[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

WO2023202096A1 - 一种车辆中数据的处理方法以及相关设备 - Google Patents

一种车辆中数据的处理方法以及相关设备 Download PDF

Info

Publication number
WO2023202096A1
WO2023202096A1 PCT/CN2022/137880 CN2022137880W WO2023202096A1 WO 2023202096 A1 WO2023202096 A1 WO 2023202096A1 CN 2022137880 W CN2022137880 W CN 2022137880W WO 2023202096 A1 WO2023202096 A1 WO 2023202096A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual machine
machine monitor
operating system
vehicle
access request
Prior art date
Application number
PCT/CN2022/137880
Other languages
English (en)
French (fr)
Inventor
陶喆
许祥益
林飞滨
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023202096A1 publication Critical patent/WO2023202096A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G06F12/1009—Address translation using page tables, e.g. page table structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/544—Buffers; Shared memory; Pipes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45583—Memory management, e.g. access or allocation

Definitions

  • vehicles in order to comply with the security requirements in ISO26262, vehicles include hardware devices with different security levels.
  • An operating system is deployed on the hardware devices of each security level.
  • the operating system with a low security level cannot directly access the high security level.
  • Hardware devices managed by a security-level operating system need to make a request to a high-security operating system to achieve access to the high-security hardware device with the help of the high-security operating system.
  • Embodiments of the present application provide a method for processing data in a vehicle and related equipment, which not only realizes the isolation between different security levels in hardware, but also realizes the isolation between different security levels in software.
  • the first virtual machine monitor determines that the access address of the target access request exceeds the management range, it will send instruction information to the second virtual machine monitor.
  • the instruction information is used to request the second virtual machine monitor to perform the access pointed to by the target access request. Operation, and the aforementioned process is implemented through a virtual machine monitor, which does not require intrusive modifications to the operating system, avoids extensive modifications to the operating system code, and avoids reducing the maintainability of the operating system.
  • embodiments of the present application provide a method for processing data in a vehicle, which can apply computer technology to the field of vehicles.
  • the vehicle includes: N types of security level hardware devices and N types of hardware equipment corresponding to the N types of security levels.
  • Virtual machine monitors the virtual machine monitors are deployed in the virtualization layer, N is an integer greater than or equal to 2, each virtual machine monitor runs at least one operating system, and the N virtual machine monitors include the first virtual machine monitor and a second virtual machine monitor.
  • the method includes: the first virtual machine monitor obtains a target access request.
  • the target access request is an access request initiated by the operating system in the vehicle for the hardware device in the vehicle.
  • the aforementioned access request can be embodied in a specific manner.
  • the first virtual machine monitor may be pre-configured with first indication information.
  • the first indication information includes a range of physical addresses managed by each virtual machine monitor in the vehicle. The range of physical addresses managed by each virtual machine monitor depends on The range of physical addresses of hardware devices with a security level corresponding to the virtual machine monitor. If the first virtual machine monitor determines, based on the first indication information, that the access address of the target access request exceeds the management range of the first virtual machine monitor, the first virtual machine monitor sends the target indication information to the second virtual machine monitor,
  • the target indication information is used to request the second virtual machine monitor to perform the access operation pointed by the target access request; the aforementioned access operation may include writing data into the hardware device pointed by the target access request, or from the hardware pointed by the target access request. Read data from the device.
  • the vehicle is equipped with N types of security level hardware devices and N virtual machine monitors corresponding to the N types of security level hardware equipment.
  • Each virtual machine monitor runs at least one operating system, thereby not only The isolation between different security levels is implemented in hardware, and the isolation between different security levels is also implemented in software.
  • the operating system inside the vehicle initiates an access request for the hardware device in the vehicle, when the first virtual machine monitor determines that the access address of the target access request exceeds the management range, it will send indication information to the second virtual machine monitor indicating that The information is used to request the second virtual machine monitor to perform the access operation pointed to by the target access request, and the foregoing process is implemented through the virtual machine monitor. Since the virtual machine monitor is deployed at the virtualization layer, that is, the implementation of the foregoing process There is no need to make invasive modifications to the operating system, which avoids extensive modifications to the operating system code and reduces the maintainability of the operating system.
  • different virtual machine monitors use a second type of interrupt instruction to communicate; when the operating system in the vehicle is in a running state, all interrupt instructions that need to be processed by the operating system are Using the first type of interrupt instructions, the aforementioned first type of interrupt instructions can directly pass through the operating system in the vehicle.
  • Interrupt instructions that need to be processed by the operating system may include: interrupt instructions generated by hardware devices in the vehicle, software generated by the operating system interrupt instructions, interrupt instructions generated by other operating systems in the vehicle, or other interrupt instructions that need to be processed by the operating system, etc.
  • the second type of interrupt instructions can be embodied as an interrupt instruction in fast interrupt mode (fast interrupt request, FIQ), and the first type of interrupt instruction can be embodied in an interrupt mode (interrupt request, IRQ). interrupt instruction.
  • FIQ mode fast interrupt request
  • IRQ interrupt request
  • interrupt instructions in FIQ mode can be applied to the safe world
  • the interrupt instructions in IRQ mode can be applied to the non-safe world.
  • different virtual machine monitors use the second type of interrupt instructions to communicate, and the first type of interrupt instructions pass directly to the operating system in the vehicle, so the virtual machine monitor no longer needs to process the first type of interrupt instructions.
  • Interrupt instructions because when the operating system in the vehicle is in a running state, it will need to process a large number of first-type interrupt instructions. Therefore, the aforementioned method can avoid the computer consumption of the virtual machine monitor when processing the first-type interrupt instructions. resources and enables communication between different virtual machine monitors. Furthermore, communication between virtual machine monitors is implemented with the help of the firmware capabilities of the processor, which has little impact on the operating system on the virtual machine monitor.
  • the first virtual machine monitor sends the target indication information to the second virtual machine monitor, including: the first virtual machine monitor can write the target indication information to a predetermined storage address, and calling an interface of the first processor corresponding to the first virtual machine monitor to trigger the first processor to send an interrupt instruction in FIQ mode to the second processor corresponding to the second virtual machine monitor.
  • the second processor can obtain the identification information carried in the interrupt instruction in FIQ mode. The identification information is used by the second processor to determine what needs to be executed based on the identification information. operate.
  • the second processor triggers the second virtual machine monitor to read the target indication information from the predetermined storage address, parses the obtained target indication information, and determines the content of the target access request.
  • the security level corresponding to the second virtual machine monitor is higher than the security level corresponding to the first virtual machine monitor, that is, the security level of the hardware resources managed by the second virtual machine monitor is
  • the security level may be higher than the security level of the hardware resources managed by the first virtual machine monitor.
  • the virtual machine monitor with the highest security level among at least two virtual machine monitors actually manages the hardware device, which is beneficial to Ensure the security of the data processing process in the vehicle, which in turn helps improve the safety of the vehicle.
  • This implementation is not only compatible with the general VirtIO technology, which improves the maintainability of this solution; it can also perform access operations through the built-in driver of the virtual machine monitor according to the actual situation, which can save the time spent performing access operations. That is to say, it is helpful to improve the processing efficiency of target access requests.
  • the back-end operating system running on the first virtual machine monitor runs a first thread and a second thread, where the first thread is used to perform access operations on hardware devices shared between the front-end operating system and the back-end operating system.
  • the second thread and the first thread are different threads, that is, the second thread is not a thread used to manage shared hardware devices.
  • the first virtual machine monitor can configure different stage2 page tables for the first thread and the second thread running in the back-end operating system.
  • the stage2 page table corresponding to the first thread contains the memory address of the front-end operating system, that is, The address of "this section of shared memory" exists in the stage2 page table corresponding to the first thread; the memory address of the front-end operating system does not exist in the stage2 page table corresponding to the second thread.
  • each thread when each thread performs an access operation, it needs to use the stage2 page table to convert the intermediate physical address to the physical address, and then perform read and write operations on the converted physical address. Since the second thread corresponds to There is no memory address of the front-end operating system in the stage2 page table, so even if the second thread is assigned to the wrong intermediate physical address, the stage2 page table corresponding to the second thread cannot be converted to the memory address of the front-end operating system, thus Further reducing the probability that the second thread on the back-end operating system accesses the memory of the front-end operating system will help improve the security of the data stored in the front-end operating system.
  • the N security level hardware devices are deployed on the hardware layer of the vehicle, and one of the virtual machine monitors is run on the hardware device of each security level. Different virtual machine monitors are running on the hardware device.
  • N types of security level hardware devices are deployed at the hardware layer, and different virtual machine monitors run on hardware devices with different security levels, which further clarifies the architecture of the vehicle to which the virtual machine monitor belongs. , which is conducive to improving the accuracy of this scheme during the execution process and improving the security of this scheme.
  • embodiments of the present application provide a virtual machine monitor that can apply computer technology to the vehicle field.
  • the virtual machine monitor is used to process data in the vehicle.
  • the vehicle includes: N security level hardware devices and N virtual machine monitors corresponding to the N security level hardware devices.
  • the virtual machine monitor is deployed on the virtual machine. layer, N is an integer greater than or equal to 2, each virtual machine monitor runs at least one operating system, and the N virtual machine monitors include a first virtual machine monitor and a second virtual machine monitor.
  • the first virtual machine monitor includes: an acquisition unit, configured to acquire a target access request, where the target access request is an access request initiated by the operating system in the vehicle for the hardware device in the vehicle; send A unit configured to, if the access address of the target access request exceeds the management range of the first virtual machine monitor, the first virtual machine monitor sends indication information to the second virtual machine monitor, the The instruction information is used to request the second virtual machine monitor to perform the access operation pointed by the target access request.
  • the first virtual machine monitor can also be used to perform the steps performed by the first virtual machine monitor in the first aspect and each possible implementation manner of the first aspect.
  • the meanings of the nouns and the beneficial effects brought about please refer to the first aspect, and will not be repeated here.
  • inventions of the present application provide a computer program product.
  • the computer program product includes a program that, when run on a computer, causes the computer to execute the method for processing data in a vehicle described in the first aspect.
  • embodiments of the present application provide a vehicle.
  • the vehicle includes hardware devices with N security levels and N virtual machine monitors corresponding to the hardware devices with N security levels.
  • the virtual machine monitors are deployed on a virtual machine.
  • layer N is an integer greater than or equal to 2
  • a first virtual machine monitor exists among the N virtual machine monitors, and the first virtual machine monitor executes the method for processing data in the vehicle described in the first aspect.
  • the first virtual machine monitor performs the steps.
  • Figure 1b is an architecture diagram of a vehicle in the method for processing data in a vehicle provided by an embodiment of the present application
  • Figure 2 is a schematic flow chart of a data processing method in a vehicle provided by an embodiment of the present application
  • Figure 3 is a schematic flow chart of a data processing method in a vehicle provided by an embodiment of the present application.
  • Figure 4 is a schematic flow chart of communication between different virtual machine monitors using a second type of interrupt instruction in the method for processing data in a vehicle provided by an embodiment of the present application;
  • Figure 5 is a schematic diagram comparing the first type and the second type of terminal instructions in the method for processing data in the vehicle provided by the embodiment of the present application;
  • Figure 7 is a schematic flow chart of a data processing method in a vehicle provided by an embodiment of the present application.
  • Figure 8 is a schematic structural diagram of a first virtual machine monitor provided by an embodiment of the present application.
  • Figure 9 is a schematic structural diagram of a first virtual machine monitor provided by an embodiment of the present application.
  • Figure 10 is a schematic structural diagram of a vehicle provided by an embodiment of the present application.
  • Embodiments of the present application can be applied in the field of vehicles.
  • the aforementioned vehicles can specifically be embodied as: cars, trucks, motorcycles, public vehicles, ships, airplanes, helicopters, lawn mowers, entertainment vehicles, amusement park vehicles, construction equipment, Trams, golf carts, trains, etc. are not particularly limited in the embodiments of this application.
  • the solution provided by the embodiment of the present application not only realizes the isolation between different security levels in hardware, but also realizes the isolation between different security levels in software, and does not require the operation of The system is invasively modified.
  • the architecture of the vehicle used in the embodiment of the present application is first introduced.
  • Figure 1b is an architecture diagram of a vehicle in the method for processing data in a vehicle provided by an embodiment of the present application.
  • the vehicle 10 includes N security levels of hardware devices 101, and N security levels of hardware devices.
  • N virtual machine monitors (VMM) 102 corresponding to the hardware device and the operating system 103 running on each virtual machine monitor 102.
  • the value of N is 2, and the above two security levels are Taking ASIL-B and ASIL-D as examples respectively, it should be noted that the number of safety levels of hardware devices included in a vehicle 10 and the specific safety level adopted need to be determined based on the actual application scenario, and are not limited here. .
  • the hardware device 101 is deployed at the hardware layer of the vehicle 10.
  • a hardware device 101 may include an integrated circuit and firmware (firmware) integrated with the integrated circuit.
  • the firmware is also called “solidified software", and the firmware is written in
  • the program code inside the integrated circuit of the hardware device 101 is computer software stored in a non-losable manner.
  • the firmware serves as the most basic and lowest-level working software of the hardware device 101.
  • the hardware device 101 may be embodied as a central processing unit (CPU), a memory chip, a network card, a hard disk or other hardware devices, etc., and the list is not exhaustive here.
  • the virtual machine monitor 102 is deployed on the virtualization layer of the vehicle 10.
  • the virtual machine monitor 102 can also be called a virtual machine hypervisor.
  • Figure 1b it is taken as an example that the virtual machine monitor 102 directly runs on the hardware layer, that is, Figure 1b
  • the vehicle 10 shown is equipped with an embedded virtual machine monitor 102 .
  • a virtual machine monitor 102 is run on the hardware device 101 of each security level (that is, Figure 1b). Different virtual machine monitors are run on the hardware devices 101 of different security levels.
  • Each virtual machine monitor The machine monitor 102 is used to manage a hardware device 101 of an ASIL level, that is, each virtual machine monitor 102 is used to manage access operations to a hardware device 101 of an ASIL level.
  • At least one operating system can run on each virtual machine monitor 102.
  • the aforementioned at least one operating system may include a back-end operating system; optionally, the aforementioned at least one operating system may also include a front-end operating system and a back-end operating system.
  • the driver in the back-end operating system can write data to the hardware device 101 or read data from the hardware device 101; the front-end operating system needs the help of the back-end operating system to complete the read and write operations on the hardware device 101. .
  • the number of codes in each virtual machine monitor 102 will be smaller, and the maintainability of each virtual machine monitor 102 will be higher. , and has higher security.
  • N types of security level hardware devices are deployed at the hardware layer, and different virtual machine monitors run on hardware devices with different security levels, which further clarifies the vehicle to which the virtual machine monitor belongs.
  • the architecture is conducive to improving the accuracy of this program during execution and improving the security of this program.
