WO2023185478A1 - 应用程序间通信方法、装置、存储介质及程序产品 - Google Patents

应用程序间通信方法、装置、存储介质及程序产品 Download PDF

Info

Publication number
WO2023185478A1
WO2023185478A1 PCT/CN2023/081645 CN2023081645W WO2023185478A1 WO 2023185478 A1 WO2023185478 A1 WO 2023185478A1 CN 2023081645 W CN2023081645 W CN 2023081645W WO 2023185478 A1 WO2023185478 A1 WO 2023185478A1
Authority
WO
WIPO (PCT)
Prior art keywords
application program
command
application
virtual device
agent module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/081645
Other languages
English (en)
French (fr)
Inventor
白卫华
肖威
柴先平
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP23777853.5A priority Critical patent/EP4468154A4/en
Publication of WO2023185478A1 publication Critical patent/WO2023185478A1/zh
Anticipated expiration legal-status Critical
Priority to US18/902,735 priority patent/US12591451B2/en
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4812—Task transfer initiation or dispatching by interrupt, e.g. masked
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
    • G06F9/4881—Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/544—Buffers; Shared memory; Pipes

Definitions

  • the present application relates to the field of communications, and in particular to an inter-application communication method, device, storage medium and program product.
  • embedded systems In response to different business needs, embedded systems usually use virtualization technology to deploy multiple different types of operating systems, such as real-time operating systems, control operating systems, security operating systems, etc.
  • a virtual machine monitor On a physical machine, a virtual machine monitor is used to simultaneously manage and run multiple operating systems mentioned above, that is, run multiple virtual machines, and run different types of services in different virtual machines according to needs.
  • the physical machine is also called a host machine.
  • multiple virtual machines run by a physical machine can also be called guest machines.
  • an inter-application communication method, device, storage medium and program product are proposed.
  • rapid communication between virtual machine services and physical machine services can be achieved , improve the communication efficiency of electronic equipment.
  • embodiments of the present application provide an inter-application communication method.
  • the method is applied to an electronic device.
  • the electronic device includes a first virtual device and a second virtual device.
  • the first virtual device and the One of the second virtual devices is a virtual machine and the other is a physical machine.
  • the method includes: the first virtual device writes the first command to the first command queue according to the first request issued by the first application. command, the first request and the first command include the identification of the second application program on the second virtual device; the first virtual device outputs a first inter-core interrupt to the location where the second virtual device is located.
  • the second virtual device can obtain the first inter-core interrupt; the second virtual device obtains the first command from the first command queue according to the first inter-core interrupt; the The second virtual device runs the second application program according to the identification of the second application program in the first command.
  • the first virtual device writes the first command to the first command queue according to the first request issued by the first application, and outputs the first inter-core interrupt to the second virtual device.
  • a core where the device is located so that the second virtual device can obtain the first inter-core interrupt and obtain the first command from the first command queue according to the first inter-core interrupt, Communication from the first virtual device to the second virtual device may be implemented; the first command is written according to the first request from the first application and includes an identification of the second application on the second virtual device, such that the second The virtual device can run the second application program according to the identification of the second application program in the first command, thereby enabling communication between the application program of the first virtual device and the application program of the second virtual device.
  • the physical machine and the virtual machine use a method of directly outputting inter-core interrupts to the core where the object to be communicated is located.
  • the use of the virtual interrupt controller can be avoided, thereby avoiding the trapping and exiting of the virtual machine, enabling fast communication between the virtual machine's business and the physical machine's business, and improving the communication efficiency of electronic equipment.
  • the first virtual device further includes a first agent module, and the first virtual device responds to a first request sent by the first application program.
  • a request to write a first command into the first command queue includes: the first agent module receiving the first request sent by the first application program; the first agent module responding to the first request , writing the first command into the first command queue; the first virtual device outputs a first inter-core interrupt to the core where the second virtual device is located, including: the first agent module outputs the first inter-core interrupt.
  • the first inter-core interrupt is sent to the core where the second virtual device is located.
  • the first agent module can be used to complete part of the work related to the first application program, preventing the first application program from directly exchanging data with the second virtual device itself, ensuring the security of the operation of the first application program, and at the same time Reduced data processing costs for first applications.
  • the second virtual device further includes a second agent module, and the The second virtual device obtains the first command from the first command queue according to the first inter-core interrupt, including: the second agent module obtains the first command from the first command queue according to the first inter-core interrupt.
  • the first command; the second virtual device running the second application program according to the identification of the second application program in the first command includes: the second agent module according to the first command, The identity of the second application program runs the second application program.
  • the second agent module can be used to complete part of the work related to the second application, preventing the second application from directly exchanging data with the first virtual device itself, ensuring the security of the second application's operation, and at the same time Reduced data processing costs for secondary applications.
  • the first request and the first command further include the Blocking information of the first application program.
  • the method further includes: the first application program enters a blocking state; after receiving the first request When there is an inter-core interrupt, the first agent module obtains the second command from the second command queue according to the second inter-core interrupt, and the second inter-core interrupt is generated after the second application program finishes running; in When the second command includes the identification of the first application program, the first agent module releases the blocking state of the first application program.
  • the second virtual device performs the following tasks according to the first command, the second application After running the second application program, the method further includes: after the second application program finishes running, the second proxy module receives a second request sent by the second application program.
  • the second request includes the identification of the first application; the second generation The management module writes the second command to the second command queue according to the second request, where the second command includes the identification of the first application; the second agent module outputs the first
  • the inter-core interrupt is sent to the core where the first virtual device is located, so that the first virtual device can obtain the second inter-core interrupt.
  • the second agent module can determine that it is the first application that needs to be notified after the second agent module is finished running, so that the first agent module can release the blocking state of the first application according to the second command, so as to It is guaranteed that when the first application program is released from the blocking state, the second application program has indeed finished running, thereby meeting the first application program's need to wait for the second application program to finish running and then continue running.
  • the first agent module Writing the first command into the first command queue according to the first request includes: the first agent module determining whether the second application has notification permission according to the first request; When the second application has notification permission, the first command is written into the first command queue.
  • the first virtual device According to the first request issued by the first application program, before writing the first command to the first command queue, the method further includes: in response to the request of the first application program, the first virtual device creates Shared memory, the first agent module establishes an association between the address of the first application program and the address of the shared memory; the first request and the first command also include parameters of the shared memory; in When the second command includes the identification of the first application, the first agent module releases the blocking state of the first application, including: when the second command includes the identification of the first application When receiving information that the channel is successfully established, the first agent module releases the blocking state of the first application program.
  • the shared memory can be used as a dedicated data channel between the first application and the second application, and richer data can be transferred compared to a solution that only uses command queues for data transfer.
  • the amount of data that can be transferred by shared memory is relatively large, which can reduce the number of data copies and improve data transmission efficiency.
  • the second agent module Running the second application program based on the program identification includes: the second agent module determines whether the second application program has the permission to access the shared memory according to the first command; the second agent module runs The second application program, and when the second application program has the permission to access the shared memory, establish an association between the address of the second application program and the address of the shared memory; the second command It also includes information on the success or failure of channel establishment.
  • the second agent module can determine whether the second application has the permission to access the shared memory.
  • the dedicated data channel is established when the second application has the permission to access the shared memory to ensure that the dedicated data channel is established. Security of data channel establishment.
  • the information of successful channel establishment or failed channel establishment is transmitted to the first virtual device side through the second command, so that the first application program of the first virtual device can determine the execution status of its request.
  • the shared memory also serves as a control channel, and the control channel includes a third A data bit and a second data bit, the status of the first data bit and the second data bit is controlled by the first agent module and the second agent module; the first virtual device outputs the first core Before interrupting to the core where the second virtual device is located, the method further The method includes: the first agent module controls the first data bit to be in a set state and the second data bit to be in a non-set state; the first agent module outputs the first inter-core interrupt to the second virtual
  • the core where the device is located includes: the first agent module determines that the first data bit of the control channel between the first application program and the second application program is in a set state and the second data bit is in a non-set state. When in the state, the first agent module outputs a first inter-core interrupt to the core where the second virtual device is located.
  • the control channel is dedicated to controlling the sending and receiving of inter-core interrupts, which can reduce the number of inter-core interrupts and reduce the implementation complexity of inter-application communication methods.
  • the second agent module obtains the information from the first inter-application communication method according to the first inter-core interrupt.
  • the command queue obtains the first command, including: the second agent module traverses the control channels associated with all applications on the second virtual device corresponding to the second agent module according to the first inter-core interrupt. ; When it is determined that the first data bit of the control channel between the first application program and the second application program is in a set state, the second agent module obtains the first command from the first command queue.
  • the second agent module can determine which application program corresponding to the channel has sent the request; through the second agent module, according to the first data bit The status determines whether a command needs to be obtained, which can avoid repeated acquisition of commands and improve the work efficiency of the second agent module.
  • the second virtual device performs the following tasks according to the first command: After running the second application program using the identification of the second application program, the method further includes: the second agent module controls a first step of the control channel between the first application program and the second application program.
  • the data bit is in a non-set state, and the second data bit is in a non-set state; for the control channel between the first application program and the second application program, after the second application program finishes running, the
  • the second agent module determines that the first data bit of the control channel is in a non-set state, it controls the second data bit of the control channel to be in a set state; the second agent module determines that the first data bit of the control channel is in a set state.
  • the state is set, a command is obtained from the first command queue again, and the second application program is scheduled to run according to the identification of the second application program in the newly obtained command.
  • the first virtual device further includes an authentication module and a first process module
  • the second agent module determines the Whether the second application has the permission to access the shared memory includes: the second agent module forwards the identification of the second application in the first command to the first virtual device on the first virtual device.
  • the first process module determines the authentication identification corresponding to the identification of the second application program, and sends a permission information acquisition request to the authentication module, where the permission information acquisition request includes the authentication identification ;
  • the first process module receives the authority information of the second application program from the authentication module and transmits it to the second agent module; the second agent module determines the authority information of the second application program according to the authority information of the second application program. information to determine whether the second application has the permission to access the shared memory.
  • the first process module can serve as an interface between the virtual machine side and the physical machine side, so that the virtual machine
  • the relevant information of the application program on the virtual machine side can be transmitted to the physical machine side through the first process module, so that the authentication module on the physical machine side can be used to authenticate the application program on the virtual machine side. Authentication through the authentication module can further improve the security of data transmission.
  • embodiments of the present application provide an inter-application communication device.
  • the device is applied to an electronic device.
  • the electronic device runs a first virtual device and a second virtual device.
  • the first virtual device and the One of the second virtual devices is a virtual machine and the other is a physical machine.
  • the device includes: the first virtual device, configured to write to the first command queue according to the first request issued by the first application program.
  • the first request and the first command include the identification of the second application program on the second virtual device; output the first inter-core interrupt to the core where the second virtual device is located, so that all The second virtual device is capable of obtaining the first inter-core interrupt; the second virtual device is configured to obtain the first command from the first command queue according to the first inter-core interrupt; In a command, the identification of the second application program runs the second application program.
  • the first virtual device further includes a first agent module, and the first agent module is configured to receive the first The first request sent by an application program; writing the first command to the first command queue according to the first request; outputting the first inter-core interrupt to the location where the second virtual device is located core.
  • the second virtual device further includes a second agent module, and the The second agent module is configured to obtain the first command from the first command queue according to the first inter-core interrupt; and run the second application program according to the identification of the second application in the first command. app.
  • the first request and the first command further include the Blocking information of the first application program.
  • the first proxy module receives the first request sent by the first application program
  • the first application program enters the blocking state; when receiving the second inter-core interrupt,
  • the first agent module is further configured to obtain a second command from a second command queue according to the second inter-core interrupt, which is generated after the second application program is finished running; in the When the second command includes the identification of the first application program, the first agent module is further configured to release the blocking state of the first application program.
  • the second agent module is also used to , receiving a second request sent by the second application program, the second request including the identification of the first application program; according to the second request, writing the second request to the second command queue.
  • command the second command includes the identification of the first application program; output the second inter-core interrupt to the core where the first virtual device is located, so that the first virtual device can obtain the second Internuclear disruption.
  • the first agent module Writing the first command into the first command queue according to the first request includes: the first agent module determining whether the second application has notification permission according to the first request; When the second application has notification permission, the first command is written into the first command queue.
  • the first virtual device Also used in response to the first The application program creates a shared memory, and the first agent module is also configured to establish an association between the address of the first application program and the address of the shared memory; the first request and the first command are also used including parameters of the shared memory; when the second command includes the identification of the first application program, the first agent module releases the blocking state of the first application program, including: in the second command When the information including the identification of the first application program and the successful channel establishment is included, the first agent module releases the blocking state of the first application program.
  • the second agent module Running the second application program based on the program identification includes: the second agent module determines whether the second application program has the permission to access the shared memory according to the first command; the second agent module runs The second application program, and when the second application program has the permission to access the shared memory, establish an association between the address of the second application program and the address of the shared memory; the second command It also includes information on the success or failure of channel establishment.
  • the shared memory also serves as a control channel, and the control channel includes a third A data bit and a second data bit, the status of the first data bit and the second data bit is controlled by the first agent module and the second agent module; the first agent module is also used to, Controlling the first data bit to be in a set state and the second data bit to be in a non-set state; the first agent module outputting the first inter-core interrupt to the core where the second virtual device is located includes: When the first agent module determines that the first data bit of the control channel between the first application program and the second application program is in a set state and the second data bit is in an unset state, the first agent module The module outputs the first inter-core interrupt to the core where the second virtual device is located.
  • the second agent module obtains the information from the first inter-application communication device according to the first inter-core interrupt.
  • the command queue obtains the first command, including: the second agent module traverses the control channels associated with all applications on the second virtual device corresponding to the second agent module according to the first inter-core interrupt. ; When it is determined that the first data bit of the control channel between the first application program and the second application program is in a set state, the second agent module obtains the first command from the first command queue.
  • the second agent module is further configured to control the first The first data bit of the control channel between the application program and the second application program is in a non-set state, and the second data bit is in a non-set state; for the relationship between the first application program and the second application program After the second application program is finished running, the second agent module is also used to control the second data bit of the control channel when it is determined that the first data bit of the control channel is in a non-set state.
  • the second agent module is also configured to, when determining that the first data bit of the control channel is in the set state, re-obtain a command from the first command queue, and based on the second of the newly acquired commands
  • the identification of the application schedules the second application to run.
  • the first virtual device further includes an authentication module and a first process module
  • the second agent module determines the Whether the second application has the permission to access the shared memory includes: the second agent module forwards the identification of the second application in the first command to the first virtual device on the first virtual device.
  • the first process module determines the authentication identifier corresponding to the identifier of the second application program, and sends the The authentication module sends a permission information acquisition request, and the permission information acquisition request includes the authentication identification; the first process module receives the permission information of the second application from the authentication module, and transmits to the second agent module; the second agent module determines whether the second application program has the authority to access the shared memory based on the permission information of the second application program.
  • embodiments of the present application provide an inter-application communication device, including: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to implement when executing the instructions One or more of the inter-application communication methods of the first aspect or multiple possible implementations of the first aspect.
  • embodiments of the present application provide a non-volatile computer-readable storage medium on which computer program instructions are stored.
  • the computer program instructions are executed by a processor, the above-mentioned first aspect or aspects are implemented.
  • embodiments of the present application provide a computer program product, including a computer readable code, or a non-volatile computer readable storage medium carrying the computer readable code, when the computer readable code is stored electronically
  • the processor in the electronic device executes one or more of the inter-application communication methods of the first aspect or multiple possible implementations of the first aspect.
  • Figure 1 shows a schematic workflow diagram of the mutual communication solution based on the network posix interface in the second prior art.
  • Figure 2 shows an exemplary application scenario of the inter-application communication method according to the embodiment of the present application.
  • Figure 3 shows an exemplary flow chart of an inter-application communication method according to an embodiment of the present application.
  • FIG. 4 shows a schematic diagram of an exemplary method for a first application to notify a second application according to an embodiment of the present application.
  • Figure 5a shows an example in which the first virtual device as an entity receives an inter-core interrupt according to an embodiment of the present application.
  • Figure 5b shows another example in which the first virtual device as an entity receives an inter-core interrupt according to an embodiment of the present application.
  • FIG. 6 shows a schematic diagram of an exemplary method for receiving a notification from the second application after the first application notifies the second application according to an embodiment of the present application.
  • Figure 7 shows an exemplary schematic diagram of establishing a dedicated data channel according to an embodiment of the present application.
  • Figure 8 shows an example of a control channel according to an embodiment of the present application.
  • Figure 9 shows an example of binding control channels, dedicated data channels, identifiers and semaphores between the first application program and the second application program according to an embodiment of the present application.
  • Figure 10a shows a schematic diagram of an exemplary method for determining whether a second application has the permission to access the shared memory according to an embodiment of the present application.
  • Figure 10b shows a schematic diagram of an exemplary method for determining whether a second application has the permission to access the shared memory according to an embodiment of the present application.
  • Figure 11 shows a specific example of an inter-application communication method according to an embodiment of the present application.
  • FIG. 12 shows an exemplary structural diagram of an inter-application communication device 10 according to an embodiment of the present application.
  • Figure 13 shows an exemplary structural diagram of an inter-application communication device according to an embodiment of the present application.
  • exemplary means "serving as an example, example, or illustrative.” Any embodiment described herein as “exemplary” is not necessarily to be construed as superior or superior to other embodiments.
  • Virtualization refers to a technology that abstracts and reallocates real computer components and computing resources to establish one or more virtual environments and allows computing components to run in this virtual environment.
  • Abstract objects include processors, memory, input/output interface peripherals, etc.
  • Virtualization technology can simplify the software reconfiguration process, allowing a platform to run multiple instances at the same time, and allowing all systems and applications to run in different spaces without interfering with each other.
  • Virtual machine An instance running in a virtual environment provided by virtualization is a virtual machine.
  • Real-time The ability of tasks to be executed within a certain deterministic delay.
  • Embedded system An embedded system is composed of hardware and software. It is an operating system embedded in the electronic/mechanical devices of non-general computers. It usually has the characteristics of miniaturization and high real-time performance.
  • VMM Virtual machine monitor
  • Host machine Also known as host OS, referred to as host, the system or machine used by the virtual machine monitor to run one or more virtual machines is called the host machine.
  • Guest machine Also known as guest OS, referred to as guest, the virtual machine run by the host is called a guest machine.
  • Application That is, the business run by the host or client, which can be understood as a program with specific functions.
  • Virtual machine trap The virtual machine switches from the virtual environment to the physical environment through hardware capabilities. It can be passively trapped due to exceptions, interruptions, etc., or actively trapped through instructions.
  • Kernel state The processor switches to privileged mode and can access all hardware resources, including memory, output/output interfaces, computing resources, etc.
  • the kernel state is responsible for managing the allocation and use of the above hardware resources by applications.
  • Virtual interrupt controller used to receive interrupt requests from multiple external interrupt sources, make priority judgments, select the interrupt request with the highest current priority, and send this request to the processor.
  • Blocking The application is in a stopped state because a certain resource is temporarily unavailable. It can be unblocked after waiting for the resource to meet the requirements.
  • Privilege level When modern processors are running, software may run at different privilege levels. High-privilege levels usually have more permissions than low-privilege levels.
  • a software running in the operating system (generally running at a higher privilege level), used to operate the behavior of peripherals.
  • Front-end and back-end drivers In a virtualization scenario, because real hardware can only be managed in the physical environment, virtual The machine can only see the virtualized hardware.
  • the driver of the virtual peripheral in the virtual machine is the front-end driver.
  • the software responsible for simulating the virtual peripheral in the physical environment and requesting the real peripheral to operate is generally called the back-end driver.
  • Semaphore essentially an atomic variable used to synchronize multiple objects.
  • a common method is for one party to block on the semaphore, and the other party to wake up by adding 1 to the variable of this semaphore. The blocking party.
  • Stage 2 page table (stage2 page table): Because the virtual environment is virtualized from the physical environment, the physical address seen by the virtual machine is not the real physical address, and a layer of page table translation is required to convert it into a real physical address. This page table is maintained by software and automatically translated by hardware. This page table is called a 2-stage page table on some platforms.
  • Hypercall The virtual machine actively requests services in the physical environment through a hypercall instruction, which can carry parameters.
  • the meaning of communication consists of two levels.
  • the first level means to notify the other party. For example, one party can block through some mechanism and wait for the other party to communicate with the other party in some way to remind one party to continue running; the second level means It is the transmission of message content, that is, both parties can notify the other party and transmit some data to the other party through a certain channel. These data may be requests to the other party or responses to requests, or they may be data based on a certain protocol.
  • the existing technology mainstream uses the following two solutions to implement communication between applications on the physical machine (host) side and applications on the virtual machine (client) side.
  • the client wants to notify the host
  • the data in the client will be passed to the host through shared memory, and the address of the shared memory will be informed to the host through the virtio transmission protocol.
  • the host wants to notify the client, it usually uses interrupt injection.
  • the interrupt will be reported in the virtual machine, giving the client a chance to process the request from the host.
  • the virtio protocol itself is to solve the communication problem between the front-end and back-end drivers of the virtual machine. It is not a communication mechanism between the virtual machine and the application program in the physical machine. The existing technology is improved based on this protocol so that this mechanism can be used for both the client and the physical machine. Inter-application communication on the host machine.
  • the host-side application When the host-side application wants to notify the client-side application, it can share the memory with the information indicating the client-side application to be notified, and force the corresponding virtual machine to exit, and then inject the information into the virtual machine. Interrupt.
  • the client-side application wants to notify the host-side application, it can also indicate the information of the host-side application to be notified in the shared memory, and actively perform virtual machine extraction, and then use the kernel to Notify the host side by means such as intermittent interruption.
  • the disadvantage of the first technology is that when communicating through the virtio protocol, the virtual machine will inevitably be trapped. On the physical machine of the arm64 platform, whether the notification is from the host to the client or the client to the host, all involve virtual machines. The machine collapses. The trapping and exiting of the virtual machine and the subsequent work of saving the context are very slow processes and will inevitably cause a performance bottleneck. Moreover, the virtio protocol itself does not provide any security mechanism. When the host-side and client-side applications communicate through the virtio protocol, since there is no identity authentication process, access to the shared memory is open to everyone. may cause safety issues.
  • FIG. 1 shows a schematic workflow diagram of the mutual communication solution based on the network posix interface in the second prior art.
  • the principle of this solution is that as long as the host provides a network for the virtual machine, the application in the virtual machine can also connect to the network through the network programming interface and use the network like a normal application. So if the host-side application and the client-side application both use the network through methods such as the POSIX network programming interface, they can communicate with each other.
  • the network card pass-through method can be used. The network card interrupt generated by this method can be directly injected into the virtual machine, so that the client does not need to be trapped when using the network card.
  • the second prior art technology avoids the trapping and exiting of the virtual machine, it also has some problems.
  • an inter-application communication method, device, storage medium and program product are proposed.
  • rapid communication between virtual machine services and physical machine services can be achieved , improve the communication efficiency of electronic equipment.
  • Figure 2 shows an exemplary application scenario of the inter-application communication method according to the embodiment of the present application.
  • the inter-application communication method of the embodiment of the present application can be applied to electronic devices.
  • the electronic devices of the present application can be smart phones, netbooks, tablet computers, notebook computers, wearable electronic devices (such as smart bracelets, Smart watches, etc.), TVs, virtual reality devices, etc.
  • the electronic device may include a virtual machine monitor and a host, where the host can run host-side process 1 and host-side process 2, and can run client 1 and client 2 through the virtual machine monitor.
  • Client2 can also run Client2 process1.
  • the inter-application communication method in the embodiment of the present application can provide fast communication services for the first virtual device and the second virtual device, and between the first application program on the first virtual device and the second application program on the second virtual device.
  • Provide fast communication services between devices where the first virtual device may be a physical machine (host machine), and the second virtual device may be a virtual machine (client 1 or client 2).
  • the first application program may correspond to host-side process 1 or host-side process 2
  • the second application program may correspond to client 2 process 1.
  • the second application program may need to run corresponding functions to cooperate.
  • the first application program (or second application program) may initiate a communication request to the second application (or first application).
  • the issued request may be carried through a command queue (not shown) corresponding to the second virtual device (or the first virtual device).
  • the information that the request has been issued may be caused by the first virtual device (or the second virtual device) issuing an inter-core interrupt to notify the second virtual device (or the first virtual device).
  • the second virtual device (or the first virtual device) can obtain the request carried by the command queue according to the inter-core interrupt, and drive the second application program on it to respond to the request. This enables fast communication between the first application program and the second application program.
  • first virtual device is a physical machine and the second virtual device is a virtual machine.
