系统的缓存中，便于后续分区管理区获取并解析该安全等级配置文件。
可选地，上述安全等级配置文件是从云端获取的。
具体地，上述安全等级配置文件可以是计算机系统从云端下载得到的。
另外，上述安全等级配置文件可以定期或者不定期进行更新或者升级。
结合第一方面，在第一方面的某些实现方式中，上述分区管理器根据安全等级配置文件为第一子系统和第二子系统中的设备进行安全等级配置，包括：分区管理器在CPU核对应的安全等级配置模块写入CPU核的安全等级信息。
其中，上述CPU核的安全等级信息用于指示CPU核的安全等级。该CPU核对应的安全等级配置模块既可以位于CPU内部，也可以位于CPU外部。
上述CPU核对应的安全等级配置模块可以是硬件模块，具体可以由硬件电路实现，用于对CPU核输出的信号进行处理，使得处理后的信号包括CPU核的安全等级信息。
上述分区管理器在CPU核对应的安全等级配置模块写入CPU核的安全等级信息时，具体是可以将CPU核的安全等级信息写入到CPU核对应的安全等级模块所对应的寄存器中，写入完毕之后，CPU核对应的安全等级模块就可以从该寄存器中获取CPU核的安全等级信息。
结合第一方面，在第一方面的某些实现方式中，在上述计算机系统中，CPU核与安全等级配置模块为一一对应关系，每个安全等级配置模块用于指示对应的CPU核的安全等级。
也就是说，每个CPU核可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU核的安全等级。当每个CPU核对应一个安全等级配置模块时，能够较为灵活地为各个CPU核配置相应的安全等级。
结合第一方面，在第一方面的某些实现方式中，CPU核对应的安全等级配置模块设置在CPU核的内部。
当CPU核对应的安全等级配置模块设置在CPU核的内部时，便于对CPU核输出的信号进行处理，使得处理后的信号包含该CPU核的安全等级信息。
结合第一方面，在第一方面的某些实现方式中，在上述计算机系统中，CPU簇与安全等级配置模块为一一对应关系，CPU簇包括多个CPU核，安全等级配置模块用于指示对应的CPU簇中的多个CPU核的安全等级。
每个CPU簇可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU簇的安全等级。当每个CPU簇对应一个安全等级配置模块时，能够减少安全等级配置模块的数量，从而简化计算机系统的复杂度。
结合第一方面，在第一方面的某些实现方式中，上述CPU簇对应的安全等级配置模块设置在CPU簇对应的L3缓存的协议处理模块L3_TAG中。
结合第一方面，在第一方面的某些实现方式中，上述分区管理器根据安全等级配置文件为第一子系统和第二子系统中的设备进行安全等级的配置，包括：分区管理器在内存访问检查器中写入内存安全等级划分信息。
通过分区管理器在内存访问检查器中写入内存安全等级划分信息，使得内存访问检查器能够根据写入的内存安全等级划分信息实现对内存访问的检查和管理，便于后续实现内存的隔离。
结合第一方面，在第一方面的某些实现方式中，上述分区管理器根据安全等级配置文件为第一子系统和第二子系统中的设备进行安全等级配置，包括：分区管理器在IO设备对应的安全等级配置和检测模块写入IO设备的安全等级信息，该IO设备对应的安全等级配置和检测模块用于对IO设备接收到的访问请求进行检测，以确定发起访问请求的设备的安全等级与IO设备的安全等级是否匹配。
通过分区管理器将IO设备的安全等级信息写入到IO设备中，能够实现对IO设备的安全等级的配置，同时也能够实现配置后的IO设备的安全等级配置和检测模块实现对发起访问请求的设备的安全等级的检查，从而实现不同安全等级的设备之间的隔离。
结合第一方面，在第一方面的某些实现方式中，上述方法还包括：启动第一子系统的第一个CPU核，以使得分区管理器在第一子系统的第一个CPU核上运行；分区管理器启动第一子系统的其他CPU核；在完成第一子系统的CPU核启动之后，分区管理器依次启动第二子系统的CPU核。
结合第一方面，在第一方面的某些实现方式中，上述第二子系统的内存包括共享内存，共享内存用于第一子系统和第二子系统之间传输数据，上述方法还包括：第一子系统的CPU核将第一子系统产生的第一通信数据存入到共享内存中，并发起第一中断，以便第二子系统的CPU核接收到第一中断之后，从共享内存中读取第一通信数据；或者，第二子系统的CPU核将第一第二子系统产生的第二通信数据存入到共享内存中，并发起第二中断，以便第一子系统的CPU核接收到第二中断之后，从共享内存中读取第二通信数据。
本申请中，通过第二子系统的共享内存能够实现在第一子系统和第二子系统之间传输数据，从而在对第一子系统和第二子系统隔离的同时保证第一子系统和第二子系统之间的正常、通信。
第二方面，提供了一种通信方法，该通信方法应用于计算机系统，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，该第一子系统的CPU核和第二子系统的CPU核集成在同一芯片上，该通信方法包括：获取计算机系统的安全等级配置文件；根据安全等级配置文件对第一子系统和第二子系统的安全等 级进行配置，以使得第一子系统的CPU核的安全等级高于第二子系统的CPU核的安全等级，第一子系统的IO设备的安全等级高于第二子系统的IO设备的安全等级，第一子系统使用的内存的安全等级高于第二子系统的内存的安全等级。
其中，上述计算机系统的安全等级配置文件用于指示第一子系统和第二子系统中的设备以及第一子系统和第二系统所使用的内存的安全等级。
上述第二方面的方法可以由计算机系统中的分区管理器来执行，该分区管理器可以是计算机系统中采用软件实现的一个模块(软件模块或者虚拟模块)。
可选地，上述计算机系统为无人驾驶系统中的系统。
当上述计算机系统为无人驾驶系统中的系统时，通过该计算机系统能够控制无人驾驶系统的行驶。
应理解，在本申请中，安全等级越高安全程度也就越高。
本申请中，在获取了计算机系统的安全等级配置文件之后，能够根据计算机系统的安全等级配置文件对第一子系统和第二子系统进行安全等级的配置，从而实现对第一子系统和第二子系统的安全隔离，能够尽量避免第二子系统出现异常时影响第一子系统的正常工作。
可选地，上述安全等级配置文件是预先配置好的文件。
上述安全等级配置文件可以是预先根据计算机系统的设备情况和应用需求来确定的，在确定了该安全等级配置文件之后，可以将该安全等级配置文件写入到计算机系统的缓存中，便于后续分区管理区获取并解析该安全等级配置文件。
可选地，上述安全等级配置文件是从云端获取的。
具体地，上述安全等级配置文件可以是计算机系统从云端下载得到的。
另外，上述安全等级配置文件可以定期或者不定期进行更新或者升级。
结合第二方面，在第二方面的某些实现方式中，上述根据安全等级配置文件对第一子系统和第二子系统的安全等级进行配置，包括：在计算机系统的CPU核对应的安全等级配置模块中写入该计算系统的CPU核的安全等级信息。
其中，上述CPU核的安全等级信息用于指示CPU核的安全等级。该CPU核对应的安全等级配置模块既可以位于CPU内部，也可以位于CPU外部。
上述CPU核对应的安全等级配置模块可以是硬件模块，具体可以由硬件电路实现，用于对CPU核输出的信号进行处理，使得处理后的信号包括CPU核的安全等级信息。
上述在CPU核对应的安全等级配置模块写入CPU核的安全等级信息时，具体是可以将CPU核的安全等级信息写入到CPU核对应的安全等级模块所对应的寄存器中，写入完毕之后，CPU核对应的安全等级模块就可以从该寄存器中获取CPU核的安全等级信息。
结合第二方面，在第二方面的某些实现方式中，上述计算机系统中的CPU核与安全等级配置模块为一一对应关系，每个安全等级模块用于指示对应的CPU核的安全等级。
当每个CPU核对应一个安全等级配置模块时，能够较为灵活地为各个CPU核配置相应的安全等级。
结合第二方面，在第二方面的某些实现方式中，计算机系统中的每个CPU核对应的安全等级配置模块设置在每个CPU核的内部。
当CPU核对应的安全等级配置模块设置在CPU核的内部时，便于对CPU核输出的 信号进行处理，使得处理后的信号包含该CPU核的安全等级信息。
结合第二方面，在第二方面的某些实现方式中，在上述计算机系统中，CPU簇与安全等级配置模块为一一对应关系，CPU簇包括多个CPU核，每个安全等级配置模块用于指示对应的CPU簇中的多个CPU核的安全等级。
每个CPU簇可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU簇的安全等级。当每个CPU簇对应一个安全等级配置模块时，能够减少安全等级配置模块的数量，从而简化计算机系统的复杂度。
结合第二方面，在第二方面的某些实现方式中，每个CPU簇对应的安全等级配置模块设置在每个CPU簇对应的L3缓存的协议处理模块L3_TAG中。
结合第二方面，在第二方面的某些实现方式中，上述第一子系统包括内存访问检查器，上述根据安全等级配置文件对第一子系统和第二子系统的安全等级进行配置，包括：在内存访问检查器中写入内存安全等级划分信息。
通过在内存访问检查器中写入内存安全等级划分信息，使得内存访问检查器能够根据写入的内存安全等级划分信息实现对内存访问的检查和管理，便于后续实现内存的隔离。
结合第二方面，在第二方面的某些实现方式中，其特征在于，根据安全等级配置文件对第一子系统和第二子系统的安全等级进行配置，包括：在IO设备对应的安全等级配置和检测模块写入IO设备的安全等级信息，该IO设备对应的安全等级配置和检测模块用于对IO设备接收到的访问请求进行检测，以确定发起访问请求的设备的安全等级与IO设备的安全等级是否匹配。
通过分区管理器将IO设备的安全等级信息写入到IO设备中，能够实现对IO设备的安全等级的配置，同时也能够实现配置后的IO设备的安全等级配置和检测模块实现对发起访问请求的设备的安全等级的检查，从而实现不同安全等级的设备之间的隔离。
第三方面，提供了一种通信方法，该通信方法应用于计算机系统，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，第一子系统的CPU核和第二子系统的CPU核集成在同一芯片上，该通信方法包括：
接收第一子系统和第二子系统的安全等级配置信息，以实现对第一子系统和第二子系统的安全等级的配置，使得第一子系统的CPU核的安全等级高于第二子系统的CPU核的安全等级，第一子系统的IO设备的安全等级高于第二子系统的IO设备的安全等级，第一子系统使用的内存的安全等级高于第二子系统的内存的安全等级。
本申请中，在接收到第一子系统和第二子系统的安全等级配置信息之后，能够根据该安全等级配置信息实现对第一系统和第二子系统的安全等级的配置，从而实现对第一子系统和第二子系统的安全隔离，能够尽量避免第二子系统出现异常时影响第一子系统的正常工作。
结合第三方面，在第三方面的某些实现方式中，上述接收第一子系统和第二子系统的安全等级的配置信息，以实现对第一子系统和第二子系统的安全等级的配置，包括：接收计算机系统中的每个CPU核的安全等级信息。
在接收到每个CPU核的安全等级信息之后，也就实现了对计算机系统中的每个CPU核的安全等级的配置。
结合第三方面，在第三方面的某些实现方式中，上述计算机系统中的CPU核与安全 等级配置模块为一一对应关系，每个安全等级模块用于指示对应的CPU核的安全等级。
也就是说，每个CPU核可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU核的安全等级。当每个CPU核对应一个安全等级配置模块时，能够较为灵活地为各个CPU核配置相应的安全等级。
结合第三方面，在第三方面的某些实现方式中，每个CPU核对应的安全等级配置模块位于每个CPU核内部。
当CPU核对应的安全等级配置模块设置在CPU核的内部时，便于对CPU核输出的信号进行处理，使得处理后的信号包含该CPU核的安全等级信息。
结合第三方面，在第三方面的某些实现方式中，计算机系统中的CPU簇与安全等级配置模块为一一对应关系，安全等级配置模块用于指示对应的CPU簇中的多个CPU核的安全等级。
每个CPU簇可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU簇的安全等级。当每个CPU簇对应一个安全等级配置模块时，能够减少安全等级配置模块的数量，从而简化计算机系统的复杂度。
结合第三方面，在第三方面的某些实现方式中，在计算机系统中，任意一个CPU簇对应的安全等级配置模块设置在任意一个CPU簇对应的L3缓存的协议处理模块L3_TAG中。
结合第三方面，在第三方面的某些实现方式中，接收第一子系统和第二子系统的安全等级的配置信息，以实现对第一子系统和第二子系统的安全等级的配置，包括：接收内存安全等级划分信息，内存安全等级划分信息用于指示计算机系统中不同地址段的内存的安全等级。
通过接收内存安全等级划分信息能够实现对计算机系统中不同地址段的内存的安全等级的配置。
结合第三方面，在第三方面的某些实现方式中，接收第一子系统和第二子系统的安全等级的配置信息，以实现对第一子系统和第二子系统的安全等级的配置，包括：
接收计算机系统中的IO设备的安全等级信息，并对该IO设备接收到的访问请求进行检测，以确定发起访问请求的访问设备的安全等级与该IO设备的安全等级是否匹配。
结合第三方面，在第三方面的某些实现方式中，上述方法还包括：接收中断发起者发起的中断请求，中断请求携带发起中断发起者的安全等级信息；
根据配置的安全等级信息和中断请求，确定中断发起者的安全等级与中断发起者对应的中断接收者的安全等级是否匹配，并在中断发起者的安全等级与中断接收者的安全等级匹配的情况下，允许中断接收者接受中断请求。