  • FIG. 2 is a schematic flow chart of a data processing method in a vehicle provided by an embodiment of the present application.
  • A1 and the first virtual machine monitor obtain a target access request, and the target access request is an access request initiated by the operating system in the vehicle for the hardware device in the vehicle.
  • the first virtual machine monitor sends instruction information to the second virtual machine monitor, and the instruction information is used to request the second virtual machine monitor to execute
  • the access operation pointed to by the target access request, the first virtual machine monitor and the second virtual machine monitor are two different virtual machine monitors 102 in the vehicle 10 shown in Figure 1b, and the virtual machine monitor 102 is deployed in the virtualization layer.
  • Figure 3 is a schematic flowchart of a method for processing data in a vehicle provided by an embodiment of the present application.
  • the method for processing data in a vehicle provided by an embodiment of the present application may include:
  • the first virtual machine monitor obtains a target access request.
  • the target access request is an access request initiated by the operating system in the vehicle for the hardware device in the vehicle.
  • the target access request is initiated by a first operating system running on a first virtual machine monitor.
  • the first operating system may initiate multiple first access requests for hardware devices in the vehicle.
  • the first virtual machine monitor can obtain each first access request, that is, each first access request is a target access request; in another case, the first virtual machine can only obtain The first operating system initiates an access request for a specific hardware device in the vehicle, that is, only the request for accessing the aforementioned specific hardware device among the multiple first access requests is determined as the target access request.
  • the target access request is initiated by an operating system running on another virtual machine monitor in the vehicle. Then the first virtual machine monitor can receive the instruction information sent by the other virtual machine monitor, and obtain the target access request according to the foregoing instruction information.
  • the method of information exchange between different virtual machine monitors will be described in detail in subsequent steps and will not be described here.
  • the first virtual machine monitor determines whether the access address of the target access request exceeds the management range of the first virtual machine monitor. If the determination result is yes, proceed to step 303; if the determination result is no, proceed to step 308.
  • the first virtual machine monitor may be pre-configured with first indication information.
  • the first indication information includes the range of physical addresses managed by each virtual machine monitor in the vehicle.
  • Each virtual machine monitor manages The physical address range depends on the physical address range of the hardware device with a security level corresponding to the virtual machine monitor.
  • the first virtual machine monitor After the first virtual machine monitor obtains the target access request, it can obtain the target access address corresponding to the target access request.
  • the target access address corresponding to the target access request refers to the physical address.
  • the first virtual machine monitor may determine whether the access address of the target access request exceeds the management range of the first virtual machine monitor based on the first indication information. If the determination result is yes, the first virtual machine monitor may also determine based on the first indication.
  • the information determines which virtual machine monitor the target access address belongs to (that is, the "second virtual machine monitor" in subsequent steps) within the management range, and step 303 is entered. If the judgment result is no, step 308 can be entered.
  • the first virtual machine monitor sends target indication information to the second virtual machine monitor, where the target indication information is used to request the second virtual machine monitor to perform the access operation pointed to by the target access request.
  • the first virtual machine monitor sends target indication information to the second virtual machine monitor, and the target indication information is used to request the second virtual machine monitor to perform the access operation pointed to by the target access request.
  • different virtual machine monitors use the second type of interrupt instructions to communicate; when the operating system in the vehicle is in a running state, all interrupt instructions that need to be processed by the operating system use the third type of interrupt instructions.
  • the aforementioned first type of interrupt instruction can directly pass through the operating system in the vehicle.
  • Interrupt instructions that need to be processed by the operating system may include: interrupt instructions generated by hardware devices in the vehicle, and interrupts generated by software in the operating system. Instructions, interrupt instructions generated by other operating systems in the vehicle or other interrupt instructions that need to be processed by the operating system are not exhaustive here.
  • the second type of interrupt instruction can be embodied as an interrupt instruction in fast interrupt mode (fast interrupt request, FIQ), and the first type of interrupt instruction can be embodied as an interrupt mode (interrupt request, IRQ). interrupt instruction.
  • FIQ mode fast interrupt request
  • IRQ interrupt request
  • interrupt instructions in FIQ mode can be applied to the safe world
  • the interrupt instructions in IRQ mode can be applied to the non-safe world.
  • the security level corresponding to the second virtual machine monitor may be higher than the security level corresponding to the first virtual machine monitor. That is, the security level of the hardware resources managed by the second virtual machine monitor may be higher than the security level of the first virtual machine monitor.
  • the security level of the hardware resources managed by the virtual machine monitor when both the first virtual machine monitor and the second virtual machine monitor have access requirements for a certain hardware device, the second virtual machine monitor with a higher security level actually manages the hardware device.
  • the virtual machine monitor with the highest security level among at least two virtual machine monitors will actually manage the hardware device, so that there is It is conducive to ensuring the security of the data processing process in the vehicle, which in turn is conducive to improving the safety of the vehicle.
  • the second type of interrupt instruction As the FIQ mode interrupt instruction as an example.
  • the first type and the second type of interrupt instructions can also be embodied as other types of interrupt instructions.
  • the examples in the embodiments of this application are not used to limit the first type and the second type of interrupt instructions.
  • each virtual machine monitor in the vehicle can register a callback function with the corresponding processor in advance, and the processor will provide an interface to the virtual machine monitor.
  • the target indication information can be written to a predetermined storage address, and the interface of the first processor corresponding to the first virtual machine monitor can be called. , to trigger the first processor to send an interrupt instruction in FIQ mode to the second processor corresponding to the second virtual machine monitor.
  • the second processor After receiving the interrupt instruction in FIQ mode sent by the first processor, the second processor can obtain the identification information carried in the interrupt instruction in FIQ mode. The identification information is used by the second processor to determine what needs to be executed based on the identification information. operate.
  • the second processor triggers the second virtual machine monitor to execute the callback function; specifically, the process of the second virtual machine monitor executing the callback function includes: the second virtual machine monitor
  • the storage address reads the target indication information, parses the obtained target indication information, and determines the content of the target access request.
  • each virtual machine monitor (including the first virtual machine monitor) no longer captures the interrupt in the IRQ mode. Instead, the operating system on each virtual machine monitor directly receives and handles the IRQ mode interrupt instructions.
  • each virtual machine monitor only captures the configuration behavior of the IRQ mode interrupt instruction when the operating system is in the initialization stage to ensure that the operating system running on it can only configure its own interrupt resources and cannot handle them.
  • the interrupt resources of other operating systems also realize the isolation of interrupt resources configured by different operating systems.
  • Figure 4 shows the communication between different virtual machine monitors using the second type of interrupt instruction in the data processing method in the vehicle provided by the embodiment of the present application.
  • a flow diagram In Figure 4, the embodiment of the present application is applied to an ARM architecture hardware platform as an example.
  • each virtual machine monitor can include a hardware device management module and an agent module.
  • the hardware device management module in the virtual machine monitor is used to manage access operations to hardware devices, and the agent module is used to implement different virtual machines. Communication between monitors.
  • the agent module in the first virtual machine monitor can call an interface on the firmware of the first processor to trigger the first processor to communicate with the second virtual machine monitor.
  • the device sends an interrupt command in FIQ mode.
  • the second processor receives and parses the interrupt instruction in FIQ mode, it triggers the agent module in the second virtual machine monitor to execute the callback function, that is, triggers the agent module in the second virtual machine monitor to store it in a predetermined storage. Address reads target indication information.
  • Figure 5 is a comparative schematic diagram of the first type and the second type of terminal instructions in the method for processing data in the vehicle provided by the embodiment of the present application.
  • the embodiment of the present application is applied to the ARM architecture.
  • Figure 5 also shows multiple operating systems running on the virtual machine monitor (that is, operating system 1, operating system 2 and operating system 3 in Figure 5). As shown in the figure, each operating system can directly obtain For interrupt instructions in IRQ mode, it should be understood that the example in Figure 5 is only for the convenience of understanding this solution and is not used to limit this solution.
  • different virtual machine monitors use the second type of interrupt instructions to communicate, and the first type of interrupt instructions pass directly to the operating system in the vehicle, so the virtual machine monitor no longer needs to process the first type of interrupt instructions. Because when the operating system in the vehicle is running, it will need to process a large number of first-type interrupt instructions. Therefore, the aforementioned method can avoid the time consumed by the virtual machine monitor when processing the first-type interrupt instructions.
  • communication between virtual machine monitors is implemented with the help of the firmware capabilities of the processor, which has little impact on the operating system on the virtual machine monitor.
  • the second virtual machine monitor determines whether the access address of the target access request exceeds the management range of the second virtual machine monitor. If the determination result is yes, step 305 is entered. If the determination result is no, other steps are performed.
  • the second virtual machine monitor determines whether the VirtIO technology needs to be used to perform the access operation pointed to by the target access request. If the determination result is yes, step 306 is entered; if the determination result is no, step 307 is entered.
  • the second virtual machine monitor can be compatible with virtualization input/output (Virtual IO, VirtIO) technology, that is, the second virtual machine monitor can use Virtual IO technology to perform the access operation pointed to by the target access request.
  • Virtual IO virtualization input/output
  • the back-end operating system and the front-end operating system can be run simultaneously on the second virtual machine monitor.
  • VirtIO technology is usually used to share the network card between different operating systems.
  • the second virtual machine monitor can determine the target back-end operating system that can perform the access operation pointed by the target access request according to the access address of the target access request, and send the target access request to the target back-end operating system.
  • Multiple threads can run on the target back-end operating system.
  • the multiple threads include a first thread for maintaining the hardware device pointed to by the target access request.
  • the first thread in the target back-end operating system uses the driver to execute the target pointed by the target access request.
  • Access operation that is, the first thread in the target back-end operating system uses the driver to write data into the hardware device, or the first thread in the target back-end operating system uses the driver to read data from the hardware device.
  • FIG. 6 is a schematic flowchart of a data processing method in a vehicle provided by an embodiment of the present application.
  • Figure 6 takes a virtual machine monitor including two security levels of ASIL-B and ASIL-D as an example.
  • the first virtual machine monitor and the second virtual machine monitor both run back-end operating systems.
  • each back-end operating system runs a first thread
  • the first thread is a thread that directly manages the shared hardware device.
  • the agent module of the second virtual machine monitor After the agent module of the second virtual machine monitor obtains the above instruction information, the second virtual machine monitor parses the instruction and determines the first thread capable of executing the target access request from the backend operating system running on it, and then The first thread executes the operation of the target access request (corresponding to the above-mentioned steps 304 to 306). It should be understood that the example in Figure 6 is only for convenience of understanding this solution and is not used to limit this solution.
  • VirtIO technology can also support the sharing of the same hardware device (that is, sharing access rights to the same hardware device) between the front-end operating system and the back-end operating system running on the second virtual machine monitor, the back-end operating system is actually controlled by the back-end operating system.
  • the front-end operating system directly performs the access operation to the hardware device, so that there can be a shared memory between the front-end operating system and the back-end operating system running on the second virtual machine monitor, that is, the back-end operating system on the second virtual machine monitor.
  • the end operating system has a section of memory of the front-end operating system that is allowed to be accessed, so that the back-end operating system on the second virtual machine monitor can read and write the aforementioned section of memory.
  • the second virtual machine monitor may first configure the stage2 page table for the second thread in the back-end operating system.
  • the memory address of the front-end operating system does not exist in the stage2 page table corresponding to the second thread.
  • the second virtual machine monitor can copy the stage2 page table corresponding to the second thread, and based on the copied stage2 page table corresponding to the second thread, generate the stage2 page table corresponding to the first thread in the back-end operating system,
  • the memory address of the front-end operating system exists in the stage2 page table corresponding to the first thread.
  • the back-end operating system needs to implement the conversion between the virtual address and the intermediate address according to the stage1 page table, and monitor it by the second virtual machine.
  • the processor allocated by the processor implements conversion between intermediate physical addresses and physical addresses based on the stage2 page table.
  • the processor allocated by the second virtual machine monitor will determine whether the current thread is a thread used to manage the above-mentioned shared hardware device (that is, determine whether the current thread is the first thread). If the determination result is yes, then according to the first The stage2 page table corresponding to the thread performs the conversion operation from the intermediate physical address to the physical address; if the judgment result is no, the stage2 page table corresponding to the second thread performs the conversion operation from the intermediate physical address to the physical address. operate.
  • each thread when each thread performs an access operation, it needs to use the stage2 page table to convert the intermediate physical address to the physical address, and then perform read and write operations on the converted physical address. Since the second thread There is no memory address of the front-end operating system in the corresponding stage2 page table. Even if the second thread is assigned to the wrong intermediate physical address, the stage2 page table corresponding to the second thread cannot be converted to the memory address of the front-end operating system. This further reduces the probability that the second thread on the back-end operating system accesses the memory of the front-end operating system, which is beneficial to improving the security of the data stored in the front-end operating system.
  • the second virtual machine monitor performs the access operation pointed to by the target access request through the built-in driver.
  • the second virtual machine monitor may also have at least one built-in driver. Then, when the second virtual machine monitor determines the access address of the target access request, it is not necessary to use VirtIO technology to execute the target access request. For access operations, you can directly perform the access operation pointed to by the target access request through the built-in driver, that is, perform read and write operations on the access address of the target access request through the built-in driver.
  • the driver of the aforementioned device can be built into the second virtual machine monitor to pass the second virtual machine monitor.
  • the driver of the machine monitor performs read and write operations on the access address of the target access request.
  • VirtIO technology can be used to perform the access operation pointed to by the target access request, and in another case Under this condition, the access operation pointed to by the target access request can be performed through the built-in driver; it is not only compatible with the common VirtIO technology, which improves the maintainability of this solution; and the access operation can be performed through the driver built into the virtual machine monitor according to the actual situation. , which can save the time spent performing access operations, which is beneficial to improving the processing efficiency of target access requests.
  • step 305 is an optional step. If step 305 is not performed, the second virtual machine monitor can only use VirtIO technology to perform the access operations pointed to by all target access requests, or the second virtual machine monitor can also Only access operations directed by all target access requests are performed through the built-in driver.
  • the first virtual machine monitor determines whether the VirtIO technology needs to be used to perform the access operation pointed to by the target access request. If the determination result is yes, step 306 is entered; if the determination result is no, step 307 is entered.