  • first virtual device may also be a virtual machine
  • second virtual device may also be a host machine.
  • the embodiments of this application do not limit the specific types of the first virtual device and the second virtual device.
  • Figure 3 shows an exemplary flow chart of an inter-application communication method according to an embodiment of the present application.
  • this application proposes an inter-application communication method.
  • the method is applied to an electronic device, the electronic device runs a first virtual device and a second virtual device, one of the first virtual device and the second virtual device is a virtual machine and the other is a physical machine, the method Including step S1-step S4:
  • Step S1 The first virtual device writes a first command to the first command queue according to the first request issued by the first application program.
  • the first request and the first command include the second virtual device.
  • the first application program may be an application program on the first virtual device, and the first request may be a request from the first application program to communicate with a second application program on the second virtual device.
  • the first command queue may be a static shared memory that is initialized when the electronic device is started and accessible to the second virtual device.
  • the first command may be stored in the first command queue, waiting for acquisition and processing by the second virtual device.
  • the first request and the first command may also include information indicating the running mode of the second application program.
  • Step S2 The first virtual device outputs a first inter-core interrupt to the core where the second virtual device is located, so that the second virtual device can obtain the first inter-core interrupt.
  • Inter-core interrupts are directly output to the core where the objects that need to communicate are located, thus allowing mutual notification between physical machines and virtual machines and between applications in different virtual machines without using a virtual interrupt controller.
  • the first virtual device outputs the first inter-core interrupt to the second virtual device, it can be considered as communication from the first virtual device to the second virtual device.
  • the second virtual device obtains the first inter-core interrupt, the communication from the first virtual device to the second virtual device may be considered to be completed.
  • Step S3 The second virtual device obtains the first command from the first command queue according to the first inter-core interrupt.
  • the second virtual device When the second virtual device receives the inter-core interrupt, it can be considered that a new command is written into the first command queue, and the newly written command needs to be processed by the second virtual device. Therefore, the second virtual device can obtain the first command from the first command queue according to the first inter-core interrupt.
  • Step S4 The second virtual device runs the second application program according to the identification of the second application program in the first command.
  • the second virtual device may consider that the application program corresponding to the identifier included in the first command is the application program that needs to be run.
  • the first command includes the identifier of the second application program. Therefore, the second virtual device can determine that the second application program needs to be run according to the first command.
  • the first command includes information indicating a running mode of the second application program
  • the second virtual device may run the second application program as instructed by the first command. At this time, it can be considered that the second virtual device has completed the corresponding response according to the communication.
  • the first virtual device writes the first command to the first command queue according to the first request issued by the first application, and outputs the first inter-core interrupt to the second virtual device.
  • the core where the device is located enables the second virtual device to obtain the first inter-core interrupt and obtain the first command from the first command queue according to the first inter-core interrupt, thereby enabling communication from the first virtual device to the second virtual device;
  • first The command is written according to the first request from the first application program and includes an identification of the second application program on the second virtual device, so that the second virtual device can run according to the identification of the second application program in the first command.
  • the second application program enables communication between the application program of the first virtual device and the application program of the second virtual device.
  • the physical machine and the virtual machine use a method of directly outputting inter-core interrupts to the core where the object to be communicated is located.
  • the use of the virtual interrupt controller can be avoided, thereby avoiding the trapping and exiting of the virtual machine, enabling fast communication between the virtual machine's business and the physical machine's business, and improving the communication efficiency of electronic equipment.
  • FIG. 4 shows a schematic diagram of an exemplary method for a first application to notify a second application according to an embodiment of the present application.
  • the first virtual device further includes a first agent module
  • step S1 includes:
  • the first proxy module receives the first request sent by the first application program
  • the first agent module writes the first command into the first command queue according to the first request
  • Step S2 includes:
  • the first agent module outputs the first inter-core interrupt to the core where the second virtual device is located.
  • the first agent module can be used to complete part of the work related to the first application program, preventing the first application program from directly exchanging data with the second virtual device itself, ensuring the security of the operation of the first application program, and at the same time Reduced data processing costs for first applications.
  • the first virtual device may include at least one application program, and the at least one application program may correspond to a first agent module.
  • the first agent module may be an agent entity introduced from a security perspective or to implement computer resource management, and runs at a higher authority level, which can be compared to the kernel state in the Linux kernel.
  • the first agent module may be responsible for managing and monitoring applications running at a lower permission level on the first virtual device, and unblocking the blocking state of applications (see Figure 6 for examples) on the first virtual device.
  • At least one application Can be entities that communicate with each other.
  • at least one application program can send what it wants to do to the first agent module in the form of a request, and request the first agent module to help with the operation.
  • the first agent module can perform operations such as sending and receiving inter-core interrupts and writing command queues. Therefore, in the process of managing the first application program, the first agent module can assist in the authentication of the first application program (see below for examples). Figure 10a, Figure 10b), memory mapping (see Figure 7 below for an example) and other matters.
  • step S1 the first request sent by the first application program may be received by the first proxy module.
  • the first request may include an identification of the second application program.
  • the first virtual device writes the first command into the first command queue according to the first request issued by the first application program.
  • the first agent module may write the first command into the first command queue according to the first request.
  • the first command may also include the identifier of the second application program.
  • the first virtual device When the first virtual device wishes to send a first request to the second virtual device, it can use the first command queue to write the first command corresponding to the first request according to a preset format (such as [command type, command parameters]). to the first command queue.
  • a preset format such as [command type, command parameters]
  • the first command queue may be configured to be accessible by an agent module of the application program on the second virtual device (eg, a second agent module described later).
  • the first inter-core interrupt may also be generated by the first agent module.
  • the first virtual device outputs the first inter-core interrupt to the core where the second virtual device is located, which may be the first agent module outputs the first inter-core interrupt to the core where the second virtual device is located, thereby realizing the first virtual device Notify the second virtual device.
  • the first application does not have to wait for the second application to finish running before it can continue to run, that is, it does not need to block. After the first application sends the first request, it can Continue running without entering a blocking state. In this case, after the second application program finishes running, the first application program may not be notified.
  • the following describes the principle of implementing the notification between the first virtual device and the second virtual device through the sending and receiving of the first inter-core interrupt in the embodiment of the present application.
  • the inter-application communication method in the embodiment of the present application can realize the communication without enabling the virtual interrupt controller.
  • Inter-core interrupt transmission and reception Since the virtual interrupt controller is not enabled, whether it is an inter-core interrupt issued by the first virtual device side or an inter-core interrupt issued by the second virtual device side, it can be directly sent to the entity that is running when receiving the inter-core interrupt.
  • the following description takes the first virtual device as an entity to receive an inter-core interrupt as an example.
  • Figure 5a shows an example in which the first virtual device as an entity receives an inter-core interrupt according to an embodiment of the present application.
  • the first virtual device serves as a physical machine
  • the physical machine is also used to run at least one virtual machine and the virtual machine management thread (client process) corresponding to the virtual machine.
  • the physical machine is in a certain core of the electronic device. superior.
  • the inter-core interrupt is received while the physical machine is running. If the inter-core interrupt is sent to the physical machine by another core of the electronic device, the inter-core interrupt can be received and processed by the physical machine. If the inter-core interrupt is sent to a certain virtual machine running on the physical machine, the physical machine can inject the inter-core interrupt to the corresponding virtual machine through the interrupt processor, and the virtual machine will process it.
  • the injection method can be implemented by existing technologies.
  • a register (not shown) on the virtual interrupt controller can be written.
  • the register context of the virtual machine can be changed. This application does not limit the specific way in which the physical machine injects inter-core interrupts into the corresponding virtual machine.
  • Figure 5b shows another example in which the first virtual device as an entity receives an inter-core interrupt according to an embodiment of the present application.
  • the first virtual device serves as a virtual machine
  • the virtual machine is run by a physical machine.
  • the physical machine also runs the virtual machine management thread (client process) corresponding to the virtual machine.
  • the physical machine is installed on the electronic device. on a certain core.
  • the virtual machine receives an inter-core interrupt while it is running. If the inter-core interrupt is sent to the virtual machine by another core of the electronic device, the inter-core interrupt can be received by the virtual machine and the inter-core interrupt can be processed directly; if the inter-core interrupt is If the interrupt is sent to the physical machine running the virtual machine, the virtual machine can issue a hypercall instruction through the interrupt processor to send the interrupt to the physical machine.
  • the physical machine can proactively handle interrupts according to the super call instruction.
  • the second virtual device further includes a second agent module
  • step S3 includes:
  • the second agent module obtains the first command from the first command queue according to the first inter-core interrupt
  • Step S4 includes:
  • the second agent module runs the second application program according to the identification of the second application program in the first command.
  • the second agent module can be used to complete part of the work related to the second application, preventing the second application from directly exchanging data with the first virtual device itself, ensuring the security of the second application's operation, and at the same time Reduced data processing costs for secondary applications.
  • the second virtual device may include at least one application program, and the at least one application program may correspond to a second agent module.
  • the second agent module can also be an agent entity introduced from a security perspective or to implement computer resource management. It runs at a higher authority level and can be compared to the kernel state in the Linux kernel.
  • the second agent module may be responsible for managing and monitoring applications running at a lower permission level on the second virtual device, and unblocking applications blocked on the second virtual device.
  • At least one application may be an entity that communicates with each other. . In the embodiment of this application, at least one application can send what it wants to do to the second generation in the form of a request.
  • the management module requests the second agent module to help with the operation.
  • the second agent module can perform operations such as sending and receiving inter-core interrupts, writing command queues, etc. Therefore, in the process of managing the second application program, the second agent module can assist in the authentication of the second application program (see below for examples). Figure 10a, Figure 10b), memory mapping (see Figure 7 below for an example) and other matters.
  • the application program on the first virtual device side and the application program on the second virtual device side can communicate with each other.
  • the second agent module can obtain the first command by accessing the first command queue. That is, the first command queue can be set so that only the second agent module and the first agent module are eligible for access, and are not visible to other entities.
  • the first command may include an identifier of the second application.
  • the second agent module may determine, based on the identifier, that the application corresponding to the identifier, that is, the second application is the application that needs to be run. , and run the second application. It is equivalent to the second application receiving the notification from the first application and responding. Moreover, the notification process does not require the trapping and exiting of the virtual machine, thereby realizing rapid notification of applications between the virtual machine and the physical machine.
  • FIG. 6 shows a schematic diagram of an exemplary method for receiving a notification from the second application after the first application notifies the second application according to an embodiment of the present application.
  • the first request and the first command also include blocking information of the first application
  • the method further includes:
  • the first application program enters a blocking state
  • the first agent module When receiving the second inter-core interrupt, the first agent module obtains the second command from the second command queue according to the second inter-core interrupt.
  • the second inter-core interrupt ends when the second application program runs. produced later;
  • the first agent module releases the blocking state of the first application program.
  • the first application program can issue a blocking request that includes the first application program.
  • a blocking message may be an instruction that instructs the application to enter a blocking state.
  • the blocking information of the first application program may be an instruction instructing the first application program to enter the blocking state.
  • the first application program may block on the corresponding semaphore (not shown), that is, enter the blocking state. In the blocking state, you can continue running after receiving a notification from the second application.
  • the first command may also include blocking information of the first application program, that is, The first request and the first command may simultaneously include the identification of the first application program and the blocking information of the first application program.
  • the first command can be obtained by the second agent module, and the second application program can be run according to the identification in the first command.
  • the second application program can be executed according to the blocking information of the first application program.
  • the application program can reversely notify the first application program in the same manner as the first application program notifies the second application program.
  • the second application program sends a second request, and the second request may include the identification of the first application program; the second agent module writes the second command to the second command queue according to the second request, and sends the second inter-core interrupt to the second application program.
  • the second command may include an identification of the first application program.
  • the first agent module obtains the second command from the second command queue according to the second inter-core interrupt; according to the identification of the first application program included in the second command, the first agent module The blocking state of the first application program is released, and the first application program can continue to run at this time.
  • the reception method of the second inter-core interrupt please refer to the above and the relevant descriptions in Figures 5a and 5b, and will not be described again here.
  • the first request and the first command may also include the identification of the first application. , that is, the first request and the first command may simultaneously include the identification of the first application, the identification of the second application, and the blocking information of the first application. So that after the second agent module determines that the second application program has finished running based on the identification of the first application program in the first command, it can further determine that what the second application program should notify is the first of the multiple applications represented by the first agent module. one application to ensure that the first application can quickly resume normal operation.
  • the method further include:
  • the second proxy module receives a second request sent by the second application program, where the second request includes the identification of the first application program;
  • the second agent module writes the second command to the second command queue according to the second request, where the second command includes the identification of the first application;
  • the second agent module outputs the second inter-core interrupt to the core where the first virtual device is located, so that the first virtual device can obtain the second inter-core interrupt.
  • the second agent module can determine that it is the first application that needs to be notified after the second agent module is finished running, so that the first agent module can release the blocking state of the first application according to the second command, so as to It is guaranteed that when the first application program is released from the blocking state, the second application program has indeed finished running, thereby meeting the first application program's need to wait for the second application program to finish running and then continue running.
  • the second agent module can determine that the first application is already in a blocking state, and the blocking state needs to wait until the second application finishes running. notification to cancel.
  • the second application can issue a second request. Since the second application is run according to the notification of the first application, the second request can include The identity of the first application.
  • the second agent module may write the second command into the second command queue.
  • the second command when the second request includes the identifier of the first application program, the second command may also include the identifier of the first application program.
  • the second request and the second command may also include information indicating a running mode of the first application.
  • the second command queue may be a piece of static shared memory between the first virtual device and the second virtual device that is initialized when the first virtual device is started.
  • the second command queue can be used to write the second command corresponding to the second request in a preset format (such as [command type, command parameters]). to the second command queue.
  • the second command queue may be configured to be accessible by some modules on the first virtual device (such as the first agent module described above).
  • the second agent module may output a second inter-core interrupt to the core where the first virtual device is located, thereby enabling the second virtual device to notify the first virtual device.
  • a second inter-core interrupt For the output method of the second inter-core interrupt, please refer to the above and the relevant descriptions in Figures 5a and 5b, and will not be described again here.
  • the second proxy module proxies multiple applications
  • the second request and the second command may also include the identifier of the second application program, that is, the second request and the second command may include the identifier of the first application program and the second application program at the same time. 2.
  • the identification of the application So that the second agent module can determine that the second application program among the multiple applications it represents has ended based on the identification of the second application program in the second request, so that it can execute writing to the second command queue according to the second request. Enter the steps for the second command.
  • the first proxy module may determine a request initiated by the first application program for the first application program to communicate with the second application program on the second virtual device based on the identification of the second application program and the first application program in the second command.
  • the processing has been completed, the second application has finished running in response to the request, and the blocking state of the first application is released. This is to ensure that when the first application is unblocked and resumes normal operation, the second application has indeed finished running.
  • the above-mentioned identification of the first application program can be applied by the first application program to its agent, that is, the first agent module, for identification and release of the blocking state.
  • the first proxy module can associate the identification of the first application program with any semaphore (not shown), so that the first application program can block on the corresponding semaphore.
  • the identity of the second application can be applied by the second application to its agent, that is, the second agent module, for identification and release of the blocking state.
  • the second proxy module can associate the identification of the second application program with any semaphore (not shown, different from the semaphore corresponding to the first application program), so that the second application program can block on the corresponding semaphore.
  • the first agent module writes the first command to the first command queue according to the first request, including:
  • the first proxy module determines whether the second application has notification permission according to the first request
  • the first command is written into the first command queue.
  • the first agent module can determine the permissions of the second application program.
  • the first request may include the identification of the second application program. Therefore, the first proxy module may determine based on the first request that the second application program is the application program that the first application program wants to request to run (notify). In this case, the first proxy module may first determine whether the second application has notification permission. When the second application has notification permission, the second application can be considered as a communication object, and then the first command is written into the first command queue. If the second application does not have notification permission, it may be considered that the second application is not a communication target, and the first command may not be written to the first command queue.
  • the notification permissions may be determined directly by the first agent module on the first virtual device. For example, for each application program represented by the second agent module, when preparing to communicate using the inter-application communication method of the embodiment of the present application, the corresponding identification can be applied to the second agent module for identification and release of the blocking state. when used. When an application applies for an identity, the application can be authorized once. Taking the second application program represented by the second agent module as an example, after the second application program applies for an identity from the second agent module, the second agent module can, for example, use cryptographic means (such as signatures) or static table configuration. Check of application legitimacy.
  • cryptographic means such as signatures
  • the second agent module may not provide an identifier for the second application program, so the subsequent second application program cannot use the inter-application communication method of the embodiment of the present application; or the second agent module may also provide an identifier for the second application program, but The second app of record does not have notification permissions.
  • the second agent module can provide an identification for the second application so that the second application can use the inter-application communication method of the embodiment of the present application; the second agent module can Record that the second app has notification permissions.
  • the second agent module may transfer the information that the second application has notification permission to the first agent module on the first virtual device side through the interface between the second virtual device and the first virtual device (such as the first process module described below). .
  • the determination result of the first determination can be directly used, and there is no need to repeat the determination.
  • the first application and the second application also need to transmit a lot of data messages. If the first command queue and the second command queue are still used to transmit data, the types of data that can be transmitted , quantity, etc. will all bring restrictions. Based on this, the embodiment of the present application also proposes to use the inter-application notification mechanism to dynamically create shared memory between the first application and the second application, so that it can be used as a link between the first application and the second application.
  • Dedicated data channels can be used to transmit data with a large variety and amount of data. The following describes an exemplary establishment method of a dedicated data channel in the embodiment of the present application.
  • Figure 7 shows an exemplary schematic diagram of establishing a dedicated data channel according to an embodiment of the present application.
  • the method before the first virtual device writes a first command to the first command queue according to the first request issued by the first application, the method also includes:
  • the first virtual device In response to the application of the first application program, the first virtual device creates a shared memory, and the first agent module establishes an association between the address of the first application program and the address of the shared memory; the first request and the first command also includes parameters of the shared memory;
  • the first agent module releases the blocking state of the first application, including:
  • the first agent module releases the blocking state of the first application program.
  • the shared memory can be used as a dedicated data channel between the first application and the second application, and richer data can be transferred compared to a solution that only uses command queues for data transfer.
  • the amount of data that can be transferred by shared memory is relatively large, which can reduce the number of data copies and improve data transmission efficiency.
  • the first application can apply to the core of the first virtual device to create a piece of shared memory.
  • the core of the first virtual device can allocate a physical memory page as the shared memory. (That is, the first virtual device creates shared memory), and the real address of the physical memory page is associated with the virtual address of the shared memory.
  • the first agent module can establish an association between the address of the first application program and the address of the shared memory ( ⁇ 1>). Therefore, the first application program can use the shared memory. Since the shared memory is associated with the physical memory page, when the first application uses the shared memory to access data, it can access multiple types of data with a large amount of data.
  • HVA represents the virtual shared memory address corresponding to the physical memory page.
  • the first request and the first command may also include parameters of the shared memory, such as the name and size of the shared memory, and so on.
  • the first request may be for the first application to communicate with the second application on the second virtual device and to create a dedicated data channel between the first application and the second application. ask.
  • the second agent module can also establish a dedicated data transmission channel for the second application program and the first application program ( ⁇ 4> ⁇ 5>) , for an exemplary manner, please refer to the relevant description of Figure 7 below.
  • the second request may be issued by the second application program after the dedicated data channel is successfully established.
  • the second request may include information that the channel is established successfully. Therefore, the second command may also include information that the channel is successfully established, that is, the second command may include the identification of the first application program and information that the channel is successfully established.
  • the first agent module releases the blocking state of the first application program. This may be when the second command includes the identifier of the first application program and information indicating that the channel is successfully established. The module unblocks the first application. At this time, the first application program and the second application program can transmit data information to each other through a dedicated data channel. Optionally, when the channel is successfully established, the information that the channel is established successfully can also be transmitted through the established dedicated data channel. This disclosure does not limit the specific transmission method of the information that the channel is established successfully.
  • the second agent module runs the second application program according to the identification of the second application program in the first command, including:
  • the second agent module determines whether the second application has the permission to access the shared memory according to the first command
  • the second agent module runs the second application program, and when the second application program has the permission to access the shared memory, establishes an association between the address of the second application program and the address of the shared memory. relationship; the second command also includes information indicating that the channel establishment is successful or that the channel establishment fails.
  • the second agent module can determine whether the second application has the permission to access the shared memory.
  • the dedicated data channel is established when the second application has the permission to access the shared memory to ensure that the dedicated data channel is established. Security of data channel establishment.
  • the information of successful channel establishment or failed channel establishment is transmitted to the first virtual device side through the second command, so that the first application program of the first virtual device can determine the execution status of its request.
  • the second agent module may determine based on the first command that the first application initiated a request to the second application on the second virtual device. communication, and a request to create a dedicated data channel between the first application and the second application.
  • the second agent module may first run the second application program and simultaneously determine whether the second application program has permission to access the shared memory. When the second application has the permission to access the shared memory, it can be considered that the second application can be used as a user of the dedicated data channel.
  • a virtual shared memory address can be allocated and a super call instruction is used to request
  • the virtual machine monitor or the physical machine kernel establishes a two-stage page table, that is, establishes the association between the virtual shared memory address GPA and the shared memory (physical) address ( ⁇ 4>).
  • the second agent module maps the address of the second application program (GVA) to the virtual shared memory address GPA ( ⁇ 5>), completing the establishment of an association between the address of the second application program and the address of the shared memory. Synchronization of the location and size of the shared memory can be achieved with the help of the first command queue and the second command queue. It can be seen from the above description that the address of the shared memory and the address of the first application program are also associated.
  • the address of the first application program being associated with the address of the second application program. That is, the dedicated data channel between the first application program and the second application program is successfully established, and the first application program and the second application program can use the shared memory to complete mutual data transmission.
  • the second command may also include information indicating that the channel is established successfully to notify the first application program that the dedicated data channel requested by it has been successfully established.
  • the second command may also include channel establishment failure information to notify the first application that the dedicated data channel requested by it has not been successfully established.
  • the ability to dynamically expand and shrink the shared memory can also be based on the process in Figure 7 above. For example, when there is no need to transmit data or the amount of data that needs to be transmitted is much smaller than the size of the shared memory that has been created, the established dedicated data channel can be dynamically deleted or the size can be dynamically adjusted to ensure the flexibility of resource deployment and improve Memory usage efficiency.
  • the inter-application communication method in the embodiment of the present application relies on inter-core interrupt transmission and reception between the virtual machine and the physical machine to realize mutual notification, therefore, if two applications are notified multiple times, the number of generated commands may be At this time, the inter-core interrupts can be aggregated through the following control channel to reduce the number of inter-core interrupts sent and received.
  • the shared memory also serves as a control channel.
  • the control channel includes a first data bit and a second data bit. The status of the first data bit and the second data bit is determined by the state of the first data bit and the second data bit.
  • step S2 the method also includes:
  • the first agent module controls the first data bit to be in a set state and the second data bit to be in a non-set state;
  • the first agent module outputs the first inter-core interrupt to the core where the second virtual device is located, including:
  • the first agent module determines that the first data bit of the control channel between the first application program and the second application program is in a set state and the second data bit is in an unset state
  • the first The agent module outputs the first inter-core interrupt to the core where the second virtual device is located.
  • the control channel is dedicated to controlling the sending and receiving of inter-core interrupts, which can reduce the number of inter-core interrupts and reduce the implementation complexity of inter-application communication methods.
  • a certain dedicated data channel between the first application program and the second application program can be set as a control channel.
  • the control channel also becomes private between the first application program and the second application program.
  • Figure 8 shows an example of a control channel according to an embodiment of the present application.
  • the first application program and the third application program may be applications on the first virtual device side
  • the second application program and the fourth application program may be applications on the second virtual device side
  • the electronic device may include a control channel between the first application program and the second application program, a control channel between the first application program and the fourth application program, and a control channel between the third application program and the second application program. control channel between.