本申请中，通过中断控制器能够实现对中断请求的处理，使得中断发起者的安全等级与中断接收者的安全等级的匹配下再由中断接收者接受该中断请求，能够在正常处理中断请求的情况下实现中断发起者和中断接收者之间的隔离。
结合第三方面，在第三方面的某些实现方式中，根据第一子系统和第二子系统的安全等级的配置信息和中断请求，确定中断发起者的安全等级与中断设备要访问的中断目标设备的安全等级是否匹配，包括：
在中断发起者与中断目标设备均属于第一子系统时，确定中断发起者的安全等级与中 断目标设备的安全等级匹配；
在中断发起者与中断目标设备均属于第二子系统时，确定中断发起者的安全等级与中断目标设备的安全等级匹配。
当中断发起者的安全等级大于或者等于中断接收者的安全等级时，允许中断接收者接收中断发起者发起的中断请求，从而避免高安全等级的设备接收或者处理低安全等级设备发起的中断请求，从而尽可能的避免安全等级的设备出现异常时对高安全等级设备的影响。
结合第三方面，在第三方面的某些实现方式中，在内存访问发起者的安全等级低于内存访问发起者要访问的内存安全等级时，确定内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级不匹配。
结合第三方面，在第三方面的某些实现方式中，上述方法还包括：接收来自内存访问发起者的内存访问请求，内存访问请求携带内存访问发起者要访问的内存地址以及内存访问发起者的安全等级信息；在内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级匹配的情况下，允许内存访问发起者访问内存访问发起者要访问的内存地址，内存安全等级划分信息用于指示不同段的内存所属的安全等级。
结合第三方面，在第三方面的某些实现方式中，上述内存访问发起者要访问的内存的安全等级与内存访问发起者的安全等级匹配，包括：内存访问发起者的安全等级高于或者等于内存访问发起者要访问的内存的安全等级。
由于内存访问发起者只能访问安全等级相同或者安全等级更低的内存，能够尽可能的避免低安全系统的设备访问较高安全等级的内存，能够在一定程度上实现对内存的隔离。
第四方面，提供了一种通信方法，该通信方法应用于计算机系统，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，第一子系统的CPU核和第二子系统的CPU核集成在同一芯片上，该通信方法包括：IO设备接收来自访问设备的访问请求，访问请求携带访问设备的安全等级信息，其中，IO设备为第一子系统或者第二子系统中的任意一个IO设备；在访问设备的安全等级与IO设备的安全等级相匹配时，IO设备允许访问设备对IO设备的访问。
结合第四方面，在第四方面的某些实现方式中，上述访问设备的安全等级与IO设备的安全等级相匹配，包括：访问设备的安全等级大于或者等于IO设备的安全等级。
第五方面，提供了一种计算机系统，该计算机系统包括第一子系统和第二子系统，该第一子系统和第二子系统用于执行上述第一方面中的方法。
第六方面，提供了一种处理装置，该处理装置包括用于执行上述第二方面中的方法中的各个模块。
第七方面，提供了一种处理装置，该处理装置包括用于执行上述第三方面中的方法中的各个模块。
第八方面，提供了一种处理装置，该处理装置包括用于执行上述第四方面中的方法中的各个模块。
上述第六方面、第七方面以及第八方面中的处理装置可以是上述第一方面中的计算机系统中的一个芯片。
第九方面，提供一种计算机可读存储介质，该计算机可读存储介质存储有程序代码， 该程序代码包括用于执行第二方面中的任意一种方法中的步骤的指令。
第十方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第二方面中的任意一种方法。
第十一方面，提供一种芯片，所述芯片包括处理器与数据接口，所述处理器通过所述数据接口读取存储器上存储的指令，执行上述第二方面中的任意一种方法。
可选地，作为一种实现方式，所述芯片还可以包括存储器，所述存储器中存储有指令，所述处理器用于执行所述存储器上存储的指令，当所述指令被执行时，所述处理器用于执行上述第二方面中的任意一种方法。
上述芯片具体可以是现场可编程门阵列FPGA或者专用集成电路ASIC。
附图说明
图1是自动驾驶系统的示意图；
图2是本申请实施例的通信方法的示意性流程图；
图3是内存访问检查器的处理内存访问请求的过程的示意图；
图4是IO设备确定是否接受访问设备的访问的过程的示意图；
图5是IO设备访问内存的示意图；
图6是每个CPU核对应一个安全等级配置模块的示意图；
图7是每个CPU簇对应一个安全等级配置模块的示意图；
图8是本申请实施例的通信方法的示意性流程图；
图9是本申请实施例的通信方法的示意性流程图；
图10是本申请实施例的通信方法的示意性流程图；
图11是自动驾驶系统的结构示意图；
图12是分区管理器配置内存访问检查器的过程的示意图；
图13是本申请实施例的计算机系统的示意性框图；
图14是本申请实施例的处理装置的示意性框图；
图15是本申请实施例的处理装置的示意性框图；
图16是本申请实施例的处理装置的示意性框图；
图17是自动驾驶系统中中断配置的示意图；
图18是中断处理过程的示意图；
图19是启动计算机系统的示意图；
图20是不同的子系统之间进行共享通信的示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请中的计算机系统具体可以位于自动驾驶系统中，当计算机系统位于自动驾驶系统中时，对计算机系统的不同子系统的(分区)隔离实质上也就是对自动驾驶系统中不同子系统的隔离。
下面以自动驾驶系统为例，对自动驾驶系统的分区隔离进行说明。对于自动驾驶系统来说，对于系统内不同安全等级的子系统来说，要实现不同安全等级的子系统的彻底隔离， 并且还要实现不同子系统之间正常工作时的通信。下面结合图1对自动驾驶系统的分区隔离进行说明。
如图1所示，自动驾驶系统包括第一子系统和第二子系统，其中，第一子系统用于识别物体，第二子系统是用于控制车辆(控制车辆的刹车、加速和转弯等)。如果第一子系统发现车辆前方有障碍物，则通知第二子系统控制车辆进行刹车。当该通知命令发出后，如果第一子系统出现故障，那么，该故障可能会导致第二子系统无法正常工作，从而使得第二子系统的刹车命令没有得到正确执行，最后很可能会导致车辆撞向障碍物，发生交通事故。
因此，在图1所示的自动驾驶系统中，为了实现安全驾驶，需要将第一子系统和第二子系统隔离，使得当其中一个子系统发生故障后，另一个子系统还能够正常工作。
下面结合图2对本申请实施例的通信方法进行详细的介绍。图2所示的通信方法可以由计算机系统中的设备来执行。图2所示的方法该方法可以应用于计算机系统中，该计算机系统包括第一子系统和第二子系统，其中，第一子系统的安全等级高于第二子系统的安全等级，第一子系统的CPU核、第二子系统的CPU核以及所述内存访问检查器集成在同一芯片上。该计算机系统包括中断控制器，该中断控制器由第一子系统和第二子系统共用，该中断控制器中的保存的中断路由配置信息是由第一子系统的CPU核配置的，该中断路由配置信息用于指示响应每个中断的CPU核，第一子系统还包括内存访问检查器。
图2所示的方法包括步骤1001和1002，下面对步骤1001和1002进行详细的介绍。
1001、内存访问这向内存访问检查器发送内存访问请求，内存访问检查器接收来自内存访问发起者的内存访问请求。
其中，上述内存访问请求携带内存访问发起者要访问的内存地址以及内存访问发起者的安全等级信息。
1002、该内存访问检查器根据预先配置的内存安全等级划分信息，确定内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级是否匹配，并根据匹配结果确定是否允许内存访问发起者进行访问。
具体地，当内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级匹配时，允许内存访问发起者访问内存；而当内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级不匹配时，不允许内存访问发起者访问内存。
上述内存安全等级划分信息用于指示计算机系统中不同地址段的内存的安全等级。
可选地，上述计算机系统为无人驾驶系统中的系统。
当上述计算机系统为无人驾驶系统中的系统时，通过该计算机系统能够控制无人驾驶系统的行驶。
应理解，在本申请中，安全等级越高安全程度也就越高。
可选地，上述方法还包括：当内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级不匹配时，不允许内存访问发起者访问内存。
本申请中，通过将内存访问检查器设置在高安全等级的子系统中，并将计算机系统的内存按照安全等级进行划分，能够实现对计算机系统的不同子系统实现较好的隔离，尽可能的避免一个子系统出现异常后影响其他子系统的正常工作。
应理解，在本申请中，计算机系统还可以包括第一子系统和第二子系统之外的其他子 系统，本申请中对计算机系统中包含的子系统的个数不做限定。当计算机系统包含其他子系统时，可以按照与第一子系统或者第二子系统类似的方式为其他子系统进行安全等级的配置。
本申请中，还可以将第二子系统再划分成至少两个微系统，然后再采用配置第一子系统和第二子系统的方式对该至少两个微系统进行配置。
例如，可以将第二子系统再划分成第一微系统和第二微系统，并采用上述配置第一子系统和第二子系统的方式来配置第一微系统和第二微系统的安全等级，使得第一微系统的安全等级高于第二微系统的安全等级。
在上述计算机系统中，除了对第一子系统和第二子系统访问的内存进行隔离之外，还可以将第一子系统的设备和第二子系统的设备进行隔离。
下面结合图3对内存访问检查器的处理内存访问请求的过程进行详细描述。
如图3所示，当CPU或者IO设备作为主设备访问内存时，CPU或者IO设备的访问请求会携带安全等级信号，该访问请求会先到达地址解码器中进行解码，从而得到内存访问地址和访问请求中携带的安全等级信号，接下来，内存访问检查器会对访问请求中携带的安全等级信号进行安全等级的校验，只有安全等级匹配的内存访问请求才允许访问内存，否则上报安全中断。
在本申请中，IO设备还可以根据访问设备的访问请求确定访问设备的安全等级与IO设备的安全等级是否匹配，并在匹配的情况下再允许访问设备的访问，下面结合图4进行具体说明。
如图4所示，IO设备确定是否接受访问设备的访问的过程具体包括步骤2001至2003，下面对这几个步骤进行介绍。
2001、IO设备接收来自访问设备的访问请求。
上述访问请求携带访问设备的安全等级信息，上述IO设备为第一子系统或者第二子系统中的任意一个IO设备。
2002、在访问设备的安全等级与IO设备的安全等级相匹配时，IO设备允许访问设备对IO设备的访问。
2003、在访问设备的安全等级与IO设备的安全等级相匹配时，IO设备允许访问设备对IO设备的访问。
应理解，在实际执行过程中，对于同一个访问设备，IO设备执行步骤2002或者2003。
进一步的，在上述步骤2002和2003之前，图4所示的过程还可以包括步骤2004。
2004、确定访问设备的安全等级与IO设备的安全等级是否匹配。
具体地，在步骤2004中，IO设备可以根据访问设备的访问请求来获取访问设备的安全等级，然后根据访问设备的安全等级和IO设备的安全等级来确定访问设备的安全等级和IO设备的安全等级是否匹配。
本申请中，只有在访问设备的安全等级与IO设备的安全等级匹配的情况下，IO设备才接受访问设备的访问，而如果访问设备的安全等级与IP设备不匹配时，IO设备不接受IO设备的访问，从而在访问设备与IO设备之间进行了一定程度的隔离，避免安全等级与IO设备不匹配的访问设备访问IO设备。
可选地，上述访问设备的安全等级与IO设备的安全等级相匹配，包括：访问设备的 安全等级大于或者等于IO设备的安全等级。
本申请中，当访问设备的安全等级高于或者等于IO设备的安全等级时，才允许访问设备访问IO设备，也就是说，安全等级高的设备可以访问安全等级相同或者安全等级较低的设备，使得安全等级较低的设备无法访问安全等级较高的设备，从而在访问设备和IO设备之间实现一定程度的隔离。
具体地，由于低安全等级的设备无法访问高安全等级的设备，从而能够避免低安全等级的设备出现异常时对高安全等级设备的影响。
对于每个IO设备来说，可以增加一个配置寄存器，用于存放该IO设备的安全等级，如图5所示，当IO设备作为主设备访问内存的时候，该IO设备的安全等级信息会随着硬件信号在地址总线上面传输，当该硬件信号经过内存访问检查器时，内存访问检查器会对该硬件信号进行安全等级的检查。
同样的，如图5所示，当CPU核访问IO设备时，该IO设备会对CPU核的访问请求进行安全等级的检查，只有CPU核的安全等级与IO设备的安全等级匹配时，才允许CPU核访问该IO设备。
除了对第一子系统和第二子系统访问的内存以及第一子系统的设备和第二子系统的设备进行隔离之外，还可以对中断请求进行隔离。
可选地，图2所示的方法还包括：中断控制器接收来自中断发起者的中断请求，该中断请求携带中断发起者的安全等级信息；中断控制器根据配置的安全等级信息和中断请求，确定中断发起者的安全等级与中断发起者对应的中断接收者的安全等级是否匹配，并在中断发起者的安全等级与中断接收者的安全等级匹配的情况下，允许中断接收者接受中断请求。
本申请中，通过中断控制器能够实现对中断请求的处理，使得中断发起者的安全等级与中断接收者的安全等级的匹配下再由中断接收者接受该中断请求，能够在正常处理中断请求的情况下实现中断发起者和中断接收者之间的隔离。