  • the first virtual machine monitor performs the access operation pointed to by the target access request based on VirtIO technology.
  • step 308 is an optional step. If step 308 is not performed, the first virtual machine monitor can only use VirtIO technology to perform the access operations pointed to by all target access requests, or the first virtual machine monitor can also only use VirtIO technology. The built-in driver performs all access operations directed to the target access request.
  • FIG. 7 is a schematic flowchart of a data processing method in a vehicle provided by an embodiment of the present application.
  • the hardware device managed by the first virtual machine monitor is an ASIL-B security level as an example.
  • a back-end operating system runs on the first virtual machine monitor, and all back-end operating systems run There is a first thread, and the first thread is a thread that directly manages the shared hardware device.
  • the hardware device management module in the first virtual machine monitor can obtain the target access request (corresponding to the above) initiated by the operating system running on it (that is, the front-end operating system and the back-end operating system running on the first virtual machine monitor) Step 301).
  • the proxy module in the first virtual machine monitor runs on it Determine the first thread that can execute the target access request in the terminal operating system, and then execute the operation of the target access request through the first thread (corresponding to the above steps 302, 308 and 309). It should be understood that the example in Figure 7 is only for the convenience of understanding this article. scheme and is not used to limit this scheme.
  • the vehicle is equipped with N types of security level hardware devices and N virtual machine monitors corresponding to the N types of security level hardware equipment.
  • Each virtual machine monitor runs at least one operating system, thereby not only
  • the isolation between different security levels is implemented in hardware, and the isolation between different security levels is also implemented in software.
  • the first virtual machine monitor determines that the access address of the target access request exceeds the management range, it will send indication information to the second virtual machine monitor indicating that The information is used to request the second virtual machine monitor to perform the access operation pointed to by the target access request, and the foregoing process is implemented through the virtual machine monitor, which does not require intrusive modifications to the operating system and avoids a large number of code modifications to the operating system. Modifications also avoid reducing the maintainability of the operating system.
  • Figure 8 is a schematic structural diagram of a first virtual machine monitor provided by an embodiment of the present application.
  • the virtual machine monitor is used to process data in a vehicle.
  • the vehicle includes: N types of security level hardware devices and N N virtual machine monitors corresponding to hardware devices with a security level.
  • the virtual machine monitors are deployed at the virtualization layer.
  • N is an integer greater than or equal to 2.
  • Each virtual machine monitor runs at least one operating system.
  • the virtual machine monitor includes a first virtual machine monitor and a second virtual machine monitor.
  • the first virtual machine monitor 800 includes: an obtaining unit 801 for obtaining a target access request.
  • the target access request is an operating system in the vehicle for the vehicle.
  • the isolation between different security levels is not only implemented in hardware, but also the isolation between different security levels is implemented in software.
  • the sending unit 802 will send indication information to the second virtual machine monitor, and the indication information is used to request the second virtual machine monitor. Execute the access operation pointed to by the target access request, and the foregoing process is implemented through the virtual machine monitor. There is no need to make intrusive modifications to the operating system, avoiding a large number of modifications to the operating system code, and avoiding reducing the reliability of the operating system. Maintainability.
  • the security level corresponding to the second virtual machine monitor is higher than the security level corresponding to the first virtual machine monitor.
  • the first virtual machine monitor 800 also includes: an execution unit 803, configured to If the access address of the target access request is within the management range of the first virtual machine monitor, in the first case, the first virtual machine monitor uses virtualization input and output processing VirtIO technology to perform the access operation pointed to by the target access request;
  • the execution unit is also configured to, in the second case, cause the first virtual machine monitor to execute the access operation pointed to by the target access request through the built-in driver.
  • VirtIO technology is used to support sharing hardware devices between a front-end operating system and a back-end operating system running on a first virtual machine monitor, and a first thread and a second thread running in the back-end operating system.
  • the corresponding stage2 page tables are different.
  • the first thread is a thread used to perform access operations on the hardware devices shared between the front-end operating system and the back-end operating system.
  • the second thread and the first thread are different threads.
  • the memory address of the front-end operating system exists in the stage2 page table corresponding to one thread, and the memory address of the front-end operating system does not exist in the stage2 page table corresponding to the second thread.
  • N types of security level hardware devices are deployed at the hardware layer.
  • Each security level hardware device runs a virtual machine monitor, and different security level hardware devices run different virtual machine monitors. device.
  • FIG. 10 is a schematic structural diagram of a vehicle provided by an embodiment of the present application.
  • the vehicle 10 may be configured in a fully or partially autonomous driving mode.
  • the vehicle 10 may control itself while in the autonomous driving mode, and may determine the current status of the vehicle and its surrounding environment through human operation, and determine the conditions in the surrounding environment.
  • a possible behavior of at least one other vehicle is determined, and a confidence level corresponding to the likelihood of the other vehicle performing the possible behavior is determined, and the vehicle 10 is controlled based on the determined information.
  • the vehicle 10 may also be configured to operate without human interaction while the vehicle 10 is in autonomous driving mode.
  • the vehicle 10 may include various operating systems, such as the travel system 100, the sensor system 104, the control system 106 and the computer system 112.
  • the multiple operating systems in the vehicle 10 may run on the N virtual machine monitors 101 shown in Figure 1b .
  • the vehicle 10 may also include one or more peripheral devices 108, a power supply 110, a processor 113, a memory 114, a user interface 116 and other hardware devices, and the multiple hardware devices in the vehicle may be classified into N security levels.
  • vehicle 10 may include more or fewer subsystems, and each subsystem may include multiple components. Additionally, each subsystem and component of vehicle 10 may be interconnected via wires or wirelessly.
  • Sensor system 104 may include a number of sensors that sense information about the environment surrounding vehicle 10 .
  • the sensor system 104 may include a positioning system 122 (the positioning system may be the global positioning GPS system, the Beidou system or other positioning systems), an inertial measurement unit (IMU) 124, a radar 126, and a laser range finder. 128 and camera 130.
  • the sensor system 104 may also include sensors for the internal systems of the vehicle 10 being monitored (eg, an interior air quality monitor, a fuel gauge, an oil temperature gauge, etc.). Sensed data from one or more of these sensors can be used to detect objects and their corresponding properties (position, shape, orientation, speed, etc.). Such detection and identification are critical functions for safe operation of autonomous vehicles 10 .
  • the positioning system 122 may be used to estimate the geographical location of the vehicle 10 .
  • the IMU 124 is used to sense the position and orientation changes of the vehicle 10 based on inertial acceleration.
  • IMU 124 may be a combination of accelerometer and gyroscope.
  • the radar 126 may use radio signals to sense objects in the surrounding environment of the vehicle 10 , and may specifically be embodied as millimeter wave radar or lidar. In some embodiments, in addition to sensing objects, radar 126 may be used to sense the speed and/or heading of the object.
  • Laser rangefinder 128 may utilize laser light to sense objects in the environment in which vehicle 10 is located.
  • laser rangefinder 128 may include one or more laser sources, laser scanners, and one or more detectors, among other system components.
  • Camera 130 may be used to capture multiple images of the surrounding environment of vehicle 10 .
  • Camera 130 may be a still camera or a video camera.
  • Control system 106 controls the operation of vehicle 10 and its components.
  • Control system 106 may include various components, including steering system 132 , throttle 134 , braking unit 136 , computer vision system 140 , line control system 142 , and obstacle avoidance system 144 .
  • Computer vision system 140 may use object recognition algorithms, Structure from Motion (SFM) algorithms, video tracking, and other computer vision techniques. In some embodiments, computer vision system 140 may be used to map an environment, track objects, estimate the speed of objects, and so on.
  • the route control system 142 is used to determine the driving route and driving speed of the vehicle 10 .
  • the line control system 142 may include a transverse planning module 1421 and a longitudinal planning module 1422, which are respectively configured to combine data from the obstacle avoidance system 144, the GPS 122, and one or more predetermined maps. The data determines the driving route and driving speed for the vehicle 10.
  • the obstacle avoidance system 144 is used to identify, evaluate and avoid or otherwise overcome obstacles in the environment of the vehicle 10 .
  • the obstacles may be actual obstacles and virtual moving objects that may collide with the vehicle 10 .
  • control system 106 may additionally or alternatively include components in addition to those shown and described. Alternatively, some of the components shown above may be reduced.
  • Vehicle 10 may interact with external sensors, other vehicles, other computer systems, or users via peripherals 108 .
  • Peripheral devices 108 may include a wireless communication system 146 , an onboard computer 148 , a microphone 150 and/or a speaker 152 .
  • peripheral device 108 provides a means for a user of vehicle 10 to interact with user interface 116 .
  • the onboard computer 148 may provide information to a user of the vehicle 10 .
  • the user interface 116 may also operate the onboard computer 148 to receive user input.
  • the onboard computer 148 can be operated via a touch screen.
  • peripheral devices 108 may provide a means for vehicle 10 to communicate with other devices located within the vehicle.
  • Wireless communication system 146 may wirelessly communicate with one or more devices directly or via a communication network.
  • wireless communication system 146 may use 3G cellular communications, such as CDMA, EVDO, GSM/GPRS, or 4G cellular communications, such as LTE. Or 5G cellular communications.
  • the wireless communication system 146 may communicate using a wireless local area network (WLAN).
  • WLAN wireless local area network
  • wireless communication system 146 may utilize infrared links, Bluetooth, or ZigBee to communicate directly with the device.
  • Other wireless protocols such as various vehicle communication systems.
  • wireless communication system 146 may include one or more dedicated short range communications (DSRC) devices, which may include communication between vehicles and/or roadside stations. public and/or private data communications.
  • DSRC dedicated short range communications
  • Power supply 110 may provide power to various components of vehicle 10 .
  • power source 110 may be a rechargeable lithium-ion or lead-acid battery.
  • One or more packs of such batteries may be configured as a power source to provide power to various components of the vehicle 10 .
  • power source 110 and energy source 119 may be implemented together, such as in some all-electric vehicles.
  • processor 113 may be located remotely from vehicle 10 and in wireless communication with vehicle 10 . In other aspects, some of the processes described herein are performed on processor 113 disposed within vehicle 10 and others are performed by remote processor 113 , including taking the steps necessary to perform a single maneuver.
  • memory 114 may contain instructions (eg, program logic) that are executable by processor 113 to perform various functions of vehicle 10 , including those described above. Memory 114 may also contain additional instructions, including instructions to send data to, receive data from, interact with, and/or control one or more of travel system 100, sensor system 104, control system 106, and peripheral devices 108. instruction. In addition to instructions 115, memory 114 may store data such as road maps, route information, vehicle location, direction, speed and other such vehicle data, as well as other information. This information may be used by various operating systems in vehicle 10 during operation of vehicle 10 in autonomous, semi-autonomous and/or manual modes. User interface 116 for providing information to or receiving information from a user of vehicle 10 . Optionally, user interface 116 may include one or more input/output devices within a collection of peripheral devices 108 , such as wireless communications system 146 , on-board computer 148 , microphone 150 , and speaker 152 .
  • peripheral devices 108 such as wireless communications system 146 , on-board computer 148
  • one or more of these components described above may be installed separately or associated with the vehicle 10 .
  • memory 114 may exist partially or completely separate from vehicle 10 .
  • the components described above may be communicatively coupled together in wired and/or wireless manners.
  • An autonomous vehicle traveling on the road can identify objects within its surrounding environment to determine adjustments to its current speed.
  • the objects may be other vehicles, traffic control equipment, or other types of objects.
  • each identified object can be considered independently and based on the object's respective characteristics, such as its current speed, acceleration, distance from the vehicle, etc., can be used to determine the speed to which the autonomous vehicle will adjust.
  • the vehicle 10 or a computing device associated with the vehicle 10 such as the computer system 112 of FIG. 1 b, the computer vision system 140, and the memory 114 may be based on the characteristics of the identified objects and the state of the surrounding environment (eg, traffic, rain, ice on the road, etc.) to predict the behavior of the identified objects.
  • each recognized object depends on the behavior of each other, so it is also possible to predict the behavior of a single recognized object by considering all recognized objects together.
  • the vehicle 10 is able to adjust its speed based on the predicted behavior of the identified objects. In other words, the vehicle 10 is able to determine what stable state the vehicle will need to adjust to (eg, accelerate, decelerate, or stop) based on the predicted behavior of the object.
  • An embodiment of the present application also provides a computer program product.
  • the computer program product includes a program.
  • the program When the program is run on a computer, it causes the computer to execute the first virtualization method in the method described in the embodiments shown in Figures 2 to 7. The steps performed by the machine monitor or secondary virtual machine monitor.
  • Embodiments of the present application also provide a computer-readable storage medium.
  • the computer-readable storage medium stores a program. When it is run on a computer, it causes the computer to execute the steps described in the embodiments shown in Figures 2 to 7. Steps performed by the first virtual machine monitor or the second virtual machine monitor in the method.
  • the embodiment of the present application also provides a data processing system in the vehicle.
  • the data processing system in the vehicle is applied to the vehicle.
  • the data processing system in the vehicle includes N virtual machine monitors, and the N virtual machine monitors are connected to the vehicle.
  • the virtual machine monitor is deployed in the virtualization layer, N is an integer greater than or equal to 2, and there is a first virtual machine monitor among the N virtual machine monitors.
  • the first virtual machine monitor Execute the steps performed by the first virtual machine monitor in the method described in the embodiments shown in FIGS. 2 to 7 .
  • the virtual machine monitor provided by the embodiment of the present application may be a chip.
  • the chip may include: a processing unit and a communication unit.
  • the processing unit may be, for example, a processor.
  • the communication unit may be, for example, an input/output interface, a pin or a circuit. wait.
  • the processing unit can execute the computer execution instructions stored in the storage unit, so that the chip executes the above-mentioned instructions for causing the computer to execute the first virtual machine monitor or the second virtual machine monitor in the method described in the embodiments shown in FIGS. 2 to 7 . steps to perform.
  • the storage unit is a storage unit within the chip, such as a register, cache, etc.
  • the storage unit may also be a storage unit located outside the chip in the wireless access device, such as Read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), etc.
  • ROM Read-only memory
  • RAM random access memory
  • the processor mentioned in any of the above places may be a general central processing unit, a microprocessor, an ASIC, or one or more integrated circuits used to control program execution of the method of the first aspect.
  • the device embodiments described above are only illustrative.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physically separate.
  • the physical unit can be located in one place, or it can be distributed across multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of this embodiment.
  • the connection relationship between modules indicates that there are communication connections between them, which can be specifically implemented as one or more communication buses or signal lines.
  • the computer software product is stored in a readable storage medium, such as a computer floppy disk. , U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc., including several instructions to cause a computer device (which can be a personal computer, training device, or network device, etc.) to execute the steps described in various embodiments of this application. method.
  • a computer device which can be a personal computer, training device, or network device, etc.
  • the computer-readable storage medium may be any available medium that a computer can store, or a data storage device such as a training device or a data center integrated with one or more available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, tape), optical media (eg, DVD), or semiconductor media (eg, Solid State Disk (SSD)), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Storage Device Security (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种车辆中数据的处理方法以及相关设备，该方法可将计算机技术应用于车辆领域中，车辆包括：N种安全等级的硬件设备和与N种安全等级的硬件设备对应的N个虚拟机监视器，虚拟机监视器部署于虚拟化层，每个虚拟机监视器上运行有操作系统，方法包括：第一虚拟机监视器获取目标访问请求，目标访问请求为车辆内的操作系统针对车辆中的硬件设备发起的访问请求；若目标访问请求的访问地址超出第一虚拟机监视器的管理范围，则向第二虚拟机监视器发送指示信息，指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作。在硬件上和软件上实现了不同安全等级之间的隔离，且不需要对操作系统进行侵入性修改。