  • the control channel may include at least a first data bit and a second data bit, the status of which may be controlled by the first agent module and the second agent module.
  • the states of the first data bit and the second data bit may include a set state and a non-set state.
  • the set state of the first data bit of the channel may indicate that the first application has a request sent to the second application.
  • the set state of the second data bit of the channel may indicate that the second application is Process the request;
  • the non-set status of the second data bit of the channel may indicate that the second application has not processed the request;
  • the non-set status of the first data bit of the channel may indicate that the first application has not sent the request to the second application. application request.
  • the status of the first data bit and the second data bit may be synchronized for the first agent module and the second agent module, for example, the first After the agent module controls the first data bit to be in the set state, if the second agent module obtains the state of the first data bit, it can obtain the set state; at this time, the second agent module controls the first data bit to be unset. After bit status, the first agent module obtains the first data bit if state, the obtained state can be a non-set state.
  • the first agent module can first control the control channel between the first application program and the second application program.
  • the first data bit is in a set state and the second data bit is in a non-set state, indicating that the first application program has a request sent to the second application program and the second application program has not yet processed the request.
  • the first agent module outputs the first inter-core interrupt to the second virtual device.
  • the second agent module obtains the first command from the first command queue according to the first inter-core interrupt, including:
  • the second agent module traverses the control channels associated with all applications on the second virtual device corresponding to the second agent module according to the first inter-core interrupt;
  • the second agent module obtains the first command from the first command queue.
  • the second agent module can determine which application program corresponding to the channel has sent the request; through the second agent module, according to the first data bit The status determines whether a command needs to be obtained, which can avoid repeated acquisition of commands and improve the work efficiency of the second agent module.
  • the second agent module can agent at least one application program, and each application program may be associated with a control channel between other virtual machines or applications on the physical machine, that is, the second agent module can Corresponds to multiple control channels.
  • the second agent module may only be able to determine that there is a request that needs to be processed by a certain application program it represents.
  • the inter-core interrupt is based on the request of which application program and which application program specifically needs to process it. May be unknown.
  • the second agent module obtains the first command from the first command queue according to the first inter-core interrupt.
  • the second agent module may first traverse the second virtual device and the second command queue according to the first inter-core interrupt.
  • the control channels associated with all application programs corresponding to the agent module determine the status of the first data bit of each control channel. When it is determined that the first data bit of the control channel between the first application program and the second application program is in a set state, it can be considered that the first application program has a request sent to the second application program, and then obtains it from the first command queue First order.
  • step S4 the method further includes:
  • the second agent module controls the first data bit of the control channel between the first application program and the second application program to be in a non-set state and the second data bit to be in a set state;
  • the second agent module determines that the first data bit of the control channel is in a non-set state.
  • the second data bit controlling the control channel is in a non-set state
  • the second agent module determines that the first data bit of the control channel is in a set state, it re-obtains a command from the first command queue and schedules the second application program according to the identity of the second application in the newly obtained command.
  • the second application runs.
  • step S4 may be executed to run the first command.
  • the second application program processes the request sent by the first application program to the second application program.
  • the second application can be considered to have processed the request.
  • the second agent module may control the first data bit of the control channel between the first application program and the second application program to be in a non-set state and the second data bit to be in a set state. While the second application is running, the first application may continue to initiate requests, and this action may cause the first data bit of the control channel to be in a set state under the control of the first agent module.
  • the second agent module can check the first data bit of the control channel between the first application program and the second application program, such as determining that the first data bit of the control channel is still in the non-zero state.
  • the set state it can be considered that the first application program has not initiated any further request to the second application program, and the set state of the second data bit can be cleared, that is, the second data bit controlling the control channel is in a non-set state. If it is determined that the first data bit of the control channel is in a set state, it can be considered that the first application has further initiated other requests to the second application, and the command can be obtained from the first command queue again, and according to the newly obtained command
  • the application's identity schedules the corresponding application to run.
  • the second agent module can continue to adjust the first data bit and second data bit of other control channels. Status viewing and request processing. For its specific implementation, please refer to the above description related to the control channel between the first application program and the second application program, which will not be described again here.
  • control channel and the dedicated data channel are both channels between the first application program and the second application program, and their functions are different, so the first application program and the second application program can be The control channel and the dedicated data channel between them are bound.
  • the control channel is used to aggregate inter-core interrupts
  • the dedicated data channel is used to carry communication data.
  • the dedicated data channel can be bound to the identity and semaphore of the data sender (such as the first application mentioned above) to allow the data sender to block and unblock.
  • Figure 9 shows an example of binding control channels, dedicated data channels, identifiers and semaphores between the first application program and the second application program according to an embodiment of the present application.
  • the inter-application communication method in the embodiment of the present application can become a high-performance fast notification and data that can interrupt aggregation. Transmission scheme.
  • FIGS. 10a and 10b respectively illustrate an exemplary method for determining whether a second application has the permission to access the shared memory according to an embodiment of the present application.
  • the first virtual device when the first virtual device is a physical machine and the second virtual device is a virtual machine, the first virtual device further includes an authentication module and a third virtual machine.
  • a process module, the second agent module determines whether the second application has the permission to access the shared memory according to the first command, including:
  • the second agent module forwards the identification of the second application in the first command to the first process module on the first virtual device;
  • the first process module determines the authentication identification corresponding to the identification of the second application, and sends a permission information acquisition request to the authentication module, where the permission information acquisition request includes the authentication identification;
  • the first process module receives the permission information of the second application from the authentication module and transmits it to the second agent module;
  • the second agent module determines whether the second application has the permission to access the shared memory based on the permission information of the second application.
  • the first process module can serve as an interface between the virtual machine side and the physical machine side, so that information related to the application program on the virtual machine side can be transmitted to the physical machine side through the first process module, so that Use the authentication module on the physical machine side to authenticate the application on the virtual machine side. Authentication through the authentication module can further improve the security of data transmission.
  • the microkernel of the physical machine has extremely strong security, and its reliability can be proved mathematically using methods such as formal verification.
  • the microkernel has an authentication module for kernel objects.
  • the module may, for example, support the capability security mechanism (capability mechanism) of the existing technology.
  • the authentication identifier can be regarded as a special object.
  • Each application needs to have the other party's authentication identifier to access specific kernel objects or execute specific processes. Therefore, the application program on the virtual machine in the embodiment of the present application can also be authenticated with the help of the authentication module.
  • the authentication module may be a module provided on the physical machine side. Since they are set up on the same physical machine, for the authentication module, each application program on the physical machine side is located within the trusted boundary. Each application program on the physical machine side can be authenticated directly through the capability security mechanism of the authentication module. right. Assuming that the second virtual device is a virtual machine, when an application program installed on the virtual machine wants to be authenticated by the authentication module, it is necessary to resort to the first process module on the physical machine.
  • the first process module can be responsible for processing the process corresponding to the virtual machine on the physical machine side.
  • the process corresponding to the virtual machine can essentially be an ordinary user-mode thread, so it itself also needs to be managed through the authentication module. Only after the first process module first obtains permission to access certain resources (such as shared memory) can it authorize many applications inside the virtual machine.
  • the first process module can assist the physical machine to authenticate the applications inside the virtual machine.
  • the second application when the second application needs to be authenticated, it needs to go through the second agent module.
  • the second agent module will pass the identifier of the second application to the first process module, and the first process module will determine the identity of the second application.
  • the authentication identifier corresponding to the identifier of the second application program (obtains the mapping of the authentication identifier ⁇ -> the representation of the second application program), and sends a permission information acquisition request for the permission information including the authentication identifier to the authentication module.
  • the authentication module can identify the authentication identifier and determine the permission information of the application program corresponding to the authentication identifier.
  • the application program corresponding to the authentication identifier is the second application program.
  • the authentication module may send the determined permission information of the second application program to the first process module.
  • the first process module can transmit the permission information of the second application program to the second agent module.
  • the second agent module determines whether the second application program has the permission to access the shared memory based on the permission information of the second application program. After the second agent module determines whether the second application has the permission to access the shared memory for the first time, and subsequently needs to determine again whether the second application has the permission to access the shared memory, it can directly use the first determination. The judgment result does not need to be repeated.
  • the notification permission of the second application can also be authenticated by the authentication module.
  • the identity information and identity of the second application can be passed through the first process.
  • the module informs the authentication module to let the authentication module know that the second application is a legal entity to determine that the second application has the notification authority.
  • An exemplary implementation manner in which the authentication module authenticates the notification permission of the second application program may be the same as the manner in which the authentication module authenticates the second application program's permission to access the shared memory, which will not be described again here.
  • the inter-application communication method in the embodiment of this application can also be used for fast communication between two virtual machines.
  • Use the kernel of the physical machine to authenticate both virtual machines that belong to the two applications that need to communicate, and at the same time make the shared memory visible between the two virtual machines.
  • the physical machine can initialize and apply for dedicated data channels for the two virtual machines.
  • Figure 11 shows a specific example of an inter-application communication method according to an embodiment of the present application.
  • This example enables fast communication between the DB client on the host side and the DB server on the client side.
  • the host machine corresponds to the first virtual device
  • the guest machine corresponds to the second virtual device.
  • agent module A corresponds to the first agent module
  • the DB client corresponds to the first application program.
  • agent module B corresponds to the second agent module
  • the DB server corresponds to the second application.
  • the DB client has applied for its own identity to the proxy module A, and the proxy module A has also transmitted the DB client information to the host. side authentication module.
  • the DB server has applied for its own identity to the agent module B, and the agent module B has also transmitted the DB server information to the authentication module through the first process module on the host side.
  • the DB client has obtained the identification of the DB server.
  • the DB client has obtained permission to use a piece of shared memory.
  • the DB client When the inter-application communication method is executed, on the host side, the DB client sends a first request to the proxy module A.
  • the first request may be a request to establish a dedicated data channel between the DB client and the DB server.
  • the first request may include the identification of the DB client, the identification of the DB server, the blocking information of the DB client, and the parameters of the shared memory. After issuing the first request, the DB client enters the blocking state.
  • the proxy module A requests the authentication module to determine whether the identities of the DB client and the DB server are legal. For example, determine whether the DB client and DB server have notification permissions.
  • the first command is written to the first command queue on the client side, and the first inter-core interrupt is issued to the client side.
  • the first command may be a command to establish a dedicated data channel between the DB client and the DB server, and may include the identifier of the DB client, the identifier of the DB server, the blocking information of the DB client, and the parameters of the shared memory.
  • agent module B receives the first inter-core interrupt and obtains the first command from the first command queue. According to the first command, the agent module B determines that the purpose of the command is to establish a dedicated data channel between the DB client and the DB server. The agent module B first requests the host through the first process module according to the identification of the DB server in the first command. Side authentication module authentication. After the authentication module determines that the DB server has the permission to access the shared memory, it authorizes the use permission of the shared memory to the DB server through the capability security mechanism, establishes a stage 2 page table (stage2 page table), and then passes the permission information of the DB server through the A process module returns to agent module B. When the DB server has the permission to access the shared memory, the agent module B also maps the virtual address of the DB server to the shared memory (establishing the stage1 page table), thereby completing the establishment of a dedicated data channel.
  • stage2 page table stage 2 page table
  • Agent module B writes the information that the channel is successfully established into the dedicated data channel, and notifies the host side by writing the second command to the second command queue on the host side and issuing a second inter-core interrupt, so that the host side
  • the agent module A on the side can obtain the information of successful channel establishment from the dedicated data channel.
  • Agent module A can relieve the blocking state of the DB client.
  • a control channel can be further established between the DB client and the DB server, or more data channels can be established, etc.
  • this dedicated data channel has been authenticated, so it does not need to be authenticated again for subsequent use.
  • the virtual machine when communicating between the DB client and the DB server, the virtual machine will no longer be trapped. Except for the channel initialization process, the information sending and receiving activities of the client kernel can be limited only to the inside of the client kernel. At the same time, during the process of establishing the channel, the security of the dedicated data channel will be ensured through authentication. Through the proxy module and application The program layered management and microkernel's capability security mechanism more securely opens a private and dedicated data channel between the DB client and the DB server. No other entity except the DB client and DB server can obtain the permission to use this channel through normal means.
  • FIG. 12 shows an exemplary structural diagram of an inter-application communication device 10 according to an embodiment of the present application.
  • this embodiment of the present application proposes an inter-application communication device 10.
  • the device 10 is applied to an electronic device.
  • the electronic device includes a first virtual device 101 and a first virtual device 101.
  • One of the first virtual device 101 and the second virtual device 102 is a virtual machine and the other is a physical machine.
  • the device 10 includes:
  • the first virtual device 101 is configured to write a first command to a first command queue according to a first request issued by a first application program, where the first request and the first command include: The identification of the second application program; output the first inter-core interrupt to the core where the second virtual device 102 is located, so that the second virtual device 102 can obtain the first inter-core interrupt;
  • the second virtual device 102 is configured to obtain the first command from the first command queue according to the first inter-core interrupt; and run the second application program according to the identification of the second application in the first command. Describe the second application.
  • the first virtual device 101 further includes a first proxy module, the first proxy module being configured to receive the first request sent by the first application; according to the The first request is to write the first command into the first command queue and output the first inter-core interrupt to the core where the second virtual device 102 is located.
  • the second virtual device 102 further includes a second agent module, the second agent module being configured to obtain the first command queue from the first inter-core interrupt.
  • First command run the second application program according to the identification of the second application program in the first command.
  • the first request and the first command further include blocking information of the first application
  • the first proxy module receives the third message sent by the first application.
  • the first application program enters the blocking state; when receiving the second inter-core interrupt, the first agent module is also configured to obtain the second command queue from the second inter-core interrupt according to the second inter-core interrupt.
  • command the second inter-core interrupt is generated after the second application program finishes running; when the second command includes the identification of the first application program, the first agent module is also used to cancel all Describe the blocking state of the first application.
  • the second proxy module is further configured to receive a second request sent by the second application program, where the second request includes the The identifier of the first application program; according to the second request, write the second command to the second command queue, where the second command includes the identifier of the first application program; output the second The inter-core interrupt is sent to the core where the first virtual device 101 is located, so that the first virtual device 101 can obtain the second inter-core interrupt.
  • the first agent module writes the first command to the first command queue according to the first request, including: the first agent module writes the first command according to the first request.
  • a request is made to determine whether the second application has notification permission; when the second application has notification permission, write the first command into the first command queue.
  • the first virtual device 101 is further configured to create a shared memory in response to the application of the first application, and the first agent module is further configured to establish the first application.
  • the relationship between the address and the address of the shared memory; the first request and the first command also include parameters of the shared memory; when the second command includes the identification of the first application program, The first agent module releases the blocking state of the first application program,
  • the method includes: when the second command includes the identification of the first application program and information indicating that the channel is successfully established, the first agent module releases the blocking state of the first application program.
  • the second agent module runs the second application program according to the identification of the second application program in the first command, including: the second agent module runs the second application program according to the identification of the second application program in the first command.
  • the first command is to determine whether the second application program has the permission to access the shared memory; the second agent module runs the second application program, and determines whether the second application program has the permission to access the shared memory.
  • the second command When requesting permission, establish an association between the address of the second application program and the address of the shared memory; the second command also includes information indicating that the channel establishment is successful or that the channel establishment fails.
  • the shared memory also serves as a control channel.
  • the control channel includes a first data bit and a second data bit. The status of the first data bit and the second data bit is determined by the state of the first data bit and the second data bit.
  • the first agent module and the second agent module control; the first agent module is also used to control the first data bit to be in a set state and the second data bit to be in a non-set state; the first The agent module outputs the first inter-core interrupt to the core where the second virtual device 102 is located, including: the first agent module determines the control channel between the first application program and the second application program. When the first data bit is in a set state and the second data bit is in an unset state, the first agent module outputs a first inter-core interrupt to the core where the second virtual device 102 is located.
  • the second agent module obtains the first command from the first command queue according to the first inter-core interrupt, including: the second agent module obtains the first command according to the first inter-core interrupt.
  • Inter-core interrupt traverse the control channels associated with all applications corresponding to the second agent module on the second virtual device; determine the control channel between the first application program and the second application program When the first data bit is in a set state, the second agent module obtains the first command from the first command queue.
  • the second agent module is further configured to control the first data bit of the control channel between the first application program and the second application program to be in a non-set state, and the first data bit of the control channel between the first application program and the second application program.
  • Two data bits are in a non-set state; for the control channel between the first application program and the second application program, after the second application program finishes running, the second agent module is also used to determine When the first data bit of the control channel is in the non-set state, the second data bit of the control channel is controlled to be in the set state; the second agent module is also used to determine that the first data bit of the control channel is in the set state.
  • bit state re-obtain a command from the first command queue, and schedule the second application program to run according to the identifier of the second application program in the newly obtained command.
  • the first virtual device 101 when the first virtual device 101 is a physical machine and the second virtual device 102 is a virtual machine, the first virtual device 101 further includes an authentication module and a first process module.
  • the second agent module determines whether the second application program has the permission to access the shared memory according to the first command, including: the second agent module converts the first command, the third The identification of the second application is forwarded to the first process module on the first virtual device; the first process module determines the authentication identification corresponding to the identification of the second application and sends it to the authentication module Permission information acquisition request, the permission information acquisition request includes the authentication identification; the first process module receives the permission information of the second application from the authentication module and transmits it to the second agent Module; the second agent module determines whether the second application has the permission to access the shared memory based on the permission information of the second application.
  • Figure 13 shows an exemplary structural diagram of an inter-application communication device according to an embodiment of the present application.
  • Embodiments of the present application provide an inter-application communication device, including: a processor and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions.
  • the inter-application communication device may be provided in electronic devices, which may include mobile phones, foldable electronic devices, tablet computers, etc. computer, desktop computer, laptop computer, handheld computer, notebook computer, screen speaker, ultra-mobile personal computer (UMPC), netbook, augmented reality (AR) device, virtual reality ( At least one of a virtual reality (VR) device, an artificial intelligence (AI) device, a drone, a vehicle-mounted device, a smart home device, or a smart city device.
  • augmented reality (AR) device virtual reality
  • VR virtual reality
  • AI artificial intelligence
  • drone drone
  • vehicle-mounted device a smart home device
  • smart city device smart city device
  • the inter-application communication device may include a processor 110, an internal memory 121, a communication module 160, and the like.
  • the processor 110 may include one or more processing units.
  • the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processing unit (GPU), and an image signal processor. (image signal processor, ISP), controller, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural network processor (neural-network processing unit, NPU), etc.
  • image signal processor image signal processor, ISP
  • controller video codec
  • digital signal processor digital signal processor
  • DSP digital signal processor
  • baseband processor baseband processor
  • neural network processor neural-network processing unit
  • NPU neural-network processing unit
  • different processing units can be independent devices or integrated in one or more processors.
  • the processor 110 may execute the output of the first inter-core interrupt in the embodiment of the present application, etc., to implement the inter-application communication method in the embodiment of the present application.
  • the processor 110 may also be provided with a memory for storing instructions and data.
  • the memory in processor 110 may be a cache memory.
  • the memory can store instructions or data that have been used or used frequently by the processor 110, such as the first command in the embodiment of the present application. If the processor 110 needs to use the instructions or data, it can be called directly from the memory. Repeated access is avoided and the waiting time of the processor 110 is reduced, thus improving the efficiency of the system.
  • processor 110 may include one or more interfaces. Interfaces may include integrated circuit (inter-integrated circuit, I2C) interface, universal asynchronous receiver/transmitter (UART) interface, general-purpose input/output (GPIO) interface, etc.
  • I2C integrated circuit
  • UART universal asynchronous receiver/transmitter
  • GPIO general-purpose input/output
  • the processor 110 can connect to wireless communication modules, displays, cameras and other modules through at least one of the above interfaces.
  • Memory 121 may be used to store computer executable program code including instructions.
  • the memory 121 may include a program storage area and a data storage area.
  • the stored program area may store an operating system, at least one application program required for a function (such as an application program that writes a first command to the first command queue, etc.).
  • the storage data area may store data created during use of the inter-application communication device (such as a first command, etc.).
  • the memory 121 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.
  • the processor 110 executes various functional methods or data processing of the inter-application communication device by executing instructions stored in the memory 121 and/or instructions stored in a memory provided in the processor.
  • the communication module 160 may be used to receive data from other devices or devices through wired communication or wireless communication, or to send data to other devices or devices.
  • applications that can be provided for inter-application communication devices include WLAN (such as Wi-Fi network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (frequency modulation, FM), Solutions for wireless communications such as near field communication (NFC) and infrared technology (IR).
  • WLAN such as Wi-Fi network
  • BT Bluetooth
  • GNSS global navigation satellite system
  • FM frequency modulation
  • Solutions for wireless communications such as near field communication (NFC) and infrared technology (IR).
  • NFC near field communication
  • IR infrared technology
  • the inter-application communication device may include more or less components than shown in the figures, or combine some components, or split some components, or arrange different components.
  • the components shown may be in hardware, software or software A combination of software and hardware.
  • Embodiments of the present application provide a non-volatile computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the above method is implemented.
  • Embodiments of the present application provide a computer program product, including computer readable code, or a non-volatile computer readable storage medium carrying the computer readable code, when the computer readable code is stored in a processor of an electronic device When running, the processor in the electronic device executes the above method.
  • Computer-readable storage media may be tangible devices that can retain and store instructions for use by an instruction execution device.
  • the computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above.
  • Non-exhaustive list of computer-readable storage media include: portable computer disks, hard drives, random access memory (RAM), read only memory (ROM), erasable memory Electrically Programmable Read-Only-Memory (EPROM or Flash Memory), Static Random-Access Memory (SRAM), Portable Compact Disc Read-Only Memory (CD) -ROM), Digital Video Disc (DVD), memory stick, floppy disk, mechanical encoding device, such as a punched card or a raised structure in a groove with instructions stored thereon, and any suitable combination of the above .
  • RAM random access memory
  • ROM read only memory
  • EPROM or Flash Memory erasable memory Electrically Programmable Read-Only-Memory
  • SRAM Static Random-Access Memory
  • CD Portable Compact Disc Read-Only Memory
  • DVD Digital Video Disc
  • memory stick floppy disk
  • mechanical encoding device such as a punched card or a raised structure in a groove with instructions stored thereon, and any suitable combination of the above .
  • Computer-readable program instructions or code described herein may be downloaded from a computer-readable storage medium to various computing/processing devices, or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and/or a wireless network.
  • the network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers.
  • a network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium in the respective computing/processing device .
  • the computer program instructions used to perform the operations of this application can be assembly instructions, instruction set architecture (Instruction Set Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, status setting data, or one or more Source code or object code written in any combination of programming languages, including object-oriented programming languages—such as Smalltalk, C++, etc., and conventional procedural programming languages—such as the “C” language or similar programming languages.
  • the computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server implement.
  • the remote computer can be connected to the user's computer through any kind of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or it can be connected to an external computer (e.g. Use an Internet service provider to connect via the Internet).
  • electronic circuits are customized by utilizing state information of computer-readable program instructions, such as programmable logic circuits, field-programmable gate arrays (Field-Programmable Gate Arrays, FPGAs) or programmable logic arrays (Programmable Logic Array (PLA), the electronic circuit can execute computer-readable program instructions to implement various aspects of the present application.
  • These computer readable program instructions may be provided to a processor of a general purpose computer, a special purpose computer, or other programmable data processing apparatus, thereby producing a machine such that the instructions are processed by the computer or other programmable data processing apparatus.
  • the processor when executed, produces means for implementing the functions/actions specified in one or more blocks in the flowcharts and/or block diagrams.
  • These computer-readable program instructions can also be stored in a computer-readable storage medium. These instructions cause the computer, programmable data processing device and/or other equipment to work in a specific manner. Therefore, the computer-readable medium storing the instructions includes An article of manufacture that includes instructions that implement aspects of the functions/acts specified in one or more blocks of the flowcharts and/or block diagrams.
  • Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other equipment, causing a series of operating steps to be performed on the computer, other programmable data processing apparatus, or other equipment to produce a computer-implemented process , thereby causing instructions executed on a computer, other programmable data processing apparatus, or other equipment to implement the functions/actions specified in one or more blocks in the flowcharts and/or block diagrams.
  • each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions that embody one or more elements for implementing the specified logical function(s).
  • Executable instructions may occur out of the order noted in the figures. For example, two consecutive blocks may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved.
  • each block of the block diagram and/or flowchart illustration, and combinations of blocks in the block diagram and/or flowchart illustration can be implemented by hardware (such as circuits or ASICs) that perform the corresponding function or action. Specific Integrated Circuit), or can be implemented with a combination of hardware and software, such as firmware.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer And Data Communications (AREA)
  • Multi Processors (AREA)