可选地，上述中断发起者的安全等级与中断接收者的安全等级匹配包括：中断发起者与中断接收者均属于第一子系统；中断发起者与中断接收者均属于第二子系统；或者，中断发起者属于第一子系统，中断接收者属于第二子系统。
当中断发起者的安全等级大于或者等于中断接收者的安全等级时，允许中断接收者接收中断发起者发起的中断请求，从而避免高安全等级的设备接收或者处理低安全等级设备发起的中断请求，从而尽可能的避免安全等级的设备出现异常时对高安全等级设备的影响。
可选地，上述中断发起者的安全等级与中断接收者的安全等级不匹配包括：中断发起者属于第二子系统，中断接收设备属于第一子系统。
当中断发起者的安全等级低于中断接收者的安全等级时，中断接收者不接受中断发起者的中断请求，从而能够在低安全系统的设备出现故障时尽可能的避免对高安全系统中的设备产生干扰。
可选地，上述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：内存访问发起者的安全等级高于或者等于内存访问发起者要访问的内存的安全等级。
由于内存访问发起者只能访问安全等级相同或者安全等级更低的内存，能够尽可能的避免低安全系统的设备访问较高安全等级的内存，能够在一定程度上实现对内存的隔离。
可选地，在内存访问发起者的安全等级低于内存访问发起者要访问的内存安全等级时，确定内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级不匹配。
上述第一子系统还包括分区管理器，图2所示的方法还包括：分区管理器根据计算机系统的安全等级配置文件为上述第一子系统和上述第二子系统中的设备进行安全等级的配置。
上述计算机系统的安全等级配置文件用于指示上述第一子系统和第二子系统中的设备以及所使用的内存的安全等级。
通过分区管理器能够实现对第一子系统和第二子系统的安全等级的配置，从而实现对第一子系统和第二子系统的隔离。
应理解，分区管理器在对第一子系统和第二子系统进行安全等级的配置之前，可以先获取并解析计算机系统的安全等级配置文件，在获取到第一子系统和第二子系统中的设备以及所使用的内存的安全等级之后，再对第一子系统和第二子系统进行安全等级的配置。
可选地，上述安全等级配置文件是预先配置好的文件。
具体地，上述安全等级配置文件可以是预先根据计算机系统的设备情况和应用需求来确定的，在确定了该安全等级配置文件之后，可以将该安全等级配置文件写入到计算机系统的缓存中，便于后续分区管理区获取并解析该安全等级配置文件。
可选地，上述安全等级配置文件是从云端获取的。
具体地，上述安全等级配置文件可以是计算机系统从云端下载得到的。
另外，上述安全等级配置文件可以定期或者不定期进行更新或者升级。
结合第一方面，在第一方面的某些实现方式中，上述分区管理器根据安全等级配置文件为第一子系统和第二子系统中的设备进行安全等级配置，包括：分区管理器在CPU核对应的安全等级配置模块写入CPU核的安全等级信息。
其中，上述CPU核的安全等级信息用于指示CPU核的安全等级。该CPU核对应的安全等级配置模块既可以位于CPU内部，也可以位于CPU外部。
上述CPU核对应的安全等级配置模块可以是硬件模块，具体可以由硬件电路实现，用于对CPU核输出的信号进行处理，使得处理后的信号包括CPU核的安全等级信息。
上述分区管理器在CPU核对应的安全等级配置模块写入CPU核的安全等级信息时，具体是可以将CPU核的安全等级信息写入到CPU核对应的安全等级模块所对应的寄存器中，写入完毕之后，CPU核对应的安全等级模块就可以从该寄存器中获取CPU核的安全等级信息。
可选地，在上述计算机系统中，CPU核与安全等级配置模块为一一对应关系，每个安全等级配置模块用于指示对应的CPU核的安全等级。
也就是说，每个CPU核可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU核的安全等级。当每个CPU核对应一个安全等级配置模块时，能够较为灵活地为各个CPU核配置相应的安全等级。
可选地，CPU核对应的安全等级配置模块设置在CPU核的内部。
当CPU核对应的安全等级配置模块设置在CPU核的内部时，便于对CPU核输出的 信号进行处理，使得处理后的信号包含该CPU核的安全等级信息。
如图6所示，每个CPU核均设置有安全等级配置模块，这样在配置完成之后，每个CPU核的发出信号都携带相应的安全等级信息。
假设图6所示的CPU核是自动驾驶系统中的CPU核，并且，图6左侧的CPU核的安全等级配置模块被配置为ASIL-D级别，图6右侧的CPU核的安全等级配置模块被配置为ASIL-B级别，那么，左侧的CPU的信号携带ASIL-D的高安全等级信息，右侧的CPU的信号携带ASIL-B的低安全等级信息。
应理解，每个CPU核对应的安全等级配置模块也可以位于CPU核的外部，此时CPU核发出的信号也可以经过该CPU核对应的安全等级模块，该CPU核对应的安全等级模块在CPU核发出的信号中添加CPU核的安全等级信息。
除了以CPU为单位来配置CPU的安全等级之外，还可以以CPU簇为粒度来配置CPU的安全等级。
可选地，在上述计算机系统中，CPU簇与安全等级配置模块为一一对应关系，CPU簇包括多个CPU核，安全等级配置模块用于指示对应的CPU簇中的多个CPU核的安全等级。
每个CPU簇可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU簇的安全等级。当每个CPU簇对应一个安全等级配置模块时，能够减少安全等级配置模块的数量，从而简化计算机系统的复杂度。
可选地，上述CPU簇对应的安全等级配置模块设置在CPU簇对应的L3缓存的协议处理模块L3_TAG中。
可选地，上述分区管理器根据安全等级配置文件为第一子系统和第二子系统中的设备进行安全等级的配置，包括：分区管理器在内存访问检查器中写入内存安全等级划分信息。
通过分区管理器在内存访问检查器中写入内存安全等级划分信息，使得内存访问检查器能够根据写入的内存安全等级划分信息实现对内存访问的检查和管理，便于后续实现内存的隔离。
在本申请中，可以在CPU簇(cluster)外面的L3缓存(L3Cache)中的L3_TAG模块(L3_TAG是L3Cache的协议处理模块，包含除数据存储外的其他所有的功能)中新增一个硬件模块，该模块可以对CPU簇内部的CPU进行安全等级的配置。
如图7所示，一个CPU簇对应一个L3_TAG，在L3_TAG中增加了安全等级配置模块。一个安全等级配置模块用于指示对应的CPU簇中的多个CPU核的安全等级。
例如，当图7中L3_TAG中的安全等级模块配置成ASIL-D级别时，每个CPU的信号经过该L3_TAG之后都会携带有ASIL-D的高安全等级信息；同样，当L3_TAG中的安全等级模块配置成ASIL-B或者QM时，每个CPU的信号经过该L3_TAG之后都会携带有ASIL-B或者QM的低安全等级信息。
可选地，上述分区管理器根据安全等级配置文件为第一子系统和第二子系统中的设备进行安全等级配置，包括：分区管理器在IO设备对应的安全等级配置和检测模块写入IO设备的安全等级信息，该IO设备对应的安全等级配置和检测模块用于对IO设备接收到的访问请求进行检测，以确定发起访问请求的设备的安全等级与IO设备的安全等级是否匹配。
通过分区管理器将IO设备的安全等级信息写入到IO设备中，能够实现对IO设备的安全等级的配置，同时也能够实现配置后的IO设备的安全等级配置和检测模块实现对发起访问请求的设备的安全等级的检查，从而实现不同安全等级的设备之间的隔离。
可选地，图2所示的方法还包括：启动第一子系统的第一个CPU核，以使得分区管理器在第一子系统的第一个CPU核上运行；分区管理器启动第一子系统的其他CPU核；在完成第一子系统的CPU核启动之后，分区管理器依次启动第二子系统的CPU核。
可选地，上述第二子系统的内存包括共享内存，共享内存用于第一子系统和第二子系统之间传输数据，上述方法还包括：第一子系统的CPU核将第一子系统产生的第一通信数据存入到共享内存中，并发起第一中断，以便第二子系统的CPU核接收到第一中断之后，从共享内存中读取第一通信数据；或者，第二子系统的CPU核将第一第二子系统产生的第二通信数据存入到共享内存中，并发起第二中断，以便第一子系统的CPU核接收到第二中断之后，从共享内存中读取第二通信数据。
本申请中，通过第二子系统的共享内存能够实现在第一子系统和第二子系统之间传输数据，从而在对第一子系统和第二子系统隔离的同时保证第一子系统和第二子系统之间的正常、通信。
下面结合图8对本申请实施例的通信方法进行详细描述。
图8是本申请实施例的通信方法的示意性流程图。图8所示的该通信方法应用于计算机系统，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，该第一子系统的CPU核和第二子系统的CPU核集成在同一芯片上。
图8所示的方法包括步骤3001和3002，下面对这两个步骤进行详细的介绍。
3001、获取计算机系统的安全等级配置文件。
其中，上述计算机系统的安全等级配置文件用于指示第一子系统和第二子系统中的设备以及第一子系统和第二系统所使用的内存的安全等级。
3002、根据安全等级配置文件对第一子系统和第二子系统的安全等级进行配置，以使得第一子系统的CPU核的安全等级高于第二子系统的CPU核的安全等级，第一子系统的IO设备的安全等级高于第二子系统的IO设备的安全等级，第一子系统使用的内存的安全等级高于第二子系统的内存的安全等级。
图8所示的方法可以由计算机系统中的分区管理器来执行，该分区管理器可以是计算机系统中采用软件实现的一个模块(软件模块或者虚拟模块)。
可选地，上述计算机系统为无人驾驶系统中的系统。
当上述计算机系统为无人驾驶系统中的系统时，通过该计算机系统能够控制无人驾驶系统的行驶。
应理解，在本申请中，安全等级越高安全程度也就越高。
本申请中，在获取了计算机系统的安全等级配置文件之后，能够根据计算机系统的安全等级配置文件对第一子系统和第二子系统进行安全等级的配置，从而实现对第一子系统和第二子系统的安全隔离，能够尽量避免第二子系统出现异常时影响第一子系统的正常工作。
可选地，上述安全等级配置文件是预先配置好的文件。
上述安全等级配置文件可以是预先根据计算机系统的设备情况和应用需求来确定的， 在确定了该安全等级配置文件之后，可以将该安全等级配置文件写入到计算机系统的缓存中，便于后续分区管理区获取并解析该安全等级配置文件。
可选地，上述安全等级配置文件是从云端获取的。
具体地，上述安全等级配置文件可以是计算机系统从云端下载得到的。
另外，上述安全等级配置文件可以定期或者不定期进行更新或者升级。
可选地，上述步骤3002具体包括：
3002a、在计算机系统的CPU核对应的安全等级配置模块中写入该计算系统的CPU核的安全等级信息。
其中，上述CPU核的安全等级信息用于指示CPU核的安全等级。该CPU核对应的安全等级配置模块既可以位于CPU内部，也可以位于CPU外部。
上述CPU核对应的安全等级配置模块可以是硬件模块，具体可以由硬件电路实现，用于对CPU核输出的信号进行处理，使得处理后的信号包括CPU核的安全等级信息。
上述在CPU核对应的安全等级配置模块写入CPU核的安全等级信息时，具体是可以将CPU核的安全等级信息写入到CPU核对应的安全等级模块所对应的寄存器中，写入完毕之后，CPU核对应的安全等级模块就可以从该寄存器中获取CPU核的安全等级信息。
可选地，上述计算机系统中的CPU核与安全等级配置模块为一一对应关系，每个安全等级模块用于指示对应的CPU核的安全等级。
当每个CPU核对应一个安全等级配置模块时，能够较为灵活地为各个CPU核配置相应的安全等级。
可选地，上述计算机系统中的每个CPU核对应的安全等级配置模块设置在每个CPU核的内部。
当CPU核对应的安全等级配置模块设置在CPU核的内部时，便于对CPU核输出的信号进行处理，使得处理后的信号包含该CPU核的安全等级信息。
可选地，在上述计算机系统中，CPU簇与安全等级配置模块为一一对应关系，CPU簇包括多个CPU核，每个安全等级配置模块用于指示对应的CPU簇中的多个CPU核的安全等级。
每个CPU簇可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU簇的安全等级。当每个CPU簇对应一个安全等级配置模块时，能够减少安全等级配置模块的数量，从而简化计算机系统的复杂度。
可选地，每个CPU簇对应的安全等级配置模块设置在每个CPU簇对应的L3缓存的协议处理模块L3_TAG中。
可选地，上述第一子系统包括内存访问检查器，上述步骤3002具体包括：
3002b、在内存访问检查器中写入内存安全等级划分信息。
通过在内存访问检查器中写入内存安全等级划分信息，使得内存访问检查器能够根据写入的内存安全等级划分信息实现对内存访问的检查和管理，便于后续实现内存的隔离。
可选地，上述步骤3002具体包括：
3002c、在IO设备对应的安全等级配置和检测模块写入IO设备的安全等级信息，该IO设备对应的安全等级配置和检测模块用于对IO设备接收到的访问请求进行检测，以确定发起访问请求的设备的安全等级与IO设备的安全等级是否匹配。
通过分区管理器将IO设备的安全等级信息写入到IO设备中，能够实现对IO设备的安全等级的配置，同时也能够实现配置后的IO设备的安全等级配置和检测模块实现对发起访问请求的设备的安全等级的检查，从而实现不同安全等级的设备之间的隔离。
下面结合图9对本申请实施例的通信方法进行详细描述。
图9是本申请实施例的通信方法的示意性流程图。图9所示的该通信方法应用于计算机系统，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，该第一子系统的CPU核和第二子系统的CPU核集成在同一芯片上。