Description

一种车辆中数据的处理方法以及相关设备
本申请要求于2022年04月21日提交中国专利局、申请号为202210421778.4、发明名称为“一种车辆中数据的处理方法以及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及一种车辆中数据的处理方法以及相关设备。
背景技术
为了对车辆的安全风险进行评估和规范，ISO26262是用于提高车辆领域的电子、电气产品功能安全的国际标准，ISO26262中引入了车辆安全完整性等级(automotive safety integrity level，ASIL)的概念，并定义了四种不同的ASIL：ASIL A、ASIL B、ASIL C和ASIL D。其中，ASIL D是最高的安全完整性等级，而ASIL A是最低的安全完整性等级。
在一些现有技术中，为了符合ISO26262中的安全性要求，车辆中包括不同安全等级的硬件设备，每种安全等级的硬件设备上部署有一个操作系统，低安全等级的操作系统无法直接访问高安全等级的操作系统管理的硬件设备，而是需要向高安全等级的操作系统发出请求，以借助高安全等级的操作系统实现对高安全等级的硬件设备的访问。
具体的，请参阅图1a，图1a为本申请实施例提供的现有技术中的车辆的一种架构图，图1a中以车辆中包括两种安全等级的硬件设备(也即图1a中的ASIL B和ASIL D两个安全等级)为例，不同安全等级的硬件设备上直接部署有不同的操作系统，且不同的操作系统中均需要额外部署代理(Proxy)模块，当ASIL B等级的操作系统需要访问ASIL D等级的操作系统管理的硬件设备时，ASIL B等级的操作系统中的代理模块可以将访问请求发送给ASIL D等级的操作系统的代理模块，以通过ASIL D等级的操作系统对硬件设备执行访问操作，ASIL D等级的操作系统的代理模块再将该访问请求所对应的访问结果发送给ASIL B等级的操作系统中的代理模块。
由于上述做法在操作系统中引入了代理模块，也即存在对操作系统的侵入性修改，导致对操作系统的代码修改量大，操作系统的可维护性差，因此，一种不对操作系统存在侵入性修改的方案亟待推出。
发明内容
本申请实施例提供了一种车辆中数据的处理方法以及相关设备，不仅在硬件上实现了不同安全等级之间的隔离，还在软件上实现了不同安全等级之间的隔离。且当第一虚拟机监视器确定目标访问请求的访问地址超出管理范围时，会向第二虚拟机监视器发送指示信息，指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作，而前述过程是通过虚拟机监视器实现的，不需要对操作系统进行侵入性修改，避免了对操作系统的代码进行大量修改，也避免了降低操作系统的可维护性。
为解决上述技术问题，本申请实施例提供以下技术方案：
第一方面，本申请实施例提供一种车辆中数据的处理方法，可将计算机技术应用于车辆领域中，车辆包括：N种安全等级的硬件设备和与N种安全等级的硬件设备对应的N个虚拟机监视器，虚拟机监视器部署于虚拟化层，N为大于或等于2的整数，每个虚拟机监视器上运行有至少一个操作系统，N个虚拟机监视器包括第一虚拟机监视器和第二虚拟机监视器，方法包括：第一虚拟机监视器获取目标访问请求，目标访问请求为车辆内的操作系统针对车辆中的硬件设备发起的访问请求，前述访问请求可以具体表现为：针对车辆中的硬件设备中数据的读请求，或者，将数据写入该车辆中的硬件设备中；进一步地，目标访问请求可以是由运行于第一虚拟机监视器上的第一操作系统发起的，也可以是由运行于车辆中的其它虚拟机监视器上的操作系统发起的。
第一虚拟机监视器上可以预先配置有第一指示信息，第一指示信息包括车辆内每个虚拟机监视器所管理的物理地址的范围，每个虚拟机监视器管理的物理地址范围取决于该虚拟机监视器所对应的一种安全等级的硬件设备的物理地址的范围。若第一虚拟机监视器根据第一指示信息，确定目标访问请求的访问地址超出第一虚拟机监视器的管理范围，则第一虚拟机监视器向第二虚拟机监视器发送目标指示信息，目标指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作；前述访问操作可以包括将数据写入目标访问请求所指向的硬件设备中，或者，从目标访问请求所指向的硬件设备中读取数据。
本实现方式中，车辆中配置有N种安全等级的硬件设备和与N种安全等级的硬件设备对应的N个虚拟机监视器，每个虚拟机监视器上运行有至少一个操作系统，从而不仅在硬件上实现了不同安全等级之间的隔离，还在软件上实现了不同安全等级之间的隔离。且在车辆内部的操作系统针对车辆中的硬件设备发起访问请求之后，当第一虚拟机监视器确定目标访问请求的访问地址超出管理范围时，会向第二虚拟机监视器发送指示信息，指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作，而前述过程是通过虚拟机监视器实现的，由于虚拟机监视器是部署在虚拟化层的，也即前述过程的实现不需要对操作系统进行侵入性修改，避免了对操作系统的代码进行大量修改，也避免了降低操作系统的可维护性。
在第一方面的一种可能实现方式中，不同的虚拟机监视器之间采用第二类型的中断指令进行通信；在车辆内的操作系统处于运行状态时，需要由操作系统处理的中断指令均采用第一类型的中断指令，前述第一类型的中断指令能够直通车辆内的操作系统，需要由操作系统处理的中断指令可以包括：车辆中的硬件设备产生的中断指令、操作系统中的软件产生的中断指令、车辆中其它的操作系统产生的中断指令或其它需要由操作系统处理的中断指令等。例如在ARM架构平台下，第二类型的中断指令可以具体表现为快速中断模式(fast interrupt request，FIQ)的中断指令，第一类型的中断指令可以具体表现为中断模式(interrupt request，IRQ)的中断指令。FIQ模式的中断指令可以应用于安全世界，IRQ模式的中断指令可以应用于非安全世界。
本实现方式中，不同的虚拟机监视器之间采用第二类型的中断指令进行通信，且第一类型的中断指令直通车辆内的操作系统，从而虚拟机监视器不再需要处理第一类型的中断指令，由于在车辆内的操作系统处于运行状态时，会需要处理大量的第一类型的中断指令， 因此通过前述方式能够避免虚拟机监视器在处理第一类型的中断指令时所消耗的计算机资源，且能够实现不同虚拟机监视器之间的通信。进一步地，借助处理器的固件的能力实现虚拟机监视器之间的通信，对虚拟机监视器之上的操作系统的影响很小。
在第一方面的一种可能实现方式中，第一虚拟机监视器向第二虚拟机监视器发送目标指示信息，包括：第一虚拟机监视器可以向将目标指示信息写入预定存储地址，并调用第一虚拟机监视器所对应的第一处理器的接口，以触发第一处理器向第二虚拟机监视器所对应的第二处理器发送FIQ模式的中断指令。第二处理器在接收到第一处理器发送的FIQ模式的中断指令之后，可以获取FIQ模式的中断指令中携带标识信息，该标识信息用于供第二处理器根据该标识信息确定需要执行的操作。第二处理器响应于收到的FIQ模式的中断指令，触发第二虚拟机监视器到预定存储地址读取目标指示信息，并解析获取到的目标指示信息，确定该目标访问请求的内容。
在第一方面的一种可能实现方式中，第二虚拟机监视器所对应的安全等级高于第一虚拟机监视器所对应的安全等级，也即第二虚拟机监视器管理的硬件资源的安全等级可以高于第一虚拟机监视器管理的硬件资源的安全等级。本实现方式中，当第一虚拟机监视器和第二虚拟机监视器均对某个硬件设备具有访问需求时，是由安全等级更高的第二虚拟机监视器来实际管理该硬件设备，也即当至少两个虚拟机监视器均可能对某个硬件设备具有访问需求时，由至少两个虚拟机监视器中安全等级最高的一个虚拟机监视器来实际管理该硬件设备，从而有利于保证车辆中数据的处理过程的安全性，进而有利于提高车辆的安全性。
在第一方面的一种可能实现方式中，方法还包括：若目标访问请求的访问地址位于第一虚拟机监视器的管理范围之内，则在第一情况下，第一虚拟机监视器采用虚拟化输入输出处理VirtIO技术执行目标访问请求指向的访问操作，以实现在不同的操作系统之间进行硬件设备的共享；在第二情况下，第一虚拟机监视器通过内置的驱动执行目标访问请求指向的访问操作。
本实现方式中，不仅兼容了通用的VirtIO技术，提高了本方案的可维护性；且可以根据实际情况，通过虚拟机监视器内置的驱动执行访问操作，可以节省执行访问操作所花费的时间，也即有利于提高目标访问请求的处理效率。
在第一方面的一种可能实现方式中，由于VirtIO技术能够支持第一虚拟机监视器上运行的前端操作系统和后端操作系统之间共享硬件设备(也即共享同一硬件设备的访问权限)，从而第一虚拟机监视器上运行的前端操作系统和后端操作系统之间可以存在一段共享内存，也即第一虚拟机监视器上的后端操作系统拥有前端操作系统的一段内存允许访问，以实现第一虚拟机监视器上的后端操作系统对前述一段内存的读写操作。“该一段共享内存”的意义包括前端操作系统将需要写入共享的硬件设备的数据告知后端操作系统，和，后端操作系统将从共享的硬件设备中读取的数据告知前端操作系统。
但第一虚拟机监视器上运行的后端操作系统运行有第一线程和第二线程，其中，第一线程为用于对前端操作系统和后端操作系统之间共享的硬件设备执行访问操作的线程，第二线程和第一线程为不同的线程，也即第二线程不是用于管理共享的硬件设备的线程。则第一虚拟机监视器可以为后端操作系统中运行的第一线程和第二线程配置不同的stage2 页表，第一线程所对应的stage2页表中存在前端操作系统的内存地址，也即第一线程所对应的stage2页表中存在“该一段共享内存”的地址；第二线程所对应的stage2页表中不存在前端操作系统的内存地址。
本实现方式中，每个线程在执行访问操作时，均需要借助stage2页表实现中间物理地址到物理地址之间的转换，进而对转换后的物理地址执行读写操作，由于第二线程所对应的stage2页表中不存在前端操作系统的内存地址，则即使第二线程被分配到错误的中间物理地址，基于第二线程所对应的stage2页表也无法转换至前端操作系统的内存地址，从而进一步降低后端操作系统上的第二线程访问到前端操作系统的内存的概率，有利于个提高前端操作系统的存储数据的安全性。
在第一方面的一种可能实现方式中，车辆中部署的为嵌入式的虚拟机监视器。本实现方式中，车辆中部署多个嵌入式的虚拟机监视器，则每个虚拟机监视器中的代码数量较少，则每个虚拟机监视器的可维护性较高，且安全性较高。
在第一方面的一种可能实现方式中，所述N种安全等级的硬件设备部署于车辆的硬件层，每种安全等级的硬件设备上运行有一个所述虚拟机监视器，不同安全等级的硬件设备上运行不同的虚拟机监视器。
本实现方式中，明确了N种安全等级的硬件设备部署于硬件层，不同安全等级的硬件设备上运行有不同的虚拟机监视器，也即进一步明确了虚拟机监视器归属的车俩的架构，有利于提高本方案在执行过程中的准确性，以提高本方案的安全性。
第二方面，本申请实施例提供一种虚拟机监视器，可将计算机技术应用于车辆领域中。虚拟机监视器用于处理车辆中的数据，所述车辆包括：N种安全等级的硬件设备和与所述N种安全等级的硬件设备对应的N个虚拟机监视器，虚拟机监视器部署于虚拟化层，N为大于或等于2的整数，每个所述虚拟机监视器上运行有至少一个操作系统，所述N个虚拟机监视器包括第一虚拟机监视器和第二虚拟机监视器，所述第一虚拟机监视器包括：获取单元，用于获取目标访问请求，所述目标访问请求为所述车辆内的操作系统针对所述车辆中的所述硬件设备发起的访问请求；发送单元，用于若所述目标访问请求的访问地址超出所述第一虚拟机监视器的管理范围，则所述第一虚拟机监视器向所述第二虚拟机监视器发送指示信息，所述指示信息用于请求所述第二虚拟机监视器执行所述目标访问请求指向的访问操作。
本申请第二方面中，第一虚拟机监视器还可以用于执行第一方面以及第一方面的各个可能实现方式中第一虚拟机监视器执行的步骤，第二方面的各个可能实现方式中的步骤的具体实现方式、名词的含义以及所带来的有益效果，均可以参阅第一方面，此处不再赘述。
第三方面，本申请实施例提供了一种计算机程序产品，计算机程序产品包括程序，当该程序在计算机上运行时，使得计算机执行上述第一方面所述的车辆中数据的处理方法。
第四方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面所述的车辆中数据的处理方法。
第五方面，本申请实施例提供了一种数据的处理系统，该车辆中数据的处理系统应用 于车辆中，车辆中数据的处理系统包括N个虚拟机监视器，N个虚拟机监视器与车辆中的N种安全等级的硬件设备对应，虚拟机监视器部署于虚拟化层，N为大于或等于2的整数，N个虚拟机监视器中存在第一虚拟机监视器，第一虚拟机监视器执行上述第一方面所述的车辆中数据的处理方法中第一虚拟机监视器执行的步骤。
第六方面，本申请实施例提供了一种车辆，车辆包括N种安全等级的硬件设备和与所述N种安全等级的硬件设备对应的N个虚拟机监视器，虚拟机监视器部署于虚拟化层，N为大于或等于2的整数，所述N个虚拟机监视器中存在第一虚拟机监视器，第一虚拟机监视器执行上述第一方面所述的车辆中数据的处理方法中第一虚拟机监视器执行的步骤。
第七方面，本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持虚拟机监视器或通信设备实现上述方面中所涉及的功能，例如，发送或处理上述方法中所涉及的数据和/或信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存虚拟机监视器或通信设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
附图说明
图1a为本申请实施例提供的现有技术中的车辆的一种架构图；
图1b为本申请实施例提供的车辆中数据的处理方法中车辆的一种架构图；
图2为本申请实施例提供的车辆中数据的处理方法的一种流程示意图；
图3为本申请实施例提供的车辆中数据的处理方法的一种流程示意图；
图4为本申请实施例提供的车辆中数据的处理方法中不同的虚拟机监视器之间利用第二类型的中断指令进行通信的一种流程示意图；
图5为本申请实施例提供的车辆中数据的处理方法中第一类型和第二类型的终端指令的一种对比示意图；
图6为本申请实施例提供的车辆中数据的处理方法的一种流程示意图；
图7为本申请实施例提供的车辆中数据的处理方法的一种流程示意图；
图8为本申请实施例提供的第一虚拟机监视器的一种结构示意图；
图9为本申请实施例提供的第一虚拟机监视器的一种结构示意图；
图10为本申请实施例提供的车辆的一种结构示意图。
具体实施方式