Abstract

本申请涉及一种应用程序间通信方法、装置、存储介质及程序产品，所述方法应用于电子设备，电子设备运行第一虚拟装置和第二虚拟装置，第一虚拟装置和第二虚拟装置中的一个是虚拟机，另一个是物理机，该方法包括：第一虚拟装置根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令；第一虚拟装置输出第一核间中断到第二虚拟装置所在的核心；第二虚拟装置根据第一核间中断从第一命令队列获取第一命令；第二虚拟装置根据第一命令中、第二应用程序的标识运行第二应用程序。根据本申请实施例的应用程序间通信方法，能够实现虚拟机的业务和物理机的业务之间的快速通信，提高电子设备的通信效率。

Description

应用程序间通信方法、装置、存储介质及程序产品
本申请要求于2022年3月29日提交中国专利局、申请号为202210322866.9、申请名称为“应用程序间通信方法、装置、存储介质及程序产品”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种应用程序间通信方法、装置、存储介质及程序产品。
背景技术
随着软硬件的发展和应用场景的变化，对于支持多操作系统同时部署的嵌入式系统的需求越来越强。以智能汽车为例，同一款芯片需运行多种完全不同的业务，这些业务对于计算资源、执行环境的需求是完全不同的。如有些和人身安全强相关的业务需要操作系统提供强实时性，而音乐媒体业务则需要操作系统具有较高的生态兼容性，对操作系统的实时性要求很低。这些不同的需求的达成，需要嵌入式系统的操作系统的密切配合。
针对于不同的业务需求，嵌入式系统通常使用虚拟化技术部署多个不同类型的操作系统，如实时操作系统、控制操作系统、安全操作系统等。在物理机上，通过一个虚拟机监控器同时管理运行上述多个操作系统，即运行多个虚拟机，并根据需求将不同种类的业务运行在不同的虚拟机中，其中物理机也称为宿主机，被物理机运行的多个虚拟机也可称为客户机。
按照通用虚拟化的特点，不同的虚拟机和物理机之间是互相隔离运行的。但是针对于某些特定的场景或者需求，虚拟机的业务和物理机的业务可能需要相互通信。
发明内容
有鉴于此，提出了一种应用程序间通信方法、装置、存储介质及程序产品，根据本申请实施例的应用程序间通信方法，能够实现虚拟机的业务和物理机的业务之间的快速通信，提高电子设备的通信效率。
第一方面，本申请的实施例提供了一种应用程序间通信方法，所述方法应用于电子设备，所述电子设备包括第一虚拟装置和第二虚拟装置，所述第一虚拟装置和所述第二虚拟装置中的一个是虚拟机，另一个是物理机，所述方法包括：所述第一虚拟装置根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，所述第一请求、所述第一命令包括所述第二虚拟装置上的第二应用程序的标识；所述第一虚拟装置输出第一核间中断到所述第二虚拟装置所在的核心，以使所述第二虚拟装置能够获取所述第一核间中断；所述第二虚拟装置根据所述第一核间中断从所述第一命令队列获取所述第一命令；所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
根据本申请实施例的应用程序间通信方法，通过第一虚拟装置根据第一应用程序发出的第一请求向第一命令队列中写入第一命令，并输出第一核间中断到第二虚拟装置所在的核心，使得第二虚拟装置可以获取第一核间中断并根据第一核间中断从第一命令队列获取第一命令， 可以实现第一虚拟装置到第二虚拟装置的通信；第一命令是根据来自第一应用程序的第一请求写入的，并包括第二虚拟装置上的第二应用程序的标识，使得第二虚拟装置根据第一命令中、第二应用程序的标识可以运行第二应用程序，从而能够实现第一虚拟装置的应用程序到第二虚拟装置的应用程序的通信。由于第一虚拟装置和所述第二虚拟装置中的一个是虚拟机，另一个是物理机，因此物理机和虚拟机之间使用将核间中断直接输出至需通信的对象所在的核心的方式完成通信，可以避免使用虚拟中断控制器，从而避免虚拟机的陷入陷出，可以实现虚拟机的业务和物理机的业务之间的快速通信，提高电子设备的通信效率。
根据第一方面，在所述应用程序间通信方法的第一种可能的实现方式中，所述第一虚拟装置还包括第一代理模块，所述第一虚拟装置根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，包括：所述第一代理模块接收所述第一应用程序发送的所述第一请求；所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令；所述第一虚拟装置输出第一核间中断到所述第二虚拟装置所在的核心，包括：所述第一代理模块输出所述第一核间中断到所述第二虚拟装置所在的核心。
通过这种方式，可以使用第一代理模块完成与第一应用程序相关的部分工作，避免第一应用程序直接与第二虚拟装置本身进行数据交换，保证了第一应用程序运行的安全性，同时降低了第一应用程序的数据处理成本。
根据第一方面或第一方面的第一种可能的实现方式，在所述应用程序间通信方法的第二种可能的实现方式中，所述第二虚拟装置还包括第二代理模块，所述第二虚拟装置根据所述第一核间中断从所述第一命令队列获取所述第一命令包括：所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令；所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序包括：所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
通过这种方式，可以使用第二代理模块完成与第二应用程序相关的部分工作，避免第二应用程序直接与第一虚拟装置本身进行数据交换，保证了第二应用程序运行的安全性，同时降低了第二应用程序的数据处理成本。
根据第一方面的第一种或第二种可能的实现方式，在所述应用程序间通信方法的第三种可能的实现方式中，所述第一请求和所述第一命令还包括所述第一应用程序的阻塞信息，所述第一代理模块接收所述第一应用程序发送的所述第一请求之后，所述方法还包括：所述第一应用程序进入阻塞状态；在接收到第二核间中断时，所述第一代理模块根据所述第二核间中断从第二命令队列获取第二命令，所述第二核间中断在所述第二应用程序运行结束后产生；在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态。
通过这种方式，对于发出向第二应用程序通信的请求后阻塞的第一应用程序，可以实现第二应用程序到第一应用程序的快速通知，阻塞的第一应用程序可以通过该通知解除阻塞状态，使得可以保证第一应用程序可以快速地继续运行。
根据第一方面的第三种可能的实现方式，在所述应用程序间通信方法的第四种可能的实现方式中，所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序之后，所述方法还包括：所述第二应用程序运行结束后，所述第二代理模块接收所述第二应用程序发送的第二请求，所述第二请求包括所述第一应用程序的标识；所述第二代 理模块根据所述第二请求，向所述第二命令队列中写入所述第二命令，所述第二命令包括所述第一应用程序的标识；所述第二代理模块输出所述第二核间中断到所述第一虚拟装置所在的核心，以使所述第一虚拟装置能够获取所述第二核间中断。
通过这种方式，使得第二代理模块可以确定第二代理模块运行结束后需通知的是第一应用程序，使得第一代理模块根据第二命令可以解除的是第一应用程序的阻塞状态，以保证第一应用程序解除阻塞状态时，第二应用程序确实已经运行结束，从而能满足第一应用程序等待第二应用程序运行完毕后继续运行的需求。
根据第一方面的第一种至第四种可能的实现方式中的任意一种可能的实现方式，在所述应用程序间通信方法的第五种可能的实现方式中，所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令，包括：所述第一代理模块根据所述第一请求，判断所述第二应用程序是否具有通知权限；在所述第二应用程序具有通知权限时，向所述第一命令队列中写入所述第一命令。
通过这种方式，可以保证接收到通知的应用程序是具有通知权限的应用程序，保证通知的安全性。
根据第一方面的第三种至第五种可能的实现方式中的任意一种可能的实现方式，在所述应用程序间通信方法的第六种可能的实现方式中，所述第一虚拟装置根据所述第一应用程序发出的第一请求，向第一命令队列中写入第一命令之前，所述方法还包括：响应于所述第一应用程序的申请，所述第一虚拟装置创建共享内存，所述第一代理模块建立所述第一应用程序的地址与所述共享内存的地址的关联关系；所述第一请求和所述第一命令还包括所述共享内存的参数；在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态，包括：在所述第二命令包括所述第一应用程序的标识以及通道建立成功的信息时，所述第一代理模块解除所述第一应用程序的阻塞状态。
通过这种方式，使得可以通过共享内存作为第一应用程序和第二应用程序之间的专用数据通道，相比仅采用命令队列的形式进行数据传递的方案，可以传递更丰富的数据。同时共享内存可传递的数据量比较大，可以减少数据的拷贝次数，提升数据的传输效率。
根据第一方面的第六种可能的实现方式，在所述应用程序间通信方法的第七种可能的实现方式中，所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序，包括：所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限；所述第二代理模块运行所述第二应用程序，并在所述第二应用程序具有访问所述共享内存的权限时，建立所述第二应用程序的地址与所述共享内存的地址的关联关系；所述第二命令还包括通道建立成功或通道建立失败的信息。
通过这种方式，使得专用数据通道建立前，第二代理模块可以确定第二应用程序是否具备访问共享内存的权限，专用数据通道在第二应用程序具备访问共享内存的权限时建立，以保证专用数据通道的建立的安全性。通过第二命令将通道建立成功或通道建立失败的信息传递给第一虚拟装置侧，以使第一虚拟装置的第一应用程序可以确定其请求的执行情况。
根据第一方面的第六种或第七种可能的实现方式，在所述应用程序间通信方法的第八种可能的实现方式中，所述共享内存还作为控制通道，所述控制通道包括第一数据位和第二数据位，所述第一数据位和所述第二数据位的状态由所述第一代理模块和所述第二代理模块控制；所述第一虚拟装置输出第一核间中断到所述第二虚拟装置所在的核心之前，所述方法还 包括：所述第一代理模块控制所述第一数据位处于置位状态、第二数据位处于非置位状态；所述第一代理模块输出所述第一核间中断到所述第二虚拟装置所在的核心，包括：所述第一代理模块确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态、第二数据位处于非置位状态时，所述第一代理模块输出第一核间中断到所述第二虚拟装置所在的核心。
通过控制通道专用于控制核间中断的发送及接收，可以降低核间中断的收发次数，降低应用程序间通信方法的实现复杂度。
根据第一方面的第八种可能的实现方式，在所述应用程序间通信方法的第九种可能的实现方式中，所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令，包括：所述第二代理模块根据所述第一核间中断，遍历所述第二虚拟装置上、所述第二代理模块对应的全部应用程序关联的控制通道；在确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态时，所述第二代理模块从第一命令队列获取所述第一命令。
通过第二代理模块对于其对应的全部应用程序关联的控制通道的第一数据位均进行检查，可以确定是哪一通道对应的应用程序有请求发出；通过第二代理模块根据第一数据位的状态确定是否需获取命令，可以避免命令的重复获取，可以提高第二代理模块的工作效率。
根据第一方面的第八种或第九种可能的实现方式，在所述应用程序间通信方法的第十种可能的实现方式中，所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序之后，所述方法还包括：所述第二代理模块控制所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于非置位状态、第二数据位处于非置位状态；针对所述第一应用程序和所述第二应用程序之间的控制通道，所述第二应用程序运行结束后，所述第二代理模块确定该控制通道的第一数据位处于非置位状态时，控制该控制通道的第二数据位处于置位状态；所述第二代理模块确定该控制通道的第一数据位处于置位状态时，重新从所述第一命令队列获取命令，并根据新获取的命令中第二应用程序的标识调度所述第二应用程序运行。
通过这种方式，可以在第一应用程序和所述第二应用程序之间的控制通道的请求处理完毕后，继续处理第一应用程序后续发起的新请求，而不必先获取核间中断后再对新请求进行处理，可以降低核间中断的收发次数，节约数据传输成本。
根据第一方面的第五种至第十种可能的实现方式中的任意一种可能的实现方式，在所述应用程序间通信方法的第十一种可能的实现方式中，在所述第一虚拟装置是物理机、所述第二虚拟装置是虚拟机时，所述第一虚拟装置还包括鉴权模块和第一进程模块，所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限，包括：所述第二代理模块将所述第一命令中、所述第二应用程序的标识转发至所述第一虚拟装置上的第一进程模块；所述第一进程模块确定与所述第二应用程序的标识对应的鉴权标识，并向所述鉴权模块发送权限信息获取请求，所述权限信息获取请求包括所述鉴权标识；所述第一进程模块接收来自所述鉴权模块的所述第二应用程序的权限信息，并传输至所述第二代理模块；所述第二代理模块根据所述第二应用程序的权限信息，判断所述第二应用程序是否具有访问所述共享内存的权限。
在第一虚拟装置是物理机时，第一进程模块可作为虚拟机侧和物理机侧的接口，使得虚 拟机侧的应用程序的相关信息可以通过第一进程模块传输至物理机侧，从而可以利用物理机侧的鉴权模块为虚拟机侧的应用程序进行鉴权。通过鉴权模块进行鉴权，可以进一步提高数据传输的安全性。
第二方面，本申请的实施例提供了一种应用程序间通信装置，所述装置应用于电子设备，所述电子设备运行第一虚拟装置和第二虚拟装置，所述第一虚拟装置和所述第二虚拟装置中的一个是虚拟机，另一个是物理机，所述装置包括：所述第一虚拟装置，用于根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，所述第一请求、所述第一命令包括第二虚拟装置上的第二应用程序的标识；输出第一核间中断到所述第二虚拟装置所在的核心，以使所述第二虚拟装置能够获取所述第一核间中断；所述第二虚拟装置，用于根据所述第一核间中断从所述第一命令队列获取所述第一命令；根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
根据第二方面，在所述应用程序间通信装置的第一种可能的实现方式中，所述第一虚拟装置还包括第一代理模块，所述第一代理模块用于，接收所述第一应用程序发送的所述第一请求；根据所述第一请求，向所述第一命令队列中写入所述第一命令；输出所述第一核间中断到所述第二虚拟装置所在的核心。
根据第二方面或第二方面的第一种可能的实现方式，在所述应用程序间通信装置的第二种可能的实现方式中，所述第二虚拟装置还包括第二代理模块，所述第二代理模块用于，根据所述第一核间中断从所述第一命令队列获取所述第一命令；根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
根据第二方面的第一种或第二种可能的实现方式，在所述应用程序间通信装置的第三种可能的实现方式中，所述第一请求和所述第一命令还包括所述第一应用程序的阻塞信息，所述第一代理模块接收所述第一应用程序发送的所述第一请求之后，所述第一应用程序进入阻塞状态；在接收到第二核间中断时，所述第一代理模块还用于，根据所述第二核间中断从第二命令队列获取第二命令，所述第二核间中断在所述第二应用程序运行结束后产生；在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块还用于，解除所述第一应用程序的阻塞状态。
根据第二方面的第三种可能的实现方式，在所述应用程序间通信装置的第四种可能的实现方式中，所述第二应用程序运行结束后，所述第二代理模块还用于，接收所述第二应用程序发送的第二请求，所述第二请求包括所述第一应用程序的标识；根据所述第二请求，向所述第二命令队列中写入所述第二命令，所述第二命令包括所述第一应用程序的标识；输出所述第二核间中断到所述第一虚拟装置所在的核心，以使所述第一虚拟装置能够获取所述第二核间中断。
根据第二方面的第一种至第四种可能的实现方式中的任意一种可能的实现方式，在所述应用程序间通信装置的第五种可能的实现方式中，所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令，包括：所述第一代理模块根据所述第一请求，判断所述第二应用程序是否具有通知权限；在所述第二应用程序具有通知权限时，向所述第一命令队列中写入所述第一命令。
根据第二方面的第三种至第五种可能的实现方式中的任意一种可能的实现方式，在所述应用程序间通信装置的第六种可能的实现方式中，所述第一虚拟装置还用于响应于所述第一 应用程序的申请创建共享内存，所述第一代理模块还用于，建立所述第一应用程序的地址与所述共享内存的地址的关联关系；所述第一请求和所述第一命令还包括所述共享内存的参数；在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态，包括：在所述第二命令包括所述第一应用程序的标识以及通道建立成功的信息时，所述第一代理模块解除所述第一应用程序的阻塞状态。
根据第二方面的第六种可能的实现方式，在所述应用程序间通信装置的第七种可能的实现方式中，所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序，包括：所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限；所述第二代理模块运行所述第二应用程序，并在所述第二应用程序具有访问所述共享内存的权限时，建立所述第二应用程序的地址与所述共享内存的地址的关联关系；所述第二命令还包括通道建立成功或通道建立失败的信息。
根据第二方面的第六种或第七种可能的实现方式，在所述应用程序间通信装置的第八种可能的实现方式中，所述共享内存还作为控制通道，所述控制通道包括第一数据位和第二数据位，所述第一数据位和所述第二数据位的状态由所述第一代理模块和所述第二代理模块控制；所述第一代理模块还用于，控制所述第一数据位处于置位状态、第二数据位处于非置位状态；所述第一代理模块输出所述第一核间中断到所述第二虚拟装置所在的核心，包括：所述第一代理模块确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态、第二数据位处于非置位状态时，所述第一代理模块输出第一核间中断到所述第二虚拟装置所在的核心。
根据第二方面的第八种可能的实现方式，在所述应用程序间通信装置的第九种可能的实现方式中，所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令，包括：所述第二代理模块根据所述第一核间中断，遍历所述第二虚拟装置上、所述第二代理模块对应的全部应用程序关联的控制通道；在确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态时，所述第二代理模块从第一命令队列获取所述第一命令。
根据第二方面的第八种或第九种可能的实现方式，在所述应用程序间通信装置的第十种可能的实现方式中，所述第二代理模块还用于，控制所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于非置位状态、第二数据位处于非置位状态；针对所述第一应用程序和所述第二应用程序之间的控制通道，所述第二应用程序运行结束后，所述第二代理模块还用于，确定该控制通道的第一数据位处于非置位状态时，控制该控制通道的第二数据位处于置位状态；所述第二代理模块还用于，确定该控制通道的第一数据位处于置位状态时，重新从所述第一命令队列获取命令，并根据新获取的命令中第二应用程序的标识调度所述第二应用程序运行。
根据第二方面的第五种至第十种可能的实现方式中的任意一种可能的实现方式，在所述应用程序间通信装置的第十一种可能的实现方式中，在所述第一虚拟装置是物理机、所述第二虚拟装置是虚拟机时，所述第一虚拟装置还包括鉴权模块和第一进程模块，所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限，包括：所述第二代理模块将所述第一命令中、所述第二应用程序的标识转发至所述第一虚拟装置上的第一进程模块；所述第一进程模块确定与所述第二应用程序的标识对应的鉴权标识，并向 所述鉴权模块发送权限信息获取请求，所述权限信息获取请求包括所述鉴权标识；所述第一进程模块接收来自所述鉴权模块的所述第二应用程序的权限信息，并传输至所述第二代理模块；所述第二代理模块根据所述第二应用程序的权限信息，判断所述第二应用程序是否具有访问所述共享内存的权限。
第三方面，本申请的实施例提供了一种应用程序间通信装置，包括：处理器；用于存储处理器可执行指令的存储器；其中，所述处理器被配置为执行所述指令时实现上述第一方面或者第一方面的多种可能的实现方式中的一种或几种的应用程序间通信方法。
第四方面，本申请的实施例提供了一种非易失性计算机可读存储介质，其上存储有计算机程序指令，所述计算机程序指令被处理器执行时实现上述第一方面或者第一方面的多种可能的实现方式中的一种或几种的应用程序间通信方法。
第五方面，本申请的实施例提供了一种计算机程序产品，包括计算机可读代码，或者承载有计算机可读代码的非易失性计算机可读存储介质，当所述计算机可读代码在电子设备中运行时，所述电子设备中的处理器执行上述第一方面或者第一方面的多种可能的实现方式中的一种或几种的应用程序间通信方法。
本申请的这些和其他方面在以下(多个)实施例的描述中会更加简明易懂。
附图说明
包含在说明书中并且构成说明书的一部分的附图与说明书一起示出了本申请的示例性实施例、特征和方面，并且用于解释本申请的原理。
图1示出现有技术二的基于网络posix接口的相互通信方案的工作流程示意图。
图2示出根据本申请实施例的应用程序间通信方法的示例性应用场景。
图3示出根据本申请实施例的应用程序间通信方法的示例性流程示意图。
图4示出根据本申请实施例的第一应用程序通知第二应用程序的示例性方法的示意图。
图5a示出根据本申请实施例的第一虚拟装置作为实体接收核间中断的一个示例。
图5b示出根据本申请实施例的第一虚拟装置作为实体接收核间中断的另一个示例。