图9所示的方法包括步骤4001和4002，下面对这两个步骤进行详细的介绍。
4001、接收第一子系统和第二子系统的安全等级配置信息。
4002、根据第一子系统和第二子系统的安全等级配置信息实现对第一子系统和第二子系统的安全等级的配置。
应理解，经过步骤4002可以使得第一子系统的CPU核的安全等级高于第二子系统的CPU核的安全等级，第一子系统的IO设备的安全等级高于第二子系统的IO设备的安全等级，第一子系统使用的内存的安全等级高于第二子系统的内存的安全等级。
本申请中，在接收到第一子系统和第二子系统的安全等级配置信息之后，能够根据该安全等级配置信息实现对第一系统和第二子系统的安全等级的配置，从而实现对第一子系统和第二子系统的安全隔离，能够尽量避免第二子系统出现异常时影响第一子系统的正常工作。
可选地，上述步骤4001具体包括：
4001a、接收计算机系统中的每个CPU核的安全等级信息。
在接收到每个CPU核的安全等级信息之后，也就实现了对计算机系统中的每个CPU核的安全等级的配置。
可选地，上述计算机系统中的CPU核与安全等级配置模块为一一对应关系，每个安全等级模块用于指示对应的CPU核的安全等级。
当每个CPU核对应一个安全等级配置模块时，能够较为灵活地为各个CPU核配置相应的安全等级。
可选地，每个CPU核对应的安全等级配置模块位于每个CPU核内部。
当CPU核对应的安全等级配置模块设置在CPU核的内部时，便于对CPU核输出的信号进行处理，使得处理后的信号包含该CPU核的安全等级信息。
可选地，计算机系统中的CPU簇与安全等级配置模块为一一对应关系，安全等级配置模块用于指示对应的CPU簇中的多个CPU核的安全等级。
每个CPU簇可以对应一个安全等级配置模块，每个安全等级配置模块用于指示与其对应的CPU簇的安全等级。当每个CPU簇对应一个安全等级配置模块时，能够减少安全等级配置模块的数量，从而简化计算机系统的复杂度。
可选地，在计算机系统中，任意一个CPU簇对应的安全等级配置模块设置在任意一个CPU簇对应的L3缓存的协议处理模块L3_TAG中。
可选地，上述步骤4001具体包括：
4001b、接收内存安全等级划分信息，内存安全等级划分信息用于指示计算机系统中不同地址段的内存的安全等级。
通过接收内存安全等级划分信息能够实现对计算机系统中不同地址段的内存的安全等级的配置。
可选地，上述步骤4001具体包括：
4001c、接收计算机系统中的IO设备的安全等级信息，并对该IO设备接收到的访问请求进行检测，以确定发起访问请求的访问设备的安全等级与该IO设备的安全等级是否匹配。
可选地，图9所示的方法还包括：
4003、接收中断发起者发起的中断请求，中断请求携带发起中断发起者的安全等级信息；
4004、根据配置的安全等级信息和中断请求，确定中断发起者的安全等级与中断发起者对应的中断接收者的安全等级是否匹配，并在中断发起者的安全等级与中断接收者的安全等级匹配的情况下，允许中断接收者接受中断请求。
本申请中，通过中断控制器能够实现对中断请求的处理，使得中断发起者的安全等级与中断接收者的安全等级的匹配下再由中断接收者接受该中断请求，能够在正常处理中断请求的情况下实现中断发起者和中断接收者之间的隔离。
应理解，上述步骤4004中配置的安全等级信息包括第一子系统和第二系统的这两个子系统的安全等级信息。
可选地，上述步骤4004具体包括：
4004a、在中断发起者与中断目标设备均属于第一子系统时，确定中断发起者的安全等级与中断目标设备的安全等级匹配；
4004b、在中断发起者与中断目标设备均属于第二子系统时，确定中断发起者的安全等级与中断目标设备的安全等级匹配。
当中断发起者的安全等级大于或者等于中断接收者的安全等级时，允许中断接收者接收中断发起者发起的中断请求，从而避免高安全等级的设备接收或者处理低安全等级设备发起的中断请求，从而尽可能的避免安全等级的设备出现异常时对高安全等级设备的影响。
可选地，在内存访问发起者的安全等级低于内存访问发起者要访问的内存安全等级时，确定内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级不匹配。
可选地，图9所示的方法还包括：
4005、接收来自内存访问发起者的内存访问请求，内存访问请求携带内存访问发起者要访问的内存地址以及内存访问发起者的安全等级信息；
4006、在内存访问发起者要访问的内存安全等级与内存访问发起者的安全等级匹配的情况下，允许内存访问发起者访问内存访问发起者要访问的内存地址，内存安全等级划分信息用于指示不同段的内存所属的安全等级。
可选地，上述内存访问发起者要访问的内存的安全等级与内存访问发起者的安全等级匹配，包括：内存访问发起者的安全等级高于或者等于内存访问发起者要访问的内存的安全等级。
由于内存访问发起者只能访问安全等级相同或者安全等级更低的内存，能够尽可能的避免低安全系统的设备访问较高安全等级的内存，能够在一定程度上实现对内存的隔离。
下面结合图10对本申请实施例的通信方法进行详细描述。
图10是本申请实施例的通信方法的示意性流程图。图10所示的该通信方法应用于计算机系统，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，该第一子系统的CPU核和第二子系统的CPU核集成在同一芯片上。
图10所示的方法包括步骤5001和5002，下面对这两个步骤进行详细的介绍。
5001、IO设备接收来自访问设备的访问请求
其中，上述访问请求携带访问设备的安全等级信息，上述IO设备为第一子系统或者第二子系统中的任意一个IO设备。
5002、在访问设备的安全等级与IO设备的安全等级相匹配时，该IO设备允许访问设备对IO设备的访问。
进一步的，图10所示的方法还可以包括步骤5003。
5003、在访问设备的安全等级与IO设备的安全等级不匹配时，该IO设备不允许访问设备对IO设备的访问。
可选地，上述访问设备的安全等级与IO设备的安全等级相匹配，包括：访问设备的安全等级大于或者等于IO设备的安全等级。
本申请实施例的通信方法应用的计算机系统具体可以是自动驾驶系统(或者也可以认为该计算机系统位于自动驾驶系统中)，下面结合图11对自动驾驶系统的具体结构进行详细的介绍。
图11是自动驾驶系统的结构示意图。
如图11所示，自动驾驶系统在软件上可以分为高安全操作子系统和低安全操作子系统，其中，高安全操作子系统的ASIL高于低安全子系统的ASIL，例如，高安全子系统的ASIL可以是ASIL-D，低安全子系统的ASIL可以是QM，ASIL-A，ASIL-B和ASIL-C中的任意一个。
其中，本申请实施例中的第一子系统可以相当于图11所示的高安全操作系统，第二子系统可以相当于图11所示的第二子系统。
图11所示的自动驾驶系统可以分为硬件层和软件层。其中，硬件层提供了安全属性配置，安全检测和安全错误上报等，软件层基于该平台提供了资源隔离划分和中断管理的分区管理器。下面分别对硬件层和软件层进行详细的介绍。
硬件层：
硬件层中增加了安全配置和检测的逻辑，用于检测操作系统软件和设备直接内存存取(direct memory access，DMA)访问是否合法。这些安全配置和检测的逻辑包括CPU核的安全等级配置，内存访问检查器对内存访问的安全检测，输入输出(input output，IO)设备的安全配置和检查，中断配置安全检查。下面对这些安全配置和检测的逻辑分别进行详细的介绍。
CPU核的安全等级配置：用于为CPU核配置相应的安全等级(高安全子系统中的CPU核配置成高安全等级，低安全子系统中的CPU核配置成低安全等级)，在为CPU核配置了相应的安全等级后，CPU核发出的信号可以携带相应的安全等级信息并在总线上面进行传输。
具体地，在对CPU核的安全等级进行配置时，可以通过为CPU核对应的安全等级配 置模块配置安全等级信息来实现。
内存访问检查器：对发到内存DDR的地址访问进行安全检查，只有安全等级匹配才允许访问，否则拒绝。
中断配置安全检查：对中断的安全等级进行检查，确保只有高安全级别的CPU才能操作高安全的中断配置，否则拒绝访问。
IO设备的安全配置和检查：用于将对应的IO设备配置成不同的安全等级，在完成安全等级的配置后，IO设备发出去的地址访问会携带有安全等级的信号，另外，该模块还可以对其他设备发起的对当前设备的访问请求进行安全等级检查，以确认安全等级是否匹配。
软件层：
软件层主要增加了分区管理器，用于进行资源的隔离和划分以及不同功能安全分区之间的共享内存通信。分区管理器中主要包括以下模块：CPU核的隔离划分、内存资源的隔离划分、IO设备安全等级配置、中断资源的隔离和配置、多操作系统的安全启动、基于共享内存的数据通信。下面对每个模块的作用进行详细介绍。
安全核的隔离划分：该模块用于对每个操作系统所使用的CPU核进行安全等级的划分，具体地，可以将高安全操作系统和低安全操作系统使用的CPU在配置文件里写好，彼此不共享(一个CPU核不会同时属于高安全系统又属于低安全系统)。例如，在系统启动过程中，可以把高安全操作系统使用的CPU配置成锁步模式且功能安全级别为ASIL-D,低安全操作系统使用的CPU配置成普通模式且功能安全级别为ASIL-B或者QM级别。
内存资源的隔离划分：该模块用于对不同操作系统使用的内存进行划分，彼此不共享。高安全的操作系统使用ASIL-D级别内存，低安全操作系统使用ASIL-B或者QM级别的内存。另外，还模块还可以把内存布局信息(内存分配信息)通过寄存器写到内存访问检查器里面。
IO设备安全等级配置：用于配置每个IO设备的功能安全等级，例如ASIL-D、ASIL-B或者QM级别。
中断资源的隔离和配置：用于对全局共享和关键的高安全中断配置进行管理，同时还可以处理低安全操作系统发过来的对高中断配置的操作请求，如果该请求合法，则代为进行操作，否则拒绝。
多操作系统的安全启动：该模块用于在高安全的CPU和低安全的CPU上面分别拉起对应功能安全等级的操作系统。
多操作系统之间的数据通信：在低功能安全的内存里面开辟一段共享内存，用来做不同功能安全等级的操作系统之间的数据传输，当数据放在共享内存之后，利用中断的方式通知对方来取数据，高功能安全的系统会检验低功能安全系统发过来的共享内存数据的合法性。
应理解，图11中的安全设备的安全配置和检查具体可以是安全配置和检测模块，CPU核的安全等级配置具体可以是CPU核的安全等级配置模块。上述安全配置和检测模块，安全等级配置模块，中断控制器和内存访问检查器可以集成在同一芯片(图中未示出该芯片)中。
下面再结合图12对分区管理器配置内存访问检查器的过程进行描述。
图12示出了分区管理器对内存访问检查器进行配置的示意图。图12所示的过程包括步骤6001至步骤6003，下面对这些步骤进行详细的介绍。
6001、获取内存配置文件。
以ARM64平台为例，上述内存配置文件可以携带在设备树源码(device tree source，DTS)文件中。上述内存配置文件可以划分不同安全等级的子系统使用的内存地址范围，例如，上述内存配置文件可以包含以下配置信息：
Figure PCTCN2020105344-appb-000001
上述配置信息表示0～0x40000000范围内的内存被划分给了ASIL-D安全级别的子系统，0x40000000～0x80000000范围内的内存被划分给了ASIL-B安全级别的子系统。
6002、根据内存配置文件确定内存划分信息。
分区管理器在获取到了内存配置文件之后，通过解析该内存配置文件确定内存划分信息。
6003、根据内存划分信息对内存访问检查器进行配置。
例如，分区管理器通过解析配置信息，确定0～0x40000000范围内的内存被划分给了ASIL-D安全级别的子系统，0x40000000～0x80000000范围内的内存被划分给了ASIL-B安全级别的子系统。接下来，分区管理器可以将内存的划分情况配置给内存访问检查器，从而使得内存访问检查器能够第各个操作系统或者其他的IO设备发起的内存地址访问进行安全检查。
具体地，当低安全操作系统要访问高安全操作系统的ASIL-D的内存，内存访问检查器就会检查出安全等级不匹配，对内存地址访问进行拦截，并上报安全(Safety)中断，通知应用软件现在已经发生了越界访问的安全(Safety)错误。
上文结合附图对本申请实施例的通信方法进行详细介绍，下面结合附图对本申请实施例的计算机系统和处理装置进行描述，应理解，下文中介绍的计算机系统和处理装置能够执行本申请实施例的通信方法的相应步骤，下文在介绍本申请实施例的计算机系统和处理装置时适当省略重复的描述。
图13是本申请实施例的计算机系统的示意性框图。图13所示的计算机系统8000包括第一子系统8010和第二子系统8020，第一子系统8010包括内存访问检查器8011。
第一子系统8010的安全等级高于第二子系统8020的安全等级，第一子系统8010的CPU核、第二子系统8020的CPU核以及内存访问检查器8011集成在同一芯片上。
所述内存访问检查器8011用于接收来自内存访问发起者的内存访问请求，所述内存访问请求携带所述内存访问发起者要访问的内存地址以及所述内存访问发起者的安全等级信息；
所述内存访问检查器8011还用于根据预先配置的内存安全等级划分信息，确定所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级是否匹配，并在所述内存地址的安全等级与所述内存访问发起者的安全等级匹配时，允许所述内存访问发起者访问所述内存地址，其中，所述内存安全等级划分信息用于指示所述计算机系统中不同地址段的内存的安全等级。
可选地，所述计算机系统8000还包括：