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本申请的实施例中对相同属性的对象在描述时所采用的区分方式。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，以便包含一系列单元的过程、方法、系统、产品或设备不必限于那些单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它单元。
下面结合附图，对本申请的实施例进行描述。本领域普通技术人员可知，随着技术的 发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请实施例可以应用于车辆领域中，前述车辆具体可以表现为：轿车、卡车、摩托车、公共车辆、船、飞机、直升飞机、割草机、娱乐车、游乐场车辆、施工设备、电车、高尔夫球车和火车等，本申请实施例不做特别的限定。
为了满足符合ISO26262中的安全性要求，本申请实施例提供的方案不仅在硬件上实现了不同安全等级之间的隔离，还在软件上实现了不同安全等级之间的隔离，且不需要对操作系统进行侵入性修改，在对本申请实施例提供的车辆中数据的处理方法进行介绍之前，先对本申请实施例所采用的车辆的架构进行介绍。
参阅图1b，图1b为本申请实施例提供的车辆中数据的处理方法中车辆的一种架构图，在图1b中，车辆10包括N种安全等级的硬件设备101、与N种安全等级的硬件设备对应的N个虚拟机监视器(virtual machine monitor，VMM)102以及每个虚拟机监视器102上运行的操作系统103，图1b中以N的取值为2，且前述2种安全等级分别为ASIL-B和ASIL-D为例，需要说明的是，一个车辆10中包括的硬件设备的安全等级的数量和具体采用的安全等级，均需要结合实际应用场景确定，此处不做限定。
其中，硬件设备101部署在车辆10的硬件层，一个硬件设备101可以包括一个集成电路以及与该集成电路集成于一体的固件(firmware)，固件又称为“固化的软件”，固件是写在该硬件设备101的集成电路内部的程序代码，是以一种不可丢失的方式进行存储的计算机软件，该固件担任该硬件设备101最基础、最底层工作的软件。作为示例，例如硬件设备101具体可以表现为中央处理器(central processing unit，CPU)、内存芯片、网卡、硬盘或其他硬件设备等等，此处不做穷举。
虚拟机监视器102部署在车辆10的虚拟化层，虚拟机监视器102也可以称为虚拟机管理程序，图1b中以虚拟机监视器102直接运行在硬件层上为例，也即图1b示出的车辆10中采用的为嵌入式的虚拟机监视器102。如图1b所示，每种安全等级(也即图1b)的硬件设备101上运行有一个虚拟机监视器102，不同安全等级的硬件设备101上运行有不同的虚拟机监视器，每个虚拟机监视器102用于管理一种ASIL等级的硬件设备101，也即每个虚拟机监视器102用于管理对一种ASIL等级的硬件设备101的访问操作。
每个虚拟机监视器102上可以运行至少一个操作系统(operation system，OS)。前述至少一个操作系统可以包括后端操作系统；可选地，前述至少一个操作系统也可以包括前端操作系统和后端操作系统。进一步地，后端操作系统中的驱动能够向硬件设备101中写入数据，或从硬件设备101中读取数据；前端操作系统需要借助后端操作系统才能够完成对硬件设备101的读写操作。
每个虚拟机监视器102负责管理其上运行的操作系统，不同的虚拟机监视器102所对应的程序代码可以不同。作为示例，例如在进阶精简指令集机器(advanced RISC machine，ARM)架构的虚拟化平台中，虚拟机监视器102可以采用页表(stage)机制实现对操作系统的管理，也即虚拟机监视器102上运行的操作系统中配置的为stage1页表，stage1页表用于进行虚拟地址(virtual address，VA)到中间物理地址(IPA)之间的映射，stage2页表用于进行IPA到物理地址(physical address，PA)之间的映射，虚拟机监视器102 上运行的操作系统不感知stage2页表，每个虚拟机监视器102可以通过对其上运行的操作系统所对应的stage2页表进行配置，以确保其上运行的操作系统只能够访问虚拟机监视器102分配给它的硬件设备101。
本申请实施例中，车辆10中部署多个嵌入式的虚拟机监视器102，则每个虚拟机监视器102中的代码数量较少，则每个虚拟机监视器102的可维护性较高，且安全性较高。
需要说明的是，图1b中的示例仅为方便理解本申请实施例所提供的车辆10的架构，例如，在其他实施例中，在硬件设备101和虚拟机监视器102之间可以运行有宿主机操作系统(host OS)，也即每个虚拟机监视器102可以不是嵌入式的，在N种安全等级的硬件设备101之上直接运行的是宿主机操作系统，该宿主机操作系统中运行有上述N个虚拟机监视器102，图1b中的示例不用于限定本申请实施例中车辆10的架构，只要保证虚拟机监视器102部署于虚拟化层即可。
本申请实施例中，明确了N种安全等级的硬件设备部署于硬件层，不同安全等级的硬件设备上运行有不同的虚拟机监视器，也即进一步明确了虚拟机监视器归属的车俩的架构，有利于提高本方案在执行过程中的准确性，以提高本方案的安全性。
在图1b示出的车辆10的架构上，基于本申请实施例提供了一种车辆中数据的处理方法。请参阅图2，图2为本申请实施例提供的车辆中数据的处理方法的一种流程示意图。其中，A1、第一虚拟机监视器获取目标访问请求，目标访问请求为车辆内的操作系统针对车辆中的硬件设备发起的访问请求。A2、若目标访问请求的访问地址超出第一虚拟机监视器的管理范围，第一虚拟机监视器向第二虚拟机监视器发送指示信息，该指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作，第一虚拟机监视器和第二虚拟机监视器为图1b示出的车辆10中的两个不同的虚拟机监视器102，虚拟机监视器102部署于虚拟化层。
本申请实施例中，不仅在硬件上实现了不同安全等级之间的隔离，还在软件上实现了不同安全等级之间的隔离。且当第一虚拟机监视器确定目标访问请求的访问地址超出管理范围时，会向第二虚拟机监视器发送指示信息，指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作，而前述过程是通过虚拟机监视器实现的，不需要对操作系统进行侵入性修改，避免了对操作系统的代码进行大量修改，也避免了降低操作系统的可维护性。
下面开始对本申请实施例提供的车辆中数据的处理方法的具体实现流程进行详细描述。具体的，请参阅图3，图3为本申请实施例提供的车辆中数据的处理方法的一种流程示意图，本申请实施例提供的车辆中数据的处理方法可以包括：
301、第一虚拟机监视器获取目标访问请求，目标访问请求为车辆内的操作系统针对车辆中的硬件设备发起的访问请求。
本申请实施例中，在第一虚拟监视器运行过程中，可以获取到一个或多个目标访问请求。其中，目标访问请求为车辆内的操作系统针对车辆中的硬件设备发起的访问请求，前述目标访问请求可以具体表现为：针对车辆中的硬件设备中数据的读取请求，或者，将数据写入该车辆中的硬件设备中。
在一种情况中，目标访问请求是由运行于第一虚拟机监视器上的第一操作系统发起的。具体的，在第一虚拟机监视器上的第一操作系统的运行过程中，第一操作系统可以针对车辆中的硬件设备发起多个第一访问请求。在一种情况下，第一虚拟机监视器可以获取每个第一访问请求，也即每个第一访问请求都为一个目标访问请求；在另一种情况下，第一虚拟机可以只获取第一操作系统针对车辆中特定的硬件设备发起的访问请求，也即多个第一访问请求中只有用于访问前述特定的硬件设备的请求才被确定为目标访问请求。
在另一种情况中，目标访问请求是由运行于车辆中的其它虚拟机监视器上的操作系统发起的。则第一虚拟机监视器可以接收该其他虚拟机监视器发送的指示信息，并根据前述指示信息获取到目标访问请求。不同虚拟机监视器之间信息交互的方式将在后续步骤进行详细描述，此处不做赘述。
302、第一虚拟机监视器判断目标访问请求的访问地址是否超出第一虚拟机监视器的管理范围，若判断结果为是，则进入步骤303；若判断结果为否，则进入步骤308。
本申请实施例中，第一虚拟机监视器上可以预先配置有第一指示信息，第一指示信息包括车辆内每个虚拟机监视器所管理的物理地址的范围，每个虚拟机监视器管理的物理地址范围取决于该虚拟机监视器所对应的一种安全等级的硬件设备的物理地址的范围。
在第一虚拟机监视器获取到目标访问请求之后，可以获取到目标访问请求所对应的目标访问地址，前述目标访问请求所对应的目标访问地址指的是物理地址。第一虚拟机监视器可以根据第一指示信息判断目标访问请求的访问地址是否超出第一虚拟机监视器的管理范围，若判断结果为是，则第一虚拟机监视器还可以根据第一指示信息确定目标访问地址属于哪个虚拟机监视器(也即后续步骤中的“第二虚拟机监视器”)的管理范围，并进入步骤303。若判断结果为否，则可以进入步骤308。
303、第一虚拟机监视器向第二虚拟机监视器发送目标指示信息，目标指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作。
本申请实施例中，第一虚拟机监视器向第二虚拟机监视器发送目标指示信息，目标指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作。
具体的，在一种实现方式中，不同的虚拟机监视器之间采用第二类型的中断指令进行通信；在车辆内的操作系统处于运行状态时，需要由操作系统处理的中断指令均采用第一类型的中断指令，前述第一类型的中断指令能够直通车辆内的操作系统，需要由操作系统处理的中断指令可以包括：车辆中的硬件设备产生的中断指令、操作系统中的软件产生的中断指令、车辆中其它的操作系统产生的中断指令或其它需要由操作系统处理的中断指令等，此处不做穷举。
其中，在ARM架构平台下，第二类型的中断指令可以具体表现为快速中断模式(fast interrupt request，FIQ)的中断指令，第一类型的中断指令可以具体表现为中断模式(interrupt request，IRQ)的中断指令。FIQ模式的中断指令可以应用于安全世界，IRQ模式的中断指令可以应用于非安全世界。
可选地，第二虚拟机监视器所对应的安全等级可以高于第一虚拟机监视器所对应的安全等级，也即第二虚拟机监视器管理的硬件资源的安全等级可以高于第一虚拟机监视器管 理的硬件资源的安全等级。本申请实施例中，当第一虚拟机监视器和第二虚拟机监视器均对某个硬件设备具有访问需求时，是由安全等级更高的第二虚拟机监视器来实际管理该硬件设备，也即当至少两个虚拟机监视器均可能对某个硬件设备具有访问需求时，由至少两个虚拟机监视器中安全等级最高的一个虚拟机监视器来实际管理该硬件设备，从而有利于保证车辆中数据的处理过程的安全性，进而有利于提高车辆的安全性。
针对两个虚拟机监视器利用第二类型的中断指令进行通信的过程，此处仅以第二类型的中断指令为FIQ模式的中断指令为例，当本申请实施例提供的方案应用于其他类型的架构平台时，第一类型和第二类型的中断指令还可以具体表现为其它类型的中断指令，本申请实施例中的举例不用于对第一类型和第二类型的中断指令进行限定。
更具体的，车辆中的各个虚拟机监视器可以预先向对应的处理器注册一个回调函数，处理器会向虚拟机监视器提供接口。当第一虚拟机监视器需要向第二虚拟机监视器发送目标指示信息时，可以向将目标指示信息写入预定存储地址，并调用第一虚拟机监视器所对应的第一处理器的接口，以触发第一处理器向第二虚拟机监视器所对应的第二处理器发送FIQ模式的中断指令。
第二处理器在接收到第一处理器发送的FIQ模式的中断指令之后，可以获取FIQ模式的中断指令中携带标识信息，该标识信息用于供第二处理器根据该标识信息确定需要执行的操作。第二处理器响应于收到的FIQ模式的中断指令，触发第二虚拟机监视器执行回调函数；具体的，第二虚拟机监视器执行回调函数的过程包括：第二虚拟机监视器到预定存储地址读取目标指示信息，并解析获取到的目标指示信息，确定该目标访问请求的内容。通过上述步骤，实现了通过FIQ模式的中断指令进行第一虚拟机监视器和第二虚拟机监视器之间的通信。
进一步地，在每个虚拟机监视器(包括第一虚拟机监视器)上的操作系统处于运行状态时，每个虚拟机监视器(包括第一虚拟机监视器)不再捕获IRQ模式的中断指令，而是由每个虚拟机监视器上的操作系统直接接收并处理IRQ模式的中断指令。
更进一步地，每个虚拟机监视器只在操作系统处于初始化阶段时，会捕获IRQ模式的中断指令的配置行为，以确保其上运行的操作系统只能配置到属于自己的中断资源，无法处理其他操作系统的中断资源，也即实现了不同的操作系统所配置的中断资源的隔离。
为了更直观地理解本方案，请参阅图4和图5，图4为本申请实施例提供的车辆中数据的处理方法中不同的虚拟机监视器之间利用第二类型的中断指令进行通信的一种流程示意图。图4中以本申请实施例应用于ARM架构的硬件平台上为例。如图4所示，每个虚拟机监视器可以包括硬件设备管理模块和代理模块，虚拟机监视器中的硬件设备管理模块用于管理对硬件设备的访问操作，代理模块用于实现不同虚拟机监视器之间的通信。
当第一虚拟机监视器需要与第二虚拟机监视器通信时，第一虚拟机监视器中的代理模块可以调用第一处理器的固件上的接口，以触发第一处理器向第二处理器发送FIQ模式的中断指令。第二处理器在接收并解析FIQ模式的中断指令之后，会触发第二虚拟机监视器的中的代理模块执行回调函数，也即触发第二虚拟机监视器的中的代理模块到预定的存储地址读取目标指示信息。应理解，图4中的示例仅为方便理解本方案，不用于限定本方案。
再参阅图5，图5为本申请实施例提供的车辆中数据的处理方法中第一类型和第二类型的终端指令的一种对比示意图，图4中以本申请实施例应用于ARM架构的硬件平台上为例。图5中不同虚拟机监视器之间的通信方式可以参阅上述对图4的描述进行理解，此处不做赘述。图5中还示出了虚拟机监视器上运行的多个操作系统(也即图5中的操作系统1、操作系统2和操作系统3)，如图所示，各个操作系统能够直接获取到IRQ模式的中断指令，应理解，图5中的示例仅为方便理解本方案，不用于限定本方案。
本申请实施例中，不同的虚拟机监视器之间采用第二类型的中断指令进行通信，且第一类型的中断指令直通车辆内的操作系统，从而虚拟机监视器不再需要处理第一类型的中断指令，由于在车辆内的操作系统处于运行状态时，会需要处理大量的第一类型的中断指令，因此通过前述方式能够避免虚拟机监视器在处理第一类型的中断指令时所消耗的计算机资源，且能够实现不同虚拟机监视器之间的通信。进一步地，借助处理器的固件的能力实现虚拟机监视器之间的通信，对虚拟机监视器之上的操作系统的影响很小。
在另一种实现方式中，不同的虚拟机监视器之间可以采用第一类型的中断指令进行通信，在每个虚拟机监视器(包括第一虚拟机监视器)上的操作系统处于运行状态时，每个虚拟机监视器(包括第一虚拟机监视器)将捕获所有IRQ模式的中断指令，并对IRQ模式的中断指令进行处理后注入给其上运行的操作系统。
304、第二虚拟机监视器判断目标访问请求的访问地址是否超出第二虚拟机监视器的管理范围，若判断结果为是，则进入步骤305，若判断结果为否，则执行其他步骤。
本申请实施例中，第二虚拟机监视器在获取到目标访问请求之后，会判断目标访问请求的访问地址是否超出第二虚拟机监视器的管理范围，若判断结果为是，则进入步骤305，若判断结果为否，则根据目标访问请求的访问地址，确定能够处理目标访问请求的虚拟机监视器，进而将目标访问请求转发给确定的前述虚拟机监视器。步骤304的具体实现方式可以参阅上述步骤302中的描述，此处不做赘述。
305、第二虚拟机监视器判断是否需要采用VirtIO技术执行目标访问请求指向的访问操作，若判断结果为是，则进入步骤306；若判断结果为否，则进入步骤307。
本申请的一些实施例中，第二虚拟机监视器上可以配置有第二指示信息，第二指示信息用于指示第二虚拟机监视器管理的物理地址中哪些物理地址需要采用VirtIO技术进行访问，哪些物理地址可以直接通过内置的驱动访问。
第二虚拟机监视器在确定目标访问请求的访问地址未超出第二虚拟机监视器的管理范围之后，可以会根据目标访问请求的访问地址和第二指示信息，判断是否需要采用VirtIO技术执行目标访问请求指向的访问操作，若判断结果为是，则进入步骤306；若判断结果为否，则进入步骤307。
306、第二虚拟机监视器基于VirtIO技术执行目标访问请求指向的访问操作。
本申请的一些实施例中，第二虚拟机监视器可以兼容虚拟化输入/输出(Virtual IO，VirtIO)技术，也即第二虚拟机监视器能够采用Virtual IO技术执行目标访问请求指向的访问操作，以实现在不同的操作系统之间进行硬件设备的共享，则第二虚拟机监视器上可以同时运行有后端操作系统和前端操作系统，对于后端操作系统和前端操作系统的概念可 以参阅上述描述，此处不做赘述。
作为示例，对于一些比较复杂的硬件设备(例如网卡)，利用网卡的驱动对网卡进行读写操作的工作量比较大，则通常需要采用VirtIO技术实现不同的操作系统之间共享网卡。
具体的，第二虚拟机监视器可以根据目标访问请求的访问地址，确定能够执行目标访问请求指向的访问操作的目标后端操作系统，并将目标访问请求发送给目标后端操作系统。目标后端操作系统上可以运行有多个线程，多个线程中包括用于维护目标访问请求指向的硬件设备的第一线程，目标后端操作系统中的第一线程利用驱动执行目标访问请求指向的访问操作，也即目标后端操作系统中的第一线程利用驱动将数据写入该硬件设备中，或者，目标后端操作系统中的第一线程利用驱动从该硬件设备中读取数据。
为了更直观地理解本方案，请参阅图6，图6为本申请实施例提供的车辆中数据的处理方法的一种流程示意图。图6中以包括ASIL-B和ASIL-D两种安全等级的虚拟机监视器为例，如图所示，第一虚拟机监视器和第二虚拟机监视器上均运行有后端操作系统，每个后端操作系统中均运行有第一线程，第一线程为直接管理共享的硬件设备的线程。
第一虚拟机监视器中的硬件设备管理模块可以获取到其上运行的操作系统(也即第一虚拟机监视器上运行的前端操作系统和后端操作系统)发起的目标访问请求(对应上述步骤301)。在第一虚拟机监视器中的硬件设备管理模块确定目标访问请求的访问地址不属于第一虚拟机监视器的管理访问的情况下，第一虚拟机监视器中的代理模块向第二虚拟机监视器的代理模块发送指示信息，该指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作(对应上述步骤302和303)。对于第一虚拟机监视器中的代理模块和第二虚拟机监视器中的代理模块之间的通信方式可以参阅上述对图4的描述，此处不做赘述。
第二虚拟机监视器的代理模块获取到上述指示信息后，第二虚拟机监视器解析该指示新，并从其上运行的后端操作系统中确定能够执行目标访问请求的第一线程，进而通过第一线程执行目标访问请求的操作(对应上述步骤304至306)，应理解，图6中的示例仅为方便理解本方案，不用于限定本方案。
进一步地，由于VirtIO技术也能够支持第二虚拟机监视器上运行的前端操作系统和后端操作系统之间共享同一硬件设备(也即共享同一硬件设备的访问权限)，而实际上是由后端操作系统直接执行对该硬件设备的访问操作，从而第二虚拟机监视器上运行的前端操作系统和后端操作系统之间可以存在一段共享内存，也即第二虚拟机监视器上的后端操作系统拥有前端操作系统的一段内存允许访问，以实现第二虚拟机监视器上的后端操作系统对前述一段内存的读写操作。“该一段共享内存”的意义包括前端操作系统将需要写入共享的硬件设备的数据告知后端操作系统，和，后端操作系统将从共享的硬件设备中读取的数据告知前端操作系统。
但第二虚拟机监视器上运行的后端操作系统中不仅运行有第一线程，还运行有大量的第二线程，其中，第一线程为用于对前端操作系统和后端操作系统之间共享的硬件设备执行访问操作的线程，第二线程和第一线程为不同的线程，也即第二线程不是用于管理共享的硬件设备的线程，则存在后端操作系统中的第二线程访问“该一段共享内存”的风险。
第二虚拟机监视器可以借助页表(stage)机制，实现后端操作系统中的第二线程和“该 一段共享内存”之间的安全隔离。更进一步地，第二虚拟机监视器可以为后端操作系统中运行的第一线程和第二线程配置不同的stage2页表，第一线程所对应的stage2页表中存在前端操作系统的内存地址，也即第一线程所对应的stage2页表中存在“该一段共享内存”的地址；需要说明的是，stage2页表中存在的“该一段共享内存”的地址可以是“该一段共享内存”的物理地址(PA)。第二线程所对应的stage2页表中不存在前端操作系统的内存地址，也即第二线程所对应的stage2页表中不存在“该一段共享内存”的地址。
具体的，第二虚拟机监视器可以先为后端操作系统中的第二线程配置stage2页表，第二线程所对应的stage2页表中不存在前端操作系统的内存地址。第二虚拟机监视器可以拷贝第二线程所对应的stage2页表，并基于拷贝到的第二线程所对应的stage2页表，生成后端操作系统中的第一线程所对应的stage2页表，第一线程所对应的stage2页表中存在前端操作系统的内存地址。采用前述方式得到的两份stage2页表中部分表项可以复用，有利于减少两份stage2页表所占用的存储资源。
在后端操作系统上的多个线程对车辆内的硬件设备执行访问操作过程中，需要由后端操作系统根据stage1页表实现虚拟地址到中间地址之间的转换，并由第二虚拟机监视器分配的处理器根据stage2页表，来实现中间物理地址到物理地址之间的转换。
则第二虚拟机监视器分配的处理器会判断当前线程是否为用于管理上述共享的硬件设备的线程(也即判断当前线程是否为第一线程)，若判断结果为是，则根据第一线程所对应的stage2页表，执行中间物理地址到物理地址之间的转换操作；若判断结果为否，则根据第二线程所对应的stage2页表，执行中间物理地址到物理地址之间的转换操作。
本申请实施例中，每个线程在执行访问操作时，均需要借助stage2页表实现中间物理地址到物理地址之间的转换，进而对转换后的物理地址执行读写操作，由于第二线程所对应的stage2页表中不存在前端操作系统的内存地址，则即使第二线程被分配到错误的中间物理地址，基于第二线程所对应的stage2页表也无法转换至前端操作系统的内存地址，从而进一步降低后端操作系统上的第二线程访问到前端操作系统的内存的概率，有利于个提高前端操作系统的存储数据的安全性。
307、第二虚拟机监视器通过内置的驱动执行目标访问请求指向的访问操作。
本申请的一些实施例中，第二虚拟机监视器中也可以内置有至少一个驱动，则在第二虚拟机监视器在确定目标访问请求的访问地址确定不需要采用VirtIO技术执行目标访问请求指向的访问操作，可以直接通过内置的驱动执行目标访问请求指向的访问操作，也即执行通过内置的驱动对目标访问请求的访问地址执行读写操作。
作为示例，例如若目标访问请求指向的硬件设备是一些比较简单的设备，例如中断控制器、串口控制器，则可以将前述设备的驱动内置于第二虚拟机监视器中，以通过第二虚拟机监视器的驱动对目标访问请求的访问地址执行读写操作。
本申请实施例中，若目标访问请求的访问地址位于当前虚拟机监视器的管理范围之内，则在一种情况下，可以采用VirtIO技术执行目标访问请求指向的访问操作，在另一种情况下，可以通过内置的驱动执行目标访问请求指向的访问操作；不仅兼容了通用的VirtIO技术，提高了本方案的可维护性；且可以根据实际情况，通过虚拟机监视器内置的驱动执行 访问操作，可以节省执行访问操作所花费的时间，也即有利于提高目标访问请求的处理效率。
需要说明的是，步骤305为可选步骤，若不执行步骤305，则第二虚拟机监视器可以仅采用VirtIO技术执行所有目标访问请求指向的访问操作，或者，第二虚拟机监视器也可以仅通过内置的驱动执行所有目标访问请求指向的访问操作。
308、第一虚拟机监视器判断是否需要采用VirtIO技术执行目标访问请求指向的访问操作，若判断结果为是，则进入步骤306；若判断结果为否，则进入步骤307。
309、第一虚拟机监视器基于VirtIO技术执行目标访问请求指向的访问操作。
310、第一虚拟机监视器通过内置的驱动执行目标访问请求指向的访问操作。
本申请实施例中，步骤308至310的具体实现方式与步骤305至307的具体实现方式类似，步骤308至310的具体实现方式可参阅上述对步骤305至307的具体实现方式的描述，区别在于将步骤308至310中的第二虚拟机监视器替换为步骤308至310中的第一虚拟机监视器，此处不再对实现细节进行赘述。
对应的，步骤308为可选步骤，若不执行步骤308，则第一虚拟机监视器可以仅采用VirtIO技术执行所有目标访问请求指向的访问操作，或者，第一虚拟机监视器也可以仅通过内置的驱动执行所有目标访问请求指向的访问操作。
为了更直观地理解本方案，请参阅图7，图7为本申请实施例提供的车辆中数据的处理方法的一种流程示意图。图7中以第一虚拟机监视器所管理的硬件设备为ASIL-B安全等级为例，如图所示，第一虚拟机监视器上运行有后端操作系统，后端操作系统中均运行有第一线程，第一线程为直接管理共享的硬件设备的线程。
第一虚拟机监视器中的硬件设备管理模块可以获取到其上运行的操作系统(也即第一虚拟机监视器上运行的前端操作系统和后端操作系统)发起的目标访问请求(对应上述步骤301)。在第一虚拟机监视器中的硬件设备管理模块确定目标访问请求的访问地址属于第一虚拟机监视器的管理访问的情况下，第一虚拟机监视器中的代理模块从其上运行的后端操作系统中确定能够执行目标访问请求的第一线程，进而通过第一线程执行目标访问请求的操作(对应上述步骤302、308和309)，应理解，图7中的示例仅为方便理解本方案，不用于限定本方案。
本实现方式中，车辆中配置有N种安全等级的硬件设备和与N种安全等级的硬件设备对应的N个虚拟机监视器，每个虚拟机监视器上运行有至少一个操作系统，从而不仅在硬件上实现了不同安全等级之间的隔离，还在软件上实现了不同安全等级之间的隔离。且在车辆内部的操作系统针对车辆中的硬件设备发起访问请求之后，当第一虚拟机监视器确定目标访问请求的访问地址超出管理范围时，会向第二虚拟机监视器发送指示信息，指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作，而前述过程是通过虚拟机监视器实现的，不需要对操作系统进行侵入性修改，避免了对操作系统的代码进行大量修改，也避免了降低操作系统的可维护性。
在图1b至图7所对应的实施例的基础上，为了更好的实施本申请实施例的上述方案， 下面还提供用于实施上述方案的相关设备。具体参阅图8，图8为本申请实施例提供的第一虚拟机监视器的一种结构示意图，虚拟机监视器用于处理车辆中的数据，车辆包括：N种安全等级的硬件设备和与N种安全等级的硬件设备对应的N个虚拟机监视器，虚拟机监视器部署于虚拟化层，N为大于或等于2的整数，每个虚拟机监视器上运行有至少一个操作系统，N个虚拟机监视器包括第一虚拟机监视器和第二虚拟机监视器，第一虚拟机监视器800包括：获取单元801，用于获取目标访问请求，目标访问请求为车辆内的操作系统针对车辆中的硬件设备发起的访问请求；发送单元802，用于若目标访问请求的访问地址超出第一虚拟机监视器的管理范围，则第一虚拟机监视器向第二虚拟机监视器发送指示信息，指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作。
本申请实施例中，不仅在硬件上实现了不同安全等级之间的隔离，还在软件上实现了不同安全等级之间的隔离。且获取单元801获取到目标访问请求之后，当确定目标访问请求的访问地址超出管理范围时，发送单元802会向第二虚拟机监视器发送指示信息，指示信息用于请求第二虚拟机监视器执行目标访问请求指向的访问操作，而前述过程是通过虚拟机监视器实现的，不需要对操作系统进行侵入性修改，避免了对操作系统的代码进行大量修改，也避免了降低操作系统的可维护性。
在一种可能的设计中，在车辆内的操作系统处于运行状态时，车辆中的硬件设备产生的第一类型的中断指令直通车辆内的操作系统，不同的虚拟机监视器之间采用第二类型的中断指令进行通信。
在一种可能的设计中，第二虚拟机监视器所对应的安全等级高于第一虚拟机监视器所对应的安全等级。
在一种可能的设计中，请参阅图9，图9为本申请实施例提供的第一虚拟机监视器的一种结构示意图，第一虚拟机监视器800还包括：执行单元803，用于若目标访问请求的访问地址位于第一虚拟机监视器的管理范围之内，则在第一情况下，第一虚拟机监视器采用虚拟化输入输出处理VirtIO技术执行目标访问请求指向的访问操作；执行单元，还用于在第二情况下，第一虚拟机监视器通过内置的驱动执行目标访问请求指向的访问操作。
在一种可能的设计中，VirtIO技术用于支持第一虚拟机监视器上运行的前端操作系统和后端操作系统之间共享硬件设备，后端操作系统中运行的第一线程和第二线程所对应的stage2页表不同，其中，第一线程为用于对前端操作系统和后端操作系统之间共享的硬件设备执行访问操作的线程，第二线程和第一线程为不同的线程，第一线程所对应的stage2页表中存在前端操作系统的内存地址，第二线程所对应的stage2页表中不存在前端操作系统的内存地址。
在一种可能的设计中，车辆中部署的为嵌入式的虚拟机监视器。
在一种可能的设计中，N种安全等级的硬件设备部署于硬件层，每种安全等级的硬件设备上运行有一个虚拟机监视器，不同安全等级的硬件设备上运行有不同的虚拟机监视器。
需要说明的是，虚拟机监视器800中各模块/单元之间的信息交互、执行过程等内容，与本申请中图2至图7对应的各个方法实施例基于同一构思，具体内容可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
接下来介绍本申请实施例提供的一种车辆，请参阅图10，图10为本申请实施例提供的车辆的一种结构示意图。车辆10可以被配置为完全或部分地自动驾驶模式，例如，车辆10可以在处于自动驾驶模式中的同时控制自身，并且可通过人为操作来确定车辆及其周边环境的当前状态，确定周边环境中的至少一个其他车辆的可能行为，并确定其他车辆执行可能行为的可能性相对应的置信水平，基于所确定的信息来控制车辆10。在车辆10处于自动驾驶模式中时，也可以将车辆10置为在没有和人交互的情况下操作。
车辆10可包括各种操作系统，例如行进系统100、传感器系统104、控制系统106和计算机系统112，车辆10中的多个操作系统可以运行于图1b示出的N个虚拟机监视器101上。车辆10还可以包括一个或多个外围设备108、电源110、处理器113、存储器114和用户接口116等硬件设备，车辆中的多个硬件设备可以被分为N种安全等级。可选地，车辆10可包括更多或更少的子系统，并且每个子系统可包括多个部件。另外，车辆10的每个子系统和部件可以通过有线或者无线互连。
车辆10中N个虚拟机监视器101执行车辆中数据处理方法的具体过程与本申请中图2至图7对应的各个方法实施例基于同一构思，具体内容可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
行进系统100可包括为车辆10提供动力运动的组件。在一个实施例中，行进系统100可包括引擎118、能量源119、传动装置120和车轮/轮胎121。
其中，引擎118可以是内燃引擎、电动机、空气压缩引擎或其他类型的引擎组合，例如，汽油发动机和电动机组成的混动引擎，内燃引擎和空气压缩引擎组成的混动引擎。引擎118将能量源119转换成机械能量。能量源119的示例包括汽油、柴油、其他基于石油的燃料、丙烷、其他基于压缩气体的燃料、乙醇、太阳能电池板、电池和其他电力来源。能量源119也可以为车辆10的其他系统提供能量。传动装置120可以将来自引擎118的机械动力传送到车轮121。传动装置120可包括变速箱、差速器和驱动轴。在一个实施例中，传动装置120还可以包括其他器件，比如离合器。其中，驱动轴可包括可耦合到一个或多个车轮121的一个或多个轴。
传感器系统104可包括感测关于车辆10周边的环境的信息的若干个传感器。例如，传感器系统104可包括定位系统122(定位系统可以是全球定位GPS系统，也可以是北斗系统或者其他定位系统)、惯性测量单元(inertial measurement unit，IMU)124、雷达126、激光测距仪128以及相机130。传感器系统104还可包括被监视车辆10的内部系统的传感器(例如，车内空气质量监测器、燃油量表、机油温度表等)。来自这些传感器中的一个或多个的传感数据可用于检测对象及其相应特性(位置、形状、方向、速度等)。这种检测和识别是自主车辆10的安全操作的关键功能。
其中，定位系统122可用于估计车辆10的地理位置。IMU 124用于基于惯性加速度来感知车辆10的位置和朝向变化。在一个实施例中，IMU 124可以是加速度计和陀螺仪的组合。雷达126可利用无线电信号来感知车辆10的周边环境内的物体，具体可以表现为毫米波雷达或激光雷达。在一些实施例中，除了感知物体以外，雷达126还可用于感知物体的 速度和/或前进方向。激光测距仪128可利用激光来感知车辆10所位于的环境中的物体。在一些实施例中，激光测距仪128可包括一个或多个激光源、激光扫描器以及一个或多个检测器，以及其他系统组件。相机130可用于捕捉车辆10的周边环境的多个图像。相机130可以是静态相机或视频相机。
控制系统106为控制车辆10及其组件的操作。控制系统106可包括各种部件，其中包括转向系统132、油门134、制动单元136、计算机视觉系统140、线路控制系统142以及障碍避免系统144。
其中，转向系统132可操作来调整车辆10的前进方向。例如在一个实施例中可以为方向盘系统。油门134用于控制引擎118的操作速度并进而控制车辆10的速度。制动单元136用于控制车辆10减速。制动单元136可使用摩擦力来减慢车轮121。在其他实施例中，制动单元136可将车轮121的动能转换为电流。制动单元136也可采取其他形式来减慢车轮121转速从而控制车辆10的速度。计算机视觉系统140可以操作来处理和分析由相机130捕捉的图像以便识别车辆10周边环境中的物体和/或特征。所述物体和/或特征可包括交通信号、道路边界和障碍体。计算机视觉系统140可使用物体识别算法、运动中恢复结构(Structure from Motion，SFM)算法、视频跟踪和其他计算机视觉技术。在一些实施例中，计算机视觉系统140可以用于为环境绘制地图、跟踪物体、估计物体的速度等等。线路控制系统142用于确定车辆10的行驶路线以及行驶速度。在一些实施例中，线路控制系统142可以包括横向规划模块1421和纵向规划模块1422，横向规划模块1421和纵向规划模块1422分别用于结合来自障碍避免系统144、GPS 122和一个或多个预定地图的数据为车辆10确定行驶路线和行驶速度。障碍避免系统144用于识别、评估和避免或者以其他方式越过车辆10的环境中的障碍体，前述障碍体具体可以表现为实际障碍体和可能与车辆10发生碰撞的虚拟移动体。在一个实例中，控制系统106可以增加或替换地包括除了所示出和描述的那些以外的组件。或者也可以减少一部分上述示出的组件。
车辆10可以通过外围设备108与外部传感器、其他车辆、其他计算机系统或用户之间进行交互。外围设备108可包括无线通信系统146、车载电脑148、麦克风150和/或扬声器152。在一些实施例中，外围设备108为车辆10的用户提供与用户接口116交互的手段。例如，车载电脑148可向车辆10的用户提供信息。用户接口116还可操作车载电脑148来接收用户的输入。车载电脑148可以通过触摸屏进行操作。在其他情况中，外围设备108可提供用于车辆10与位于车内的其它设备通信的手段。例如，麦克风150可从车辆10的用户接收音频(例如，语音命令或其他音频输入)。类似地，扬声器152可向车辆10的用户输出音频。无线通信系统146可以直接地或者经由通信网络来与一个或多个设备无线通信。例如，无线通信系统146可使用3G蜂窝通信，例如CDMA、EVD0、GSM/GPRS，或者4G蜂窝通信，例如LTE。或者5G蜂窝通信。无线通信系统146可利用无线局域网(wireless localarea network，WLAN)通信。在一些实施例中，无线通信系统146可利用红外链路、蓝牙或ZigBee与设备直接通信。其他无线协议，例如各种车辆通信系统，例如，无线通信系统146可包括一个或多个专用短程通信(dedicated short range communications，DSRC)设备，这些设备可包括车辆和/或路边台站之间的公共和/或私有数据通信。
电源110可向车辆10的各种组件提供电力。在一个实施例中，电源110可以为可再充电锂离子或铅酸电池。这种电池的一个或多个电池组可被配置为电源为车辆10的各种组件提供电力。在一些实施例中，电源110和能量源119可一起实现，例如一些全电动车中那样。
处理器113可以是任何常规的处理器，诸如商业可获得的中央处理器(central processing unit，CPU)。可选地，处理器113可以是诸如专用集成电路(application specific integrated circuit，ASIC)或其它基于硬件的处理器的专用设备。该处理器113、存储器114实际上可以包括不存储在相同的物理外壳内的多个处理器、或存储器。例如，存储器114可以是硬盘驱动器或位于不同于计算机系统112的外壳内的其它存储介质。因此，对处理器113或存储器114的引用将被理解为包括可以并行操作或者可以不并行操作的处理器或存储器的集合的引用。不同于使用单一的处理器来执行此处所描述的步骤，诸如转向组件和减速组件的一些组件每个都可以具有其自己的处理器，所述处理器只执行与特定于组件的功能相关的计算。
在此处所描述的各个方面中，处理器113可以位于远离车辆10并且与车辆10进行无线通信。在其它方面中，此处所描述的过程中的一些在布置于车辆10内的处理器113上执行而其它则由远程处理器113执行，包括采取执行单一操纵的必要步骤。
在一些实施例中，存储器114可包含指令(例如，程序逻辑)，指令可被处理器113执行来执行车辆10的各种功能，包括以上描述的那些功能。存储器114也可包含额外的指令，包括向行进系统100、传感器系统104、控制系统106和外围设备108中的一个或多个发送数据、从其接收数据、与其交互和/或对其进行控制的指令。除了指令115以外，存储器114还可存储数据，例如道路地图、路线信息，车辆的位置、方向、速度以及其它这样的车辆数据，以及其他信息。这种信息可在车辆10在自主、半自主和/或手动模式中操作期间被车辆10中的各个操作系统使用。用户接口116，用于向车辆10的用户提供信息或从其接收信息。可选地，用户接口116可包括在外围设备108的集合内的一个或多个输入/输出设备，例如无线通信系统146、车载电脑148、麦克风150和扬声器152。
计算机系统112可基于从各种子操作系统系统(例如，行进系统100、传感器系统104和控制系统106)以及从用户接口116接收的输入来控制车辆10的功能。例如，计算机系统112可利用来自控制系统106的输入以便控制转向系统132来避免由传感器系统104和障碍避免系统144检测到的障碍体。在一些实施例中，计算机系统112可操作来对车辆10及其子系统的许多方面提供控制。
可选地，上述这些组件中的一个或多个可与车辆10分开安装或关联。例如，存储器114可以部分或完全地与车辆10分开存在。上述组件可以按有线和/或无线方式来通信地耦合在一起。
可选地，上述组件只是一个示例，实际应用中，上述各个模块中的组件有可能根据实际需要增添或者删除，图1b不应理解为对本申请实施例的限制。在道路行进的自动驾驶车辆，如上面的车辆10，可以识别其周围环境内的物体以确定对当前速度的调整。所述物体可以是其它车辆、交通控制设备、或者其它类型的物体。在一些示例中，可以独立地考虑 每个识别的物体，并且基于物体的各自的特性，诸如它的当前速度、加速度、与车辆的间距等，可以用来确定自动驾驶车辆所要调整的速度。
可选地，车辆10或者与车辆10相关联的计算设备如图1b的计算机系统112、计算机视觉系统140、存储器114可以基于所识别的物体的特性和周围环境的状态(例如，交通、雨、道路上的冰、等等)来预测所识别的物体的行为。可选地，每一个所识别的物体都依赖于彼此的行为，因此还可以将所识别的所有物体全部一起考虑来预测单个识别的物体的行为。车辆10能够基于预测的所识别的物体的行为来调整它的速度。换句话说，车辆10能够基于所预测的物体的行为来确定车辆将需要调整到(例如，加速、减速、或者停止)什么稳定状态。在这个过程中，也可以考虑其它因素来确定车辆10的速度，诸如，车辆10在行驶的道路中的横向位置、道路的曲率、静态和动态物体的接近度等等。除了提供调整自动驾驶车辆的速度的指令之外，计算设备还可以提供修改车辆10的转向角的指令，以使得车辆10遵循给定的轨迹和/或维持与车辆10附近的物体(例如，道路上的相邻车道中的轿车)的安全横向和纵向距离。
本申请实施例中还提供一种包括计算机程序产品，计算机程序产品包括程序，当该程序在计算机上运行时，使得计算机执行如前述图2至图7所示实施例描述的方法中第一虚拟机监视器或第二虚拟机监视器所执行的步骤。
本申请实施例中还提供一种计算机可读存储介质，该计算机可读存储介质中存储有程序，当其在计算机上运行时，使得计算机执行如前述图2至图7所示实施例描述的方法中第一虚拟机监视器或第二虚拟机监视器所执行的步骤。
本申请实施例中还提供一种车辆中数据的处理系统，车辆中数据的处理系统应用于车辆中，车辆中数据的处理系统包括N个虚拟机监视器，N个虚拟机监视器与车辆中的N种安全等级的硬件设备对应，虚拟机监视器部署于虚拟化层，N为大于或等于2的整数，N个虚拟机监视器中存在第一虚拟机监视器，第一虚拟机监视器执行如前述图2至图7所示实施例描述的方法中第一虚拟机监视器所执行的步骤。
本申请实施例提供的虚拟机监视器具体可以为芯片，芯片包括：处理单元和通信单元，所述处理单元例如可以是处理器，所述通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使芯片执行上述使得计算机执行如前述图2至图7所示实施例描述的方法中第一虚拟机监视器或第二虚拟机监视器所执行的步骤。可选地，所述存储单元为所述芯片内的存储单元，如寄存器、缓存等，所述存储单元还可以是所述无线接入设备端内的位于所述芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
其中，上述任一处提到的处理器，可以是一个通用中央处理器，微处理器，ASIC，或一个或多个用于控制上述第一方面方法的程序执行的集成电路。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际 的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、ROM、RAM、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，训练设备，或者网络设备等)执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、训练设备或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、训练设备或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的训练设备、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。

Claims (17)

  1. 一种车辆中数据的处理方法，其特征在于，所述车辆包括：N种安全等级的硬件设备和与所述N种安全等级的硬件设备对应的N个虚拟机监视器，所述虚拟机监视器部署于虚拟化层，所述N为大于或等于2的整数，每个所述虚拟机监视器上运行有至少一个操作系统，所述N个虚拟机监视器包括第一虚拟机监视器和第二虚拟机监视器，所述方法包括：
    所述第一虚拟机监视器获取目标访问请求，所述目标访问请求为所述车辆内的操作系统针对所述车辆中的所述硬件设备发起的访问请求；
    若所述目标访问请求的访问地址超出所述第一虚拟机监视器的管理范围，则所述第一虚拟机监视器向所述第二虚拟机监视器发送指示信息，所述指示信息用于请求所述第二虚拟机监视器执行所述目标访问请求指向的访问操作。
  2. 根据权利要求1所述的方法，其特征在于，在所述车辆内的操作系统处于运行状态时，所述车辆中的硬件设备产生的第一类型的中断指令直通所述车辆内的操作系统，不同的所述虚拟机监视器之间采用第二类型的中断指令进行通信。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第二虚拟机监视器所对应的安全等级高于所述第一虚拟机监视器所对应的安全等级。
  4. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    若所述目标访问请求的访问地址位于所述第一虚拟机监视器的管理范围之内，则在第一情况下，所述第一虚拟机监视器采用虚拟化输入输出处理VirtIO技术执行所述目标访问请求指向的访问操作；
    在第二情况下，所述第一虚拟机监视器通过内置的驱动执行所述目标访问请求指向的访问操作。
  5. 根据权利要求4所述的方法，其特征在于，所述第一虚拟机监视器上运行的至少一个操作系统包括前端操作系统和后端操作系统，所述VirtIO技术用于支持所述第一虚拟机监视器上运行的所述前端操作系统和所述后端操作系统之间共享所述硬件设备，所述后端操作系统中运行的第一线程和第二线程所对应的stage2页表不同，其中，所述第一线程为用于对所述前端操作系统和后端操作系统之间共享的硬件设备执行访问操作的线程，所述第二线程和所述第一线程为不同的线程，所述第一线程所对应的stage2页表中存在所述前端操作系统的内存地址，所述第二线程所对应的stage2页表中不存在所述前端操作系统的内存地址。
  6. 根据权利要求1或2所述的方法，其特征在于，所述车辆中部署的为嵌入式的所述虚拟机监视器。
  7. 根据权利要求6所述的方法，其特征在于，所述N种安全等级的硬件设备部署于硬件层，每种安全等级的硬件设备上运行有一个所述虚拟机监视器，不同安全等级的硬件设备上运行有不同的所述虚拟机监视器。
  8. 一种虚拟机监视器，其特征在于，所述虚拟机监视器用于处理车辆中的数据，所述车辆包括：N种安全等级的硬件设备和与所述N种安全等级的硬件设备对应的N个虚拟机监视器，所述虚拟机监视器部署于虚拟化层，所述N为大于或等于2的整数，每个所述虚 拟机监视器上运行有至少一个操作系统，所述N个虚拟机监视器包括第一虚拟机监视器和第二虚拟机监视器，所述第一虚拟机监视器包括：
    获取单元，用于获取目标访问请求，所述目标访问请求为所述车辆内的操作系统针对所述车辆中的所述硬件设备发起的访问请求；
    发送单元，用于若所述目标访问请求的访问地址超出所述第一虚拟机监视器的管理范围，则所述第一虚拟机监视器向所述第二虚拟机监视器发送指示信息，所述指示信息用于请求所述第二虚拟机监视器执行所述目标访问请求指向的访问操作。
  9. 根据权利要求8所述的虚拟机监视器，其特征在于，在所述车辆内的操作系统处于运行状态时，所述车辆中的硬件设备产生的第一类型的中断指令直通所述车辆内的操作系统，不同的所述虚拟机监视器之间采用第二类型的中断指令进行通信。
  10. 根据权利要求8或9所述的虚拟机监视器，其特征在于，所述第二虚拟机监视器所对应的安全等级高于所述第一虚拟机监视器所对应的安全等级。
  11. 根据权利要求8或9所述的虚拟机监视器，其特征在于，所述第一虚拟机监视器还包括：
    执行单元，用于若所述目标访问请求的访问地址位于所述第一虚拟机监视器的管理范围之内，则在第一情况下，所述第一虚拟机监视器采用虚拟化输入输出处理VirtIO技术执行所述目标访问请求指向的访问操作；
    所述执行单元，还用于在第二情况下，所述第一虚拟机监视器通过内置的驱动执行所述目标访问请求指向的访问操作。
  12. 根据权利要求11所述的虚拟机监视器，其特征在于，所述第一虚拟机监视器上运行的至少一个操作系统包括前端操作系统和后端操作系统，所述VirtIO技术用于支持所述第一虚拟机监视器上运行的所述前端操作系统和所述后端操作系统之间共享所述硬件设备，所述后端操作系统中运行的第一线程和第二线程所对应的stage2页表不同，其中，所述第一线程为用于对所述前端操作系统和后端操作系统之间共享的硬件设备执行访问操作的线程，所述第二线程和所述第一线程为不同的线程，所述第一线程所对应的stage2页表中存在所述前端操作系统的内存地址，所述第二线程所对应的stage2页表中不存在所述前端操作系统的内存地址。
  13. 根据权利要求8或9所述的虚拟机监视器，其特征在于，所述车辆中部署的为嵌入式的所述虚拟机监视器。
  14. 一种计算机程序产品，其特征在于，所述计算机程序产品包括程序，当所述程序在计算机上运行时，使得计算机执行如权利要求1至7中任一项所述的方法。
  15. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有程序，当所述程序在计算机上运行时，使得计算机执行如权利要求1至7中任一项所述的方法。
  16. 一种车辆中数据的处理系统，其特征在于，所述车辆中数据的处理系统应用于车辆中，所述车辆中数据的处理系统包括N个虚拟机监视器，所述N个虚拟机监视器与所述车辆中的N种安全等级的硬件设备对应，所述虚拟机监视器部署于虚拟化层，所述N为大于或等于2的整数，所述N个虚拟机监视器中存在第一虚拟机监视器，所述第一虚拟机监视 器执行如权利要求1至7中任一项所述的方法中所述第一虚拟机监视器执行的步骤。
  17. 一种车辆，其特征在于，所述车辆包括：N种安全等级的硬件设备和与所述N种安全等级的硬件设备对应的N个虚拟机监视器，所述虚拟机监视器部署于所述车辆的虚拟化层，所述N为大于或等于2的整数，所述N个虚拟机监视器中存在第一虚拟机监视器，所述第一虚拟机监视器执行如权利要求1至7中任一项所述的方法中所述第一虚拟机监视器执行的步骤。
PCT/CN2022/137880 2022-04-21 2022-12-09 一种车辆中数据的处理方法以及相关设备 WO2023202096A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210421778.4 2022-04-21
CN202210421778.4A CN114880658A (zh) 2022-04-21 2022-04-21 一种车辆中数据的处理方法以及相关设备

Publications (1)

Publication Number Publication Date
WO2023202096A1 true WO2023202096A1 (zh) 2023-10-26

Family

ID=82671310

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/137880 WO2023202096A1 (zh) 2022-04-21 2022-12-09 一种车辆中数据的处理方法以及相关设备

Country Status (2)

Country Link
CN (1) CN114880658A (zh)
WO (1) WO2023202096A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114880658A (zh) * 2022-04-21 2022-08-09 华为技术有限公司 一种车辆中数据的处理方法以及相关设备
CN118474027B (zh) * 2024-07-09 2024-10-29 比亚迪股份有限公司 通信方法、电子装置、车辆和存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101059761A (zh) * 2006-04-20 2007-10-24 联想(北京)有限公司 一种虚拟机系统及其硬件设备访问方法
CN101520738A (zh) * 2008-02-27 2009-09-02 黄歆媚 基于设备访存管理技术的虚拟机系统及其设备访问方法
CN106844007A (zh) * 2016-12-29 2017-06-13 中国科学院计算技术研究所 一种基于空间复用的虚拟化方法与系统
CN110442425A (zh) * 2019-07-19 2019-11-12 南京芯驰半导体科技有限公司 一种虚拟化地址空间隔离系统及方法
CN110531733A (zh) * 2018-05-25 2019-12-03 Tttech汽车股份公司 用于高度集成汽车系统的方法、设备和实时网络
CN113312155A (zh) * 2021-07-29 2021-08-27 阿里云计算有限公司 虚拟机创建方法、装置、设备、系统及计算机程序产品
CN114880658A (zh) * 2022-04-21 2022-08-09 华为技术有限公司 一种车辆中数据的处理方法以及相关设备

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101059761A (zh) * 2006-04-20 2007-10-24 联想(北京)有限公司 一种虚拟机系统及其硬件设备访问方法
CN101520738A (zh) * 2008-02-27 2009-09-02 黄歆媚 基于设备访存管理技术的虚拟机系统及其设备访问方法
CN106844007A (zh) * 2016-12-29 2017-06-13 中国科学院计算技术研究所 一种基于空间复用的虚拟化方法与系统
CN110531733A (zh) * 2018-05-25 2019-12-03 Tttech汽车股份公司 用于高度集成汽车系统的方法、设备和实时网络
CN110442425A (zh) * 2019-07-19 2019-11-12 南京芯驰半导体科技有限公司 一种虚拟化地址空间隔离系统及方法
CN113312155A (zh) * 2021-07-29 2021-08-27 阿里云计算有限公司 虚拟机创建方法、装置、设备、系统及计算机程序产品
CN114880658A (zh) * 2022-04-21 2022-08-09 华为技术有限公司 一种车辆中数据的处理方法以及相关设备

Also Published As

Publication number Publication date
CN114880658A (zh) 2022-08-09

Similar Documents

Publication Publication Date Title
WO2023202096A1 (zh) 一种车辆中数据的处理方法以及相关设备
WO2021052213A1 (zh) 调整油门踏板特性的方法和装置
WO2021212379A1 (zh) 车道线检测方法及装置
WO2023051591A1 (zh) 一种进程间通信方法及相关装置
WO2022000448A1 (zh) 车内隔空手势的交互方法、电子装置及系统
EP4207134A1 (en) Parking control method and related device
JP6831474B2 (ja) センサ間でデータを伝送するためのデータ伝送ロジック並びに自動運転車の計画及び制御
WO2022000127A1 (zh) 一种目标跟踪方法及其装置
US20230249660A1 (en) Electronic Mechanical Braking Method and Electronic Mechanical Braking Apparatus
WO2021103536A1 (zh) 一种车辆调控方法、装置及电子设备
CN114779790A (zh) 识别障碍物方法、装置、车辆、服务器、存储介质及芯片
WO2022022344A1 (zh) 一种自动驾驶行车控制方法及装置
CN113859265A (zh) 一种驾驶过程中的提醒方法及设备
CN115179879B (zh) 车辆自唤醒方法、装置、车辆及存储介质
US20220309806A1 (en) Road structure detection method and apparatus
EP4159564A1 (en) Method and device for planning vehicle longitudinal motion parameters
WO2021217646A1 (zh) 检测车辆可通行区域的方法及装置
EP4383110A1 (en) Data processing method and related apparatus
EP4209901A1 (en) Multi-task deployment method and apparatus
WO2022110779A1 (zh) 液冷系统、应用在液冷系统的控制方法、控制装置及车辆
US20230256970A1 (en) Lane Change Track Planning Method and Apparatus
CN115056784B (zh) 车辆控制方法、装置、车辆、存储介质及芯片
CN115334109A (zh) 用于交通信号识别的系统架构、传输方法，车辆，介质及芯片
CN115237630B (zh) 数据处理方法、装置、车辆、存储介质及芯片
WO2024055252A1 (zh) 一种数据融合方法、装置及智能驾驶设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22938314

Country of ref document: EP

Kind code of ref document: A1