图6示出根据本申请实施例的第一应用程序通知第二应用程序之后接收到第二应用程序的通知的示例性方法的示意图。
图7示出根据本申请实施例建立专用数据通道的示例性示意图。
图8示出根据本申请实施例的控制通道的一个示例。
图9示出根据本申请实施例的第一应用程序和所述第二应用程序之间的控制通道、专用数据通道、标识和信号量进行绑定的示例。
图10a示出根据本申请实施例确定第二应用程序是否具备访问所述共享内存的权限的示例性方法示意图。
图10b示出根据本申请实施例确定第二应用程序是否具备访问所述共享内存的权限的示例性方法示意图。
图11示出根据本申请实施例的应用程序间通信方法的一个具体示例。
图12示出根据本申请实施例的应用程序间通信装置10的示例性结构示意图。
图13示出根据本申请实施例的应用程序间通信装置的示例性结构示意图。
具体实施方式
以下将参考附图详细说明本申请的各种示例性实施例、特征和方面。附图中相同的附图标记表示功能相同或相似的元件。尽管在附图中示出了实施例的各种方面，但是除非特别指出，不必按比例绘制附图。
在这里专用的词“示例性”意为“用作例子、实施例或说明性”。这里作为“示例性”所说明的任何实施例不必解释为优于或好于其它实施例。
另外，为了更好的说明本申请，在下文的具体实施方式中给出了众多的具体细节。本领域技术人员应当理解，没有某些具体细节，本申请同样可以实施。在一些实例中，对于本领域技术人员熟知的方法、手段、元件和电路未作详细描述，以便于凸显本申请的主旨。
以下对本文中出现的术语进行解释。
虚拟化(Virtualization)：虚拟化是指将真实计算机元器件、计算资源进行抽象，并重新分配，建立一个或者多个虚拟环境，让计算元件在此虚拟的环境中运行的技术。抽象的对象包括处理器、内存、输入/输出接口外设等。虚拟化技术可以简化软件的重新配置过程，让一个平台可同时运行多个实例，并让所有的系统和应用程序都运行于互不干扰的不同空间。
虚拟机(virtual machine，VM)：在虚拟化提供的某个虚拟环境中运行的实例就是一个虚拟机。
实时性：任务在某个确定性时延内得到执行的能力。
嵌入式系统(embedded system)：嵌入式系统由硬件和软件组成，是一种嵌入在非通用计算机的电子/机械器件中的操作系统，通常具有小型化、高实时性的特点。
虚拟机监视器(virtual machine monitor，VMM)：用来创建与运行虚拟机的软件、固件或硬件，例如hypervisor。
宿主机(host machine)：又称host OS，简称host，被虚拟机监视器用来运行一个或多个虚拟机的系统或机器称为宿主机。
客户机(guest machine)：又称guest OS，简称guest，被宿主机运行的虚拟机称为客户机。
应用程序(app)：即宿主机或客户机运行的业务，可以理解为一个有特定功能的程序。
虚拟机陷出(trap)：虚拟机通过硬件能力从虚拟环境中切换到物理环境中运行，可以因异常、中断等被动陷出，也可通过指令主动陷出。
内核态：处理器切换到特权模式，可以访问所有硬件资源，包括内存、输出/输出接口、计算资源等。内核态负责管理应用程序对于上述硬件资源的分配和使用。
虚拟中断控制器：用于接收多个外部中断源的中断请求，并进行优先级判断，选中当前优先级最高的中断请求，并将此请求送给处理器。
阻塞：应用程序因为某种资源暂时不可得而处于停止运行状态，等待资源满足要求后可解除阻塞状态。
特权级：现代处理器在运行时，软件可能会运行在不同的特权级，高特权级通常比低特权级有更多权限。
驱动：运行在操作系统中的一种软件(一般运行于较高特权级别)，用来操作外设的行为。
前后端驱动：在虚拟化场景中，因为真实的硬件只能在物理环境中进行管理，所以虚拟 机只能看到虚拟出来的硬件。在虚拟机中的虚拟外设的驱动便是前端驱动，在物理环境中负责模拟虚拟外设，并去请求真正外设进行操作的软件一般被叫做后端驱动。
信号量(futex)：本质上是一个原子变量，用来在多个对象之间进行同步，常用的方式是一方在信号量上阻塞，另一方通过给此信号量的变量+1的方式，唤醒阻塞的一方。
2阶段页表(stage2页表)：因为虚拟环境是物理环境虚拟出来的，所以虚拟机看到的物理地址并不是真实的物理地址，需要一层页表翻译，转换为真实的物理地址。这个页表由软件维护，硬件自动翻译。此页表在一些平台上被称为2阶段页表。
超级调用(hypercall)：虚拟机主动通过一条超级调用指令请求物理环境中的服务，可以携带参数。
通信的含义包含两层，对于需通信的双方，第一层含义是通知对方，例如，一方可以通过某种机制阻塞，等待另一方通过某种方式与对方通信提醒一方继续运行；第二层含义则是消息内容的传递，即双方均可以通过某种通道，在通知对方的同时，给对方传递一些数据。这些数据可能是给对方的请求或者对于请求的答复，也可能是基于某种协议的数据。
在虚拟机的场景中，通用的虚拟化方案中，对于某一虚拟机和其外界的其他装置(例如其他虚拟机或物理机)是强调隔离性的，并不强调底层虚拟机和外界的通信行为。在不得不进行信息传递的时候，一般只能通过虚拟机陷出的方式，把消息带出来，然后再返回继续运行。虚拟机陷出和返回过程速度很慢，而且信息传递效率很低。所以在遇到性能瓶颈的时候，就需要有一种足够快速，又足够安全的机制，让位于物理机侧的应用程序和虚拟机侧的应用程序能够快速地相互通信。
现有技术主流使用以下两种方案实现物理机(宿主机)侧的应用程序和虚拟机(客户机)侧的应用程序之间的通信。
现有技术一提出了一种同步的共享内存机制，该方案的设计起源是为了解决如何使虚拟机中的驱动通过物理机使用真实外设的问题。该方案的实现方式如下：
当客户机想要通知宿主机时，客户机中的数据会通过共享内存的方式传递给宿主机，并将共享内存所在的地址通过virtio传输协议告知宿主机。当宿主机想要通知客户机侧时，一般通过中断注入的方式，当客户机被调度的时候，中断便会在虚拟机中上报，让客户机有机会处理宿主机侧的请求。
virtio协议本身是为了解决虚拟机的前后端驱动间通信的问题，并非虚拟机和物理机内应用程序间通信的机制，现有技术一基于此协议进行改良，使得此机制可以用于客户机和宿主机的应用程序间通信。
当宿主机侧的应用程序想要通知客户机侧应用程序时，可共享内存中注明要通知的客户机侧的应用程序的信息，并迫使对应的虚拟机陷出，再向虚拟机中注入中断。而当客户机侧的应用程序想要通知宿主机侧的应用程序时，也可在共享内存中注明要通知的宿主机侧的应用程序的信息，并主动进行虚拟机陷出，再通过核间中断等手段通知给宿主机侧。
现有技术一的缺点在于，通过virtio协议进行通信时，势必会造成虚拟机的陷出，在arm64平台的物理机上，无论是宿主机向客户机还是客户机向宿主机的通知，都涉及虚拟机陷出。虚拟机的陷入陷出以及后续的保存上下文工作是很慢的流程，势必会造成性能瓶颈。并且，virtio协议本身并没有提供任何安全机制，宿主机侧和客户机侧的应用程序通过virtio协议进行通信的时候，由于没有认证身份的流程，共享内存的访问向所有人开放，可 能会造成安全问题。
现有技术二提出了基于网络posix接口的相互通信方案。图1示出现有技术二的基于网络posix接口的相互通信方案的工作流程示意图。
如图1所示，该方案的原理是，只要宿主机为虚拟机提供了网络，则虚拟机中的应用程序也可以通过网络编程接口连接网络，并像普通应用程序一样使用网络。所以如果宿主机侧的应用程序和客户机侧的应用程序都通过如posix网络编程接口等方式使用网络，则可互相通信。为了加速客户机使用网络的性能，可以使用网卡直通的方式，该方式产生的网卡中断可以直接注入给虚拟机，让客户机使用网卡时无需陷入陷出。
现有技术二虽然免于虚拟机的陷入陷出，但是同样存在一些问题。其一，网络协议的数据传输效率是很低的，会造成数据的多次拷贝，如果通信传输的数据量大，会使通信时延大大增加。其二，即使使用网卡直通的方式加速网络性能，但由于网卡直通要依托于较苛刻的硬件环境，因此使用网卡直通意味着硬件成本的提高。对于无法直通的场景，或者没有可直通网卡的场景，网卡的使用同样会造成虚拟机的陷入陷出，降低性能。
有鉴于此，提出了一种应用程序间通信方法、装置、存储介质及程序产品，根据本申请实施例的应用程序间通信方法，能够实现虚拟机的业务和物理机的业务之间的快速通信，提高电子设备的通信效率。
图2示出根据本申请实施例的应用程序间通信方法的示例性应用场景。
如图2所示，本申请实施例的应用程序间通信方法可应用于电子设备，本申请的电子设备可以是智能手机、上网本、平板电脑、笔记本电脑、可穿戴电子设备(如智能手环、智能手表等)、TV、虚拟现实设备等等。
电子设备可包括虚拟机监控器和宿主机，其中宿主机可运行宿主机侧进程1、宿主机侧进程2，并可通过虚拟机监控器运行客户机1、客户机2。客户机2还可运行客户机2进程1。
本申请实施例的应用程序间通信方法可以为第一虚拟装置和第二虚拟装置提供快速通信服务，以及为第一虚拟装置上的第一应用程序和第二虚拟装置上的第二应用程序之间提供快速通信服务，其中，第一虚拟装置可以是物理机(宿主机)，第二虚拟装置可以是虚拟机(客户机1或客户机2)。第一应用程序可以对应于宿主机侧进程1或宿主机侧进程2，第二应用程序可以对应于客户机2进程1。
其中，第一应用程序(或第二应用程序)在运行过程中，可能需要第二应用程序(或第一应用程序)运行对应的功能进行配合，此时第一应用程序(或第二应用程序)可发起向第二应用程序(或第一应用程序)通信请求。已发出的请求可通过第二虚拟装置(或第一虚拟装置)对应的命令队列(未示出)来承载。请求已发出的信息可由第一虚拟装置(或第二虚拟装置)发出核间中断来通知第二虚拟装置(或第一虚拟装置)。第二虚拟装置(或第一虚拟装置)根据核间中断，可以获取被命令队列承载的请求，并驱动其上的第二应用程序对该请求作出响应。从而实现第一应用程序和第二应用程序之间的快速通信。
图2中以第一虚拟装置是物理机，第二虚拟装置是虚拟机作为示例。本领域技术人员应理解，第一虚拟装置也可以是虚拟机，第二虚拟装置也可以是宿主机，本申请实施例对于第一虚拟装置和第二虚拟装置的具体类型不作限制。
图3示出根据本申请实施例的应用程序间通信方法的示例性流程示意图。
如图3所示，在一种可能的实现方式中，本申请提出一种应用程序间通信方法，所述方 法应用于电子设备，所述电子设备运行第一虚拟装置和第二虚拟装置，所述第一虚拟装置和所述第二虚拟装置中的一个是虚拟机，另一个是物理机，所述方法包括步骤S1-步骤S4：
步骤S1，所述第一虚拟装置根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，所述第一请求、所述第一命令包括所述第二虚拟装置上的第二应用程序的标识。
其中，第一应用程序可以是第一虚拟装置上的某一应用程序，第一请求可以是第一应用程序向第二虚拟装置上的第二应用程序通信的请求。第一命令队列可以是电子设备启动时即初始化好的、第二虚拟装置可访问的静态共享内存。第一命令可以储存在第一命令队列中，等待第二虚拟装置进行获取和处理。可选地，第一请求、第一命令还可以包括指示第二应用程序的运行方式的信息。
步骤S2，所述第一虚拟装置输出第一核间中断到所述第二虚拟装置所在的核心，以使所述第二虚拟装置能够获取所述第一核间中断。
核间中断是直接输出至需通信的对象所在的核心，因此允许不使用虚拟中断控制器实现物理机与虚拟机之间、不同虚拟机的应用程序之间的互相通知。第一虚拟装置输出第一核间中断到第二虚拟装置时，可认为是第一虚拟装置向第二虚拟装置的通信。在第二虚拟装置获取到第一核间中断时，可认为第一虚拟装置向第二虚拟装置的通信已完成。
步骤S3，所述第二虚拟装置根据所述第一核间中断从所述第一命令队列获取所述第一命令。
第二虚拟装置接收到核间中断时，可认为有新的命令写入第一命令队列，且该新写入的命令需第二虚拟装置进行处理。因此，第二虚拟装置可根据第一核间中断从第一命令队列处获取第一命令。
步骤S4，所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
第二虚拟装置可认为第一命令所包括的标识对应的应用程序即为需运行的应用程序。第一命令包括第二应用程序的标识，因此，第二虚拟装置根据第一命令，可以确定需运行的是第二应用程序。在第一命令包括指示第二应用程序的运行方式的信息时，第二虚拟装置可以按照第一命令的指示运行第二应用程序。此时可认为第二虚拟装置根据通信完成了对应响应。
根据本申请实施例的应用程序间通信方法，通过第一虚拟装置根据第一应用程序发出的第一请求向第一命令队列中写入第一命令，并输出第一核间中断到第二虚拟装置所在的核心，使得第二虚拟装置可以获取第一核间中断并根据第一核间中断从第一命令队列获取第一命令，可以实现第一虚拟装置到第二虚拟装置的通信；第一命令是根据来自第一应用程序的第一请求写入的，并包括第二虚拟装置上的第二应用程序的标识，使得第二虚拟装置根据第一命令中、第二应用程序的标识可以运行第二应用程序，从而能够实现第一虚拟装置的应用程序到第二虚拟装置的应用程序的通信。由于第一虚拟装置和所述第二虚拟装置中的一个是虚拟机，另一个是物理机，因此物理机和虚拟机之间使用将核间中断直接输出至需通信的对象所在的核心的方式完成通信，可以避免使用虚拟中断控制器，从而避免虚拟机的陷入陷出，可以实现虚拟机的业务和物理机的业务之间的快速通信，提高电子设备的通信效率。
图4示出根据本申请实施例的第一应用程序通知第二应用程序的示例性方法的示意图。
如图4所示，在一种可能的实现方式中，所述第一虚拟装置还包括第一代理模块，步骤S1包括：
所述第一代理模块接收所述第一应用程序发送的所述第一请求；
所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令；
步骤S2包括：
所述第一代理模块输出所述第一核间中断到所述第二虚拟装置所在的核心。
通过这种方式，可以使用第一代理模块完成与第一应用程序相关的部分工作，避免第一应用程序直接与第二虚拟装置本身进行数据交换，保证了第一应用程序运行的安全性，同时降低了第一应用程序的数据处理成本。
举例来说，第一虚拟装置上可包括至少一个应用程序，该至少一个应用程序可以对应于一个第一代理模块。第一代理模块可以为出于安全角度考虑或者为实现计算机资源管理而引入的代理实体，运行于较高权限级别，可以类比为Linux内核中的内核态。第一代理模块可以负责管理、监控第一虚拟装置上运行于较低权限级别的应用程序，以及解除第一虚拟装置上阻塞的应用程序(示例参见图6)的阻塞状态等，至少一个应用程序可以是相互通信的实体。本申请实施例中，至少一个应用程序可将想要做的事情以请求的形式发送至第一代理模块，请求第一代理模块帮助操作。响应于请求，第一代理模块能够进行收发核间中断、写命令队列等操作，所以在第一代理模块管理第一应用程序的过程中，可以辅助进行第一应用程序的鉴权(示例参见下文图10a、图10b)、内存映射(示例参见下文图7)等事项。
步骤S1中，第一应用程序发出的第一请求可以由第一代理模块接收。在第一请求为第一应用程序发起的、向第二虚拟装置上的第二应用程序通信的请求时，第一请求可以包括第二应用程序的标识。
第一虚拟装置根据第一应用程序发出的第一请求向第一命令队列中写入第一命令，可以是第一代理模块根据第一请求，向第一命令队列中写入第一命令。作为与第一请求对应的第一命令，在第一请求包括第二应用程序的标识时，第一命令也可以包括第二应用程序的标识。
当第一虚拟装置希望发送第一请求给第二虚拟装置时，可使用第一命令队列，按照预设的格式(如[命令类型，命令参数])将对应于第一请求的第一命令写到第一命令队列中。除可被第一代理模块访问之外，第一命令队列可以设置为可被第二虚拟装置上的应用程序的代理模块(例如后文所述的第二代理模块)访问。
第一核间中断也可以由第一代理模块产生。步骤S2中，第一虚拟装置输出第一核间中断到第二虚拟装置所在的核心，可以是第一代理模块输出第一核间中断到第二虚拟装置所在的核心，从而实现第一虚拟装置通知第二虚拟装置。
如果第一应用程序的运行需第二应用程序配合时，第一应用程序不必等待第二应用程序运行完毕后才能继续运行，即不必阻塞时，则第一应用程序发出第一请求之后，即可继续运行，而不进入阻塞状态。在此情况下，第二应用程序运行结束后，可不通知第一应用程序。
下面介绍本申请实施例通过第一核间中断的发送和接收实现第一虚拟装置和第二虚拟装置之间的通知的原理。
出于高性能的需求，宿主机和客户机之间进行通信时，都需要直接发送核间中断给对方，且此流程中不需要客户机陷入陷出。然而在arm平台上，如果使能虚拟中断控制器(vgic)实现中断的发送，无论是客户机想要发送中断通知宿主机的时候，还是宿主机发送中断通知客户机的时候，理论上都需要客户机陷出。
基于此，本申请实施例的应用程序间通信方法可实现不使能虚拟中断控制器的情况下的 核间中断的收发。由于没有使能虚拟中断控制器，因此，无论是第一虚拟装置侧发出的核间中断还是第二虚拟装置侧发出的核间中断，都可以直接发送给接收核间中断时正在运行的实体。以下以第一虚拟装置作为实体接收核间中断为例进行描述。
图5a示出根据本申请实施例的第一虚拟装置作为实体接收核间中断的一个示例。
如图5a所示，假设第一虚拟装置作为物理机，且物理机还用于运行至少一个虚拟机以及虚拟机对应的虚拟机管理线程(客户机进程)，物理机在电子设备的某一核心上。物理机正在运行时接收到核间中断，如果核间中断是电子设备的另一核心发送给物理机的，则核间中断可由物理机接收并处理。如果核间中断是发送给物理机运行的某一虚拟机的，则物理机可以通过中断处理器将此核间中断注入给对应的虚拟机，由虚拟机进行处理。注入的方式可以通过现有技术来实现，例如在通过硬件方式注入时，可以写虚拟中断控制器上的寄存器(未示出)，又例如通过软件方式注入时，可以更改虚拟机的寄存器上下文。本申请对于物理机将核间中断注入给对应的虚拟机的具体方式不作限制。
图5b示出根据本申请实施例的第一虚拟装置作为实体接收核间中断的另一个示例。
如图5b所示，假设第一虚拟装置作为虚拟机，且虚拟机由一物理机运行，该物理机还运行虚拟机对应的虚拟机管理线程(客户机进程)，该物理机设置在电子设备的某一核心上。虚拟机正在运行时接收到核间中断，如果核间中断是电子设备的另一核心发送给虚拟机的，则核间中断可由虚拟机接收，直接处理核间中断即可；如果核间中断是发送给运行虚拟机的物理机的，则虚拟机可通过中断处理器发出超级调用(hypercall)指令将中断发送至物理机。物理机根据超级调用指令，可以主动进行中断处理。
结合图5a和图5b的相关描述可知，对于正运行的虚拟机，在收到向自己发出的核间中断时不需要陷出的动作。同时，因为没有使能虚拟中断控制器，所以虚拟机也可以直接发送核间中断给物理机所在核心。通过这种方式，使得核间中断不必使能虚拟中断控制器也可以在物理机和虚拟机之间发送，且虚拟机也不必陷入陷出，从而实现虚拟机与物理机之间的中断的直接通知。
如图4所示，在一种可能的实现方式中，所述第二虚拟装置还包括第二代理模块，步骤S3包括：
所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令；
步骤S4包括：
所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
通过这种方式，可以使用第二代理模块完成与第二应用程序相关的部分工作，避免第二应用程序直接与第一虚拟装置本身进行数据交换，保证了第二应用程序运行的安全性，同时降低了第二应用程序的数据处理成本。
举例来说，第二虚拟装置上可包括至少一个应用程序，该至少一个应用程序可以对应于一个第二代理模块。类似于第一代理模块，第二代理模块也可以为出于安全角度考虑或者为实现计算机资源管理而引入的代理实体，运行于较高权限级别，可以类比为Linux内核中的内核态。第二代理模块可以负责管理、监控第二虚拟装置上运行于较低权限级别的应用程序，以及解除第二虚拟装置上阻塞的应用程序的阻塞状态等，至少一个应用程序可以是相互通信的实体。本申请实施例中，至少一个应用程序可将想要做的事情以请求的形式发送至第二代 理模块，请求第二代理模块帮助操作。响应于请求，第二代理模块能够进行收发核间中断、写命令队列等操作，所以在第二代理模块管理第二应用程序的过程中，可以辅助进行第二应用程序的鉴权(示例参见下文图10a、图10b)、内存映射(示例参见下文图7)等事项。在引入第一代理模块和第二代理模块的基础上，第一虚拟装置侧的应用程序和第二虚拟装置侧的应用程序即可做到相互通信。
步骤S3中，第二代理模块可以通过访问第一命令队列获取第一命令。即第一命令队列可以使设置为仅第二代理模块和第一代理模块才有资格访问，对于其他实体不可见。
参见上文描述，第一命令可包括第二应用程序的标识，在步骤S4中，第二代理模块根据该标识，可以确定该标识对应的应用程序也即第二应用程序是需运行的应用程序，并运行第二应用程序。相当于第二应用程序接收到了来自第一应用程序的通知，并做出了响应。且该通知过程不需虚拟机的陷入陷出，从而实现了虚拟机与物理机之间的应用程序的快速通知。
图6示出根据本申请实施例的第一应用程序通知第二应用程序之后接收到第二应用程序的通知的示例性方法的示意图。
如图6所示，在一种可能的实现方式中，所述第一请求和所述第一命令还包括所述第一应用程序的阻塞信息，
所述第一代理模块接收所述第一应用程序发送的所述第一请求之后，所述方法还包括：
所述第一应用程序进入阻塞状态；
在接收到第二核间中断时，所述第一代理模块根据所述第二核间中断从第二命令队列获取第二命令，所述第二核间中断在所述第二应用程序运行结束后产生；
在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态。
通过这种方式，对于发出向第二应用程序通信的请求后阻塞的第一应用程序，可以实现第二应用程序到第一应用程序的快速通知，阻塞的第一应用程序可以通过该通知解除阻塞状态，使得可以保证第一应用程序可以快速地继续运行。
举例来说，如果第一应用程序的运行需第二应用程序配合，且第一应用程序必须等待第二应用程序运行完毕后才能继续运行，则第一应用程序可发出包括第一应用程序的阻塞信息的第一请求。阻塞信息可以是指示应用程序进入阻塞状态的指令。第一应用程序的阻塞信息，可以是指示第一应用程序进入阻塞状态的指令。在发出第一请求之后，第一应用程序可以在对应的信号量(未示出)上阻塞，即进入阻塞状态。在阻塞状态下，在接收到来自第二应用程序的通知之后，可以继续运行。
在步骤S1中，第一代理模块接收第一应用程序发送的第一请求之后，在向第一命令队列中写入第一命令时，第一命令也可以包括第一应用程序的阻塞信息，即第一请求、第一命令可同时包括第一应用程序的标识和第一应用程序的阻塞信息。结合上文描述可知，第一命令可由第二代理模块获取，并根据第一命令中的标识运行第二应用程序，在第二应用程序运行结束之后，根据第一应用程序的阻塞信息，第二应用程序可以反向通知第一应用程序，其通知方式可以与第一应用程序通知第二应用程序的方式相同。例如第二应用程序发送第二请求，第二请求可包括第一应用程序的标识；第二代理模块根据第二请求将第二命令写入第二命令队列，并发送第二核间中断到第一虚拟装置所在的核心，第二命令可包括第一应用程序的标识。其具体的通知方式可以参见下文中图6的相关描述。对于第一虚拟装置侧，则可体现为， 第一虚拟装置接收到第二核间中断时，第一代理模块根据第二核间中断从第二命令队列获取第二命令；根据第二命令包括的第一应用程序的标识，第一代理模块解除第一应用程序的阻塞状态，此时第一应用程序可继续运行。第二核间中断的接收方式可以参见上文及图5a和图5b的相关描述，在此不再赘述。
进一步地，第一代理模块在代理多个应用程序时，如果第一应用程序必须等待第二应用程序运行完毕后才能继续运行，则第一请求、第一命令还可包括第一应用程序的标识，即第一请求、第一命令可同时包括第一应用程序的标识、第二应用程序的标识、第一应用程序的阻塞信息。以使第二代理模块根据第一命令中第一应用程序的标识确定第二应用程序运行结束之后，可进一步确定第二应用程序应通知的是第一代理模块代理的多个应用程序中的第一应用程序，以保证第一应用程序可以快速地恢复正常运行的状态。
如图6所示，在一种可能的实现方式中，所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序之后，所述方法还包括：
所述第二应用程序运行结束后，所述第二代理模块接收所述第二应用程序发送的第二请求，所述第二请求包括所述第一应用程序的标识；
所述第二代理模块根据所述第二请求，向所述第二命令队列中写入所述第二命令，所述第二命令包括所述第一应用程序的标识；
所述第二代理模块输出所述第二核间中断到所述第一虚拟装置所在的核心，以使所述第一虚拟装置能够获取所述第二核间中断。
通过这种方式，使得第二代理模块可以确定第二代理模块运行结束后需通知的是第一应用程序，使得第一代理模块根据第二命令可以解除的是第一应用程序的阻塞状态，以保证第一应用程序解除阻塞状态时，第二应用程序确实已经运行结束，从而能满足第一应用程序等待第二应用程序运行完毕后继续运行的需求。
举例来说，如果第一命令包括第一应用程序的阻塞信息，则根据第一命令，第二代理模块可以确定第一应用程序已经处于阻塞状态，且阻塞状态需等待第二应用程序运行结束后的通知来解除。在此情况下，第二代理模块调度第二应用程序运行结束后，第二应用程序可发出第二请求，由于第二应用程序是根据第一应用程序的通知运行的，因此第二请求可包括第一应用程序的标识。
根据第二请求，第二代理模块可以向第二命令队列中写入第二命令。作为与第二请求对应的第二命令，在第二请求包括第一应用程序的标识时，第二命令也可以包括第一应用程序的标识。可选地，第二请求和第二命令还可以包括指示第一应用程序的运行方式的信息。
第二命令队列可以是第一虚拟装置和第二虚拟装置之间的、一块第一虚拟装置启动时即初始化好的静态共享内存。当第二虚拟装置希望发送第二请求给第一虚拟装置时，可使用第二命令队列，按照预设的格式(如[命令类型，命令参数])将对应于第二请求的第二命令写到第二命令队列中。第二命令队列可以设置为可被第一虚拟装置上的一些模块(例如上文所述的第一代理模块)访问。
在写入第二命令到第二命令队列之后，第二代理模块可以输出第二核间中断到第一虚拟装置所在的核心，从而实现第二虚拟装置通知第一虚拟装置。第二核间中断的输出方式可以参见上文及图5a和图5b的相关描述，在此不再赘述。
进一步地，第二代理模块代理多个应用程序在代理多个应用程序时，如果第一应用程序 必须等待第二应用程序运行完毕后才能继续运行，则第二请求、第二命令还可包括第二应用程序的标识，即第二请求、第二命令可同时包括第一应用程序的标识和第二应用程序的标识。以使第二代理模块可以根据第二请求中第二应用程序的标识可以确定其代理的多个应用程序中的第二应用程序运行结束，从而能执行根据第二请求向第二命令队列中写入第二命令的步骤。同时第一代理模块可以根据第二命令中第二应用程序和第一应用程序的标识，确定由第一应用程序发起的、第一应用程序向第二虚拟装置上的第二应用程序通信的请求已经处理完毕，第二应用程序已经响应于该请求运行结束，再解除第一应用程序的阻塞状态。以保证第一应用程序解除阻塞状态恢复正常运行的状态时，第二应用程序确实已经运行结束。
以上所述的第一应用程序的标识可以由第一应用程序向其代理也即第一代理模块申请，用于身份识别和阻塞状态的解除。第一代理模块可以将第一应用程序的标识与任一信号量(未示出)关联起来，使得第一应用程序可以在对应的信号量上阻塞。类似地，第二应用程序的标识可以由第二应用程序向其代理也即第二代理模块申请，用于身份识别和阻塞状态的解除。第二代理模块可以将第二应用程序的标识与任一信号量(未示出，不同于第一应用程序对应的信号量)关联起来，使得第二应用程序可以在对应的信号量上阻塞。
以上仅示出第一应用程序阻塞的示例。本领域技术人员应理解，第二应用程序的运行需除第二虚拟装置之外的其他物理机的对应的应用程序配合时，如果第二应用程序必须等待对应的应用程序运行完毕后才能继续运行，则第二应用程序也可在第二代理模块为其关联的信号量上阻塞，阻塞的方式以及阻塞状态解除的方式可以参见第一应用程序阻塞的方式以及阻塞状态解除的方式的相关描述，在此不再赘述。
在一种可能的实现方式中，所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令，包括：
所述第一代理模块根据所述第一请求，判断所述第二应用程序是否具有通知权限；
在所述第二应用程序具有通知权限时，向所述第一命令队列中写入所述第一命令。
通过这种方式，可以保证接收到通知的应用程序是具有通知权限的应用程序，保证通知的安全性。
举例来说，在一些应用场景下，例如微内核场景，对于互相通信的应用程序的权限可能有一定需求，需要对应用程序进行鉴权，以保证通信的安全性。因此，在向第一命令队列中写入第一命令之前，第一代理模块可以对第二应用程序的权限进行判断。第一请求可以包括第二应用程序的标识，因此，第一代理模块根据第一请求，可以确定第二应用程序是第一应用程序想要请求运行(通知)的应用程序。在此情况下，第一代理模块可以先确定第二应用程序是否具有通知权限。在第二应用程序具有通知权限时，可认为第二应用程序是可以通信的对象，再向第一命令队列中写入第一命令。如果第二应用程序不具有通知权限时，可认为第二应用程序不是可以通信的对象，可不向第一命令队列中写入第一命令。
通知权限可以直接由第一虚拟装置上的第一代理模块确定。例如，对于第二代理模块代理的各应用程序，在准备使用本申请实施例的应用程序间通信方法进行通信时，可以向第二代理模块申请对应的标识，用于身份识别和阻塞状态的解除时使用。在某一应用程序申请标识的时候可以对该应用程序进行一次授权。以第二代理模块代理的第二应用程序为例，在第二应用程序向第二代理模块申请标识之后，可例如由第二代理模块使用密码学手段(如签名)或者静态表配置的方式进行应用程序合法性的检查。如果第二应用程序是不合法的应用程序， 第二代理模块可不为第二应用程序提供标识，所以后续第二应用程序就无法使用本申请实施例的应用程序间通信方法；或者，第二代理模块也可为第二应用程序提供标识，但记录第二应用程序不具备通知权限。反之，如果第二应用程序是合法的应用程序，第二代理模块可为第二应用程序提供标识，以使第二应用程序可以使用本申请实施例的应用程序间通信方法；第二代理模块可以记录第二应用程序具备通知权限。第二代理模块可以将第二应用程序具备通知权限的信息通过第二虚拟装置与第一虚拟装置的接口(例如下文所述的第一进程模块)传递给第一虚拟装置侧的第一代理模块。
第一代理模块第一次判断第二应用程序是否具有通知权限之后，在后续需要再次判断第二应用程序是否具有通知权限时，可以直接使用第一次判断的判断结果，可以不必重复进行判断。
一些情况下，第一应用程序和第二应用程序之间除了互相通知，还需要传递很多数据消息，如果仍然使用第一命令队列和第二命令队列进行数据的传递，对于可传递的数据的种类、数量等等都会带来限制。基于此，本申请实施例还提出利用应用程序间通知的机制为第一应用程序和第二应用程序之间动态地创建共享内存，使其可以作为第一应用程序和第二应用程序之间的专用数据通道，可以用于传递种类、数据量都比较多的数据。下面介绍本申请实施例的专用数据通道的示例性建立方法。
图7示出根据本申请实施例建立专用数据通道的示例性示意图。
如图7所示，在一种可能的实现方式中，所述第一虚拟装置根据所述第一应用程序发出的第一请求，向第一命令队列中写入第一命令之前，所述方法还包括：
响应于第一应用程序的申请，所述第一虚拟装置创建共享内存，所述第一代理模块建立所述第一应用程序的地址与所述共享内存的地址的关联关系；所述第一请求和所述第一命令还包括所述共享内存的参数；
在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态，包括：
在所述第二命令包括所述第一应用程序的标识以及通道建立成功的信息时，所述第一代理模块解除所述第一应用程序的阻塞状态。
通过这种方式，使得可以通过共享内存作为第一应用程序和第二应用程序之间的专用数据通道，相比仅采用命令队列的形式进行数据传递的方案，可以传递更丰富的数据。同时共享内存可传递的数据量比较大，可以减少数据的拷贝次数，提升数据的传输效率。
举例来说，第一应用程序可以向第一虚拟装置的核心申请创建一块共享内存，该申请得到第一虚拟装置的核心的引用后，第一虚拟装置的核心可以分配一块物理内存页面作为共享内存(即第一虚拟装置创建共享内存)，物理内存页面的真实地址与共享内存的虚拟地址相关联。第一代理模块可以建立第一应用程序的地址与共享内存的地址的关联关系(<1>)，因此，第一应用程序就可以使用该共享内存。由于共享内存关联于物理内存页面，因此，第一应用程序使用该共享内存存取数据时，可满足多种类的、数据量较大的数据的存取。图7中，HVA表示对应于物理内存页面的虚拟的共享内存地址。
在第一应用程序具备可使用的共享内存的情况下，第一请求和第一命令还可包括共享内存的参数，例如共享内存的名称、大小等等。此时第一请求可以是第一应用程序向第二虚拟装置上的第二应用程序通信、以及创建第一应用程序和第二应用程序之间的专用数据通道的 请求。
第二虚拟装置上，第二代理模块根据第一命令，在驱动第一应用程序运行的同时，还可以为第二应用程序和第一应用程序建立专用数据传输通道(<4><5>)，其示例性方式可以参见下文中图7的相关描述。第二请求可以在专用数据通道建立成功之后由第二应用程序发出。第二请求可以包括通道建立成功的信息。因此，第二命令也可以包括通道建立成功的信息，即第二命令可以包括第一应用程序的标识以及通道建立成功的信息。
在第二命令包括第一应用程序的标识时，第一代理模块解除第一应用程序的阻塞状态，可以是在第二命令包括第一应用程序的标识以及通道建立成功的信息时，第一代理模块解除第一应用程序的阻塞状态。此时第一应用程序和第二应用程序就可以通过专用数据通道互相传递数据信息。可选地，在通道建立成功时，通道建立成功的信息也可以通过建立好的专用数据通道进行传递，本公开对于通道建立成功的信息的具体传递方式不作限制。
如图7所示，在一种可能的实现方式中，所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序，包括：
所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限；
所述第二代理模块运行所述第二应用程序，并在所述第二应用程序具有访问所述共享内存的权限时，建立所述第二应用程序的地址与所述共享内存的地址的关联关系；所述第二命令还包括通道建立成功或通道建立失败的信息。
通过这种方式，使得专用数据通道建立前，第二代理模块可以确定第二应用程序是否具备访问共享内存的权限，专用数据通道在第二应用程序具备访问共享内存的权限时建立，以保证专用数据通道的建立的安全性。通过第二命令将通道建立成功或通道建立失败的信息传递给第一虚拟装置侧，以使第一虚拟装置的第一应用程序可以确定其请求的执行情况。
举例来说，在第一命令包括第二应用程序的标识以及共享内存的参数时，第二代理模块根据第一命令，可以确定第一应用程序发起了向第二虚拟装置上的第二应用程序通信、以及创建第一应用程序和第二应用程序之间的专用数据通道的请求。在一些场景下，例如微内核场景，对于应用程序的权限可能有一定需求，需要对应用程序进行鉴权，以保证数据传输的安全性。在此情况下，第二代理模块可以先运行第二应用程序，同时确定第二应用程序是否具有访问所述共享内存的权限。在第二应用程序具有访问所述共享内存的权限时，可认为第二应用程序是可以作为专用数据通道的使用者的，此时可以分配虚拟共享内存地址(GPA)，并利用超级调用指令请求虚拟机监控器或者物理机内核建立2阶段页表，即建立虚拟共享内存地址GPA与共享内存(物理)地址的关联关系(<4>)。之后第二代理模块再将第二应用程序的地址(GVA)映射到虚拟共享内存地址GPA上(<5>)，完成建立第二应用程序的地址与共享内存的地址的关联关系。共享内存的位置、大小的同步可以借助第一命令队列和第二命令队列实现。由上文描述可知，共享内存的地址与第一应用程序的地址也具有关联关系，因此，相当于第一应用程序的地址与第二应用程序的地址相关联。即第一应用程序和第二应用程序之间的专用数据通道建立成功，第一应用程序和第二应用程序可以使用共享内存完成相互的数据传输。第二命令还可包括通道建立成功的信息，以通知第一应用程序其请求的专用数据通道已经成功建立。
如果第二应用程序不具有访问所述共享内存的权限时，可认为第二应用程序不可以作为 专用数据通道的使用者，可不建立第二应用程序的地址与共享内存的地址的关联关系。第二命令还可包括通道建立失败的信息，以通知第一应用程序其请求的专用数据通道未能成功建立。
可选地，如果物理机侧有接口支持，也可以基于上述图7的流程动态扩缩共享内存的能力。例如在不需传输数据或者需要传输的数据量远小于已经创建的共享内存的大小时，已经建立的专用数据通道还可以动态地删除或者进行大小的动态调整，以保证资源部署的灵活性，提升内存使用效率。
由于本申请实施例的应用程序间通信方法依赖于虚拟机和物理机之间的核间中断收发实现互相通知，因此，如果某两个应用程序之间多次通知，产生的命令的个数可能较多，此时可以通过以下的控制通道对核间中断进行汇聚，以降低核间中断的收发次数。
在一种可能的实现方式中，所述共享内存还作为控制通道，所述控制通道包括第一数据位和第二数据位，所述第一数据位和所述第二数据位的状态由所述第一代理模块和所述第二代理模块控制；
步骤S2之前，所述方法还包括：
所述第一代理模块控制所述第一数据位处于置位状态、第二数据位处于非置位状态；
所述第一代理模块输出所述第一核间中断到所述第二虚拟装置所在的核心，包括：
所述第一代理模块确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态、第二数据位处于非置位状态时，所述第一代理模块输出第一核间中断到所述第二虚拟装置所在的核心。
通过控制通道专用于控制核间中断的发送及接收，可以降低核间中断的收发次数，降低应用程序间通信方法的实现复杂度。
举例来说，可选地，可以设置第一应用程序和第二应用程序之间的某一专用数据通道作为控制通道，此时控制通道也成为第一应用程序和第二应用程序之间的私有控制通道。图8示出根据本申请实施例的控制通道的一个示例。
如图8所示，第一应用程序、第三应用程序可以是第一虚拟装置侧的应用程序，第二应用程序、第四应用程序可以是第二虚拟装置侧的应用程序，在图8的示例中，在电子设备上可以包括第一应用程序和第二应用程序之间的控制通道，第一应用程序和第四应用程序之间的控制通道、以及第三应用程序和第二应用程序之间的控制通道。
以第一应用程序和第二应用程序之间的控制通道为例，该控制通道可以至少包括第一数据位和第二数据位，二者的状态可由第一代理模块和第二代理模块控制。其中，第一数据位和第二数据位的状态可包括置位状态和非置位状态。该通道的第一数据位的置位状态可以表示第一应用程序有发送给第二应用程序的请求，在此情况下，该通道的第二数据位的置位状态可以表示第二应用程序正在处理该请求；该通道的第二数据位的非置位状态可以表示第二应用程序尚未处理该请求；该通道的第一数据位的非置位状态可以表示第一应用程序没有发送给第二应用程序的请求。
由于控制通道本质上是第一应用程序和第二应用程序之间共享内存，因此第一数据位和第二数据位的状态对于第一代理模块和第二代理模块可以是同步的，例如第一代理模块控制第一数据位为置位状态后，第二代理模块如获取第一数据位的状态，则获取到的可以是置位状态；此时第二代理模块控制第一数据位为非置位状态后，第一代理模块如获取第一数据位 的状态，则获取到的可以是非置位状态。
因此，在第一虚拟装置需发送第一核间中断至第二虚拟装置时，在步骤S2执行之前，第一代理模块可以先控制该第一应用程序和第二应用程序之间的控制通道的第一数据位处于置位状态、第二数据位处于非置位状态，表示第一应用程序有发送给第二应用程序的请求，且第二应用程序尚未处理该请求。在此情况下，第一代理模块再输出第一核间中断到第二虚拟装置。
在一种可能的实现方式中，所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令，包括：
所述第二代理模块根据所述第一核间中断，遍历所述第二虚拟装置上、所述第二代理模块对应的全部应用程序关联的控制通道；
在确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态时，所述第二代理模块从第一命令队列获取所述第一命令。
通过第二代理模块对于其对应的全部应用程序关联的控制通道的第一数据位均进行检查，可以确定是哪一通道对应的应用程序有请求发出；通过第二代理模块根据第一数据位的状态确定是否需获取命令，可以避免命令的重复获取，可以提高第二代理模块的工作效率。
举例来说，第二虚拟装置上，第二代理模块可代理至少一个应用程序，每一应用程序和其他虚拟机或者物理机上的应用程序之间都可能关联一个控制通道，即第二代理模块可对应于多个控制通道。在核间中断到来时，第二代理模块可能仅可以确定有请求需其代理的某一应用程序处理，而对于该核间中断是根据哪一应用程序的请求发出、具体需要哪一应用程序处理可能是未知的。
在此情况下，第二代理模块根据第一核间中断从第一命令队列获取所述第一命令，可以是第二代理模块先根据第一核间中断，遍历第二虚拟装置上、第二代理模块对应的全部应用程序关联的控制通道，确定各控制通道的第一数据位的状态。在确定第一应用程序和第二应用程序之间的控制通道的第一数据位处于置位状态时，可认为第一应用程序有发送给第二应用程序的请求，再从第一命令队列获取第一命令。如果确定第一应用程序和第二应用程序之间的控制通道的第一数据位处于非置位状态时，可认为第一应用程序没有请求需第二应用程序处理，不必从第一命令队列获取第一命令。
在一种可能的实现方式中，步骤S4之后，所述方法还包括：
所述第二代理模块控制所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于非置位状态、第二数据位处于置位状态；
针对所述第一应用程序和所述第二应用程序之间的控制通道，所述第二应用程序运行结束后，所述第二代理模块确定该控制通道的第一数据位处于非置位状态时，控制该控制通道的第二数据位处于非置位状态；
所述第二代理模块确定该控制通道的第一数据位处于置位状态时，重新从所述第一命令队列获取命令，并根据新获取的命令中的第二应用程序的标识调度所述第二应用程序运行。
通过这种方式，可以在第一应用程序和所述第二应用程序之间的控制通道的请求处理完毕后，继续处理第一应用程序后续发起的新请求，而不必先获取核间中断后再对新请求进行处理，可以降低核间中断的收发次数，节约数据传输成本。
举例来说，在第二代理模块从第一命令队列获取第一命令之后，可以执行步骤S4运行第 二应用程序，对第一应用程序发送给第二应用程序的请求进行处理。此时可认为第二应用程序已经处理该请求。第二代理模块可以控制第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于非置位状态、第二数据位处于置位状态。在第二应用程序运行的过程中，第一应用程序还可能继续发起请求，这一动作可能导致该控制通道的第一数据位在第一代理模块的控制下处于置位状态。因此，在第二应用程序运行结束之后，第二代理模块可以检查第一应用程序和第二应用程序之间的控制通道的第一数据位，如确定该控制通道的第一数据位仍处于非置位状态，可认为第一应用程序没有进一步向第二应用程序发起请求，可以清除第二数据位的置位状态，即控制该控制通道的第二数据位处于非置位状态。如确定该控制通道的第一数据位处于置位状态，可认为第一应用程序进一步向第二应用程序发起了其他请求，可以重新从第一命令队列获取命令，并根据新获取的命令中的应用程序的标识调度对应的应用程序运行。
在按照某一控制通道的请求完成调度应用程序运行之后，确定该控制通道的第一数据位处于非置位状态，第二代理模块可以继续其他控制通道的第一数据位、第二数据位的状态查看和请求处理。其具体实现方式可以参见上文中与第一应用程序和所述第二应用程序之间的控制通道相关的描述，在此不再赘述。
参见上文所述，控制通道和专用数据通道都是第一应用程序和所述第二应用程序之间通道，且二者的职能不同，所以可以将第一应用程序和所述第二应用程序之间的控制通道和专用数据通道绑定起来，控制通道用来进行核间中断的汇聚，专用数据通道用来承载通信数据。专用数据通道又可以和数据发送方(如上文所述的第一应用程序)的标识和信号量绑定起来，用来让数据发送方阻塞和解除阻塞。图9示出根据本申请实施例的第一应用程序和所述第二应用程序之间的控制通道、专用数据通道、标识和信号量进行绑定的示例。综上所述，结合标识/信号量、控制通道、专用数据通道和第一命令队列、第二命令队列，本申请实施例的应用程序间通信方法可以成为可中断汇聚的高性能快速通知、数据传输方案。
上文中提及了在一些场景下，例如微内核场景，对于通信的安全性可能有需求，因此可进一步确定第二应用程序的通知权限以及访问所述共享内存的权限。其中，确定第二应用程序是否具备通知权限的相关描述已经介绍过，下面介绍确定第二应用程序是否具备访问所述共享内存的权限的示例性方法。图10a和图10b分别示出根据本申请实施例确定第二应用程序是否具备访问所述共享内存的权限的示例性方法示意图。
如图10a所示，在一种可能的实现方式中，在所述第一虚拟装置是物理机、所述第二虚拟装置是虚拟机时，所述第一虚拟装置还包括鉴权模块和第一进程模块，所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限，包括：
所述第二代理模块将所述第一命令中、所述第二应用程序的标识转发至所述第一虚拟装置上的第一进程模块；
所述第一进程模块确定与所述第二应用程序的标识对应的鉴权标识，并向所述鉴权模块发送权限信息获取请求，所述权限信息获取请求包括所述鉴权标识；
所述第一进程模块接收来自所述鉴权模块的所述第二应用程序的权限信息，并传输至所述第二代理模块；
所述第二代理模块根据所述第二应用程序的权限信息，判断所述第二应用程序是否具有访问所述共享内存的权限。