IO设备，用于接收来自访问设备的访问请求，所述访问请求携带所述访问设备的安全等级信息，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备；
所述IO设备还用于在所述访问设备的安全等级与所述IO设备的安全等级相匹配时，允许所述访问设备对所述IO设备的访问。
可选地，所述访问设备的安全等级与所述IO设备的安全等级相匹配，包括：所述访问设备的安全等级大于或者等于所述IO设备的安全等级。
可选地，上述计算机系统8000还包括：
中断控制器，其中，所述第一子系统和所述第二子系统共用所述中断控制器，所述中断控制器中的保存的中断路由配置信息是由第一子系统的CPU核配置的，所述中断路由配置信息用于指示响应每个中断的CPU核
所述中断控制器用于：
接收来自中断发起者的中断请求，所述中断请求携带所述中断发起者的安全等级信息；
根据配置的安全等级信息和所述中断请求，确定所述中断发起者的安全等级与所述中断发起者对应的中断接收者的安全等级是否匹配，并在所述中断发起者的安全等级与所述中断接收者的安全等级匹配的情况下，允许所述中断接收者接受所述中断请求。
可选地，上述所述中断发起者的安全等级与所述中断接收者的安全等级匹配包括：
所述中断发起者与所述中断接收者均属于所述第一子系统；
所述中断发起者与所述中断接收者均属于所述第二子系统；或者，
所述中断发起者属于第一子系统，所述中断接收者属于第二子系统。
可选地，所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：
所述内存访问发起者的安全等级高于或者等于所述内存访问发起者要访问的内存的安全等级。
可选地，所述第一子系统还包括：
分区管理器，所述分区管理器用于：
根据所述计算机系统的安全等级配置文件为所述第一子系统和所述第二子系统中的设备进行安全等级的配置，所述计算机系统的安全等级配置文件用于指示所述第一子系统和第二子系统中的设备以及所使用的内存的安全等级。
可选地，所述分区管理器用于：
在所述计算机系统的CPU核对应的安全等级配置模块写入所述计算机系统的CPU核的安全等级信息，所述计算机系统的CPU核的安全等级信息用于指示所述计算机系统的CPU核的安全等级。
可选地，所述分区管理器用于在所述内存访问检查器中写入所述内存安全等级划分信息。
可选地，所述分区管理器用于：
在IO设备对应的安全等级配置和检测模块写入所述IO设备的安全等级信息，所述IO设备对应的安全等级配置和检测模块用于对所述IO设备接收到的访问请求进行检测，以确定发起所述访问请求的设备的安全等级与所述IO设备的安全等级是否匹配，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备。
可选地，所述计算机系统还包括：
初始启动模块，用于启动所述第一子系统的第一个CPU核，以使得所述分区管理器在所述第一子系统的第一个CPU核上运行；
所述分区管理器用于启动所述第一子系统的其他CPU核；
在完成所述第一子系统的CPU核启动之后，所述分区管理器还用于依次启动所述第二子系统的CPU核。
可选地，其特征在于，所述第二子系统的内存包括共享内存，所述共享内存用于第一子系统和第二子系统之间传输数据，所述第一子系统的CPU核用于将第一子系统产生的第一通信数据存入到所述共享内存中，并发起第一中断，以便所述第二子系统的CPU核接收到所述第一中断之后，从所述共享内存中读取第一通信数据；或者
所述第二子系统的CPU核用于将所述第二子系统产生的第二通信数据存入到所述共享内存中，并发起第二中断，以便所述第一子系统的CPU核接收到所述第二中断之后，从所述共享内存中读取第二通信数据。
图14是本申请实施例的处理装置的示意性框图。图14所示的处理装置9000包括存储器9001和处理器9002。
图14所示的处理装置9000可以应用于计算机系统中，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，第一子系统的CPU核和第二子系统的CPU核集成在同一芯片上，处理装置位于第一子系统中。
上述存储器9001用于存储程序，当存储器9001存储的程序被处理器9002执行时，处理9002用于图8所示的方法中的各个步骤。
图15是本申请实施例的处理装置的示意性框图。图15所示的处理装置10000包括存储器10001和处理器10002。
图15所示的处理装置10000可以应用于计算机系统中，所述处理装置10000应用于计算机系统中，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的操作系统与所述第二子系统的操作系统不同，所述第一子系统的CPU核和所述第二子系统的CPU核集成在所述处理装置10000上，所述处理装置10000位于所述第一子系统中，所述处理装置10000包括：
安全等级配置模块10001，用于接收所述第一子系统和所述第二子系统的安全等级配置信息；
所述安全等级配置模块10001，还用于根据接收到的安全等级配置文件，对所述第一子系统和所述第二子系统的安全等级的配置，所述第一子系统使用的内存的安全等级高于所述第二子系统的内存的安全等级。
上述处理装置10000可以是计算机系统中的一个芯片。
可选地，所述安全等级配置模块10001用于：
接收所述计算机系统中的每个CPU核的安全等级信息，以实现对所述计算机系统中的每个CPU核的安全等级的配置。
可选地，所述处理装置还包括：
内存访问检查器10002，用于接收内存安全等级划分信息，所述内存安全等级划分信息用于指示所述计算机系统中不同地址段的内存的安全等级。
可选地，所述处理装置还包括：
安全等级配置和检测模块10003，用于接收所述计算机系统中的IO设备的安全等级信息；
所述安全等级配置和检测模块10003还用于对所述计算机系统中的IO设备接收到的访问请求进行检测，以确定发起所述访问请求的访问设备的安全等级与所述计算机系统中的IO设备的安全等级是否匹配。
可选地，所述处理装置还包括：
中断控制器10004，用于根据配置的安全等级信息和所述中断请求，确定所述中断发起者的安全等级与所述中断发起者对应的中断接收者的安全等级是否匹配，并在所述中断发起者的安全等级与所述中断接收者的安全等级匹配的情况下，允许所述中断接收者接受所述中断请求。
可选地，所述中断发起者的安全等级与所述中断接收者的安全等级匹配包括：
所述中断发起者与所述中断接收者均属于所述第一子系统；
所述中断发起者与所述中断接收者均属于所述第二子系统；或者，
所述中断发起者属于第一子系统，所述中断接收者属于第二子系统。
可选地，所述安全等级配置模块10001用于：
接收来自内存访问发起者的内存访问请求，所述内存访问请求携带所述内存访问发起者要访问的内存地址以及所述内存访问发起者的安全等级信息；
在所述内存访问发起者要访问的内存安全等级与所述内存访问发起者的安全等级匹配的情况下，允许所述内存访问发起者访问所述内存访问发起者要访问的内存地址，所述内存安全等级划分信息用于指示不同段的内存所属的安全等级。
可选地，所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：
所述内存访问发起者的安全等级高于或者等于所述内存访问发起者要访问的内存的安全等级。
图16是本申请实施例的处理装置的示意性框图。图16所示的处理装置11000包括接收器11001和处理器11002。
图16所示的处理装置11000可以应用于计算机系统中，该计算机系统包括第一子系统和第二子系统，第一子系统的操作系统与第二子系统的操作系统不同，第一子系统的 CPU核和第二子系统的CPU核集成在同一芯片上，该处理装置11000位于第一子系统中。
上述处理装置11000中的接收器11001和处理器11002可以用于执行图10所示的方法中的各个步骤。
上述装置11000可以是计算机系统中的一个设备，例如，IO设备。
为了对本申请实施例的通信方法和相关装置有进一步的理解，下面以自动驾驶系统为例对相关的通信过程进行详细的介绍。
如图17所示，在自动驾驶系统的硬件设计的时候，可以把中断控制器配置分成了两部分，核心以及共享的中断配置设计成ASIL-D等级，只有安全锁步核才能操作，这样也是避免非锁步核上面的低安全操作系统在失效的时候对中断的恶意更改，从而避免对高安全操作系统的影响。其中的中断配置包括中断的使能，中断的关闭,中断的路由等。如果普通的CPU核(非锁步核)想操作该配置，必须把请求发给锁步核，让锁步核代为进行操作。Per-Core的配置以及部分低安全配置不区分安全等级，每个CPU都可以操作，包括低安全操作系统所在的普通CPU，因为高安全操作系统不会使用这部分配置，即使低安全操作系统出了问题，也不会对高安全操作系统的运行产生影响。
其中，图17中的GIC_STREAMBUS表示总线，GICD表示中断分发器(distrubitor)，GICR表示中断重分发器(REdistrubitor)，ITS表示中断转发服务组件(interrupt translation service components，ITS)。DEVICE_ASILD表示一个安全等级为ASILD的设备，DEVICE_ASILB表示一个安全等级为ASILB的设备，DEVICE_QM表示一个安全等级为QM的设备，OS ASILD表示安全等级为ASILD的操作系统，OS ASILB表示安全等级为ASILB的操作系统。
上文结合图17对中断配置进行了介绍，下面结合图18对分区管理器以及中断处理过程进行介绍。
分区管理器位于高安全操作系统中，系统启动过程中会根据高安全操作系统配置文件配置情况，调用中断控制器驱动，把全局共享的ASIL-D资源配置好，也包括高安全操作系统所使用的非ASIL-D的资源(配置)。
低安全操作系统启动过程中，解析中断的配置文件，By-pass对ASIL-D中断配置的操作，把对ASIL-D中断的操作转换为对高安全操作系统的中断操作请求，让高安全操作系统代为进行操作。高安全操作系统收到该请求后，会检查该操作是否合法，比如要操作的中断号属于高安全操作系统管理的设备，高安全操作系统会拒绝。因为两个操作系统的所管理的设备是独立的，没有共享。同样对于已经初始化好的全局共享的ASIL-D中断配置，高安全操作系统也会拒绝，因为高安全操作系统启动过程中，已经被分区管理初始化过了，不需要重新初始化，上述过程如图18所示。出于性能方面的考虑，低安全操作系统会减少在运行时操作ASIL-D的中断配置。
高功能安全操作系统隔离使用的CPU，在配置文件里面提前配置好，例如对于ARM64平台，其配置文件为DTS(Device Tree Source),OS kernel解析DTS配置文件就能够知道要使用哪几个CPU，并建立CPU拓扑结构，在SMP boot的时候，分区管理器根据配置文件，依次通知BIOS或者ATF(ARM64平台)，把即将要启动的CPU配置成锁步状态还是普通状态，并拉起对应的CPU运行，过程如图19所示。
高安全操作系统本地的SMP启动完成后，分区管理器会拉起低安全操作系统的第一 个核，低安全操作系统的第一个核被拉起后，跳入到低安全操作系统的内部kernel入口地址，然后进行初始化，低安全操作系统使用哪几个CPU,也是在配置文件里面提前划分好的，低安全操作系统根据自身配置文件里面的CPU划分，依次拉起划分给他的CPU。因为是低安全的操作系统,所以不需要把属于他的CPU配置锁步状态。
下面结合图20对不同的子系统之间进行共享通信的过程进行详细介绍。
如图20所示，内存可以被分为不同的功能安全区域，例如ASIL-D和ASIL-B,不同的功能安全OS用不同级别的内存区域，例如高安全OS用ASIL-D的内存，低功能安全OS用ASIL-B的内存。当在两者进行共享内存通信的时候，在低功能安全内存区域开辟一段内存，这样两个OS都可以进行读写访问该区域，下面我们分别来阐述图20所示的各个模块的作用。
IRQ Notifier/Handler:当一个OS把数据放在共享内存之后，调用IRQ Notifier通知另一个OS去共享内存里面取数据，另一个OS收到中断后，进入IRQ Handler,在该Handler里面查看需要从哪块共享内存里面取数据，并通知目标app去取数据。
驱动hmem driver:该驱动提供了分配共享内存区的功能，把映射之后的内存给用户态去使用。
接口1为Libshmem，是对上层用户态提供的封装接口，通过类似open，mmap等接口完成对共享内存的操作。
当低安全OS上面通过Hypervisor运行Guest OS的时候，Guest OS上面提供了跟低安全Host OS进行通信的shmem FE driver,该驱动与shemem BE driver进行通信，完成Guest OS对共享内存的读写。
Shmem FE driver:共享内存前端程序，提供了Guest OS自身的Stage1的地址映射功能，同时与Host OS Shmem BE driver后端驱动进行对接。
Shmem BE driver:共享内存后端程序，处理共享内存前端程序的退出，调用libshmem完成Stage2的映射，并调用IRQ Notifier通知对方OS去接收数据；当收到对端OS发过来的数据时，该共享内存后端程序注入中断给Guest OS，共享内存前端程序收到注入的中断后，通知Guest内的对应App去读取数据。
端到端(E2E):端到端保护，当数据从高安全操作系统传向低安全的操作系统的时候，通过CRC校验数据的完整性以及正确性。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显 示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (51)

