JP2023032307A - Virtualization control device and interrupt control method - Google Patents

Abstract

To allow for providing flexible and appropriate interrupt control when allowing multiple VMs to coexist.SOLUTION: A virtualization control device according to an embodiment is configured to make one processor operate multiple virtual machines while switching them in a time-division manner, and comprises an interrupt control unit. The interrupt control unit provides different interrupt control according to importance of each interrupt disable process executed by the virtual machines.SELECTED DRAWING: Figure 6

Description

The disclosed embodiments relate to a virtualization controller and an interrupt control method.

2. Description of the Related Art Conventionally, an ECU (Electronic Control Unit) is known, which is mounted on a vehicle, for example, and electronically controls various systems of the vehicle such as an engine and a transmission. In such an ECU, a built-in microcomputer executes control programs for the various systems described above, thereby realizing various assigned functions.

Further, in recent years, studies are underway to reduce the number of ECUs and integrate ECUs to realize a plurality of electronic controls with a single ECU. One of the methods of ECU integration is the use of virtualization technology. As virtualization technology, there is a virtualization control that operates a plurality of virtual machines (VMs) on a one-core microcomputer while switching them in a time-sharing manner (see, for example, Patent Document 1).

Also in this kind of virtualization control, for processing that occurs in each VM, interrupt prohibition processing is performed so that an interrupt (for example, switching to another VM) does not occur during processing, and then the processing is executed. Interrupt control is performed.

JP 2009-070014 A

However, the conventional technology described above has room for further improvement in terms of realizing flexible and appropriate interrupt control when multiple VMs coexist.

One aspect of the embodiments has been made in view of the above, and aims to provide a virtualization control device and an interrupt control method capable of realizing flexible and appropriate interrupt control when a plurality of VMs coexist. aim.

A virtualization control device according to an aspect of an embodiment is a virtualization control device that causes a single processor to operate a plurality of virtual machines while switching them in a time-sharing manner, and includes an interrupt control unit. The interrupt control unit executes different interrupt control according to the importance of each interrupt disabled process executed by the virtual machine.

According to one aspect of the embodiments, it is possible to implement flexible and appropriate interrupt control when multiple VMs coexist.

FIG. 1 is a schematic explanatory diagram (Part 1) of the interrupt control method according to the embodiment. FIG. 2 is a schematic explanatory diagram (Part 2) of the interrupt control method according to the embodiment. FIG. 3 is a schematic explanatory diagram (Part 3) of the interrupt control method according to the embodiment. FIG. 4 is a schematic explanatory diagram (part 4) of the interrupt control method according to the embodiment. FIG. 5 is a schematic explanatory diagram (No. 5) of the interrupt control method according to the embodiment. FIG. 6 is a block diagram showing a configuration example of an ECU according to the embodiment. FIG. 7 is an explanatory diagram of levels of interrupt prohibition processing. FIG. 8 is a processing explanatory diagram of level 1 interrupt prohibition processing. FIG. 9 is a flow chart showing a processing procedure of level 1 interrupt prohibition processing. FIG. 10 is a processing explanatory diagram of level 2 interrupt prohibition processing. FIG. 11 is a flow chart showing a processing procedure of level 2 interrupt prohibition processing. FIG. 12 is a processing explanatory diagram of level 3 interrupt prohibition processing. FIG. 13 is a flow chart showing a processing procedure of level 3 interrupt prohibition processing.

Hereinafter, embodiments of a virtualization control device and an interrupt control method disclosed in the present application will be described in detail with reference to the accompanying drawings. In addition, this invention is not limited by embodiment shown below.

1 to 5, an ECU 10 (corresponding to an example of a “virtualization control device”) to which the interrupt control method according to the embodiment is applied. A configuration example of is described with reference to FIGS. 6 to 13. FIG.

First, an outline of an interrupt control method according to this embodiment will be described with reference to FIGS. 1 to 5. FIG. 1 to 5 are schematic explanatory diagrams (part 1) to (part 5) of the interrupt control method according to the embodiment.

In a virtualization control device that executes virtualization control, it is possible for a plurality of ASIL controls to coexist with respect to the safety requirement level (ASIL: Automotive Safety Integrity Level) conforming to ISO26262, for example.

For example, regarding ASIL, when each control of different levels is implemented in one ECU 10, existing technology includes a method by "multi-core separation" as shown in the left diagram of FIG. In such a case, each control is implemented for each physically separated core, and execution spaces including core space and memory space are also physically separated between controls.

On the other hand, from the viewpoint of ECU integration, as shown in the right figure of FIG. In such a case, virtualization control that operates multiple VMs on a single core allows different levels of ASIL control to coexist on a single core.

However, when "virtual separation" is used, the aforementioned execution space is virtually separated between controls (VMs, etc.). For example, as shown in FIG. 2, the execution space is basically assigned to each control by switching control by time division (1 ms period here). That is, control is performed to switch the VM to be executed in a time division manner.

Therefore, when "virtualization separation" is used, as shown in FIG. is likely to be affected by the shortening of the processing time in one allocated cycle.

Therefore, an interrupt control method according to an embodiment is an interrupt control method using a virtualization control device that causes a plurality of VMs to operate while virtually switching a plurality of execution spaces by a single processor in a time-division manner. Different interrupt control is executed according to the importance of each interrupt disabled process to be executed.

Specifically, as shown in FIG. 4, in the interrupt control method according to the embodiment, interrupt prohibition processing executed by each VM is classified into levels according to the degree of importance. In this embodiment, the importance is divided into three levels of levels 1-3.

Then, in the interrupt control method according to the embodiment, different interrupt control is performed according to the degree of importance of such interrupt prohibition processing.

For example, as shown in FIG. 3, the interrupt disabling process that is permitted to be executed at any timing, and the interrupt disabling process that disables interrupts for other VMs is the interrupt disabling process according to the embodiment, as shown in FIG. The control method is limited only to execution of level 3 interrupt disabling processing, which has the highest level of importance.

Level 3 interrupt prohibition processing is processing that must be executed immediately by the ECU system, for example, when an abnormality occurs. The details of the contents of levels 1 to 3 and the contents of control corresponding to them will be described later with reference to FIG.

Note that, in the interrupt control method according to the embodiment, as shown in FIG. 5, each API (Application Programming Interface) for disabling interrupts/disabling interrupts according to each level is provided, and these are implemented in each VM process according to the application. Interrupt control corresponding to each level is realized by using each level properly. The details of the contents of the interrupt control according to each level will be described later with reference to FIG. 8 and subsequent figures.

As described above, the interrupt control method according to the embodiment is an interrupt control method using a virtualization control device that operates a plurality of VMs while virtually switching a plurality of execution spaces in a time division with one processor, Different interrupt control is executed according to the importance of each interrupt disabled process executed by the VM.

Therefore, according to the interrupt control method according to the embodiment, it is possible to implement flexible and appropriate interrupt control when a plurality of VMs coexist.

A configuration example of the ECU 10 to which the interrupt control method according to the above-described embodiment is applied will now be described more specifically.

FIG. 6 is a block diagram showing a configuration example of the ECU 10 according to the embodiment. It should be noted that FIG. 6 shows only the components necessary for explaining the features of the present embodiment by functional blocks, and omits the description of general components.

In other words, each component illustrated in FIG. 6 is functionally conceptual and does not necessarily need to be physically configured as illustrated. For example, the specific forms of distribution and integration of each functional block are not limited to those shown in the figure, and all or part of them can be functionally or physically distributed in arbitrary units according to various loads and usage conditions.・It is possible to integrate and configure.

In addition, in the description using FIG. 6, the description of components that have already been described may be simplified or omitted.

As shown in FIG. 6, the ECU 10 includes a timer 11, a storage section 12, and a control section 13. A timer 11 is a real-time clock mounted on the ECU 10 .

The storage unit 12 is realized by semiconductor memory devices such as RAM (Random Access Memory), ROM (Read Only Memory), and flash memory. Storage unit 12 includes a register and a cache.

In the example of FIG. 6, the storage unit 12 stores time division information 12a, a VM processing program 12b, interrupt disable level information 12c, a program counter 12d, threshold information 12e, and an interrupt disable processing library 12f. do.

The time-division information 12a is information in which a time-division cycle for performing switching control for switching each VM is set. The VM processing program 12b is a program for executing VM processing that implements electronic control functions assigned to each VM.

The interrupt prohibition level information 12c is information in which the importance of each interrupt prohibition process executed in each VM process, the processing time of each interrupt prohibition process, and the like are set in advance.

Here, each level of the interrupt prohibition process and the contents of control according to the level will be described with reference to FIG. FIG. 7 is an explanatory diagram of levels of interrupt prohibition processing.

As shown in FIG. 7, in this embodiment, the interrupt prohibition process is classified into three levels according to the degree of importance. As shown in FIG. 4, the importance increases from level 1 to level 3 in order.

As shown in FIG. 7, level 1 interrupt disabling processing is processing that affects only the own VM. Therefore, the content of interrupt control at level 1 is to disable interrupts only within the processing of the own VM. Also, as shown in the contents of the switching control, at level 1, when the time-division cycle arrives, the allocation of the execution space is switched to another VM. Supplementally, in level 1 interrupt disabling processing, even if you switch to another VM, the interrupt disabling time is retained. processing takes place.

Also, the level 2 interrupt prohibition process is a process that affects the ECU system when switching to another VM during the process. In such a case, the content of the interrupt control is to prohibit interrupts if it can be executed within the remaining time of the own VM processing. On the other hand, if it cannot be executed within the remaining time, it will be put on hold until its own VM processing in the next cycle. Therefore, when the time division cycle arrives, the allocation of the execution space is switched to another VM. Supplementally, in the level 2 interrupt disabling process, unlike the level 1 interrupt disabling process, when interrupts are disabled, not only the processing in the own VM, but all processing including VM switching are interrupted. restrict.

As already mentioned, the level 3 interrupt prohibition process is a process that must be executed immediately by the ECU system, for example, when an abnormality occurs. In such a case, the contents of interrupt control are set to disable interrupts for all VMs including other VMs. Also, even when the time division cycle arrives, the allocation of the execution space is not switched to another VM. Supplementally, in level 3 interrupt disabling processing, unlike level 2 interrupt disabling processing, interrupt disabling processing is permitted at any timing, that is, interrupt disabling processing is immediately executed with the highest priority.

Returning to the description of FIG. The program counter 12d is an address register for each VM process being executed. The threshold information 12e is information including a threshold and the like used for remaining time determination at level 2 described above. The interrupt disable processing library 12f is a library containing programs and the like corresponding to each API described above.

The control unit 13 is a controller, and various programs stored in the storage unit 12 are executed by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, using the RAM as a work area. It is realized by Also, the control unit 13 can be implemented by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

The control unit 13 has a switching control unit 13a and a plurality of VM processing units 13b, and implements or executes information processing functions and actions described below.

The switching control unit 13a performs switching control to allocate an execution space to each VM processing unit 13b in a time division manner based on a signal from the timer 11 and the time division information 12a.

Each VM processing unit 13b executes its assigned VM processing based on the VM processing program 12b. Each VM processing unit 13b has a main processing unit 13ba, an interrupt control unit 13bb, an acquisition unit 13bc, a determination unit 13bd, and an interrupt prohibition processing unit 13be.

The main processing unit 13ba executes the main processing of each VM processing based on the VM processing program 12b. Further, the main processing unit 13ba notifies the interrupt control unit 13bb of the corresponding interrupt prohibition processing when the interrupt prohibition processing should be executed during the main processing.

The interrupt control unit 13bb extracts the level of the corresponding interrupt prohibition process based on the interrupt prohibition level information 12c when the interrupt prohibition process to be executed is notified.

Further, when the level of the extracted interrupt prohibition processing is level 1 or level 3, the interrupt control unit 13bb causes the interrupt prohibition processing unit 13be to execute the interrupt prohibition processing corresponding to level 1 or level 3.

Further, when the level of the extracted interrupt prohibition processing is level 2, the interrupt control unit 13bb performs the interrupt prohibition processing corresponding to the level 2 through each process of the acquisition unit 13bc and the determination unit 13bd. The processing unit 13be is made to execute.

The acquisition unit 13bc acquires the signal from the timer 11, the processing time of the interrupt prohibition process set in the interrupt prohibition level information 12c, and the contents of the program counter 12d.

The determination unit 13bd determines the remaining time at level 2 described above based on the information acquired by the acquisition unit 13bc and the threshold information 12e. The determination unit 13bd causes the interrupt prohibition processing unit 13be to execute the corresponding interrupt prohibition process if it can be executed within the remaining time of the own VM process.

The interrupt disabling processing unit 13be executes interrupt disabling processing according to the level based on the interrupt disabling processing library 12f while selectively using the above-described API according to the level of the applicable interrupt disabling processing.

Further, the interrupt prohibition processing unit 13be causes the switching control unit 13a to perform switching control according to each level of interrupt prohibition processing to be executed.

Next, the details of interrupt prohibition processing corresponding to each level of interrupt prohibition processing will be described with reference to FIGS. 8 to 13. FIG. First, level 1 will be explained. FIG. 8 is a processing explanatory diagram of level 1 interrupt prohibition processing. FIG. 9 is a flow chart showing the processing procedure of level 1 interrupt prohibition processing.

As shown in FIG. 8, it is assumed that VM#0 needs to execute interrupt disabling processing in the middle of cycle C1 in which the execution space is allocated to itself, and the interrupt disabling processing level is level 1. .

In this case, as shown in FIG. 8, the interrupt prohibition processing unit 13be of VM#0 executes the level 1 interrupt prohibition control shown in FIG. 7 by the level 1 interrupt prohibition API in cycle C1. That is, the interrupt prohibition processing unit 13be of VM#0 executes interrupt prohibition processing so that interrupts are prohibited only in the process of its own VM.

Therefore, as shown in FIG. 8, when the cycle C2 arrives in the middle of the interrupt prohibition processing, the interrupt prohibition processing unit 13be of the VM#0 switches the switching control to allocate the execution space to the VM#1 as usual. 13a to execute. As a result, the interrupt prohibition processing by the interrupt prohibition processing unit 13be of the VM#0 is temporarily stopped during the cycle C2.

Then, when the cycle C3 arrives and the execution space is allocated to its own VM, the interrupt prohibition processing unit 13be of the VM#0 restarts the interrupt prohibition processing that has been temporarily stopped. When the interrupt disabling process ends, the interrupt disabling processing unit 13be of VM#0 cancels the interrupt disabling in its own VM process by the level 1 interrupt disabling cancellation API.

That is, as shown in FIG. 9, in the level 1 interrupt prohibition process, the own VM interrupt prohibition process is executed (step S101). Then, in the level 1 interrupt prohibition release process, self VM interrupt prohibition release process is executed (step S102).

Next, level 2 will be explained. FIG. 10 is a processing explanatory diagram of level 2 interrupt prohibition processing. FIG. 11 is a flow chart showing the processing procedure of level 2 interrupt prohibition processing.

As shown in FIG. 10, it is assumed that VM#0 needs to execute interrupt disabling processing in the middle of cycle C1, and the interrupt disabling processing level is level 2. FIG.

In such a case, as shown in FIG. 10, the interrupt prohibition processing unit 13be of VM#0 executes the interrupt prohibition processing using the level 2 interrupt prohibition API if the interrupt prohibition processing can be performed within the remaining time of the cycle C1.

Then, when the interrupt prohibition processing is completed, the interrupt prohibition processing unit 13be of VM#0 cancels the interrupt prohibition by the level 2 interrupt prohibition release API, and performs switching control to allocate the execution space to VM#1 as usual. The part 13a is made to execute.

On the other hand, if the level 2 interrupt prohibition processing cannot be executed within the remaining time of the cycle C1, the interrupt prohibition processing unit 13be of the VM#0 suspends the interrupt prohibition processing until the next cycle C3. Then, when the next cycle C3 arrives, the interrupt prohibition processing unit 13be of VM#0 executes the suspended interrupt prohibition processing using the level 2 interrupt prohibition API. Then, when the interrupt disabling process ends, the interrupt disabling is released by the level 2 interrupt disabling API.

That is, as illustrated in FIG. 11 , in the level 2 interrupt prohibition processing, the acquisition unit 13bc acquires the remaining time of the own VM (step S201), and the determination unit 13bd determines that the remaining time of the own VM is interrupt prohibition. It is determined whether or not it is longer than the processing time (step S202).

If the self-VM remaining time is longer (step S202, Yes), self-VM interrupt prohibition processing is executed (step S203). If the remaining time of the own VM is shorter (step S202, No), the own VM interrupt disable processing is suspended until the end of the own VM, that is, until the next period C3 (step S204).

Then, in the level 2 interrupt prohibition release process, self VM interrupt prohibition release process is executed (step S205).

Next, level 3 will be explained. FIG. 12 is a processing explanatory diagram of level 3 interrupt prohibition processing. FIG. 13 is a flow chart showing the processing procedure of level 3 interrupt prohibition processing.

As shown in FIG. 12, it is assumed that VM#0 needs to execute interrupt disabling processing in the middle of cycle C1, and the interrupt disabling processing level is level 3. FIG.

In this case, as shown in FIG. 12, the interrupt prohibition processing unit 13be of VM#0 executes the level 3 interrupt prohibition control shown in FIG. 7 by the level 3 interrupt prohibition API in cycle C1. That is, the interrupt prohibition processing unit 13be of VM#0 executes interrupt prohibition processing so that interrupts are prohibited for all VMs including other VMs.

Therefore, as shown in FIG. 12, even if the cycle C2 arrives in the middle of the interrupt prohibition process, the interrupt prohibition processing unit 13be of VM#0 switches the execution space allocation to VM#1 to the switching control unit 13a. do not let the As a result, the execution space is continuously allocated to VM#0 during the interrupt prohibition processing by the interrupt prohibition processing unit 13be of VM#0.

Then, when the interrupt prohibition processing is completed, the interrupt prohibition processing unit 13be of VM#0 cancels the interrupt prohibition by the level 3 interrupt prohibition release API, and switches the switching control to allocate the execution space to VM#1. to execute.

That is, as shown in FIG. 13, in level 3 interrupt prohibition processing, all interrupt prohibition processing is executed to prohibit interrupts from all VMs including other VMs (step S301). Then, in the level 3 interrupt prohibition release process, all interrupt prohibition release process is executed (step S302).

As described above, the ECU 10 according to the embodiment is a virtualization control device that allows one control unit 13 (equivalent to an example of a "processor") to operate a plurality of VMs while switching them in a time-sharing manner. 13bb. The interrupt control unit 13bb executes interrupt control that differs according to the importance of each interrupt prohibition process executed by the VM.

Therefore, according to the ECU 10 according to the embodiment, it is possible to realize flexible and appropriate interrupt control when a plurality of VMs coexist.

Further, the interrupt control unit 13bb, when the importance is level 1 (equivalent to an example of the "first importance"), disables the interrupt only in the VM that executes the interrupt disabling process. Execute interrupt disable processing.

Therefore, according to the ECU 10 according to the embodiment, when the interrupt prohibition processing is level 1 and affects only the own VM, flexible and appropriate interrupt control is realized without affecting the VM processing of other VMs. can do.

Further, when the importance is level 2 higher than level 1 (corresponding to an example of “second importance”), the interrupt control unit 13bb disables the interrupt before the next VM switching cycle. If it is determined that the processing will not end, the interrupt disabled processing is put on hold until an execution space is allocated to the interrupt disabled processing next time.

Therefore, according to the ECU 10 according to the embodiment, if the interrupt prohibition processing is level 2 and switching to another VM during processing may affect the ECU system, the ECU 10 prevents switching to another VM during processing. can be caused to execute the above-described interrupt prohibition processing.

Further, the interrupt control unit 13bb disables interrupts so that interrupts are disabled for all VMs when the importance is level 3 higher than level 2 (corresponding to an example of "third importance"). Let the process run.

Therefore, according to the ECU 10 according to the embodiment, when the interrupt prohibition process is level 3 and the process needs to be executed immediately by the ECU system, for example, when an abnormality occurs, another The interrupt prohibition process can be executed without interrupting.

Further, when the importance level is level 3, the interrupt control unit 13bb prohibits switching of VMs until the interrupt prohibition process is completed and interrupt prohibition for all the VMs is released.

Therefore, according to the ECU 10 according to the embodiment, when the interrupt prohibition process is at level 3, the interrupt prohibition process can be continuously executed to the end without switching the VM.

In the above-described embodiment, the importance of interrupt prohibition processing is divided into three levels, but a plurality of levels may be used. Therefore, it may be two, or four or more.

Also, in the above-described embodiment, two VMs are mainly exemplified, but the number of VMs may be any number as long as it is plural, and therefore may be three or more.

Further, in the above-described embodiment, the ECU 10 is used as an example of a virtual control device, but any computer having one core may be used, and other electronic control devices other than the ECU 10 may be used. Moreover, it is not necessary to be limited to what is mounted in a vehicle.

Further, the interrupt prohibition process according to the embodiment may be a process of prohibiting an interrupt of another interrupt process when an interrupt process is performed in response to an interrupt request. Alternatively, it may be a process for prohibiting an interrupt by an interrupt process.

Also, the switching cycle of each VM (the time allocated to each VM) in time-sharing may be the same for all VMs, or may be different. For example, a VM with a larger amount of processing than other VMs has a longer switching period (allocation time) than other VMs.

Further effects and modifications can be easily derived by those skilled in the art. Therefore, the broader aspects of the invention are not limited to the specific details and representative embodiments so shown and described. Accordingly, various changes may be made without departing from the spirit or scope of the general inventive concept defined by the appended claims and equivalents thereof.

1 in-vehicle system 10 ECU
11 timer 12 storage unit 12a time division information 12b VM processing program 12c interrupt inhibition level information 12d program counter 12e threshold information 12f interrupt inhibition processing library 13 control unit 13a switching control unit 13b VM processing unit 13ba main processing unit 13bb interrupt control unit 13bc acquisition Section 13bd Determining Section 13be Interrupt Disabling Processing Section

Claims (6)

A virtualization control device that operates a plurality of virtual machines while switching them in a time division manner with one processor,
A virtualization control device comprising: an interrupt control unit that executes different interrupt control according to the importance of each interrupt disabled process executed by the virtual machine. The interrupt control unit
2. The method according to claim 1, wherein when the importance is the first importance, the interrupt prohibition processing is executed so that the interrupt is prohibited only in the virtual machine that executes the interrupt prohibition processing. virtualization controller. The interrupt control unit
When the importance is a second importance higher than the first importance, if it is determined that the interrupt prohibition processing will not end by the arrival of the next switching cycle of the virtual machine, the 3. The virtualization control device according to claim 2, wherein the interrupt disabled process is put on hold until an execution space is allocated to the interrupt disabled process next time. The interrupt control unit
3. When the importance is a third importance higher than the second importance, the interrupt disabling process is executed so as to disable interrupts for all of the virtual machines. The virtualization control device according to . The interrupt control unit
When the importance is the third importance, the switching of the virtual machines is prohibited until the interrupt prohibition processing is completed and the interrupt prohibition for all the virtual machines is released. 5. The virtualization control device according to claim 4. An interrupt control method using a virtualization control device for operating a plurality of virtual machines while switching them in a time division manner with one processor,
An interrupt control method, comprising: an interrupt control step of executing different interrupt control depending on the importance of each interrupt disabled process executed by the virtual machine.

Images