在第一虚拟装置是物理机时，第一进程模块可作为虚拟机侧和物理机侧的接口，使得虚拟机侧的应用程序的相关信息可以通过第一进程模块传输至物理机侧，从而可以利用物理机侧的鉴权模块为虚拟机侧的应用程序进行鉴权。通过鉴权模块进行鉴权，可以进一步提高数据传输的安全性。
举例来说，现有技术中，物理机的微内核拥有极强的安全性，可以使用诸如形式化验证的手段用数学手段证明其可靠性，微内核拥有针对内核对象的鉴权模块，鉴权模块可例如支持现有技术的能力安全机制(capability机制)。在该能力安全机制中，鉴权标识可以当做一种特殊的对象，每一个应用程序都需要拥有对方的鉴权标识才能访问特定的内核对象，或者执行特定的流程。因此，对于本申请实施例的虚拟机上的应用程序，也可以借助鉴权模块进行鉴权。
如图10b所示，假设第一虚拟装置是物理机(宿主机)，则鉴权模块可以是设置在物理机侧的模块。由于设置在同一物理机上，因此对于鉴权模块而言，物理机侧的各应用程序是位于可信边界之内的，物理机侧的各应用程序可以直接通过鉴权模块的能力安全机制进行鉴权。假设第二虚拟装置是虚拟机，则对于设置在虚拟机上的应用程序，想要通过鉴权模块鉴权时，需要借助于物理机上的第一进程模块。
第一进程模块可以负责处理物理机侧、对应于虚拟机的进程，该对应于虚拟机的进程本质上可以是一个普通的用户态线程，所以其本身同样需要通过鉴权模块进行权限管理。只有第一进程模块先得到了访问某些资源(例如共享内存)的权限后，才能给虚拟机内部的众多应用程序授权。
而针对虚拟机内部的应用程序，由于鉴权模块在物理机侧，物理机侧是无法感知到虚拟机内部的应用程序的区别的，所以可以由第一进程模块协助物理机为虚拟机内部的应用程序进行功能的维护，可以选择将每个虚拟机内部的应用程序都作为虚拟机内核的一个“实例”，即可以获得能力安全机制的实体。以第二应用程序为例，当第二应用程序需要鉴权时，需要经过第二代理模块，第二代理模块会将第二应用程序的标识传递至第一进程模块，由第一进程模块确定与第二应用程序的标识对应的鉴权标识(得到鉴权标识<->第二应用程序的表示的映射)，并向鉴权模块发送权限信息包括鉴权标识的权限信息获取请求。
在此情况下，鉴权模块可以识别鉴权标识，并确定鉴权标识对应的应用程序的权限信息，该鉴权标识对应的应用程序即第二应用程序。鉴权模块可以发送确定的第二应用程序的权限信息到第一进程模块。第一进程模块第二应用程序的权限信息后，可以传输至第二代理模块，第二代理模块根据第二应用程序的权限信息，判断第二应用程序是否具有访问所述共享内存的权限。第二代理模块第一次判断第二应用程序是否具有访问所述共享内存的权限之后，在后续需要再次判断第二应用程序是否具有访问所述共享内存的权限时，可以直接使用第一次判断的判断结果，可以不必重复进行判断。
可选地，第二应用程序的通知权限也可以由鉴权模块鉴权，例如第二代理模块为第二应用程序提供标识时，可以将第二应用程序的身份信息和其标识经由第一进程模块告知鉴权模块，让鉴权模块了解到第二应用程序是合法的实体，以确定二应用程序具备通知权限。鉴权模块鉴权第二应用程序的通知权限的示例性实现方式可以与鉴权模块鉴权第二应用程序的访问所述共享内存的权限的方式相同，在此不再赘述。
可选地，本申请实施例的应用程序间通信方法也可以用于两个虚拟机之间的快速通信， 通过物理机的内核为需通信的两个应用程序分别所属的两个虚拟机都进行鉴权，同时使共享内存于两台虚拟机之间可见即可。此时，可由物理机为该两个虚拟机进行专用数据通道的初始化、申请等工作。
图11示出根据本申请实施例的应用程序间通信方法的一个具体示例。该示例可实现位于宿主机侧的DB客户端和客户机侧的DB服务器的快速通信。在图11的示例中，宿主机对应于第一虚拟装置，客户机对应于第二虚拟装置。宿主机侧，代理模块A对应于第一代理模块，DB客户端对应于第一应用程序。客户机侧，代理模块B对应于第二代理模块，DB服务器对应于第二应用程序。
如图11所示，首先，在应用程序间通信方法执行之前，在宿主机侧，DB客户端已经向代理模块A申请了自己的标识，代理模块A也已经将DB客户端的信息传输给宿主机侧的鉴权模块。在客户机侧，DB服务器已经向代理模块B申请了自己的标识，代理模块B也已经将DB服务器的信息经宿主机侧的第一进程模块传输给鉴权模块。且DB客户端已获得DB服务器的标识。DB客户端已经得到一块共享内存的使用权限。
在应用程序间通信方法执行时，在宿主机侧，DB客户端向代理模块A发出第一请求，第一请求可以是DB客户端和DB服务器之间的专用数据通道建立请求。第一请求可以包括DB客户端的标识、DB服务器的标识、DB客户端的阻塞信息、共享内存的参数。发出第一请求后，DB客户端进入阻塞状态。
根据第一请求，代理模块A请求鉴权模块判断DB客户端和DB服务器的标识是否合法。例如判断DB客户端和DB服务器是否具备通知权限。在合法时，例如DB客户端和DB服务器具备通知权限时，向客户机侧的第一命令队列写入第一命令，并发出第一核间中断给客户机侧。第一命令可以是DB客户端和DB服务器之间的专用数据通道建立命令，可包括DB客户端的标识、DB服务器的标识、DB客户端的阻塞信息、共享内存的参数。
在客户机侧，代理模块B接收第一核间中断，从第一命令队列处获取到第一命令。根据第一命令，代理模块B确定该命令目的是在DB客户端和DB服务器之间建立专用数据通道，代理模块B根据第一命令中的DB服务器的标识，先通过第一进程模块请求宿主机侧鉴权模块鉴权。鉴权模块判断DB服务器具备访问所述共享内存的权限后，通过能力安全机制授权共享内存的使用权限给DB服务器，建立2阶段页表(stage2页表)，再将DB服务器的权限信息经由第一进程模块返回代理模块B。代理模块B在DB服务器具有访问共享内存的权限时，将DB服务器的虚拟地址也映射到共享内存上(建立stage1页表)，从而完成专用数据通道的建立。
代理模块B将通道建立成功的信息写入专用数据通道，并通过写入第二命令到宿主机侧的第二命令队列、并发出第二核间中断的方式，通知宿主机侧，使宿主机侧的代理模块A可以从专用数据通道获取到通道建立成功的信息。代理模块A可解除DB客户端的阻塞状态。
在建立专用数据通道后，DB客户端和DB服务器之间还可以进一步建立控制通道、或者建立更多的数据通道等等。同时，此专用数据通道已经经过鉴权，因此后续使用时可不必重复鉴权。
通过这种方式，使得DB客户端和DB服务器之间通信的时候，不会再发生虚拟机陷入陷出，除通道初始化过程外，客户机内核的信息收发活动可以仅限制客户机内核内部。同时在建立通道的过程中，会通过鉴权的方式保障专用数据通道的安全性，通过代理模块和应用程 序分层管理和微内核的能力安全机制，较为安全地在DB客户端和DB服务器之间开启了一条私密的专用数据通道。除DB客户端和DB服务器外的其他实体均无法通过正常手段获取到此通道的使用权限。
图12示出根据本申请实施例的应用程序间通信装置10的示例性结构示意图。
如图12所示，在一种可能的实现方式中，本申请实施例提出一种应用程序间通信装置10，所述装置10应用于电子设备，所述电子设备包括第一虚拟装置101和第二虚拟装置102，所述第一虚拟装置101和所述第二虚拟装置102中的一个是虚拟机，另一个是物理机，所述装置10包括：
所述第一虚拟装置101，用于根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，所述第一请求、所述第一命令包括第二虚拟装置上的第二应用程序的标识；输出第一核间中断到所述第二虚拟装置102所在的核心，以使所述第二虚拟装置102能够获取所述第一核间中断；
所述第二虚拟装置102，用于根据所述第一核间中断从所述第一命令队列获取所述第一命令；根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
在一种可能的实现方式中，所述第一虚拟装置101还包括第一代理模块，所述第一代理模块用于，接收所述第一应用程序发送的所述第一请求；根据所述第一请求，向所述第一命令队列中写入所述第一命令；输出所述第一核间中断到所述第二虚拟装置102所在的核心。
在一种可能的实现方式中，所述第二虚拟装置102还包括第二代理模块，所述第二代理模块用于，根据所述第一核间中断从所述第一命令队列获取所述第一命令；根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
在一种可能的实现方式中，所述第一请求和所述第一命令还包括所述第一应用程序的阻塞信息，所述第一代理模块接收所述第一应用程序发送的所述第一请求之后，所述第一应用程序进入阻塞状态；在接收到第二核间中断时，所述第一代理模块还用于，根据所述第二核间中断从第二命令队列获取第二命令，所述第二核间中断在所述第二应用程序运行结束后产生；在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块还用于，解除所述第一应用程序的阻塞状态。
在一种可能的实现方式中，所述第二应用程序运行结束后，所述第二代理模块还用于，接收所述第二应用程序发送的第二请求，所述第二请求包括所述第一应用程序的标识；根据所述第二请求，向所述第二命令队列中写入所述第二命令，所述第二命令包括所述第一应用程序的标识；输出所述第二核间中断到所述第一虚拟装置101所在的核心，以使所述第一虚拟装置101能够获取所述第二核间中断。
在一种可能的实现方式中，所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令，包括：所述第一代理模块根据所述第一请求，判断所述第二应用程序是否具有通知权限；在所述第二应用程序具有通知权限时，向所述第一命令队列中写入所述第一命令。
在一种可能的实现方式中，所述第一虚拟装置101还用于响应于所述第一应用程序的申请创建共享内存，所述第一代理模块还用于，建立所述第一应用程序的地址与所述共享内存的地址的关联关系；所述第一请求和所述第一命令还包括所述共享内存的参数；在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态， 包括：在所述第二命令包括所述第一应用程序的标识以及通道建立成功的信息时，所述第一代理模块解除所述第一应用程序的阻塞状态。
在一种可能的实现方式中，所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序，包括：所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限；所述第二代理模块运行所述第二应用程序，并在所述第二应用程序具有访问所述共享内存的权限时，建立所述第二应用程序的地址与所述共享内存的地址的关联关系；所述第二命令还包括通道建立成功或通道建立失败的信息。
在一种可能的实现方式中，所述共享内存还作为控制通道，所述控制通道包括第一数据位和第二数据位，所述第一数据位和所述第二数据位的状态由所述第一代理模块和所述第二代理模块控制；所述第一代理模块还用于，控制所述第一数据位处于置位状态、第二数据位处于非置位状态；所述第一代理模块输出所述第一核间中断到所述第二虚拟装置102所在的核心，包括：所述第一代理模块确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态、第二数据位处于非置位状态时，所述第一代理模块输出第一核间中断到所述第二虚拟装置102所在的核心。
在一种可能的实现方式中，所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令，包括：所述第二代理模块根据所述第一核间中断，遍历所述第二虚拟装置上、所述第二代理模块对应的全部应用程序关联的控制通道；在确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态时，所述第二代理模块从第一命令队列获取所述第一命令。
在一种可能的实现方式中，所述第二代理模块还用于，控制所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于非置位状态、第二数据位处于非置位状态；针对所述第一应用程序和所述第二应用程序之间的控制通道，所述第二应用程序运行结束后，所述第二代理模块还用于，确定该控制通道的第一数据位处于非置位状态时，控制该控制通道的第二数据位处于置位状态；所述第二代理模块还用于，确定该控制通道的第一数据位处于置位状态时，重新从所述第一命令队列获取命令，并根据新获取的命令中第二应用程序的标识调度所述第二应用程序运行。
在一种可能的实现方式中，在所述第一虚拟装置101是物理机、所述第二虚拟装置102是虚拟机时，所述第一虚拟装置101还包括鉴权模块和第一进程模块，所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限，包括：所述第二代理模块将所述第一命令中、所述第二应用程序的标识转发至所述第一虚拟装置上的第一进程模块；所述第一进程模块确定与所述第二应用程序的标识对应的鉴权标识，并向所述鉴权模块发送权限信息获取请求，所述权限信息获取请求包括所述鉴权标识；所述第一进程模块接收来自所述鉴权模块的所述第二应用程序的权限信息，并传输至所述第二代理模块；所述第二代理模块根据所述第二应用程序的权限信息，判断所述第二应用程序是否具有访问所述共享内存的权限。
图13示出根据本申请实施例的应用程序间通信装置的示例性结构示意图。
本申请的实施例提供了一种应用程序间通信装置，包括：处理器以及用于存储处理器可执行指令的存储器；其中，所述处理器被配置为执行所述指令时实现上述方法。
应用程序间通信装置可以设置在电子设备中，可以包括手机、可折叠电子设备、平板电 脑、桌面型计算机、膝上型计算机、手持计算机、笔记本电脑、有屏音箱、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本、增强现实(augmented reality，AR)设备、虚拟现实(virtual reality，VR)设备、人工智能(artificial intelligence,AI)设备、无人机、车载设备、智能家居设备、或智慧城市设备中的至少一种。本申请实施例对该应用程序间通信装置的具体类型不作特殊限制。
应用程序间通信装置可以包括处理器110，内部存储器121，通信模块160等。
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。例如，处理器110可执行本申请实施例的第一核间中断的输出等，以实现本申请实施例的应用程序间通信方法。
处理器110中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器110中的存储器可以为高速缓冲存储器。该存储器可以保存处理器110用过或使用频率较高的指令或数据，例如本申请实施例中的第一命令等。如果处理器110需要使用该指令或数据，可从该存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
在一些实施例中，处理器110可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，通用输入输出(general-purpose input/output，GPIO)接口等。处理器110可以通过以上至少一种接口连接无线通信模块、显示器、摄像头等模块。
存储器121可以用于存储计算机可执行程序代码，该可执行程序代码包括指令。存储器121可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，至少一个功能所需的应用程序(比如向第一命令队列中写入第一命令的应用程序等)等。存储数据区可存储应用程序间通信装置的使用过程中所创建的数据(比如第一命令等)等。此外，存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。处理器110通过运行存储在存储器121的指令，和/或存储在设置于处理器中的存储器的指令，执行应用程序间通信装置的各种功能方法或数据处理。
通信模块160可以用于通过有线通信或者无线通信的方式接收来自其他装置或设备的数据，或者发送数据到其他装置或设备。例如可以提供应用在应用程序间通信装置上的包括WLAN(如Wi-Fi网络)、蓝牙(Bluetooth，BT)、全球导航卫星系统(global navigation satellite system，GNSS)、调频(frequency modulation，FM)、近距离无线通信技术(near field communication，NFC)、红外技术(infrared，IR)等无线通信的解决方案。在应用程序间通信装置连接其他装置或设备时，通信模块160也可以使用有线通信方案。
可以理解的是，本申请实施例示意的结构并不构成对应用程序间通信装置的具体限定。在本申请另一些实施例中，应用程序间通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软 件和硬件的组合实现。
本申请的实施例提供了一种非易失性计算机可读存储介质，其上存储有计算机程序指令，所述计算机程序指令被处理器执行时实现上述方法。
本申请的实施例提供了一种计算机程序产品，包括计算机可读代码，或者承载有计算机可读代码的非易失性计算机可读存储介质，当所述计算机可读代码在电子设备的处理器中运行时，所述电子设备中的处理器执行上述方法。
计算机可读存储介质可以是可以保持和存储由指令执行设备使用的指令的有形设备。计算机可读存储介质例如可以是――但不限于――电存储设备、磁存储设备、光存储设备、电磁存储设备、半导体存储设备或者上述的任意合适的组合。计算机可读存储介质的更具体的例子(非穷举的列表)包括：便携式计算机盘、硬盘、随机存取存储器(Random Access Memory，RAM)、只读存储器(Read Only Memory，ROM)、可擦式可编程只读存储器(Electrically Programmable Read-Only-Memory，EPROM或闪存)、静态随机存取存储器(Static Random-Access Memory，SRAM)、便携式压缩盘只读存储器(Compact Disc Read-Only Memory，CD-ROM)、数字多功能盘(Digital Video Disc，DVD)、记忆棒、软盘、机械编码设备、例如其上存储有指令的打孔卡或凹槽内凸起结构、以及上述的任意合适的组合。
这里所描述的计算机可读程序指令或代码可以从计算机可读存储介质下载到各个计算/处理设备，或者通过网络、例如因特网、局域网、广域网和/或无线网下载到外部计算机或外部存储设备。网络可以包括铜传输电缆、光纤传输、无线传输、路由器、防火墙、交换机、网关计算机和/或边缘服务器。每个计算/处理设备中的网络适配卡或者网络接口从网络接收计算机可读程序指令，并转发该计算机可读程序指令，以供存储在各个计算/处理设备中的计算机可读存储介质中。
用于执行本申请操作的计算机程序指令可以是汇编指令、指令集架构(Instruction Set Architecture，ISA)指令、机器指令、机器相关指令、微代码、固件指令、状态设置数据、或者以一种或多种编程语言的任意组合编写的源代码或目标代码，所述编程语言包括面向对象的编程语言—诸如Smalltalk、C++等，以及常规的过程式编程语言—诸如“C”语言或类似的编程语言。计算机可读程序指令可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络—包括局域网(Local Area Network，LAN)或广域网(Wide Area Network，WAN)—连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。在一些实施例中，通过利用计算机可读程序指令的状态信息来个性化定制电子电路，例如可编程逻辑电路、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或可编程逻辑阵列(Programmable Logic Array，PLA)，该电子电路可以执行计算机可读程序指令，从而实现本申请的各个方面。
这里参照根据本申请实施例的方法、装置(系统)和计算机程序产品的流程图和/或框图描述了本申请的各个方面。应当理解，流程图和/或框图的每个方框以及流程图和/或框图中各方框的组合，都可以由计算机可读程序指令实现。
这些计算机可读程序指令可以提供给通用计算机、专用计算机或其它可编程数据处理装置的处理器，从而生产出一种机器，使得这些指令在通过计算机或其它可编程数据处理装置 的处理器执行时，产生了实现流程图和/或框图中的一个或多个方框中规定的功能/动作的装置。也可以把这些计算机可读程序指令存储在计算机可读存储介质中，这些指令使得计算机、可编程数据处理装置和/或其他设备以特定方式工作，从而，存储有指令的计算机可读介质则包括一个制造品，其包括实现流程图和/或框图中的一个或多个方框中规定的功能/动作的各个方面的指令。
也可以把计算机可读程序指令加载到计算机、其它可编程数据处理装置、或其它设备上，使得在计算机、其它可编程数据处理装置或其它设备上执行一系列操作步骤，以产生计算机实现的过程，从而使得在计算机、其它可编程数据处理装置、或其它设备上执行的指令实现流程图和/或框图中的一个或多个方框中规定的功能/动作。
附图中的流程图和框图显示了根据本申请的多个实施例的装置、系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或指令的一部分，所述模块、程序段或指令的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。
也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行相应的功能或动作的硬件(例如电路或ASIC(Application Specific Integrated Circuit，专用集成电路))来实现，或者可以用硬件和软件的组合，如固件等来实现。
尽管在此结合各实施例对本发明进行了描述，然而，在实施所要求保护的本发明过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其它变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其它单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
以上已经描述了本申请的各实施例，上述说明是示例性的，并非穷尽性的，并且也不限于所披露的各实施例。在不偏离所说明的各实施例的范围的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。本文中所用术语的选择，旨在最好地解释各实施例的原理、实际应用或对市场中的技术的改进，或者使本技术领域的其它普通技术人员能理解本文披露的各实施例。