  1. 一种通信方法，其特征在于，所述方法应用于计算机系统，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的安全等级高于所述第二子系统的安全等级；
    所述第一子系统包括内存访问检查器，其中，所述第一子系统的CPU核、所述第二子系统的CPU核以及所述内存访问检查器集成在同一芯片上，所述方法包括：
    内存访问检查器接收来自内存访问发起者的内存访问请求，所述内存访问请求携带所述内存访问发起者要访问的内存地址以及所述内存访问发起者的安全等级信息；
    所述内存访问检查器根据预先配置的内存安全等级划分信息，确定所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级是否匹配，并在所述内存地址的安全等级与所述内存访问发起者的安全等级匹配时，允许所述内存访问发起者访问所述内存地址，所述内存安全等级划分信息用于指示所述计算机系统中不同地址段的内存的安全等级。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    IO设备接收来自访问设备的访问请求，所述访问请求携带所述访问设备的安全等级信息，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备；
    在所述访问设备的安全等级与所述IO设备的安全等级相匹配时，所述IO设备允许所述访问设备对所述IO设备的访问。
  3. 如权利要求2所述的方法，其特征在于，所述访问设备的安全等级与所述IO设备的安全等级相匹配，包括：
    所述访问设备的安全等级大于或者等于所述IO设备的安全等级。
  4. 如权利要求1-3中任一项所述的方法，其特征在于，所述计算机系统还包括中断控制器，所述第一子系统和所述第二子系统共用所述中断控制器，所述中断控制器中的保存的中断路由配置信息是由第一子系统的CPU核配置的，所述中断路由配置信息用于指示响应每个中断的CPU核，所述方法还包括：
    所述中断控制器接收来自中断发起者的中断请求，所述中断请求携带所述中断发起者的安全等级信息；
    所述中断控制器根据配置的安全等级信息和所述中断请求，确定所述中断发起者的安全等级与所述中断发起者对应的中断接收者的安全等级是否匹配，并在所述中断发起者的安全等级与所述中断接收者的安全等级匹配的情况下，允许所述中断接收者接受所述中断请求。
  5. 如权利要求4所述的方法，其特征在于，所述中断发起者的安全等级与所述中断接收者的安全等级匹配包括：
    所述中断发起者与所述中断接收者均属于所述第一子系统；
    所述中断发起者与所述中断接收者均属于所述第二子系统；或者，
    所述中断发起者属于第一子系统，所述中断接收者属于第二子系统。
  6. 如权利要求1-5中任一项所述的方法，其特征在于，所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：
    所述内存访问发起者的安全等级高于或者等于所述内存访问发起者要访问的内存的安全等级。
  7. 如权利要求1-6中任一项所述的方法，其特征在于，所述第一子系统包括分区管理器，所述方法还包括：
    所述分区管理器根据所述计算机系统的安全等级配置文件为所述计算机系统中的设备和/或内存进行安全等级的配置，所述计算机系统的安全等级配置文件用于指示所述计算机系统中的设备或者内存的安全等级。
  8. 如权利要求7所述的方法，其特征在于，所述分区管理器根据所述安全等级配置文件为所述计算机系统中的设备进行安全等级配置，包括：
    所述分区管理器在所述计算机系统的CPU核对应的安全等级配置模块写入所述计算机系统的CPU核的安全等级信息，所述计算机系统的CPU核的安全等级信息用于指示所述计算机系统的CPU核的安全等级。
  9. 如权利要求7或8所述的方法，其特征在于，所述分区管理器根据所述安全等级配置文件为所述计算机系统中的内存进行安全等级的配置，包括：
    所述分区管理器在所述内存访问检查器中写入所述内存安全等级划分信息。
  10. 如权利要求7-9中任一项所述的方法，其特征在于，所述分区管理器根据所述安全等级配置文件为所述计算机系统中的设备进行安全等级配置，包括：
    所述分区管理器在IO设备对应的安全等级配置和检测模块写入所述IO设备的安全等级信息，所述IO设备对应的安全等级配置和检测模块用于为所述IO设备进行安全等级的配置，所述IO设备对应的安全等级配置和检测模块还用于对所述IO设备接收到的访问请求进行检测，以确定发起所述访问请求的设备的安全等级与所述IO设备的安全等级是否匹配，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备。
  11. 如权利要求7-10中任一项所述的方法，其特征在于，所述方法还包括：
    启动所述第一子系统的第一个CPU核，以使得所述分区管理器在所述第一子系统的第一个CPU核上运行；
    所述分区管理器启动所述第一子系统的其他CPU核；
    在完成所述第一子系统的CPU核启动之后，所述分区管理器启动所述第二子系统的第一个CPU核，以使得在所述第二子系统的第一个CPU核启动之后，所述第二子系统拉起所述第二子系统中除所述第二子系统中的第一个CPU核之外的其他CPU核。
  12. 如权利要求1-11中任一项所述的方法，其特征在于，所述第二子系统的内存包括共享内存，所述共享内存用于第一子系统和第二子系统之间传输数据，所述方法还包括：
    所述第一子系统的CPU核将第一子系统产生的第一通信数据存入到所述共享内存中，并发起第一中断，以便所述第二子系统的CPU核接收到所述第一中断之后，从所述共享内存中读取第一通信数据；或者
    所述第二子系统的CPU核将所述第二子系统产生的第二通信数据存入到所述共享内存中，并发起第二中断，以便所述第一子系统的CPU核接收到所述第二中断之后，从所述共享内存中读取第二通信数据。
  13. 一种通信方法，其特征在于，所述方法应用于计算机系统，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的操作系统与所述第二子系统的操作系统不 同，所述第一子系统的CPU核和所述第二子系统的CPU核集成在同一芯片上，所述方法包括：
    获取所述计算机系统的安全等级配置文件，所述计算机系统的安全等级配置文件用于指示所述计算机系统中的设备或者内存的安全等级；
    根据所述计算机系统的安全等级配置文件对所述计算机系统中的设备和/或内存的安全等级进行配置，以使得所述第一子系统的CPU核的安全等级高于所述第二子系统的CPU核的安全等级，所述第一子系统的IO设备的安全等级高于所述第二子系统的IO设备的安全等级，所述第一子系统使用的内存的安全等级高于所述第二子系统的内存的安全等级。
  14. 如权利要求13所述的方法，其特征在于，所述根据所述安全等级配置文件对所述计算机系统中的设备的安全等级进行配置，包括：
    在所述计算机系统的CPU核对应的安全等级配置模块中写入所述计算机系统的CPU核的安全等级信息，所述计算机系统的CPU核的安全等级信息用于指示所述计算机系统的CPU核的安全等级。
  15. 如权利要求13或14所述的方法，其特征在于，所述第一子系统包括内存访问检查器，所述根据所述安全等级配置文件对所述计算机系统中的内存的安全等级进行配置，包括：
    在所述内存访问检查器中写入所述内存安全等级划分信息。
  16. 如权利要求13-15中任一项所述的方法，其特征在于，所述根据所述安全等级配置文件对所述计算机系统中的设备的安全等级进行配置，包括：
    在所述IO设备对应的安全等级配置和检测模块写入所述IO设备的安全等级信息，所述IO设备对应的安全等级配置和检测模块用于为所述IO设备进行安全等级的配置，所述IO设备对应的安全等级配置和检测模块还用于对所述IO设备接收到的访问请求进行检测，以确定发起所述访问请求的访问设备的安全等级与所述IO设备的安全等级是否匹配，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备。
  17. 一种通信方法，其特征在于，所述方法应用于计算机系统，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的操作系统与所述第二子系统的操作系统不同，所述第一子系统的CPU核和所述第二子系统的CPU核集成在同一芯片上，所述方法包括：
    接收所述第一子系统和所述第二子系统的安全等级配置信息，以实现对所述计算机系统中的设备和/或内存的安全等级的配置，使得所述第一子系统的CPU核的安全等级高于所述第二子系统的CPU核的安全等级，所述第一子系统的IO设备的安全等级高于所述第二子系统的IO设备的安全等级，所述第一子系统使用的内存的安全等级高于所述第二子系统的内存的安全等级。
  18. 如权利要求17所述的方法，其特征在于，所述接收所述第一子系统和所述第二子系统的安全等级的配置信息，以实现对所述计算机系统中的设备的安全等级的配置，包括：
    接收所述计算机系统中的每个CPU核的安全等级信息，以实现对所述计算机系统中的每个CPU核的安全等级的配置。
  19. 如权利要求17或18所述的方法，其特征在于，所述接收所述第一子系统和所述第二子系统的安全等级的配置信息，以实现对所述计算机系统中的内存的安全等级的配置，包括：
    接收内存安全等级划分信息，所述内存安全等级划分信息用于指示所述计算机系统中不同地址段的内存的安全等级。
  20. 如权利要求17-19中任一项所述的方法，其特征在于，所述接收所述第一子系统和所述第二子系统的安全等级的配置信息，以实现对所述计算机系统中的设备的安全等级的配置，包括：
    接收所述计算机系统中的IO设备的安全等级信息，并对所述计算机系统中的IO设备接收到的访问请求进行检测，以确定发起所述访问请求的访问设备的安全等级与所述计算机系统中的IO设备的安全等级是否匹配。
  21. 如权利要求17-20中任一项所述的方法，其特征在于，所述方法还包括：
    接收中断发起者发起的中断请求，所述中断请求携带发起所述中断发起者的安全等级信息；
    根据配置的安全等级信息和所述中断请求，确定所述中断发起者的安全等级与所述中断发起者对应的中断接收者的安全等级是否匹配，并在所述中断发起者的安全等级与所述中断接收者的安全等级匹配的情况下，允许所述中断接收者接受所述中断请求。
  22. 如权利要求21所述的方法，其特征在于，所述中断发起者的安全等级与所述中断接收者的安全等级匹配包括：
    所述中断发起者与所述中断接收者均属于所述第一子系统；
    所述中断发起者与所述中断接收者均属于所述第二子系统；或者，
    所述中断发起者属于第一子系统，所述中断接收者属于第二子系统。
  23. 如权利要求17-22中任一项所述的方法，其特征在于，所述方法还包括：
    接收来自内存访问发起者的内存访问请求，所述内存访问请求携带所述内存访问发起者要访问的内存地址以及所述内存访问发起者的安全等级信息；
    在所述内存访问发起者要访问的内存安全等级与所述内存访问发起者的安全等级匹配的情况下，允许所述内存访问发起者访问所述内存访问发起者要访问的内存地址，所述内存安全等级划分信息用于指示不同段的内存所属的安全等级。
  24. 如权利要求23所述的方法，其特征在于，所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：
    所述内存访问发起者的安全等级高于或者等于所述内存访问发起者要访问的内存的安全等级。
  25. 一种通信方法，其特征在于，所述方法应用于计算机系统，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的操作系统与所述第二子系统的操作系统不同，所述第一子系统的CPU核和所述第二子系统的CPU核集成在同一芯片上，所述方法包括：
    IO设备接收来自访问设备的访问请求，所述访问请求携带所述访问设备的安全等级信息，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备；
    在所述访问设备的安全等级与所述IO设备的安全等级相匹配时，所述IO设备允许所 述访问设备对所述IO设备的访问。
  26. 如权利要求25所述的方法，其特征在于，所述访问设备的安全等级与所述IO设备的安全等级相匹配，包括：
    所述访问设备的安全等级大于或者等于所述IO设备的安全等级。
  27. 一种计算机系统，其特征在于，包括：
    第一子系统，所述第一子系统包括内存访问检查器；
    第二子系统，其中，所述第一子系统的安全等级高于所述第二子系统的安全等级，所述第一子系统的CPU核、所述第二子系统的CPU核以及所述内存访问检查器集成在所述计算机系统中的同一芯片上；
    所述内存访问检查器用于接收来自内存访问发起者的内存访问请求，所述内存访问请求携带所述内存访问发起者要访问的内存地址以及所述内存访问发起者的安全等级信息；
    所述内存访问检查器还用于根据预先配置的内存安全等级划分信息，确定所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级是否匹配，并在所述内存地址的安全等级与所述内存访问发起者的安全等级匹配时，允许所述内存访问发起者访问所述内存地址，其中，所述内存安全等级划分信息用于指示所述计算机系统中不同地址段的内存的安全等级。
  28. 如权利要求27所述的计算机系统，其特征在于，所述计算机系统还包括：
    IO设备，用于接收来自访问设备的访问请求，所述访问请求携带所述访问设备的安全等级信息，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备；
    所述IO设备还用于在所述访问设备的安全等级与所述IO设备的安全等级相匹配时，允许所述访问设备对所述IO设备的访问。
  29. 如权利要求28所述的计算机系统，其特征在于，所述访问设备的安全等级与所述IO设备的安全等级相匹配，包括：
    所述访问设备的安全等级大于或者等于所述IO设备的安全等级。
  30. 如权利要求27-29中任一项所述的计算机系统，其特征在于，所述计算机系统还包括：
    中断控制器，其中，所述第一子系统和所述第二子系统共用所述中断控制器，所述中断控制器中的保存的中断路由配置信息是由第一子系统的CPU核配置的，所述中断路由配置信息用于指示响应每个中断的CPU核
    所述中断控制器用于：
    接收来自中断发起者的中断请求，所述中断请求携带所述中断发起者的安全等级信息；
    根据配置的安全等级信息和所述中断请求，确定所述中断发起者的安全等级与所述中断发起者对应的中断接收者的安全等级是否匹配，并在所述中断发起者的安全等级与所述中断接收者的安全等级匹配的情况下，允许所述中断接收者接受所述中断请求。
  31. 如权利要求30所述的计算机系统，其特征在于，所述中断发起者的安全等级与所述中断接收者的安全等级匹配包括：
    所述中断发起者与所述中断接收者均属于所述第一子系统；
    所述中断发起者与所述中断接收者均属于所述第二子系统；或者，
    所述中断发起者属于第一子系统，所述中断接收者属于第二子系统。
  32. 如权利要求27-31中任一项所述的计算机系统，其特征在于，所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：
    所述内存访问发起者的安全等级高于或者等于所述内存访问发起者要访问的内存的安全等级。
  33. 如权利要求27-32中任一项所述的计算机系统，其特征在于，所述第一子系统包括分区管理器，所述分区管理器用于：
    根据所述计算机系统的安全等级配置文件为所述计算机系统中的设备和/或内存进行安全等级的配置，所述计算机系统的安全等级配置文件用于指示计算机系统中的设备或者内存的安全等级。
  34. 如权利要求33所述的计算机系统，其特征在于，所述分区管理器用于：
    在所述计算机系统的CPU核对应的安全等级配置模块写入所述计算机系统的CPU核的安全等级信息，所述计算机系统的CPU核的安全等级信息用于指示所述计算机系统的CPU核的安全等级。
  35. 如权利要求33或34所述的计算机系统，其特征在于，所述分区管理器用于在所述内存访问检查器中写入所述内存安全等级划分信息。
  36. 如权利要求33-35中任一项所述的计算机系统，其特征在于，所述分区管理器用于：
    在IO设备对应的安全等级配置和检测模块写入所述IO设备的安全等级信息，所述IO设备对应的安全等级配置和检测模块用于为所述IO设备进行安全等级的配置，所述IO设备对应的安全等级配置和检测模块还用于对所述IO设备接收到的访问请求进行检测，以确定发起所述访问请求的设备的安全等级与所述IO设备的安全等级是否匹配，其中，所述IO设备为所述第一子系统或者第二子系统中的任意一个IO设备。
  37. 如权利要求33-36中任一项所述的计算机系统，其特征在于，所述计算机系统还包括：
    初始启动模块，用于启动所述第一子系统的第一个CPU核，以使得所述分区管理器在所述第一子系统的第一个CPU核上运行；
    所述分区管理器用于启动所述第一子系统的其他CPU核；
    在完成所述第一子系统的CPU核启动之后，所述分区管理器还用于启动所述第二子系统的第一个CPU核，以使得在所述第二子系统的第一个CPU核启动之后，所述第二子系统拉起所述第二子系统中除所述第二子系统中的第一个CPU核之外的其他CPU核。
  38. 如权利要求27-37中任一项所述的计算机系统，其特征在于，所述第二子系统的内存包括共享内存，所述共享内存用于第一子系统和第二子系统之间传输数据，所述第一子系统的CPU核用于将第一子系统产生的第一通信数据存入到所述共享内存中，并发起第一中断，以便所述第二子系统的CPU核接收到所述第一中断之后，从所述共享内存中读取第一通信数据；或者
    所述第二子系统的CPU核用于将所述第二子系统产生的第二通信数据存入到所述共享内存中，并发起第二中断，以便所述第一子系统的CPU核接收到所述第二中断之后，从所述共享内存中读取第二通信数据。
  39. 一种处理装置，其特征在于，所述处理装置应用于计算机系统中，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的操作系统与所述第二子系统的操作系统不同，所述第一子系统的CPU核和所述第二子系统的CPU核集成在同一芯片上，所述处理装置位于所述第一子系统中，所述处理装置包括存储器和处理器，所述存储器用于存储程序，当所述存储器存储的程序被所述处理器执行时，所述处理器用于：
    获取所述计算机系统的安全等级配置文件，所述计算机系统的安全等级配置文件用于指示所述计算机系统中的设备或者内存的安全等级；
    根据所述计算机系统的安全等级配置文件对所述计算机系统中的内存的安全等级进行配置，以使得所述第一子系统使用的内存的安全等级高于所述第二子系统的内存的安全等级。
  40. 一种处理装置，其特征在于，所述处理装置应用于计算机系统中，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的操作系统与所述第二子系统的操作系统不同，所述第一子系统的CPU核和所述第二子系统的CPU核集成在所述处理装置上，所述处理装置位于所述第一子系统中，所述处理装置包括：
    安全等级配置模块，用于接收所述第一子系统和所述第二子系统的安全等级配置信息；
    所述安全等级配置模块，还用于根据接收到的安全等级配置文件，实现对所述计算机系统中的设备和/或内存的安全等级的配置，所述第一子系统使用的内存的安全等级高于所述第二子系统的内存的安全等级。
  41. 如权利要求40所述的处理装置，其特征在于，所述安全等级配置模块用于：
    接收所述计算机系统中的每个CPU核的安全等级信息，以实现对所述计算机系统中的每个CPU核的安全等级的配置。
  42. 如权利要求40或41所述的处理装置，其特征在于，所述处理装置还包括：
    内存访问检查器，用于接收内存安全等级划分信息，所述内存安全等级划分信息用于指示所述计算机系统中不同地址段的内存的安全等级。
  43. 如权利要求40-42中任一项所述的处理装置，其特征在于，所述处理装置还包括：
    安全等级配置和检测模块，用于接收所述计算机系统中的IO设备的安全等级信息；
    所述安全等级配置和检测模块还用于对所述计算机系统中的IO设备接收到的访问请求进行检测，以确定发起所述访问请求的访问设备的安全等级与所述计算机系统中的IO设备的安全等级是否匹配。
  44. 如权利要求40-43中任一项所述的处理装置，其特征在于，所述处理装置还包括：
    中断控制器，用于根据配置的安全等级信息和所述中断请求，确定所述中断发起者的安全等级与所述中断发起者对应的中断接收者的安全等级是否匹配，并在所述中断发起者的安全等级与所述中断接收者的安全等级匹配的情况下，允许所述中断接收者接受所述中断请求。
  45. 如权利要求44所述的处理装置，其特征在于，所述中断发起者的安全等级与所述中断接收者的安全等级匹配包括：
    所述中断发起者与所述中断接收者均属于所述第一子系统；
    所述中断发起者与所述中断接收者均属于所述第二子系统；或者，
    所述中断发起者属于第一子系统，所述中断接收者属于第二子系统。
  46. 如权利要求40-45中任一项所述的处理装置，其特征在于，所述安全等级配置模块用于：
    接收来自内存访问发起者的内存访问请求，所述内存访问请求携带所述内存访问发起者要访问的内存地址以及所述内存访问发起者的安全等级信息；
    在所述内存访问发起者要访问的内存安全等级与所述内存访问发起者的安全等级匹配的情况下，允许所述内存访问发起者访问所述内存访问发起者要访问的内存地址，所述内存安全等级划分信息用于指示不同段的内存所属的安全等级。
  47. 如权利要求46所述的处理装置，其特征在于，所述内存访问发起者要访问的内存的安全等级与所述内存访问发起者的安全等级匹配，包括：
    所述内存访问发起者的安全等级高于或者等于所述内存访问发起者要访问的内存的安全等级。
  48. 一种处理装置，其特征在于，所述处理装置应用于计算机系统中，所述计算机系统包括第一子系统和第二子系统，所述第一子系统的操作系统与所述第二子系统的操作系统不同，所述第一子系统的CPU核和所述第二子系统的CPU核集成在同一芯片上，所述处理装置位于所述第一子系统中，所述处理装置包括：
    接收器，用于接收来自访问设备的访问请求，所述访问请求携带所述访问设备的安全等级信息；
    处理器，用于在所述访问设备的安全等级与所述处理装置的安全等级相匹配时，允许所述访问设备对所述处理装置的访问。
  49. 如权利要求48所述的处理装置，其特征在于，所述访问设备的安全等级与所述处理装置的安全等级相匹配，包括：
    所述访问设备的安全等级大于或者等于所述处理装置的安全等级。
  50. 一种计算机可读存储介质，其特征在于，所述计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行如权利要求13-16中任一项所述的方法。
  51. 一种芯片，其特征在于，所述芯片包括处理器与数据接口，所述处理器通过所述数据接口读取存储器上存储的指令，以执行如权利要求13-16中任一项所述的方法。
PCT/CN2020/105344 2019-09-18 2020-07-29 通信方法、装置、计算机可读存储介质和芯片 WO2021052017A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CA3111427A CA3111427A1 (en) 2019-09-18 2020-07-29 Communication method, apparatus, computer-readable storage medium, and chip
AU2020343994A AU2020343994A1 (en) 2019-09-18 2020-07-29 Communication method, apparatus, computer-readable storage medium, and chip
EP20859621.3A EP3835988A4 (en) 2019-09-18 2020-07-29 COMMUNICATION PROCESS AND DEVICE, COMPUTER-READABLE STORAGE MEDIUM AND CHIP
US17/369,520 US11941259B2 (en) 2019-09-18 2021-07-07 Communication method, apparatus, computer-readable storage medium, and chip