Claims (16)

  1. 一种应用程序间通信方法，其特征在于，所述方法应用于电子设备，所述电子设备包括第一虚拟装置和第二虚拟装置，所述第一虚拟装置和所述第二虚拟装置中的一个是虚拟机，另一个是物理机，所述方法包括：
    所述第一虚拟装置根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，所述第一请求、所述第一命令包括所述第二虚拟装置上的第二应用程序的标识；
    所述第一虚拟装置输出第一核间中断到所述第二虚拟装置所在的核心，以使所述第二虚拟装置能够获取所述第一核间中断；
    所述第二虚拟装置根据所述第一核间中断从所述第一命令队列获取所述第一命令；
    所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
  2. 根据权利要求1所述的方法，其特征在于，所述第一虚拟装置还包括第一代理模块，所述第一虚拟装置根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，包括：
    所述第一代理模块接收所述第一应用程序发送的所述第一请求；
    所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令；
    所述第一虚拟装置输出第一核间中断到所述第二虚拟装置所在的核心，包括：
    所述第一代理模块输出所述第一核间中断到所述第二虚拟装置所在的核心。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第二虚拟装置还包括第二代理模块，所述第二虚拟装置根据所述第一核间中断从所述第一命令队列获取所述第一命令包括：
    所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令；
    所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序包括：
    所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
  4. 根据权利要求2或3所述的方法，其特征在于，所述第一请求和所述第一命令还包括所述第一应用程序的阻塞信息，
    所述第一代理模块接收所述第一应用程序发送的所述第一请求之后，所述方法还包括：
    所述第一应用程序进入阻塞状态；
    在接收到第二核间中断时，所述第一代理模块根据所述第二核间中断从第二命令队列获取第二命令，所述第二核间中断在所述第二应用程序运行结束后产生；
    在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态。
  5. 根据权利要求4所述的方法，其特征在于，所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序之后，所述方法还包括：
    所述第二应用程序运行结束后，所述第二代理模块接收所述第二应用程序发送的第二请求，所述第二请求包括所述第一应用程序的标识；
    所述第二代理模块根据所述第二请求，向所述第二命令队列中写入所述第二命令，所述第二命令包括所述第一应用程序的标识；
    所述第二代理模块输出所述第二核间中断到所述第一虚拟装置所在的核心，以使所述第一虚拟装置能够获取所述第二核间中断。
  6. 根据权利要求2-5中任一项所述的方法，其特征在于，所述第一代理模块根据所述第一请求，向所述第一命令队列中写入所述第一命令，包括：
    所述第一代理模块根据所述第一请求，判断所述第二应用程序是否具有通知权限；
    在所述第二应用程序具有通知权限时，向所述第一命令队列中写入所述第一命令。
  7. 根据权利要求4-6中任一项所述的方法，其特征在于，所述第一虚拟装置根据所述第一应用程序发出的第一请求，向第一命令队列中写入第一命令之前，所述方法还包括：
    响应于所述第一应用程序的申请，所述第一虚拟装置创建共享内存，所述第一代理模块建立所述第一应用程序的地址与所述共享内存的地址的关联关系；所述第一请求和所述第一命令还包括所述共享内存的参数；
    在所述第二命令包括所述第一应用程序的标识时，所述第一代理模块解除所述第一应用程序的阻塞状态，包括：
    在所述第二命令包括所述第一应用程序的标识以及通道建立成功的信息时，所述第一代理模块解除所述第一应用程序的阻塞状态。
  8. 根据权利要求7所述的方法，其特征在于，所述第二代理模块根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序，包括：
    所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内 存的权限；
    所述第二代理模块运行所述第二应用程序，并在所述第二应用程序具有访问所述共享内存的权限时，建立所述第二应用程序的地址与所述共享内存的地址的关联关系；所述第二命令还包括通道建立成功或通道建立失败的信息。
  9. 根据权利要求7或8所述的方法，其特征在于，所述共享内存还作为控制通道，所述控制通道包括第一数据位和第二数据位，所述第一数据位和所述第二数据位的状态由所述第一代理模块和所述第二代理模块控制；
    所述第一虚拟装置输出第一核间中断到所述第二虚拟装置所在的核心之前，所述方法还包括：
    所述第一代理模块控制所述第一数据位处于置位状态、第二数据位处于非置位状态；
    所述第一代理模块输出所述第一核间中断到所述第二虚拟装置所在的核心，包括：
    所述第一代理模块确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态、第二数据位处于非置位状态时，所述第一代理模块输出第一核间中断到所述第二虚拟装置所在的核心。
  10. 根据权利要求9所述的方法，其特征在于，所述第二代理模块根据所述第一核间中断从所述第一命令队列获取所述第一命令，包括：
    所述第二代理模块根据所述第一核间中断，遍历所述第二虚拟装置上、所述第二代理模块对应的全部应用程序关联的控制通道；
    在确定所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于置位状态时，所述第二代理模块从第一命令队列获取所述第一命令。
  11. 根据权利要求9或10所述的方法，其特征在于，所述第二虚拟装置根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序之后，所述方法还包括：
    所述第二代理模块控制所述第一应用程序和所述第二应用程序之间的控制通道的第一数据位处于非置位状态、第二数据位处于非置位状态；
    针对所述第一应用程序和所述第二应用程序之间的控制通道，所述第二应用程序运行结束后，所述第二代理模块确定该控制通道的第一数据位处于非置位状态时，控制该控制通道的第二数据位处于置位状态；
    所述第二代理模块确定该控制通道的第一数据位处于置位状态时，重新从所述第一命令队列获取命令，并根据新获取的命令中第二应用程序的标识调度所述第二应用程序运行。
  12. 根据权利要求6-11中任一项所述的方法，其特征在于，在所述第一虚拟装置是物理 机、所述第二虚拟装置是虚拟机时，所述第一虚拟装置还包括鉴权模块和第一进程模块，所述第二代理模块根据所述第一命令，判断所述第二应用程序是否具有访问所述共享内存的权限，包括：
    所述第二代理模块将所述第一命令中、所述第二应用程序的标识转发至所述第一虚拟装置上的第一进程模块；
    所述第一进程模块确定与所述第二应用程序的标识对应的鉴权标识，并向所述鉴权模块发送权限信息获取请求，所述权限信息获取请求包括所述鉴权标识；
    所述第一进程模块接收来自所述鉴权模块的所述第二应用程序的权限信息，并传输至所述第二代理模块；
    所述第二代理模块根据所述第二应用程序的权限信息，判断所述第二应用程序是否具有访问所述共享内存的权限。
  13. 一种应用程序间通信装置，其特征在于，所述装置应用于电子设备，所述电子设备运行第一虚拟装置和第二虚拟装置，所述第一虚拟装置和所述第二虚拟装置中的一个是虚拟机，另一个是物理机，所述装置包括：
    所述第一虚拟装置，用于根据第一应用程序发出的第一请求，向第一命令队列中写入第一命令，所述第一请求、所述第一命令包括第二虚拟装置上的第二应用程序的标识；输出第一核间中断到所述第二虚拟装置所在的核心，以使所述第二虚拟装置能够获取所述第一核间中断；
    所述第二虚拟装置，用于根据所述第一核间中断从所述第一命令队列获取所述第一命令；根据所述第一命令中、所述第二应用程序的标识运行所述第二应用程序。
  14. 一种应用程序间通信装置，其特征在于，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器被配置为执行所述指令时实现权利要求1-12任意一项所述的方法。
  15. 一种非易失性计算机可读存储介质，其上存储有计算机程序指令，其特征在于，所述计算机程序指令被处理器执行时实现权利要求1-12中任意一项所述的方法。
  16. 一种计算机程序产品，包括计算机可读代码，或者承载有计算机可读代码的非易失性计算机可读存储介质，其特征在于，当所述计算机可读代码在电子设备中运行时，所述电子设备中的处理器执行权利要求1-12中任意一项所述的方法。
PCT/CN2023/081645 2022-03-29 2023-03-15 应用程序间通信方法、装置、存储介质及程序产品 Ceased WO2023185478A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP23777853.5A EP4468154A4 (en) 2022-03-29 2023-03-15 METHOD AND DEVICE FOR COMMUNICATION BETWEEN APPLICATION PROGRAMS AND STORAGE MEDIUM AND PROGRAM PRODUCT
US18/902,735 US12591451B2 (en) 2022-03-29 2024-09-30 Inter-application communication method and apparatus, storage medium, and program product

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210322866.9 2022-03-29
CN202210322866.9A CN116932234A (zh) 2022-03-29 2022-03-29 应用程序间通信方法、装置、存储介质及程序产品

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/902,735 Continuation US12591451B2 (en) 2022-03-29 2024-09-30 Inter-application communication method and apparatus, storage medium, and program product

Publications (1)

Publication Number Publication Date
WO2023185478A1 true WO2023185478A1 (zh) 2023-10-05

Family

ID=88199056

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/081645 Ceased WO2023185478A1 (zh) 2022-03-29 2023-03-15 应用程序间通信方法、装置、存储介质及程序产品

Country Status (4)

Country Link
US (1) US12591451B2 (zh)
EP (1) EP4468154A4 (zh)
CN (1) CN116932234A (zh)
WO (1) WO2023185478A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117807016B (zh) * 2024-03-01 2024-07-09 上海励驰半导体有限公司 多核异构系统与外部设备的通信方法、设备、存储介质
CN119672936B (zh) * 2025-02-18 2025-09-02 深圳慧源创新科技有限公司 一种应用于无人机的双屏遥控器数据处理方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102693162A (zh) * 2011-12-29 2012-09-26 中国科学技术大学苏州研究院 基于共享内存和核间中断的多核平台上多个虚拟机之间进程通信方法
US20150082300A1 (en) * 2013-09-13 2015-03-19 Netapp. Inc. Method and system for enabling an application in a virtualized environment to communicate with multiple types of virtual servers
CN108304269A (zh) * 2017-01-13 2018-07-20 阿里巴巴集团控股有限公司 一种数据的发送、接收方法、装置及通信框架
CN108845863A (zh) * 2018-06-12 2018-11-20 北京百度网讯科技有限公司 用于虚拟机与宿主机的通信方法、装置和系统
CN113778611A (zh) * 2021-07-06 2021-12-10 锐捷网络(苏州)有限公司 数据传输方法、装置、系统及存储介质

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8291135B2 (en) * 2010-01-15 2012-10-16 Vmware, Inc. Guest/hypervisor interrupt coalescing for storage adapter virtual function in guest passthrough mode
US8417862B2 (en) * 2010-10-13 2013-04-09 Lsi Corporation Inter-virtual machine interrupt coalescing
US9507617B1 (en) * 2013-12-02 2016-11-29 Trend Micro Incorporated Inter-virtual machine communication using pseudo devices
EP3070607B1 (en) * 2015-03-20 2020-12-09 Virtual Open Systems Compute node supporting virtual machines and services
US9747122B2 (en) * 2015-04-16 2017-08-29 Google Inc. Virtual machine systems
US9639395B2 (en) * 2015-04-16 2017-05-02 Google Inc. Byte application migration
US10437623B2 (en) * 2015-12-24 2019-10-08 Intel IP Corporation Fast switching between virtual machines without interrupt virtualization for high-performance, secure trusted-execution environment
CN109144679B (zh) * 2017-06-27 2022-03-29 华为技术有限公司 中断请求的处理方法、装置及虚拟化设备
US12160359B2 (en) * 2019-12-23 2024-12-03 Nippon Telegraph And Telephone Corporation Server delay control device, server delay control method, and program
JP7485101B2 (ja) * 2021-02-10 2024-05-16 日本電信電話株式会社 サーバ内遅延制御装置、サーバ内遅延制御方法およびプログラム
US20240160468A1 (en) * 2021-03-18 2024-05-16 Nippon Telegraph And Telephone Corporation Server delay control device, server delay control method, and program
WO2023002547A1 (ja) * 2021-07-19 2023-01-26 日本電信電話株式会社 サーバ内データ転送装置、サーバ内データ転送方法およびプログラム
CN117891624B (zh) * 2024-01-17 2024-07-26 北京火山引擎科技有限公司 基于虚拟化设备的应用间通信方法、装置及电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102693162A (zh) * 2011-12-29 2012-09-26 中国科学技术大学苏州研究院 基于共享内存和核间中断的多核平台上多个虚拟机之间进程通信方法
US20150082300A1 (en) * 2013-09-13 2015-03-19 Netapp. Inc. Method and system for enabling an application in a virtualized environment to communicate with multiple types of virtual servers
CN108304269A (zh) * 2017-01-13 2018-07-20 阿里巴巴集团控股有限公司 一种数据的发送、接收方法、装置及通信框架
CN108845863A (zh) * 2018-06-12 2018-11-20 北京百度网讯科技有限公司 用于虚拟机与宿主机的通信方法、装置和系统
CN113778611A (zh) * 2021-07-06 2021-12-10 锐捷网络(苏州)有限公司 数据传输方法、装置、系统及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4468154A4

Also Published As

Publication number Publication date
CN116932234A (zh) 2023-10-24
EP4468154A1 (en) 2024-11-27
EP4468154A4 (en) 2025-05-21
US12591451B2 (en) 2026-03-31
US20250028552A1 (en) 2025-01-23

Similar Documents

Publication Publication Date Title
US10698717B2 (en) Accelerator virtualization method and apparatus, and centralized resource manager
US9619417B2 (en) Method and apparatus for remote delivery of managed USB services via a mobile computing device
US9622068B2 (en) System, method and computer program product for connecting roaming mobile devices to a virtual device platform
EP2862065B1 (en) Intermediary virtual machine task management
CN102411693B (zh) 虚拟机的继承产品激活
US10762204B2 (en) Managing containerized applications
JP2024509739A (ja) コンテナアプリケーションの最小クラウドサービスアクセス権を自動的に設定する技術
US12591451B2 (en) Inter-application communication method and apparatus, storage medium, and program product
KR102295960B1 (ko) 가상화 기반의 보안 서비스 제공 장치 및 제공 방법
US20160342784A1 (en) Mobile device authentication
WO2018072713A1 (zh) 通信系统和电子设备
CN103870749B (zh) 一种实现虚拟机系统的安全监控系统及方法
US20150186176A1 (en) Dynamic allocation and assignment of virtual environment
WO2018072715A1 (zh) 通信系统和电子设备
WO2015081249A1 (en) Managing containerized applications
US12561180B2 (en) System and method for subscription management by instantiating and/or retiring composed systems of a managed system
US12373097B2 (en) Memory pool management using a cloud platform
WO2018072714A1 (zh) 多通道通信系统和电子设备
US11194706B2 (en) System and method for split storage stack
CN107491354A (zh) 一种基于共享内存的虚拟机间通信方法及装置
WO2018076882A1 (zh) 存储设备的操作方法及物理服务器
US11003618B1 (en) Out-of-band interconnect control and isolation
US9569241B2 (en) Sharing devices assigned to virtual machines using runtime exclusion
CN119536976A (zh) 一种资源分配方法及装置
US20140195590A1 (en) Managing a logical client for a virtual machine

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23777853

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023777853

Country of ref document: EP

Effective date: 20240822

NENP Non-entry into the national phase

Ref country code: DE