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910883765.7A CN112528345A (zh) 2019-09-18 2019-09-18 通信方法、装置、计算机可读存储介质和芯片
CN201910883765.7 2019-09-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/369,520 Continuation US11941259B2 (en) 2019-09-18 2021-07-07 Communication method, apparatus, computer-readable storage medium, and chip

Publications (1)

Publication Number Publication Date
WO2021052017A1 true WO2021052017A1 (zh) 2021-03-25

Family

ID=74883989

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/105344 WO2021052017A1 (zh) 2019-09-18 2020-07-29 通信方法、装置、计算机可读存储介质和芯片

Country Status (6)

Country Link
US (1) US11941259B2 (zh)
EP (1) EP3835988A4 (zh)
CN (1) CN112528345A (zh)
AU (1) AU2020343994A1 (zh)
CA (1) CA3111427A1 (zh)
WO (1) WO2021052017A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113452722A (zh) * 2021-08-30 2021-09-28 统信软件技术有限公司 一种用户隔离方法、数据传输方法、计算设备及存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022141128A1 (zh) * 2020-12-29 2022-07-07 华为技术有限公司 一种安全隔离装置和方法
CN113190854A (zh) * 2021-04-19 2021-07-30 亚信科技（成都）有限公司 一种资源隔离方法及电子设备
CN115510447A (zh) * 2021-06-23 2022-12-23 华为技术有限公司 组件访问方法和装置、计算机可读存储介质以及芯片
US12013931B2 (en) * 2021-12-14 2024-06-18 Texas Instruments Incorporated Method and system for freedom from interference (FFI)
CN115328825A (zh) * 2022-08-09 2022-11-11 地平线(上海)人工智能技术有限公司 用于内存访问的集成电路、处理方法、电子设备和介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104573565A (zh) * 2015-01-23 2015-04-29 宇龙计算机通信科技(深圳)有限公司 一种TrustZone上的内存管理方法及装置
US20150212952A1 (en) * 2014-01-30 2015-07-30 Robert Bosch Gmbh Method for the coexistence of software having different safety levels in a multicore processor system
CN104981815A (zh) * 2013-03-14 2015-10-14 英特尔公司 用于用安全属性限制cpu事务的方法、装置和系统
CN110210214A (zh) * 2019-06-03 2019-09-06 成都海光集成电路设计有限公司 处理器核心隔离方法及装置

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040064723A1 (en) * 2001-10-31 2004-04-01 Barnes Brian C. Method and apparatus for physical address-based security to determine target security
EP1742152B1 (en) * 2005-07-07 2012-09-12 Texas Instruments Inc. Method and system for a multi-sharing memory access control
KR101925806B1 (ko) * 2011-12-02 2018-12-07 삼성전자 주식회사 보안 방법 및 장치
CN103810422B (zh) 2014-02-20 2017-05-17 东莞中国科学院云计算产业技术创新与育成中心 一种基于镜像智能管理的安全虚拟化隔离方法
CN105302765A (zh) * 2014-07-22 2016-02-03 电信科学技术研究院 一种系统级芯片及其内存访问管理方法
CN105787360B (zh) * 2016-03-02 2019-01-04 杭州字节信息技术有限公司 一种嵌入式系统内存安全访问控制的技术实现方法
CN107358129A (zh) * 2016-05-09 2017-11-17 恩智浦美国有限公司 安全的数据存储设备和方法
CN106445702A (zh) * 2016-09-21 2017-02-22 乐视控股（北京）有限公司 多系统通信方法及终端
US10482289B2 (en) * 2017-08-24 2019-11-19 Qualcomm Incorporated Computing device to provide access control to a hardware resource
CN109669884A (zh) * 2017-10-16 2019-04-23 华为技术有限公司 一种处理器系统和终端芯片
US11036887B2 (en) * 2018-12-11 2021-06-15 Micron Technology, Inc. Memory data security

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104981815A (zh) * 2013-03-14 2015-10-14 英特尔公司 用于用安全属性限制cpu事务的方法、装置和系统
US20150212952A1 (en) * 2014-01-30 2015-07-30 Robert Bosch Gmbh Method for the coexistence of software having different safety levels in a multicore processor system
CN104573565A (zh) * 2015-01-23 2015-04-29 宇龙计算机通信科技(深圳)有限公司 一种TrustZone上的内存管理方法及装置
CN110210214A (zh) * 2019-06-03 2019-09-06 成都海光集成电路设计有限公司 处理器核心隔离方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3835988A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113452722A (zh) * 2021-08-30 2021-09-28 统信软件技术有限公司 一种用户隔离方法、数据传输方法、计算设备及存储介质
CN113452722B (zh) * 2021-08-30 2022-01-21 统信软件技术有限公司 一种用户隔离方法、数据传输方法、计算设备及存储介质

Also Published As

Publication number Publication date
US11941259B2 (en) 2024-03-26
US20210334018A1 (en) 2021-10-28
EP3835988A1 (en) 2021-06-16
CA3111427A1 (en) 2021-03-18
CN112528345A (zh) 2021-03-19
AU2020343994A1 (en) 2021-04-01
EP3835988A4 (en) 2021-11-10

Similar Documents

Publication Publication Date Title
WO2021052017A1 (zh) 通信方法、装置、计算机可读存储介质和芯片
US9734096B2 (en) Method and system for single root input/output virtualization virtual functions sharing on multi-hosts
US9760408B2 (en) Distributed I/O operations performed in a continuous computing fabric environment
US8464260B2 (en) Configuration and association of a supervisory virtual device function to a privileged entity
US7493425B2 (en) Method, system and program product for differentiating between virtual hosts on bus transactions and associating allowable memory access for an input/output adapter that supports virtualization
US9384060B2 (en) Dynamic allocation and assignment of virtual functions within fabric
US10635499B2 (en) Multifunction option virtualization for single root I/O virtualization
US7890669B2 (en) Computer system for sharing I/O device
US20080065854A1 (en) Method and apparatus for accessing physical memory belonging to virtual machines from a user level monitor
US10592434B2 (en) Hypervisor-enforced self encrypting memory in computing fabric
US10592270B2 (en) Safety hypervisor function
US11163597B2 (en) Persistent guest and software-defined storage in computing fabric
WO2006088637A1 (en) Method, apparatus and system for dynamically reassigning memory from one virtual machine to another
US9507617B1 (en) Inter-virtual machine communication using pseudo devices
EP3436947B1 (en) Secure driver platform
US10140214B2 (en) Hypervisor translation bypass by host IOMMU with virtual machine migration support
US10257166B2 (en) Guest netfilter protection by virtual machine function
US20130148669A1 (en) Virtual Computer System, Virtual Computer Management Program, and MAC Address Management Method
US10013199B2 (en) Translation bypass by host IOMMU for systems with virtual IOMMU
CN103984591A (zh) 计算机虚拟化系统的PCI设备INTx中断投递方法
KR20220141674A (ko) PCIe 디바이스 및 그 동작 방법
US9558364B2 (en) Computing machine, access management method, and access management program
CN111522692A (zh) 一种基于虚拟机的多操作系统输入及输出设备冗余保障系统

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2020859621

Country of ref document: EP

Effective date: 20210308

ENP Entry into the national phase

Ref document number: 2020343994

Country of ref document: AU

Date of ref document: 20200729

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE