WO2022001506A1 - 一种运行进程的方法及装置 - Google Patents

一种运行进程的方法及装置 Download PDF

Info

Publication number
WO2022001506A1
WO2022001506A1 PCT/CN2021/095905 CN2021095905W WO2022001506A1 WO 2022001506 A1 WO2022001506 A1 WO 2022001506A1 CN 2021095905 W CN2021095905 W CN 2021095905W WO 2022001506 A1 WO2022001506 A1 WO 2022001506A1
Authority
WO
WIPO (PCT)
Prior art keywords
functional safety
target process
kernel
context
safety partition
Prior art date
Application number
PCT/CN2021/095905
Other languages
English (en)
French (fr)
Inventor
崔爱国
陶喆
邓良
王强东
谭中平
曹建龙
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2022581002A priority Critical patent/JP2023532324A/ja
Priority to EP21832604.9A priority patent/EP4160399A4/en
Publication of WO2022001506A1 publication Critical patent/WO2022001506A1/zh
Priority to US18/148,954 priority patent/US20230146364A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/542—Event management; Broadcasting; Multicasting; Notifications
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/544—Buffers; Shared memory; Pipes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/545—Interprogram communication where tasks reside in different layers, e.g. user- and kernel-space
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/4557—Distribution of virtual machine instances; Migration and load balancing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45583—Memory management, e.g. access or allocation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2209/00—Indexing scheme relating to G06F9/00
    • G06F2209/54—Indexing scheme relating to G06F9/54
    • G06F2209/543—Local
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment

Definitions

  • the present application relates to the field of computer technology, and in particular, to a method and apparatus for running a process.
  • Embedded operating systems are inseparable from the Internet of Things, automotive electronics, industrial automation, military and aerospace fields that have strict requirements on real-time and reliability.
  • the embedded operating system of the macro kernel includes a user mode (user mode) and a kernel mode (kernel mode), which may also be called user layer and kernel layer, or user mode or kernel mode.
  • the application is in the user layer, the kernel is in the kernel layer, and the privilege level of the kernel layer is higher than that of the user layer. Due to the isolation of the privileged layer, the process of the application in the user layer cannot directly access the kernel service through function calls, but must trigger the mode switch through the system call (syscall) to switch from the user layer to the kernel layer in order to access the kernel service.
  • the embodiments of the present application provide a method for running a process, which can avoid frequent switching from a user layer to a kernel layer when running a process of a functional safety application, thereby reducing the performance overhead caused by the switching of the privileged layer.
  • the embodiments of the present application also provide corresponding devices.
  • a first aspect of the present application provides a method for running a process, including: receiving a process start request, where the process start request is used to instruct to start a target process; according to the process start request, executing an executable file of the target process in the kernel to obtain support for the target process
  • the first operation function data running in the kernel; the first operation function data is migrated to the functional safety partition to obtain the second operation function data, and the functional safety partition and the kernel are located in the same privileged layer; based on the second operation function data, in the functional safety partition Run the target process.
  • the executable file contains tag information, where the tag information is used to indicate that the target process is a process of a functional safety application.
  • the method may be applied to a terminal device or a computer system in the terminal device.
  • the terminal device can be a mobile phone, a vehicle terminal, or an automatic driving device (for example, an automatic driving car, an automatic driving ship, an automatic driving plane), etc.
  • the automatic driving device can also be called a smart device, for example, an automatic driving car can be called a smart car.
  • a process can be an application's process.
  • the process startup request can be a request triggered when the system starts, or a request triggered when a user uses an application.
  • the process start request may carry the identifier of the target process or the identifier of the application corresponding to the target process, so that the corresponding executable file can be found through the identifier of the process or the identifier of the corresponding application.
  • the executable file includes a file header and binary executable code, each process has a corresponding executable file, and the script of the executable file can include the identification of the process.
  • the executable file that executes the target process in the kernel refers to the binary executable code that executes the executable file in the environment of the kernel.
  • the file header of the executable file can contain tag information, which can be a special tag data, a character string, or a numerical value.
  • the functional safety partition is also called the data plane environment (DPE).
  • the functional safety partition is configured at the kernel layer.
  • the functional safety partition can be used for processes running all applications or for processes running functional safety applications.
  • Functional safety applications refer to applications that have strict requirements on real-time and reliability (such as autonomous driving), usually based on data-driven applications or applications triggered by frequent events.
  • Migrating the first operating function data to the functional safety partition may be migrating the first operating function data to the storage space "exclusively" of the functional safety partition. It can be seen from the first aspect that the functional safety partition and the kernel are both located at the kernel layer, so that when the process is running, it is not necessary to switch from the user layer to the kernel layer to call the services of the kernel layer, thereby reducing the performance brought by the privilege layer switching. Overhead, improves the performance of the processor and terminal equipment.
  • the kernel is isolated from the physical resources of the functional safety partition.
  • the physical resources may include computing resources of processors or processing cores, storage resources of memory, and the like.
  • the kernel corresponds to the first physical resource
  • the functional safety partition corresponds to the second physical resource.
  • the kernel is not aware of the second physical resource, that is, a process in the kernel cannot access the second physical resource.
  • the functional safety partition is not aware of the first physical resource, that is, the processes in the functional safety partition cannot access the first physical resource.
  • Physical resource isolation of the kernel and functional safety partitions ensures that the kernel and functional safety partitions are isolated from each other. In this way, even if there is an information security risk in the kernel, it will not affect the functional safety partition, thus ensuring the data security of the functional safety partition.
  • the code in the functional safety application for example, because of upgrading When changes occur, the kernel does not need to be modified, and the maintainability of the kernel is also improved.
  • the first running function data includes a virtual address of the target process, a mapping relationship between the virtual address and the first physical address, and a context of the target process, where the first physical address is the target process in The physical address allocated in the storage resources of the kernel;
  • the second running function data includes the virtual address of the target process, the mapping relationship between the virtual address and the second physical address, and the context of the target process, and the second physical address is the target process in the functional safety.
  • the physical address to which the partition's storage resource is allocated.
  • the first operation function data and the second operation function data are only different in physical addresses
  • the first physical address is the physical address of the kernel
  • the second physical address is the physical address of the functional safety partition.
  • the first physical address corresponds to the storage resource of the kernel
  • the second physical address corresponds to the storage resource of the functional safety partition.
  • the context of the target process includes at least one of the data segment, heap, stack and register context of the target process; the register context refers to the value in the register of the target process.
  • the above step: migrating the first operating function data to the functional safety partition to obtain the second operating function data includes: triggering the virtual machine manager to migrate the virtual address to the functional safety partition , release the mapping relationship between the virtual address and the first physical address, and establish the mapping relationship between the virtual address and the second physical address; transfer the context of the target process to the functional safety partition through the shared memory, and the shared memory is shared by the kernel and the functional safety partition RAM.
  • the architecture in addition to the kernel layer and the user layer, can also include a higher-privileged privilege layer.
  • EL0 is usually used to represent the user layer
  • EL1 is used to represent the kernel layer
  • EL2 is used. to represent a higher privilege layer.
  • Ring3 is usually used to represent the user layer
  • Ring2 is used to represent the kernel layer
  • Ring1 is used to represent the higher privilege layer.
  • the virtual machine manager is located at a higher privilege layer, such as: EL2 layer or Ring1 layer.
  • Higher-privileged layers can manage lower-privileged layers, so the hypervisor can manage the kernel and functional security partitions.
  • the virtual machine manager can allocate the second physical address to the target process on the storage resource of the functional safety partition. , and release the mapping relationship between the virtual address and the first physical address, and establish the mapping relationship between the virtual address and the second physical address, thereby preparing storage resources for the target process to run in the functional safety partition.
  • the context of the target process is stored in the kernel and can be passed to the functional safety partition through shared memory, so that the target process can run in the functional safety partition. This possible implementation does not need to modify the kernel, but also ensures that the process of the functional safety application runs in the functional safety partition, and realizes the ecological compatibility between the functional safety partition and the kernel.
  • the method further includes: when the kernel executes the executable file of the target process, creating a first task structure in the kernel, where the first task structure is used to store the context of the target process Add an indication value in the first task structure, and the indication value is used to indicate that the target process needs to run in the functional safety partition; when running the target process, according to the indication value, the first notification is sent from the kernel to the functional safety, The first notification is used to instruct the creation of the second task structure in the functional safety partition; according to the first notification, the second task structure is created, and the context of the target process is stored in the second task structure.
  • the above step: adding an indication value to the first task structure, where the indication value is used to indicate that the target process needs to run in the functional safety partition includes: according to the flag information, in the first task structure An indicator value is added to the task structure, and the indicator value is used to indicate that the target process is a functional safety application process.
  • the first task structure is a structure in the kernel for storing the context of the target process, which may be in the form of a table or in other forms.
  • the first task structure is first created in the kernel.
  • an indication value is set on the application identification bit (DPE APP) of the first structure.
  • the indication value is, for example, Can be set to "1", of course, can also be set to other values.
  • the indication value indicates that the target process needs to run in the functional safety partition or the target process is a functional safety application process.
  • the method further includes: reading the context of the target process from the shared memory to the functional safety partition; and performing a consistency check on the context of the target process to obtain the first check If the first check value is the same as the second check value, it is determined that the context of the target process is secure data, and the second check value is a trusted value obtained by performing consistency check on the initial configuration context of the target process.
  • the consistency check is performed first when the context of the target process enters the functional safety partition, which can ensure the security of the target process.
  • the method further includes: if the target process calls the system call instruction of the functional safety partition at runtime, storing the context of the system call instruction from the functional safety partition into the shared memory;
  • the functional safety partition sends a second notification to the kernel, and the second notification is used to indicate the occurrence of a system call;
  • the context of the system call instruction is read from the shared memory, and the system call instruction of the kernel is called according to the context of the system call instruction to make a system call, and the system call is obtained.
  • the return value of the call; the return value of the system call is passed to the functional safety partition through shared memory.
  • the context of the system call instruction can be transferred between the functional safety partition and the kernel through shared memory, so that the system call in the functional safety partition can be implemented through the kernel system call process, thus ensuring that The functional safety partition is ecologically compatible with the kernel.
  • the method further includes: reading the return value of the system call from the shared memory to the functional safety partition; and performing a consistency check on the return value of the system call to obtain the third Check value; if the third check value is the same as the fourth check value, it is determined that the return value of the system call is safe data, and the fourth check value is obtained from the consistency check based on the original file corresponding to the system call credible value.
  • the method further includes: if a page fault exception occurs when the target process is running, storing the context of the page fault exception into the shared memory from the functional safety partition;
  • the kernel sends a third notification, and the third notification is used to indicate the occurrence of a page fault exception;
  • the context of the page fault exception is read from the shared memory, and the page fault exception handling function in the kernel is called according to the context of the page fault exception, and the page fault exception is processed according to the page fault exception.
  • the function performs page fault exception processing to obtain the processing result; the processing result is passed to the functional safety partition through shared memory.
  • the context of the system page fault exception can be transferred between the functional safety partition and the kernel, so that the page fault exception in the functional safety partition can be handled by the kernel page fault exception process to achieve, thus ensuring that the functional safety partition is ecologically compatible with the kernel.
  • the page fault exception handling is performed according to the page fault exception handling function, including: executing the page fault exception handling function to allocate a physical page to the target process, and configuring the page table of the physical page; triggering a virtual
  • the machine manager establishes a mapping relationship between the virtual address and the third physical address, and the third physical address is obtained by adding the address of the physical page on the basis of the first physical address; modify the page table permission of the target process according to the page table of the physical page value, the page table permission value is used to indicate the range of page tables that the target process is allowed to use.
  • the virtual machine manager can add physical pages to the storage resources corresponding to the functional safety partition, and modify the page table, which can also ensure that the target process is normal after the page fault occurs. run.
  • the target process includes a thread and a coroutine, the thread is created in the kernel and runs in the functional safety partition, and the coroutine is created in the functional safety partition and runs in the functional safety partition;
  • the functional safety partition includes a unified scheduler, which is used for unified scheduling of threads and coroutines.
  • the coroutine is a micro-thread.
  • the thread scheduler is used to schedule threads, and the coroutine scheduler schedules the coroutine.
  • the coroutine scheduler schedules the coroutine.
  • two-level switching is required, the overhead is large, and there is more interference in the kernel, which cannot guarantee the certainty of scheduling.
  • the unified scheduler is located in the functional safety zone and will not be disturbed, thus ensuring the certainty of scheduling.
  • a second aspect of the present application provides a method for running a process.
  • the method is applied to a computer system.
  • the computer system includes a first processing device and a second processing device.
  • the method includes: the first processing device receives a process start request, and the process start request It is used to instruct to start the target process; the first processing device executes the executable file of the target process in the kernel according to the process start request, and obtains the first running function data supporting the running of the target process in the kernel; the first processing device converts the first running function data Migrating to the functional safety partition to obtain second running function data, the functional safety partition and the kernel are located in the same privilege layer, and the second function data is used for the target process to run in the functional safety partition.
  • the executable file contains tag information, and the tag information is used to indicate that the target process is a process of a functional safety application.
  • the first processing device and the second processing device may be two processors or two processing cores, and other contents are the same as in the first aspect, which can be understood with reference to the corresponding description of the first aspect.
  • the kernel is isolated from the physical resources of the functional safety partition.
  • the first running function data includes a virtual address of the target process, a mapping relationship between the virtual address and the first physical address, and a context of the target process, and the first physical address is the target process in The physical address allocated in the storage resources of the kernel;
  • the second running function data includes the virtual address of the target process, the mapping relationship between the virtual address and the second physical address, and the context of the target process, and the second physical address is the target process in the functional safety.
  • the physical address to which the partition's storage resource is allocated.
  • the above step: migrating the first operating function data to the functional safety partition to obtain the second operating function data includes: the first processing device triggering the virtual machine manager to migrate the virtual address to the functional safety partition, release the mapping relationship between the virtual address and the first physical address, and establish the mapping relationship between the virtual address and the second physical address; the first processing device transfers the context of the target process to the functional safety partition through the shared memory, and the shared memory Shared memory for the kernel and functional safety partitions.
  • the method further includes: when the kernel executes the executable file of the target process, the first processing device creates a first task structure in the kernel, and the first task structure is used for storing The context of the target process; an indication value is added to the first task structure, and the indication value is used to indicate that the target process needs to run in the functional safety partition; when running the target process, according to the indication value, the function is sent from the kernel to the functional safety The first notification, where the first notification is used to instruct the creation of the second task structure in the functional safety partition.
  • the above step: adding an indication value to the first task structure, where the indication value is used to indicate that the target process needs to run in the functional safety partition includes: according to the flag information, in the first task structure An indicator value is added to the task structure, and the indicator value is used to indicate that the target process is a functional safety application process.
  • the method further includes: the first processing device receives a second notification sent by the second processing device, where the second notification is used to indicate the occurrence of a system call; reading the system call from the shared memory The context of the instruction is called, and the system call instruction of the kernel is called according to the context of the system call instruction to make a system call, and the return value of the system call is obtained; the return value of the system call is passed to the functional safety partition through the shared memory.
  • the method further includes: the first processing apparatus receives a third notification sent by the second processing apparatus, where the third notification is used to indicate that a page fault exception occurs; the context of the page exception, and call the page fault exception handling function in the kernel according to the context of the page fault exception, and process the page fault exception according to the page fault exception processing function to obtain the processing result; pass the processing result to the functional safety partition through the shared memory .
  • the above step: performing page fault exception processing according to a page fault exception handling function includes: the first processing device executes a page fault exception handling function to allocate physical pages to the target process, and configure physical pages page table of the page; trigger the virtual machine manager to establish a mapping relationship between the virtual address and the third physical address, and the third physical address is obtained by adding the address of the physical page on the basis of the first physical address; according to the page table of the physical page Modify the page table permission value of the target process.
  • the page table permission value is used to indicate the range of page tables that the target process is allowed to use.
  • the target process includes a thread and a coroutine, the thread is created in the kernel and runs in the functional safety partition, and the coroutine is created in the functional safety partition and runs in the functional safety partition;
  • the functional safety partition includes a unified scheduler, which is used for unified scheduling of threads and coroutines.
  • a third aspect of the present application provides a method for running a process.
  • the method is applied to a computer system.
  • the computer system includes a first processing device and a second processing device.
  • the method includes: the second processing device obtains second running function data, and the first The second operation function data is obtained by the first processing device migrating the first operation function data to the functional safety partition, and the first operation function data is obtained by the first processing device executing the executable file of the target process in the kernel to support the target process running in the kernel
  • the functional safety partition and the kernel are located in the same privilege layer; based on the second running function data, the target process is run in the functional safety partition.
  • the first processing device and the second processing device may be two processors or two processing cores, and other contents are the same as those in the first aspect, which can be understood with reference to the corresponding description of the first aspect.
  • the kernel is isolated from the physical resources of the functional safety partition.
  • the first running function data includes a virtual address of the target process, a mapping relationship between the virtual address and the first physical address, and a context of the target process, where the first physical address is the target process in The physical address allocated in the storage resources of the kernel;
  • the second running function data includes the virtual address of the target process, the mapping relationship between the virtual address and the second physical address, and the context of the target process, and the second physical address is the target process in the functional safety.
  • the physical address to which the partition's storage resource is allocated.
  • the method further includes: the second processing device receives a first notification sent by the first processing device, where the first notification is used to instruct the creation of the second task structure in the functional safety partition; According to the first notification, a second task structure is created, and the context of the target process is stored in the second task structure.
  • the method further includes: the second processing device reads the context of the target process from the shared memory to the functional safety partition; and performs consistency check on the context of the target process to obtain The first check value; if the first check value is the same as the second check value, it is determined that the context of the target process is security data, and the second check value is obtained by performing consistency check on the initial configuration context of the target process trusted value.
  • the method further includes: if the target process calls the system call instruction of the functional safety partition at runtime, storing the context of the system call instruction from the functional safety partition into the shared memory;
  • the functional safety partition sends a second notification to the kernel, where the second notification is used to indicate the occurrence of a system call;
  • the context of the system call instruction is used by the first processing device to read the context of the system call instruction from the shared memory, and call the context of the system call instruction according to the context of the system call instruction
  • the system call instruction of the kernel makes a system call and obtains the return value of the system call; the return value of the system call is passed to the functional safety partition through the shared memory.
  • the method further includes: the second processing device reads the return value of the system call from the shared memory to the functional safety partition; and performs consistency check on the return value of the system call, To obtain the third check value; if the third check value is the same as the fourth check value, it is determined that the return value of the system call is safe data, and the fourth check value is consistent with the original file corresponding to the system call The reliability value obtained by the verification.
  • the method further includes: if the second processing device encounters a page fault exception when the target process is running, storing the context of the page fault exception into the shared memory from the functional safety partition;
  • the functional safety partition sends a third notification to the kernel, and the third notification is used to indicate the occurrence of a page fault exception;
  • the context of the page fault exception is used by the first processing device to read the context of the page fault exception from the shared memory, and according to the context of the page fault exception
  • the page fault exception processing function in the kernel is called, and the page fault exception processing function is performed according to the page fault exception processing function to obtain the processing result; the processing result is transmitted to the functional safety partition through the shared memory.
  • the target process includes threads and coroutines, the threads are created in the kernel and run in the functional safety partition, and the coroutines are created in the functional safety partition and run in the functional safety partition;
  • the functional safety partition includes a unified scheduler, which is used for unified scheduling of threads and coroutines.
  • a fourth aspect of the present application provides an apparatus for running a process, and the apparatus for running a process has the function of implementing the method of the first aspect or any possible implementation manner of the first aspect.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions, such as: a receiving unit, a sending unit, a first processing unit, a second processing unit and a third processing unit, wherein the first processing unit, the second processing unit The unit and the third processing unit may also be implemented by one processing unit or two processing units.
  • a fifth aspect of the present application provides a processing device, where the processing device has the function of implementing the method of the second aspect or any possible implementation manner of the second aspect.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions, such as: a receiving unit, a sending unit, a first processing unit and a second processing unit, wherein the first processing unit and the second processing unit can also be A processing unit is implemented.
  • a sixth aspect of the present application provides a processing device, where the processing device has the function of implementing the method of the third aspect or any possible implementation manner of the third aspect.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions, such as: a receiving unit, a sending unit, a first processing unit and a second processing unit, wherein the first processing unit and the second processing unit can also be A processing unit is implemented.
  • a seventh aspect of the present application provides a computer device.
  • the computer device may be a terminal device.
  • the computer device includes at least one processor, a memory, an input/output (I/O) interface, and storage in the memory and can Computer-executed instructions running on the processor, when the computer-executed instructions are executed by the processor, the processor executes the method as described above in the first aspect or any possible implementation manner of the first aspect.
  • I/O input/output
  • An eighth aspect of the present application provides a computer device.
  • the computer device may be a terminal device.
  • the computer device includes at least one processor, a memory, an input/output (I/O) interface, and storage in the memory and can
  • the computer-implemented instructions run on the processor, and when the computer-implemented instructions are executed by the processor, the processor executes the method of the second aspect or any of the possible implementations of the second aspect.
  • a ninth aspect of the present application provides a computer device, the computer device may be a terminal device, the computer device includes at least one processor, a memory, an input/output (I/O) interface, and a computer device stored in the memory and available Computer-executed instructions running on the processor, when the computer-executed instructions are executed by the processor, the processor executes the method of the third aspect or any of the possible implementations of the third aspect.
  • the computer device may be a terminal device
  • the computer device includes at least one processor, a memory, an input/output (I/O) interface, and a computer device stored in the memory and available Computer-executed instructions running on the processor, when the computer-executed instructions are executed by the processor, the processor executes the method of the third aspect or any of the possible implementations of the third aspect.
  • I/O input/output
  • a tenth aspect of the present application provides a computer-readable storage medium that stores one or more computer-executable instructions.
  • the processor executes the first aspect or any one of the possible operations of the first aspect. method of implementation.
  • An eleventh aspect of the present application provides a computer-readable storage medium that stores one or more computer-executable instructions.
  • the processor executes the second aspect or any one of the possibilities of the second aspect. method of implementation.
  • a twelfth aspect of the present application provides a computer-readable storage medium storing one or more computer-executable instructions.
  • the processor executes the third aspect or any one of the possibilities of the third aspect. method of implementation.
  • a thirteenth aspect of the present application provides a computer program product that stores one or more computer-executable instructions.
  • the processor executes the first aspect or any of the possible implementations of the first aspect. method.
  • a fourteenth aspect of the present application provides a computer program product that stores one or more computer-executable instructions.
  • the processor executes the second aspect or any of the possible implementations of the second aspect. method.
  • a fifteenth aspect of the present application provides a computer program product that stores one or more computer-executable instructions.
  • the processor executes the third aspect or any of the possible implementations of the third aspect. method.
  • a sixteenth aspect of the present application provides a chip system, where the chip system includes a processor, and a device for supporting a running process implements the functions involved in the first aspect or any possible implementation manner of the first aspect.
  • the chip system may further include a memory, which is used for storing necessary program instructions and data of the apparatus for running the process.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • a seventeenth aspect of the present application provides a chip system, where the chip system includes a processor, and a device for supporting a running process implements the functions involved in the second aspect or any possible implementation manner of the second aspect.
  • the chip system may further include a memory, which is used for storing necessary program instructions and data of the apparatus for running the process.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • An eighteenth aspect of the present application provides a chip system, where the chip system includes a processor, and a device for supporting a running process implements the functions involved in the third aspect or any possible implementation manner of the third aspect.
  • the chip system may further include a memory, which is used for storing necessary program instructions and data of the apparatus for running the process.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • both the functional safety partition and the kernel are located at the kernel layer, and the process of the functional safety application runs in the functional safety partition. In this way, when the process of the functional safety application is running, it is not necessary to switch from the user layer to the kernel layer to call the services of the kernel layer, thereby reducing the performance overhead caused by the switching of the privilege layer and improving the performance of the processor and the terminal device.
  • FIG. 1 is a schematic diagram of a system architecture of a terminal device provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of an automatic driving device provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an embodiment of a method for running a process provided by an embodiment of the present application
  • FIG. 4 is a schematic diagram of another embodiment of a method for running a process provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another embodiment of a method for running a process provided by an embodiment of the present application.
  • 6A is a schematic diagram of another embodiment of the method for running a process provided by an embodiment of the present application.
  • 6B is a schematic diagram of another embodiment of the method for running a process provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another embodiment of the method for running a process provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of a scenario provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an embodiment of an apparatus for running a process provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • FIG. 11 is another schematic structural diagram of a computer device provided by an embodiment of the present application.
  • the embodiment of the present application provides a method for running an application, which can avoid frequent switching from the user layer to the kernel layer, thereby reducing the performance overhead caused by the switching of the privileged layer.
  • the embodiments of the present application also provide corresponding devices. Each of them will be described in detail below.
  • Executable file is a static concept. It is a file of some pre-compiled instructions and data sets.
  • the executable file includes the file header and binary execution code.
  • Each process has a corresponding executable file.
  • the script can include the ID of the process.
  • a process is a dynamic concept.
  • a process is a running activity of a program in a computer on a data set, and it is the basic unit of resource allocation and scheduling in the system.
  • the kernel is the most fundamental part of the operating system, the piece of software that provides secure access to computer hardware for numerous applications.
  • the kernel can be a Linux kernel.
  • the functional safety partition is also called the data plane evironment (DPE).
  • DPE data plane evironment
  • the functional safety partition is configured at the kernel layer and is located in the same privileged layer as the kernel. Functional safety partitions can be used for processes running all applications or for processes running functional safety applications.
  • Functional safety applications refer to applications that have strict requirements on real-time and reliability (such as autonomous driving), usually based on data-driven applications or applications triggered by frequent events.
  • the running function data refers to the data supporting the running of the process, including the virtual address of the process, the mapping relationship between the virtual address and the physical address, and the context of the process.
  • a virtual address is also called a logical address, and is usually represented by an offset. If the logical space shared by all processes in the operating system is described as the entire virtual address space, then the entire virtual address space will have a starting value. The starting value and offset can determine the virtual address space that the target process can use.
  • the physical address is the address corresponding to the storage resource, and the physical address can also be represented by an offset.
  • the context of the process includes at least one of a data segment, a heap, a stack, and a register context of the process.
  • a register context refers to the values that a process writes to a register at runtime.
  • the task structure (task_struct) is a structure for storing the context of the process, which may be in the form of a table or in other forms.
  • System call The main function of the operating system is to manage hardware resources and provide a good environment for application developers to make applications more compatible.
  • the kernel provides a series of predetermined functions.
  • a multi-kernel function that is presented to the user through a set of interfaces called system calls.
  • the system call transmits the application's request to the kernel, calls the corresponding kernel function to complete the required processing, and returns the processing result to the application.
  • Page fault exceptions refer to exceptions caused by missing pages.
  • the method of consistency check may be cyclic redundancy check (CRC).
  • CRC cyclic redundancy check
  • a method for running a process provided by an embodiment of the present application can be applied to a terminal device or a computer system of the terminal device, where the terminal device (also referred to as user equipment (UE)) is a wireless transceiver capable of It can be deployed on land, including indoor or outdoor, handheld or vehicle; it can also be deployed on water (such as ships, etc.); it can also be deployed in the air (such as planes, balloons and satellites, etc.).
  • the terminal can be a mobile phone (mobile phone), a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, an industrial control (industrial control) terminal.
  • the terminal device can be understood by referring to the system architecture shown in FIG. 1 .
  • the terminal device includes a user layer, a kernel layer, a management layer and a hardware layer.
  • the kernel layer includes the kernel and functional safety partitions.
  • the processes of ordinary applications run in the kernel, and the processes of functional safety applications run in the functional safety partitions.
  • the functional safety partitions and the kernel can interact. The operation of some functional safety applications is completed with the assistance of the kernel.
  • the management layer may include a virtual machine manager, the virtual machine manager has higher privileges than the kernel layer and the user layer, and can manage the kernel layer, for example, configure the running function data of the process of the functional safety application to the functional safety partition.
  • the names of the user layer, kernel layer and management layer may be slightly different.
  • EL0 is usually used to represent the user layer
  • EL1 to represent the kernel layer
  • EL2 to represent the higher privilege layer
  • Ring3 is usually used to represent the user layer
  • Ring2 is used to represent the kernel layer
  • Ring1 is used to represent the higher privilege layer.
  • the hardware layer includes resources such as computing units, memory, and communication interfaces.
  • the hardware layer is used to provide hardware resources for the normal work of the user layer, the kernel layer, and the management layer.
  • the hardware layer may also include hardware such as radar and camera. Because functional safety applications are often involved in the field of automatic driving, the following describes the application of the present application in the automatic driving device 100 with reference to FIG. 2 .
  • the autonomous driving apparatus 100 includes a computer system 101 , a display 109 , an input device 117 , a media tray 121 , a transceiver 123 (which can transmit and/or receive radio communication signals), a sensor 153 and a camera 155 .
  • the computer system 101 includes a processor 103 , and the processor 103 is coupled to a system bus 105 .
  • the processor 103 may be one or more processors, wherein each processor may include one or more processor cores.
  • a video adapter 107 which can drive a display 109, is coupled to the system bus 105.
  • System bus 105 is coupled to input-output (I/O) bus 113 through bus bridge 111 .
  • I/O interface 115 is coupled to the I/O bus.
  • the I/O interface 115 communicates with various I/O devices, such as an input device 117 (eg, keyboard, mouse, touch screen, etc.), a multimedia disk 121 such as a CD-ROM, a multimedia interface, and the like.
  • Transceiver 123 and camera 155 (which can capture sceneries and dynamic digital video images) and external USB interface 125.
  • the interface connected to the I/O interface 115 may be a USB interface.
  • the processor 103 may be any conventional processor, including a reduced instruction set computing (“RISC”) processor, a complex instruction set computing (“CISC”) processor, or a combination thereof.
  • the processor may be a special purpose device such as an application specific integrated circuit (“ASIC").
  • the processor 103 may be a neural network processor (neural-network processing unit, NPU) or a combination of a neural network processor and the above conventional processors.
  • the processor 103 is mounted with a neural network processor.
  • Network interface 129 is a hardware network interface, such as a network card.
  • the network 127 may be an external network, such as the Internet, or an internal network, such as an Ethernet network or a virtual private network (VPN).
  • the network 127 may also be a wireless network, such as a WiFi network, a cellular network, and the like.
  • the hard disk drive interface is coupled to the system bus 105 .
  • the hard drive interface is connected to the hard drive.
  • System memory 135 is coupled to system bus 105 . Data running in system memory 135 may include operating system 137 and application programs 143 .
  • the operating system 137 includes a functional safety partition (DPE) 139 and a kernel (kernel) 141 .
  • DPE functional safety partition
  • kernel kernel
  • Kernel 141 consists of those parts of the operating system that manage memory, files, peripherals, and system resources. Interacting directly with hardware, the operating system kernel usually runs processes and provides inter-process communication, providing CPU time slice management, interrupts, memory management, IO management, and more.
  • the application programs 143 include autonomous driving related programs 147 , such as positioning programs, planning programs, and perception programs, etc.
  • the applications corresponding to these programs are all functional safety applications.
  • Application 143 also exists on the system of software deploying server 149 .
  • computer system 101 may download application 143 from software deployment server 149 when application 143 needs to be executed.
  • Sensor 153 is associated with computer system 101 .
  • Sensor 153 is used to detect the environment around computer system 101 .
  • the sensor 153 can detect animals, cars, obstacles and pedestrian crossings, etc., and further sensors can also detect the environment around the above objects, such as animals, cars, obstacles and pedestrian crossings, such as: the environment around animals, for example, animals appear around other animals, weather conditions, ambient light levels, etc.
  • the sensor may be a camera, an infrared sensor, a chemical detector, a microphone, and the like.
  • the sensor 153 when activated, senses information at preset intervals and provides the sensed information to the computer system 101 in real time or near real time.
  • the computer system 101 is used to determine the driving state of the automatic driving device according to the sensor data collected by the sensor 153, and determine the driving operation required to perform the automatic driving transposition according to the driving state and the current driving task, and send the information to the control system. Control commands corresponding to driving operations.
  • the driving state of the automatic driving device can include the driving conditions of the automatic driving device itself, such as the direction of the vehicle’s head, speed, position, acceleration, etc., as well as the state of the surrounding environment of the automatic driving device, such as the position of obstacles, the position and speed of other vehicles, and the crosswalk. location, traffic lights, etc.
  • Computer system 101 may include a task abstraction network and a shared policy network implemented by processor 103 .
  • the processor 103 determines the current automatic driving task; the processor 103 inputs at least one group of historical paths of the automatic driving task into the task abstraction network for feature extraction, and obtains a task feature vector representing the features of the automatic driving task; processing The processor 103 determines a state vector representing the current driving state of the automatic driving device according to the sensor data collected by the sensor 153; the processor 103 inputs the task feature vector and the state vector into the shared strategy network for processing, and obtains the current state of the automatic driving device.
  • the autopilot 100 may be a car, truck, motorcycle, bus, boat, airplane, helicopter, lawn mower, recreational vehicle, playground autopilot, construction equipment, tram, golf cart, train, cart, etc. , the embodiments of the present application are not particularly limited.
  • the kernel layer of the operating system will include the above-mentioned functional safety partition.
  • the apparatus for running a process may be a processor system, and the processor system includes one or more processors, as shown in FIG. 2 above.
  • the device running the process can manage the kernel and functional safety partitions.
  • an embodiment of the method for running a process provided by the embodiment of the present application includes:
  • the process start request may be a request triggered when the system starts, or a request triggered when the user uses the application.
  • the process start request may carry the identifier of the target process or the identifier of the application corresponding to the target process, so that the corresponding executable file can be found through the identifier of the process or the identifier of the corresponding application.
  • the executable file includes a file header and binary executable code, each process has a corresponding executable file, and the script of the executable file can include the identification of the process.
  • the executable file that executes the target process in the kernel refers to the binary executable code that executes the executable file in the environment of the kernel.
  • the file header of the executable file can contain tag information, which can be a special tag data, a character string, or a numerical value.
  • the first running function data includes the virtual address of the target process, the mapping relationship between the virtual address and the first physical address, and the context of the target process.
  • the first physical address is the physical address allocated by the target process in the kernel storage resource.
  • the tag information is used to indicate that the target process is a functional safety application process, and the functional safety partition and the kernel are located in the same privilege layer.
  • the second running function data includes the virtual address of the target process, the mapping relationship between the virtual address and the second physical address, and the context of the target process.
  • the second physical address is the physical address allocated by the target process in the storage resources of the functional safety partition.
  • the executable file contains tag information
  • the first operation function data is migrated to the functional safety partition to obtain the second operation function data
  • the tag information is used to indicate
  • the target process is the process of the functional safety application.
  • Migrating the first operating function data to the functional safety partition may be migrating the first operating function data to the storage space "exclusively" of the functional safety partition.
  • the functional safety partition and the kernel are both located at the kernel layer, when the process is running, it is not necessary to switch from the user layer to the kernel layer to invoke the services of the kernel layer, thereby reducing the performance brought by the privilege layer switching.
  • Overhead improves the performance of the processor and terminal equipment.
  • the kernel is isolated from the physical resources of the functional safety partition.
  • different physical resources can be configured for the kernel and the functional safety partition respectively when the virtual machine manager is initialized, so as to realize the physical resource isolation of the two.
  • Physical resources may include computing resources of processors or processing cores, storage resources of memory, and the like.
  • the kernel corresponds to the first physical resource
  • the functional safety partition corresponds to the second physical resource.
  • the kernel is not aware of the second physical resource, that is, a process in the kernel cannot access the second physical resource.
  • the functional safety partition is not aware of the first physical resource, that is, the processes in the functional safety partition cannot access the first physical resource.
  • Physical resource isolation of the kernel and functional safety partitions ensures that the kernel and functional safety partitions are isolated from each other. In this way, even if there is an information security risk in the kernel, it will not affect the functional safety partition, thus ensuring the data security of the functional safety partition.
  • the code in the functional safety application for example, because of upgrading When changes occur, the kernel does not need to be modified, and the maintainability of the kernel is also improved.
  • the method for running a process may include the following three aspects. 1. Start the target process in the kernel; 2: Migrate the running function data of the target process to the functional safety partition; 3: Run the target process in the functional safety partition. They are introduced separately below.
  • the device for running the process loads the executable file of the target process according to the identifier of the target process and the identifier of the process included in the script of the executable file. .
  • the executable file of the target process can be loaded into the memory corresponding to the kernel.
  • the apparatus for running the process creates a first task structure (task_struct) in the kernel.
  • the first task structure is used to store the context of the target process.
  • the first task structure (task_struct) is a structure in the kernel for storing the context of the target process, which may be in the form of a table or in other forms.
  • the apparatus for running the process adds an indication value to the first task structure according to the tag information, where the indication value is used to indicate that the target process is a functional safety application process.
  • the indication value may be added to the identification bit of the functional safety application (DPE APP) of the first task structure, and the indication value may be "1" or other numerical values.
  • the specific value of the indication value is not specified in this application. Do limit.
  • a first task structure is created in the kernel, and the value of the identification bit of the functional safety application of the task structure is "1", which indicates that the target process is a process of a functional safety application.
  • the context of the target process is also stored in the first task structure.
  • the device for running the process also allocates a virtual address to the target process from the virtual address space, allocates a first physical address to the target process from the storage resources of the kernel, and then creates the target process.
  • the mapping relationship between the virtual address and the first physical address is a mapping relationship between the virtual address and the first physical address.
  • the virtual address space indicated by the virtual address and the physical address space indicated by the first physical address can be used to add, delete, modify or modify the target process.
  • Related operations such as query can use the corresponding virtual address space and physical address space of the target process.
  • the shared memory can be passed to the functional safety partition, so that the target process can run in the functional safety partition.
  • the target process can run in the functional safety partition.
  • the kernel There is no need to modify the kernel, and it can ensure that the process of functional safety applications runs in the functional safety partition, realizing the ecological compatibility between the functional safety partition and the kernel.
  • the context of the target process can also be checked for consistency in the functional safety partition, which further ensures the security of the target process when the functional safety partition is initialized.
  • a first proxy module can be configured in the kernel, and a second proxy module can be configured in the functional safety partition.
  • the first proxy module and the second proxy module can be implemented by software, and the processor system can be implemented by executing corresponding software. to implement the proxy functions of the first proxy module and the second proxy module in the kernel and functional safety partitions.
  • Notifications between the kernel and the functional safety partition may be sent through the first proxy module and the second proxy module. As shown in FIG. 5 , the first proxy module sends a first notification to the second proxy module.
  • the first check value is the same as the second check value, it is determined that the context of the target process is the security data, and the second check value is a trusted value obtained by performing consistency check on the initial configuration context of the target process.
  • the first agent module triggers the virtual machine manager to migrate the virtual address to the functional safety partition, and release the mapping relationship between the virtual address and the first physical address.
  • the first proxy module triggers the virtual machine manager to establish a mapping relationship between the virtual address and the second physical address.
  • the process of running the target process in the functional safety partition may include: a process of processing a system call and a process of processing a page fault exception. They are introduced separately below.
  • the processing procedure of the system call can be understood by referring to FIG. 6A .
  • the process may include:
  • the second agent module runs the target process in the functional safety partition, and invokes a system call instruction of the functional safety partition.
  • the second agent module stores the context of the system call instruction in the shared memory from the functional safety partition.
  • This step may be to store the context of the system call instruction in the shared memory through the second proxy module.
  • the second agent module sends a second notification from the functional safety partition to the kernel, where the second notification is used to indicate the occurrence of a system call.
  • the first proxy module reads the context of the system call instruction from the shared memory.
  • the first proxy module invokes the system call instruction of the kernel to perform a system call according to the context of the system call instruction, and obtains a return value of the system call.
  • the first proxy module puts the return value into the shared memory.
  • the second agent module reads the return value of the system call to the functional safety partition from the shared memory; performs consistency check on the return value of the system call to obtain a third check value; if the third check value is the same as the first check value; If the four check values are the same, it is determined that the return value of the system call is security data, and the fourth check value is a trusted value obtained by performing consistency check on the original file corresponding to the system call.
  • the second proxy module uses the returned value to complete the system call process of the functional safety partition.
  • the context of the system call instruction can be transferred between the functional safety partition and the kernel through the shared memory, so that the system call in the functional safety partition can be implemented through the system call process of the kernel, thereby ensuring the functional safety partition and the kernel. ecological compatibility.
  • the processing process of the page fault exception can be understood by referring to FIG. 6B .
  • the process may include:
  • a page fault exception occurs when the second agent module runs the target process in the functional safety partition.
  • the second agent module stores the context of the page fault exception into the shared memory from the functional safety partition.
  • This step may be to store the context of the page fault exception into the shared memory through the second proxy module.
  • the second agent module sends a third notification from the functional safety partition to the kernel, where the third notification is used to indicate that a page fault exception occurs.
  • the second notification may be sent to the first proxy module through the second proxy module.
  • the first proxy module reads the context of the page fault exception from the shared memory.
  • the first agent module invokes a page fault exception handling function in the kernel according to the context of the page fault exception, and processes the page fault exception according to the page fault exception processing function to obtain a processing result.
  • the step includes: executing a page fault exception handling function to allocate a physical page to the target process, and configuring a page table of the physical page; the first proxy module triggers the virtual machine manager to establish a mapping relationship between a virtual address and a third physical address, and the third physical address It is obtained by adding the address of the physical page on the basis of the first physical address; the page table permission value of the target process is modified according to the page table of the physical page, and the page table permission value is used to indicate the range of the page table that the target process is allowed to use . This ensures that the target process runs normally after a page fault occurs.
  • the first proxy module writes the processing result into the shared memory.
  • the second proxy module reads the processing result of the page fault exception from the shared memory, and verifies the processing result, and if the verification passes, returns the processing result to the target process for continued execution.
  • the second proxy module uses the processing result to complete the process of processing the page fault exception of the functional safety partition.
  • the context of the system page fault exception can be transferred between the functional safety partition and the kernel, so that the page fault exception in the functional safety partition can be implemented through the kernel's page fault exception processing process, thereby It is ensured that the functional safety partition is ecologically compatible with the kernel.
  • the consistency check can also be performed on the return value or the processing result, which further ensures the security of the data.
  • the target process in the above embodiment may include threads and coroutines.
  • the solution provided by the embodiment of the present application can perform unified scheduling of threads and coroutines. This process can be understood with reference to FIG. 7 . As shown in FIG. 7 , the process Can include:
  • a thread entity in the kernel creates a thread.
  • the coroutine entity in the functional safety partition creates a coroutine.
  • Coroutines are microthreads.
  • Functional safety partitions include the unified scheduler.
  • the unified scheduler can schedule threads and coroutines uniformly.
  • the thread scheduler is used to schedule threads, and the coroutine scheduler schedules the coroutine.
  • the coroutine scheduler schedules the coroutine.
  • two-level switching is required, the overhead is large, and there is more interference in the kernel, which cannot guarantee the certainty of scheduling.
  • the unified scheduler is located in the functional safety zone and will not be disturbed, thus ensuring the certainty of scheduling.
  • FIGS. 3 to 7 describe the process from the process startup to the process running in the functional safety zone.
  • the following uses the map scene in the autonomous driving vehicle platform shown in FIG. 8 as an example to further introduce the embodiments of the present application.
  • the method to run the process is described in FIG. 8 as an example to further introduce the embodiments of the present application.
  • the autonomous driving vehicle platform includes functional safety applications, middleware, operating system and hardware layers.
  • Functional safety applications may include map engine applications, localization applications, perception applications, prediction applications, and planning applications.
  • the middleware includes the corresponding configuration files for the process startup and operation of various functional safety applications.
  • the operating system includes the kernel and functional safety partitions.
  • the hardware layer includes a computing unit (computer unit), a camera (camera), a memory (memory) and a sensor (sensor), the computing unit may be a processor, and the sensor may include a radar (lidar).
  • a computing unit computer unit
  • a camera camera
  • memory memory
  • sensor sensor
  • the computing unit may be a processor
  • the sensor may include a radar (lidar).
  • the positioning event is monitored, and a map loading request is issued when a positioning event occurs.
  • the positioning event may be a global positioning system (GPS) event.
  • GPS global positioning system
  • the middleware processes the map loading request, loads the corresponding map file into the memory according to the GPS parameters, and triggers the mmap system call in the functional safety partition.
  • the functional safety partition transmits the context of the mmap system call to the kernel through an agent (for example, the second agent module in the above embodiment) and the shared memory.
  • agent for example, the second agent module in the above embodiment
  • the kernel processes the mmap system call request, and reads the map file through the file system in the read-only memory segment.
  • the kernel maps the map file to the address space of the map engine application in the functional safety partition, and transmits the return value to the functional safety partition.
  • the agent in the functional safety partition obtains the consistency check value according to the map path, and calculates the consistency check value of the map file in the memory. After comparison, it is found that two If they are consistent, the verification passes, and the return value is passed to the middleware.
  • the middleware sends out a map read success event, which is read by the map engine callback.
  • system call performed by the running process is used as an example for description, and other related processes of the running process (for example, page fault exception) can also be understood in combination with the descriptions in the foregoing embodiments and the process in the scenario in FIG. 8 .
  • the above steps 201 to 204, 301 to 304, 401 to 406, 501 to 507, 601 to 607, and 701 to 705 can be performed by the device running the application, and the above scenario examples The flow from S1 to S7. Because the physical resources of the kernel and the functional safety partition are isolated, if the kernel is managed by the first processing device and the functional safety partition is managed by the second processing device, from the perspective of the first processing device and the second processing device, the above Steps 201 to 203 may be performed by the first processing means, and step 204 may be performed by the second processing means. The above steps 301, 302, 303 and 304 may be performed by the first processing means.
  • the above steps 401 and 402 may be executed by the first processing device, the steps 403 and 404 may be executed by the second processing device, and the above steps 405 and 406 may be executed by the first processing device.
  • the above steps 501 and 502 may be executed by the second processing device, the steps 503, 504 and 505 may be executed by the first processing device, and the above steps 506 and 507 may be executed by the second processing device.
  • the above steps 601 and 602 may be executed by the second processing device, the steps 603, 604, 605 and 606 may be executed by the first processing device, and the above step 607 may be executed by the second processing device.
  • the above steps 701 and 703 may be executed by the first processing device, and the above steps 702, 704 and 705 may be executed by the second processing device.
  • the first processing device and the second processing device are included in the terminal equipment.
  • an embodiment of an apparatus 80 for running a process includes: a receiving unit 801 , a first processing unit 802 , a second processing unit 803 , a third processing unit 804 , and a sending unit 805 .
  • the receiving unit 801 is configured to receive a process start request, where the process start request is used to instruct to start a target process.
  • the first processing unit 802 is configured to execute the executable file of the target process in the kernel according to the process start request received by the receiving unit 801, and obtain first operation function data supporting the target process running in the kernel.
  • the second processing unit 803 is configured to migrate the first operating function data obtained by the first processing unit 802 to the functional safety partition to obtain the second operating function data, and the functional safety partition and the kernel are located in the same privileged layer.
  • the third processing unit 804 is configured to run the target process in the functional safety partition based on the second running function data obtained by the second processing unit 803 .
  • both the functional safety partition and the kernel are located at the kernel layer. In this way, when the process is running, it is not necessary to switch from the user layer to the kernel layer to invoke the services of the kernel layer, thereby reducing the burden caused by the switching of the privileged layer. Performance overhead, which improves the performance of processors and terminal devices.
  • the first running function data includes the virtual address of the target process, the mapping relationship between the virtual address and the first physical address, and the context of the target process, and the first physical address is the physical address allocated by the target process in the storage resource of the kernel. address; the second running function data includes the virtual address of the target process, the mapping relationship between the virtual address and the second physical address, and the context of the target process, and the second physical address is the physical address allocated by the target process in the storage resources of the functional safety partition address.
  • the second processing unit 803 is used to trigger the virtual machine manager to migrate the virtual address to the functional safety partition, release the mapping relationship between the virtual address and the first physical address, and establish the mapping relationship between the virtual address and the second physical address. ; Pass the context of the target process to the functional safety partition through shared memory, which is the memory shared by the kernel and the functional safety partition.
  • the first processing unit 802 is further configured to create a first task structure in the kernel when the kernel executes the executable file of the target process, and the first task structure is used to store the context of the target process; An indication value is added to the structure, and the indication value is used to indicate that the target process needs to run in the functional safety partition.
  • the sending unit 805 is configured to send a first notification from the kernel to the functional safety according to the indication value when the target process is running, where the first notification is used to instruct to create a second task structure in the functional safety partition.
  • the third processing unit 804 is configured to create a second task structure according to the first notification, and store the context of the target process in the second task structure.
  • the third processing unit 804 is further configured to read the context of the target process to the functional safety partition from the shared memory; perform a consistency check on the context of the target process to obtain a first check value; if the first If the check value is the same as the second check value, it is determined that the context of the target process is the security data, and the second check value is a trusted value obtained by performing consistency check on the initial configuration context of the target process.
  • the third processing unit 804 is configured to store the context of the system call instruction from the functional safety partition into the shared memory if the target process invokes the system call instruction of the functional safety partition at runtime.
  • the sending unit 805 is configured to send a second notification from the functional safety partition to the kernel, where the second notification is used to indicate that a system call occurs.
  • the second processing unit 803 is further configured to read the context of the system call instruction from the shared memory, and call the system call instruction of the kernel to perform a system call according to the context of the system call instruction, and obtain the return value of the system call; The return value is passed to the functional safety partition.
  • the third processing unit 804 is further configured to read the return value of the system call to the functional safety partition from the shared memory; perform consistency check on the return value of the system call to obtain a third check value; if The third check value is the same as the fourth check value, then it is determined that the return value of the system call is security data, and the fourth check value is a trusted value obtained by performing consistency check on the original file corresponding to the system call.
  • the third processing unit 804 is further configured to store the context of the page fault exception into the shared memory from the functional safety partition if a page fault exception occurs when the target process is running.
  • the sending unit 805 is configured to send a third notification from the functional safety partition to the kernel, where the third notification is used to indicate that a page fault exception occurs.
  • the second processing unit 803 is further configured to read the context of the page fault exception from the shared memory, call the page fault exception processing function in the kernel according to the context of the page fault exception, and perform the page fault exception processing according to the page fault exception processing function, so as to Get the processing result; pass the processing result to the functional safety partition through shared memory.
  • the above-mentioned sending unit 805 may be a first sending unit, a second sending unit or a third sending unit.
  • the first processing unit 802, the second processing unit 803 and the third processing unit 804 may also be implemented by one processing unit or two processing units. If the device running the function is a terminal device or a computer system in the terminal device, the first processing unit 802 and the second processing unit 803 may be included in the first processing device, and the first processing device may be implemented by a processor or One processing core, the third processing unit 804 may be included in the second processing device, and the second processing device may be implemented by another processor or processing core.
  • the first processing device and the second processing device may have respective independent receiving units and transmitting units. This ensures that the computing resources of the kernel are isolated from the computing resources of the functional safety partition.
  • the apparatus 80 for the above-mentioned movement process can be understood by referring to the embodiments in the above-mentioned part of the method for the movement process, and details are not repeated here.
  • FIG. 10 is a schematic diagram of a possible logical structure of a computer device 90 according to an embodiment of the present application.
  • the computer device may be the terminal device described in the foregoing embodiments.
  • Computer device 90 includes: processor system 901 , communication interface 902 , memory 903 , and bus 904 .
  • the processor system 901 may include a first processor and a second processor, where the first processor corresponds to a core, and the second processor corresponds to a functional safety partition. If the processor system is a processor, the first processor is a processor core.
  • the second processor is another processor core.
  • the memory 903 may include a first memory and a second memory, where the first memory corresponds to the kernel, and the second memory corresponds to the functional safety partition.
  • the processor system 901 , the communication interface 902 , and the memory 903 are connected to each other through a bus 904 .
  • the processor system 901 is used to control and manage the actions of the computer device 90.
  • the processor system 901 is used to execute steps 202 to 204 in FIG. 3 and steps 301 to 301 in FIG. 4 . 304, and steps 401 to 406 in FIG. 5, and steps 501 to 507 in FIG. 6A, and steps 601 to 607 in FIG. 6B, and steps 701 to 705 in FIG. other processes of technology.
  • the specific steps performed by the first processor and the second processor can be understood by referring to the steps of the aforementioned first processing device and the second processing device.
  • Communication interface 902 is used to support computer device 90 to communicate.
  • the memory 903 is used for storing program codes and data of the computer device 90 .
  • the processor system 901 may be a central processing unit system unit, a general-purpose processor system, a digital signal processor system, an application-specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components, or any of its combination. It may implement or execute the various exemplary logical blocks, modules and circuits described in connection with this disclosure.
  • a processor system may also be a combination that implements computing functions, such as a combination of one or more microprocessor systems, a combination of a digital signal processor system and a microprocessor system, and the like.
  • the bus 904 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • FIG. 11 a schematic diagram of a possible logical structure of a computer device 1000 provided by an embodiment of the present application.
  • the computer device may be the terminal device described in the foregoing embodiments.
  • the computer device 1000 includes a hardware layer 1001 and a virtual machine (VM) layer 1002, and the VM layer may include one or more VMs.
  • the hardware layer 1001 provides hardware resources for the VM and supports the running of the VM. The functions of the VM and the processes related to the present application can be understood by referring to the corresponding descriptions in FIG. 1 to FIG. 8 above.
  • the hardware layer 1001 includes hardware resources such as a processor, a communication interface, and a memory.
  • a computer-readable storage medium is also provided, where computer-executable instructions are stored in the computer-readable storage medium, and when at least one processor of a device executes the computer-executable instructions, the device executes the above diagram The method for running a process described in some embodiments 1 to 8 .
  • a computer program product in another embodiment, includes computer-executable instructions, and the computer-executable instructions are stored in a computer-readable storage medium; at least one processor of the device can be obtained from a computer-readable storage medium. Reading the storage medium reads the computer-executable instructions, and at least one processor executes the computer-executable instructions to cause the device to execute the method for running a process described in the above-mentioned partial embodiments of FIG. 1 to FIG. 8 .
  • a chip system in another embodiment of the present application, includes a processor, and the apparatus for supporting a running process implements the method for running a process described in the above-mentioned partial embodiments of FIG. 1 to FIG. 8 .
  • the chip system may further include a memory, which is used for storing necessary program instructions and data of the apparatus for running the process.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed over multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the embodiments of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium.
  • the technical solutions of the embodiments of the present application can be embodied in the form of software products in essence, or the parts that make contributions to the prior art or the parts of the technical solutions, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Abstract

本申请公开了一种运行进程的方法，包括：接收进程启动请求，根据进程启动请求，在内核执行目标进程的可执行文件，得到支持目标进程在内核运行的第一运行功能数据；将第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，功能安全分区和内核位于同一特权层；基于第二运行功能数据，在功能安全分区运行目标进程。本申请方案的功能安全分区和内核都位于内核层，这样，在进程运行时，不需要从用户层切换到内核层才能调用内核层的服务，从而减少了特权层切换带来的性能开销，提升了处理器及终端设备的性能。

Description

一种运行进程的方法及装置
本申请要求于2020年6月30日提交中国专利局、申请号为202010616278.7、发明名称为“一种运行进程的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，具体涉及一种运行进程的方法及装置。
背景技术
随着信息技术的发展与芯片制造工艺的不断提高，嵌入式操作系统得到了广泛的发展与应用。对实时性和可靠性有严格要求的物联网、汽车电子、工业自动化、军事与航空航天等领域，都离不开嵌入式操作系统。
对实时性和可靠性有严格要求的应用(如：自动驾驶)通常是基于数据驱动的应用或频繁发生事件触发的应用。这些应用通常可以称为功能安全应用。无论是功能安全应用还是非功能安全应用，通常依赖宏内核(monolithic kernel)的嵌入式操作系统。该宏内核的嵌入式操作系统包括用户模式(user mode)和内核模式(kernel mode)，也可以称为用户层和内核层，或者用户态或内核态。应用处于用户层,内核处于内核层，内核层的特权级别高于用户层的特权级别。由于特权层的隔离，处于用户层的应用的进程不可以直接通过函数调用访问内核服务，而是要通过系统调用(syscall)触发模式切换，从用户层切换到内核层，才能访问内核服务。
因为功能安全应用会频繁的发生从用户层到内核模式的切换，造成了较大的性能开销。
发明内容
本申请实施例提供一种运行进程的方法，在运行功能安全应用的进程时，可以避免频繁发生从用户层到内核层的切换，减少了特权层切换带来的性能开销。本申请实施例还提供了相应的装置。
本申请第一方面提供一种运行进程的方法，包括：接收进程启动请求，该进程启动请求用于指示启动目标进程；根据进程启动请求，在内核执行目标进程的可执行文件，得到支持目标进程在内核运行的第一运行功能数据；将第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，功能安全分区和内核位于同一特权层；基于第二运行功能数据，在功能安全分区运行目标进程。一种可能的实现方式中，该可执行文件包含标记信息，该标记信息用于指示目标进程为功能安全应用的进程。
上述第一方面中，该方法可以应用于终端设备或终端设备中的计算机系统。该终端设备可以是手机、车载终端或自动驾驶装置(例如：自动驾驶汽车、自动驾驶轮船、自动驾驶飞机)等，自动驾驶装置也可以称为智能装置，如自动驾驶汽车可以称为智能汽车。进程可以是应用的进程。进程启动请求可以是系统启动时触发的请求，也可以是用户使用应用时触发的请求。该进程启动请求中可以携带目标进程的标识，也可以携带与该目标进程对应的应用的标识，这样，通过该进程的标识或对应的应用的标识就可以查找到相应的可执行文件。可执行文件包括文件头和二进制执行代码，每个进程都有相应的可执行文件，可执行文件的脚本中可以包括进程的标识。在内核执行目标进程的可执行文件指的是在内 核的环境中执行可执行文件的二进制执行代码。可执行文件的文件头中可以包含标记信息，标记信息可以是一段特殊标记数据，可以是一个字符串，也可以是一个数值。功能安全分区也称为数据面环境(data plane evironment，DPE)，功能安全分区配置在内核层，该功能安全分区可以用于运行所有应用的进程，也可以用于运行功能安全应用的进程。功能安全应用指的是对实时性和可靠性有严格要求的应用(如：自动驾驶)，通常是基于数据驱动的应用或频繁发生事件触发的应用。将第一运行功能数据迁移到功能安全分区可以是将第一运行功能数据迁移到功能安全分区“独享”的存储空间。由该第一方面可知，功能安全分区和内核都位于内核层，这样，在进程运行时，不需要从用户层切换到内核层才能调用内核层的服务，从而减少了特权层切换带来的性能开销，提升了处理器及终端设备的性能。
在第一方面的一种可能的实现方式中，内核与功能安全分区的物理资源是隔离的。
该种可能的实现方式中，物理资源可以包括处理器或处理核的计算资源以及存储器的存储资源等。内核对应第一物理资源，功能安全分区对应第二物理资源。内核对第二物理资源不感知，即内核中的进程无法访问第二物理资源。同样，功能安全分区对第一物理资源不感知，即功能安全分区中的进程无法访问第一物理资源。内核与功能安全分区的物理资源隔离可以确保内核和功能安全分区是相互隔离的。这样即使内核出现了信息安全风险，也不会影响到功能安全分区，从而确保了功能安全分区数据的安全性，另外，因为内核和功能安全分区是相互隔离，在功能安全应用的代码例如因为升级而发生变化时，也不需要修改内核，也提高了内核的可维护性。
在第一方面的一种可能的实现方式中，第一运行功能数据包括目标进程的虚拟地址，虚拟地址和第一物理地址的映射关系，以及目标进程的上下文，第一物理地址是目标进程在内核的存储资源中被分配的物理地址；第二运行功能数据包括目标进程的虚拟地址，虚拟地址和第二物理地址的映射关系，以及目标进程的上下文，第二物理地址是目标进程在功能安全分区的存储资源中被分配的物理地址。
该种可能的实现方式中，第一运行功能数据与第二运行功能数据只是物理地址不同，第一物理地址是内核的物理地址，第二物理地址是功能安全分区的物理地址。第一物理地址所对应的是内核的存储资源，第二物理地址对应的是功能安全分区的存储资源。目标进程的上下文包括目标进程的数据段、堆、栈和寄存器上下文中的至少一个；寄存器上下文指的是目标进程在寄存器中的值。
在第一方面的一种可能的实现方式中，上述步骤：将第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，包括：触发虚拟机管理器将虚拟地址迁移到功能安全分区，解除虚拟地址和第一物理地址的映射关系，并建立虚拟地址与第二物理地址的映射关系；将目标进程的上下文通过共享内存传递给功能安全分区，共享内存为内核和功能安全分区共享的内存。
该种可能的实现方式中，该架构中除了内核层和用户层，还可以包括更高特权级的特权层，在ARM架构中通常用EL0来表示用户层，用EL1来表示内核层，用EL2来表示更高特权层。在X86架构中，通常用Ring3来表示用户层，用Ring2来表示内核层，用Ring1来表示更高特权层。虚拟机管理器位于更高特权层，如：EL2层或Ring1层。特权高的层可以管理特 权低的层，所以，虚拟机管理器可以管理内核和功能安全分区。虚拟机管理器可以为内核中的目标进程准备好虚拟地址、第一物理地址以及虚拟地址和第一物理地址的映射关系后，在功能安全分区的存储资源上为该目标进程分配第二物理地址，并解除虚拟地址和第一物理地址的映射关系，建立虚拟地址与第二物理地址的映射关系，从而为目标进程在功能安全分区运行准备好存储资源。另外，目标进程的上下文存放在内核，可以通过共享内存传递给功能安全分区，这样，目标进程就可以在功能安全分区运行了。该种可能的实现方式，既不需要修改内核，又可以确保功能安全应用的进程在功能安全分区运行，实现了功能安全分区与内核的生态兼容。
在第一方面的一种可能的实现方式中，该方法还包括：在内核执行目标进程的可执行文件时，在内核创建第一任务结构体，第一任务结构体用于存放目标进程的上下文；在第一任务结构体中添加指示值，指示值用于指示所述目标进程需要运行在所述功能安全分区；在运行目标进程时，根据指示值，从内核向功能安全发送第一通知，第一通知用于指示在功能安全分区创建第二任务结构体；根据第一通知，创建第二任务结构体，并将目标进程的上下文存放到第二任务结构体。另一种可能的实现方式中，上述步骤：在第一任务结构体中添加指示值，指示值用于指示所述目标进程需要运行在所述功能安全分区，包括：根据标记信息，在第一任务结构体中添加指示值，指示值用于指示目标进程为功能安全应用的进程。
该种可能的实现方式中，第一任务结构体(task_struct)是内核中用于存放目标进程的上下文的结构，可以是表的形式，也可以是其他形式。在进程启动时，会在内核中先创建第一任务结构体，通常若可执行文件中包含标记信息，则在该第一结构体的应用标识位(DPE APP)上设置指示值，指示值例如可以设置成“1”，当然，也可以设置成其他值。该指示值表示该目标进程需要运行在功能安全分区或者该目标进程为功能安全应用的进程。这样，当执行该目标进程时，当查看到第一任务结构体中的指示值时，就获知该目标进程应该运行在功能安全分区，从而通知在功能安全分区创建第二任务结构体。该种可能的实现方式，实现了功能安全分区与内核的生态兼容。
在第一方面的一种可能的实现方式中，该方法还包括：从共享内存将目标进程的上下文读取到功能安全分区；对目标进程的上下文进行一致性校验，以得到第一校验值；若第一校验值与第二校验值相同，则确定目标进程的上下文为安全数据，第二校验值为对目标进程的初始配置上下文进行一致性校验得到的可信值。
该种可能的实现方式中，在目标进程的上下文进入到功能安全分区时先进行一致性校验，可以确保目标进程的安全性。
在第一方面的一种可能的实现方式中，该方法还包括：若目标进程在运行时调用功能安全分区的系统调用指令，则从功能安全分区将系统调用指令的上下文存入共享内存；从功能安全分区向内核发送第二通知，第二通知用于指示发生系统调用；从共享内存读取系统调用指令的上下文，并根据系统调用指令的上下文调用内核的系统调用指令进行系统调用，得到系统调用的返回值；通过共享内存将系统调用的返回值传递给功能安全分区。
该种可能的实现方式中，通过共享内存，可以在功能安全分区与内核之间传递系统调 用指令的上下文，这样，在功能安全分区的系统调用可以通过内核的系统调用过程来实现，从而确保了功能安全分区与内核的生态兼容。
在第一方面的一种可能的实现方式中，该方法还包括：从共享内存将系统调用的返回值读取到功能安全分区；对系统调用的返回值进行一致性校验，以得到第三校验值；若第三校验值与第四校验值相同，则确定系统调用的返回值为安全数据，第四校验值为根据与系统调用相对应的原始文件进行一致性校验得到的可信值。
该种可能的实现方式中，在发生系统调用时，针对返回给功能安全分区的返回值，要先进行一致性校验，这样可以确保功能安全分区的安全性。
在第一方面的一种可能的实现方式中，该方法还包括：若目标进程在运行时发生缺页异常，则从功能安全分区将缺页异常的上下文存入共享内存；从功能安全分区向内核发送第三通知，第三通知用于指示发生缺页异常；从共享内存读取缺页异常的上下文，并根据缺页异常的上下文调用内核中缺页异常处理函数，以及根据缺页异常处理函数进行缺页异常处理，以得到处理结果；通过共享内存将处理结果传递给功能安全分区。
该种可能的实现方式中，在发生缺页异常时，可以在功能安全分区与内核之间传递系缺页异常的上下文，这样，在功能安全分区的缺页异常可以通过内核的缺页异常处理过程来实现，从而确保了功能安全分区与内核的生态兼容。
在第一方面的一种可能的实现方式中，根据缺页异常处理函数进行缺页异常处理，包括：执行缺页异常处理函数为目标进程分配物理页，并配置物理页的页表；触发虚拟机管理器建立虚拟地址与第三物理地址的映射关系，第三物理地址为在第一物理地址的基础上增加物理页的地址后得到的；根据物理页的页表修改目标进程的页表权限值，页表权限值用于指示目标进程被允许使用的页表的范围。
该种可能的实现方式中，当发生缺页异常时，通过虚拟机管理器在功能安全分区对应的存储资源中增加物理页，并修改页表，也可以确保目标进程在发生缺页异常后正常运行。
在第一方面的一种可能的实现方式中，目标进程包括线程和协程，线程在内核被创建，并运行在功能安全分区，协程在功能安全分区被创建，并运行在功能安全分区；功能安全分区种包括统一调度器，统一调度器用于对线程和协程进行统一调度。
该种可能的实现方式中，协程是微线程。相比于现有技术中要通过线程调度器来调度线程，协程调度器来调度协程，在调度协程时，需要先切换到协程所在的线程，然后再切换到协程进性调度，需要进行两级切换，开销较大，而且内核存在较多干扰，无法保证调度的确定性。该种可能的实现方式种，通过统一调度器的统一调度，避免了两级调度，减少了开销，而且，统一调度器位于功能安全分区，不会受到干扰，确保了调度的确定性。
本申请第二方面提供一种运行进程的方法，该方法应用于计算机系统，该计算机系统包括第一处理装置和第二处理装置，该方法包括：第一处理装置接收进程启动请求，进程启动请求用于指示启动目标进程；第一处理装置根据进程启动请求，在内核执行目标进程的可执行文件，得到支持目标进程在内核运行的第一运行功能数据；第一处理装置将第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，功能安全分区和内核位于同一特权层，第二功能数据用于目标进程在功能安全分区运行。一种可能的实现方式中，该 可执行文件包含标记信息，该标记信息用于指示目标进程为功能安全应用的进程。
该第二方面中，第一处理装置和第二处理装置可以是两个处理器，也可以是两个处理核，其他内容与第一方面相同，可以参阅第一方面的相应描述进行理解。
在第二方面的一种可能的实现方式中，内核与功能安全分区的物理资源是隔离的。
在第二方面的一种可能的实现方式中，第一运行功能数据包括目标进程的虚拟地址，虚拟地址和第一物理地址的映射关系，以及目标进程的上下文，第一物理地址是目标进程在内核的存储资源中被分配的物理地址；第二运行功能数据包括目标进程的虚拟地址，虚拟地址和第二物理地址的映射关系，以及目标进程的上下文，第二物理地址是目标进程在功能安全分区的存储资源中被分配的物理地址。
在第二方面的一种可能的实现方式中，上述步骤：将第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，包括：第一处理装置触发虚拟机管理器将虚拟地址迁移到功能安全分区，解除虚拟地址和第一物理地址的映射关系，并建立虚拟地址与第二物理地址的映射关系；第一处理装置将目标进程的上下文通过共享内存传递给功能安全分区，共享内存为内核和功能安全分区共享的内存。
在第二方面的一种可能的实现方式中，该方法还包括：第一处理装置在内核执行目标进程的可执行文件时，在内核创建第一任务结构体，第一任务结构体用于存放目标进程的上下文；在第一任务结构体中添加指示值，指示值用于指示所述目标进程需要运行在所述功能安全分区；在运行目标进程时，根据指示值，从内核向功能安全发送第一通知，第一通知用于指示在功能安全分区创建第二任务结构体。另一种可能的实现方式中，上述步骤：在第一任务结构体中添加指示值，指示值用于指示所述目标进程需要运行在所述功能安全分区，包括：根据标记信息，在第一任务结构体中添加指示值，指示值用于指示目标进程为功能安全应用的进程。
在第二方面的一种可能的实现方式中，该方法还包括：第一处理装置接收第二处理装置发送的第二通知，第二通知用于指示发生系统调用；从共享内存读取系统调用指令的上下文，并根据系统调用指令的上下文调用内核的系统调用指令进行系统调用，得到系统调用的返回值；通过共享内存将系统调用的返回值传递给功能安全分区。
在第二方面的一种可能的实现方式中，该方法还包括：第一处理装置接收第二处理装置发送的第三通知，第三通知用于指示发生缺页异常；从共享内存读取缺页异常的上下文，并根据缺页异常的上下文调用内核中缺页异常处理函数，以及根据缺页异常处理函数进行缺页异常处理，以得到处理结果；通过共享内存将处理结果传递给功能安全分区。
在第二方面的一种可能的实现方式中，上述步骤：根据缺页异常处理函数进行缺页异常处理，包括：第一处理装置执行缺页异常处理函数为目标进程分配物理页，并配置物理页的页表；触发虚拟机管理器建立虚拟地址与第三物理地址的映射关系，第三物理地址为在第一物理地址的基础上增加物理页的地址后得到的；根据物理页的页表修改目标进程的页表权限值，页表权限值用于指示目标进程被允许使用的页表的范围。
在第二方面的一种可能的实现方式中，目标进程包括线程和协程，线程在内核被创建，并运行在功能安全分区，协程在功能安全分区被创建，并运行在功能安全分区；功能安全 分区种包括统一调度器，统一调度器用于对线程和协程进行统一调度。
本申请第三方面提供一种运行进程的方法，该方法应用于计算机系统，该计算机系统包括第一处理装置和第二处理装置，该方法包括：第二处理装置获取第二运行功能数据，第二运行功能数据是第一处理装置将第一运行功能数据迁移到功能安全分区得到的，第一运行功能数据是第一处理装置在内核执行目标进程的可执行文件得到的支持目标进程在内核运行的数据，功能安全分区和内核位于同一特权层；基于第二运行功能数据，在功能安全分区运行目标进程。
该第三方面中，第一处理装置和第二处理装置可以是两个处理器，也可以是两个处理核，其他内容与第一方面相同，可以参阅第一方面的相应描述进行理解。
在第二方面的一种可能的实现方式中，内核与功能安全分区的物理资源是隔离的。
在第三方面的一种可能的实现方式中，第一运行功能数据包括目标进程的虚拟地址，虚拟地址和第一物理地址的映射关系，以及目标进程的上下文，第一物理地址是目标进程在内核的存储资源中被分配的物理地址；第二运行功能数据包括目标进程的虚拟地址，虚拟地址和第二物理地址的映射关系，以及目标进程的上下文，第二物理地址是目标进程在功能安全分区的存储资源中被分配的物理地址。
在第三方面的一种可能的实现方式中，该方法还包括：第二处理装置接收第一处理装置发送的第一通知，第一通知用于指示在功能安全分区创建第二任务结构体；根据第一通知，创建第二任务结构体，并将目标进程的上下文存放到第二任务结构体。
在第三方面的一种可能的实现方式中，该方法还包括：第二处理装置从共享内存将目标进程的上下文读取到功能安全分区；对目标进程的上下文进行一致性校验，以得到第一校验值；若第一校验值与第二校验值相同，则确定目标进程的上下文为安全数据，第二校验值为对目标进程的初始配置上下文进行一致性校验得到的可信值。
在第三方面的一种可能的实现方式中，该方法还包括：若目标进程在运行时调用功能安全分区的系统调用指令，则从功能安全分区将系统调用指令的上下文存入共享内存；从功能安全分区向内核发送第二通知，第二通知用于指示发生系统调用；系统调用指令的上下文用于第一处理装置从共享内存读取系统调用指令的上下文，并根据系统调用指令的上下文调用内核的系统调用指令进行系统调用，得到系统调用的返回值；通过共享内存将系统调用的返回值传递给功能安全分区。
在第三方面的一种可能的实现方式中，该方法还包括：第二处理装置从共享内存将系统调用的返回值读取到功能安全分区；对系统调用的返回值进行一致性校验，以得到第三校验值；若第三校验值与第四校验值相同，则确定系统调用的返回值为安全数据，第四校验值为根据与系统调用相对应的原始文件进行一致性校验得到的可信值。
在第三方面的一种可能的实现方式中，该方法还包括：第二处理装置若目标进程在运行时发生缺页异常，则从功能安全分区将缺页异常的上下文存入共享内存；从功能安全分区向内核发送第三通知，第三通知用于指示发生缺页异常；缺页异常的上下文用于第一处理装置从共享内存读取缺页异常的上下文，并根据缺页异常的上下文调用内核中缺页异常处理函数，以及根据缺页异常处理函数进行缺页异常处理，以得到处理结果；通过共享内 存将处理结果传递给功能安全分区。
在第三方面的一种可能的实现方式中，目标进程包括线程和协程，线程在内核被创建，并运行在功能安全分区，协程在功能安全分区被创建，并运行在功能安全分区；功能安全分区种包括统一调度器，统一调度器用于对线程和协程进行统一调度。
本申请第四方面提供一种运行进程的装置，该运行进程的装置具有实现上述第一方面或第一方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块，例如：接收单元、发送单元、第一处理单元、第二处理单元和第三处理单元，其中，第一处理单元、第二处理单元和第三处理单元也可以是通过一个处理单元或两个处理单元来实现的。
本申请第五方面提供一种处理装置，该处理装置具有实现上述第二方面或第二方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块，例如：接收单元、发送单元、第一处理单元和第二处理单元，其中，第一处理单元和第二处理单元也可以是通过一个处理单元来实现的。
本申请第六方面提供一种处理装置，该处理装置具有实现上述第三方面或第三方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块，例如：接收单元、发送单元、第一处理单元和第二处理单元，其中，第一处理单元和第二处理单元也可以是通过一个处理单元来实现的。
本申请第七方面提供一种计算机设备，该计算机设备可以是终端设备，该计算机设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当计算机执行指令被处理器执行时，处理器执行如上述第一方面或第一方面任意一种可能的实现方式的方法。
本申请第八方面提供一种计算机设备，该计算机设备可以是终端设备，该计算机设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当计算机执行指令被处理器执行时，处理器执行如上述第二方面或第二方面任意一种可能的实现方式的方法。
本申请第九方面提供一种计算机设备，该计算机设备可以是终端设备，该计算机设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当计算机执行指令被处理器执行时，处理器执行如上述第三方面或第三方面任意一种可能的实现方式的方法。
本申请第十方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，处理器执行如上述第一方面或第一方面任意一种可能的实现方式的方法。
本申请第十一方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，处理器执行如上述第二方面或第二方面任意一种可能的实现方式的方法。
本申请第十二方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，处理器执行如上述第三方面或第三方面任意一种可能的实现方式的方法。
本申请第十三方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当计算机执行指令被处理器执行时，处理器执行上述第一方面或第一方面任意一种可能实现方式的方法。
本申请第十四方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当计算机执行指令被处理器执行时，处理器执行上述第二方面或第二方面任意一种可能实现方式的方法。
本申请第十五方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当计算机执行指令被处理器执行时，处理器执行上述第三方面或第三方面任意一种可能实现方式的方法。
本申请第十六方面提供了一种芯片系统，该芯片系统包括处理器，用于支持运行进程的装置实现上述第一方面或第一方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存运行进程的装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请第十七方面提供了一种芯片系统，该芯片系统包括处理器，用于支持运行进程的装置实现上述第二方面或第二方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存运行进程的装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请第十八方面提供了一种芯片系统，该芯片系统包括处理器，用于支持运行进程的装置实现上述第三方面或第三方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存运行进程的装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第四方面至第十八方面或者其中任一种可能实现方式所带来的技术效果可参见第一方面或第一方面不同可能实现方式所带来的技术效果，此处不再赘述。
本申请实施例采用功能安全分区和内核都位于内核层，功能安全应用的进程运行在功能安全分区。这样，在功能安全应用的进程运行时，不需要从用户层切换到内核层才能调用内核层的服务，从而减少了特权层切换带来的性能开销，提升了处理器及终端设备的性能。
附图说明
图1是本申请实施例提供的终端设备的一系统架构示意图；
图2是本申请实施例提供的自动驾驶装置的一架构示意图；
图3是本申请实施例提供的运行进程的方法的一实施例示意图；
图4是本申请实施例提供的运行进程的方法的另一实施例示意图；
图5是本申请实施例提供的运行进程的方法的另一实施例示意图；
图6A是本申请实施例提供的运行进程的方法的另一实施例示意图；
图6B是本申请实施例提供的运行进程的方法的另一实施例示意图；
图7是本申请实施例提供的运行进程的方法的另一实施例示意图；
图8是本申请实施例提供的一场景示意图；
图9是本申请实施例提供的运行进程的装置的一实施例示意图；
图10是本申请实施例提供的计算机设备的一结构示意图；
图11是本申请实施例提供的计算机设备的另一结构示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请实施例提供一种运行应用的方法，可以避免频繁发生从用户层到内核层的切换，从而减少了特权层切换带来的性能开销。本申请实施例还提供了相应的装置。以下分别进行详细说明。
为了便于理解本申请实施例，下面对本申请实施例中涉及到的一些词语进行介绍。
可执行文件是一个静态的概念，它是一些预先编译好的指令和数据集合的一个文件，可执行文件包括文件头和二进制执行代码，每个进程都有相应的可执行文件，可执行文件的脚本中可以包括进程的标识。
进程则是一个动态的概念，进程是计算机中的程序关于某数据集合上的一次运行活动，是系统进行资源分配和调度的基本单位。
内核是操作系统最基本的部分，它是为众多应用程序提供对计算机硬件的安全访问的一部分软件。该内核可以为Linux内核。
功能安全分区也称为数据面环境(data plane evironment，DPE)，功能安全分区配置在内核层，与内核位于同一特权层。功能安全分区可以用于运行所有应用的进程，也可以用于运行功能安全应用的进程。
功能安全应用指的是对实时性和可靠性有严格要求的应用(如：自动驾驶)，通常是基于数据驱动的应用或频繁发生事件触发的应用。
运行功能数据指的是支持进程运行的数据，包括进程的虚拟地址、虚拟地址与物理地址的映射关系，以及该进程的上下文。
虚拟地址也称为逻辑地址，通常用偏移量来表示，如果将操作系统中所有进程所共用的逻辑空间描述为整个虚拟地址空间，那么该整个虚拟地址空间会有一个起始值，使用该 起始值和偏移量就可以确定出该目标进程所能使用的虚拟地址空间。
物理地址是对应存储资源的地址，物理地址也可以通过偏移量来表示。
进程的上下文包括进程的数据段(data segment)、堆(heap)、栈(stack)和寄存器上下文中的至少一个。
寄存器上下文指的是进程在运行时写入到寄存器中的值。
任务结构体(task_struct)是用于存放进程的上下文的结构，可以是表的形式，也可以是其他形式。
系统调用(system call)：操作系统的主要功能是为管理硬件资源和为应用程序开发人员提供良好的环境来使应用程序具有更好的兼容性，为了达到这个目的，内核提供一系列具备预定功能的多内核函数，通过一组称为系统调用的接口呈现给用户。系统调用把应用程序的请求传给内核，调用相应的内核函数完成所需的处理，将处理结果返回给应用程序。
缺页异常指的是因缺页而引起的异常。
一致性校验的方法可以为循环冗余校验(cyclic redundancy check，CRC)。CRC是一种常用的、具有检错、纠错能力的校验方法。
本申请实施例提供的一种运行进程的方法，可以应用于终端设备或终端设备的计算机系统中，该终端设备(也可以称为用户设备(user equipment，UE))是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、自动驾驶装置、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
该终端设备可以参阅图1所示的系统架构进行理解。如图1所示，该终端设备包括用户层、内核层、管理层和硬件层。
其中，用户层中可以有多个应用(application，APP)，多个应用中可以包括功能安全应用和普通应用，普通应用是相对于功能安全应用来说的。可以将除功能安全应用之外的应用称为普通应用。
内核层包括内核和功能安全分区，普通应用的进程在内核运行，功能安全应用的进程在功能安全分区运行，为了确保功能安全分区兼容内核的生态，可以在功能安全分区和内核之间进行交互，由内核辅助完成一些功能安全应用的操作。
管理层可以包括虚拟机管理器，该虚拟机管理器的特权高于内核层和用户层，可以对内核层进行管理，例如：将功能安全应用的进程的运行功能数据配置到功能安全分区。
在不同架构下，用户层、内核层和管理层的名称可能略有不同，例如：在ARM架构中通常用EL0来表示用户层，用EL1来表示内核层，用EL2来表示更高特权层。在X86架构中，通 常用Ring3来表示用户层，用Ring2来表示内核层，用Ring1来表示更高特权层。
硬件层包括计算单元、存储器和通信接口等资源，硬件层用于为用户层、内核层和管理层正常工作提供硬件资源。
若该终端设备是自动驾驶装置，硬件层还可以包括雷达和摄像头等硬件。因为在自动驾驶领域会较多的涉及到功能安全应用，下面结合图2对本申请应用在自动驾驶装置100中的形态进行描述。
如图2所示，自动驾驶装置100包括计算机系统101、显示器109、输入设备117、多媒体盘(media tray)121、收发器123(可以发送和/或接受无线电通信信号)、传感器153和摄像头155。其中，计算机系统101包括处理器103，处理器103和系统总线105耦合。处理器103可以是一个或者多个处理器，其中，每个处理器都可以包括一个或多个处理器核。显示适配器(video adapter)107，显示适配器107可以驱动显示器109，显示器109和系统总线105耦合。系统总线105通过总线桥111和输入输出(I/O)总线113耦合。I/O接口115和I/O总线耦合。I/O接口115和多种I/O设备进行通信，比如输入设备117(如：键盘，鼠标，触摸屏等)，多媒体盘121，例如CD-ROM，多媒体接口等。收发器123以及摄像头155(可以捕捉景田和动态数字视频图像)和外部USB接口125。可选的，和I/O接口115相连接的接口可以是USB接口。
其中，处理器103可以是任何传统处理器，包括精简指令集计算(“RISC”)处理器、复杂指令集计算(“CISC”)处理器或上述的组合。可选的，处理器可以是诸如专用集成电路(“ASIC”)的专用装置。可选的，处理器103可以是神经网络处理器(neural-network processing unit，NPU)或者是神经网络处理器和上述传统处理器的组合。可选的,处理器103挂载有一个神经网络处理器。
计算机系统101可以通过网络接口129和软件部署服务器149通信。网络接口129是硬件网络接口，比如，网卡。网络127可以是外部网络，比如因特网，也可以是内部网络，比如以太网或者虚拟私人网络(VPN)。可选的，网络127还可以是无线网络，比如WiFi网络，蜂窝网络等。
硬盘驱动接口和系统总线105耦合。硬件驱动接口和硬盘驱动器相连接。系统内存135和系统总线105耦合。运行在系统内存135的数据可以包括操作系统137和应用程序143。
操作系统137包括功能安全分区(DPE)139和内核(kernel)141。
内核141由操作系统中用于管理存储器、文件、外设和系统资源的那些部分组成。直接与硬件交互，操作系统内核通常运行进程，并提供进程间的通信，提供CPU时间片管理、中断、内存管理、IO管理等等。
应用程序143包括自动驾驶相关程序147，比如，定位的程序，规划的程序和感知的程序等，这些程序对应的应用都是功能安全应用。应用程序143也存在于软件部署服务器(deploying server)149的系统上。在一个实施例中，在需要执行应用程序143时，计算机系统101可以从软件部署服务器149下载应用程序143。
传感器153和计算机系统101关联。传感器153用于探测计算机系统101周围的环境。举例来说，传感器153可以探测动物，汽车，障碍物和人行横道等，进一步传感器还可以探测上述动物，汽车，障碍物和人行横道等物体周围的环境，比如：动物周围的环境，例如， 动物周围出现的其他动物，天气条件，周围环境的光亮度等。可选的，如果计算机系统101位于自动驾驶装置上，传感器可以是摄像头，红外线感应器，化学检测器，麦克风等。传感器153在激活时按照预设间隔感测信息并实时或接近实时地将所感测的信息提供给计算机系统101。
计算机系统101，用于根据传感器153采集的传感器数据，确定自动驾驶装置的行驶状态，以及根据该行驶状态和当前的驾驶任务确定自动驾驶转置所需执行的驾驶操作，并向控制系统发送该驾驶操作对应的控制指令。自动驾驶装置行驶状态可以包括自动驾驶装置自身的行驶状况，例如车头方向、速度、位置、加速度等，也包括自动驾驶装置周边环境的状态，例如障碍物的位置、其他车辆的位置和速度、人行横道的位置、交通灯的信号等。计算机系统101可以包括由处理器103实现的任务抽象网络和共享策略网络。具体的，处理器103确定当前的自动驾驶任务；处理器103将该自动驾驶任务的至少一组历史路径输入到任务抽象网络做特征提取，得到表征该自动驾驶任务的特征的任务特征向量；处理器103根据传感器153采集的传感器数据，确定表征自动驾驶装置的当前行驶状态的状态向量；处理器103将该任务特征向量和该状态向量输入到共享策略网络做处理，得到该自动驾驶装置当前所需执行的驾驶操作；处理器103通过控制系统执行该驾驶操作；处理器103重复之前确定和执行驾驶操作的步骤，直到完成该自动驾驶任务。
自动驾驶装置100可以为轿车、卡车、摩托车、公共汽车、船、飞机、直升飞机、割草机、娱乐车、游乐场自动驾驶装置、施工设备、电车、高尔夫球车、火车和手推车等，本申请实施例不做特别的限定。
无论上述终端设备是自动驾驶装置，还是其他设备，操作系统的内核层都会包括上述功能安全分区。
下面，结合附图介绍本申请实施例提供运行进程的装置所执行的运行进程的方法，该运行进程的装置可以是处理器系统，该处理器系统包括一个或多个处理器，如上述图2中的处理器103，该运行进程的装置可以对内核和功能安全分区进行管理。
如图3所示，本申请实施例提供的运行进程的方法的一实施例包括：
201、接收进程启动请求，该进程启动请求用于指示启动目标进程。
该进程启动请求可以是系统启动时触发的请求，也可以使用户使用应用时触发的请求。
202、根据进程启动请求，在内核执行目标进程的可执行文件，得到支持目标进程在内核运行的第一运行功能数据。
该进程启动请求中可以携带目标进程的标识，也可以携带与该目标进程对应的应用的标识，这样，通过该进程的标识或对应的应用的标识就可以查找到相应的可执行文件。
可执行文件包括文件头和二进制执行代码，每个进程都有相应的可执行文件，可执行文件的脚本中可以包括进程的标识。在内核执行目标进程的可执行文件指的是在内核的环境中执行可执行文件的二进制执行代码。
可执行文件的文件头中可以包含标记信息，标记信息可以是一段特殊标记数据，可以是一个字符串，也可以是一个数值。
第一运行功能数据包括目标进程的虚拟地址，虚拟地址和第一物理地址的映射关系， 以及目标进程的上下文，第一物理地址是目标进程在内核的存储资源中被分配的物理地址。
203、将第一运行功能数据迁移到功能安全分区，得到第二运行功能数据。
该标记信息用于指示目标进程为功能安全应用的进程，功能安全分区和内核位于同一特权层。
第二运行功能数据包括目标进程的虚拟地址，虚拟地址和第二物理地址的映射关系，以及目标进程的上下文，第二物理地址是目标进程在功能安全分区的存储资源中被分配的物理地址。
一种可能的实现方式中，该可执行文件包含标记信息，若可执行文件包含标记信息，则将第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，该标记信息用于指示目标进程为功能安全应用的进程。
将第一运行功能数据迁移到功能安全分区可以是将第一运行功能数据迁移到功能安全分区“独享”的存储空间。
204、基于第二运行功能数据，在功能安全分区运行目标进程。
本申请实施例中，因为功能安全分区和内核都位于内核层，这样，在进程运行时，不需要从用户层切换到内核层才能调用内核层的服务，从而减少了特权层切换带来的性能开销，提升了处理器及终端设备的性能。
可选地，本申请实施例中，内核与功能安全分区的物理资源是隔离的。该物理资源隔离的过程可以在虚拟机管理器初始化时分别为内核和功能安全分区配置不同的物理资源，以实现两者的物理资源隔离。物理资源可以包括处理器或处理核的计算资源以及存储器的存储资源等。内核对应第一物理资源，功能安全分区对应第二物理资源。内核对第二物理资源不感知，即内核中的进程无法访问第二物理资源。同样，功能安全分区对第一物理资源不感知，即功能安全分区中的进程无法访问第一物理资源。内核与功能安全分区的物理资源隔离可以确保内核和功能安全分区是相互隔离的。这样即使内核出现了信息安全风险，也不会影响到功能安全分区，从而确保了功能安全分区数据的安全性，另外，因为内核和功能安全分区是相互隔离，在功能安全应用的代码例如因为升级而发生变化时，也不需要修改内核，也提高了内核的可维护性。
本申请实施例提供的运行进程的方法可以如下三方面的内容。一、在内核拉起目标进程；二：将目标进程的运行功能数据迁移到功能安全分区；三：在功能安全分区运行目标进程。下面分别进行介绍。
一：在内核拉起目标进程。
在内核拉起目标进程的过程可以参阅图4进行理解。如图4所示，该过程包括：
301、在操作系统启动时，或者目标进程对应的目标应用被触发时，运行进程的装置根据该目标进程的标识以及可执行文件的脚本中包含的进程的标识，加载该目标进程的可执行文件。
该目标进程的可执行文件可以加载到内核对应的内存中。
302、运行进程的装置在执行该目标进程的可执行文件过程中，会在内核中创建第一任务结构体(task_struct)。
第一任务结构体用于存放目标进程的上下文。第一任务结构体(task_struct)是内核中用于存放目标进程的上下文的结构，可以是表的形式，也可以是其他形式。
303、若可执行文件的文件头中包含标记信息，则运行进程的装置在根据标记信息，在第一任务结构体中添加指示值，指示值用于指示目标进程为功能安全应用的进程。
该指示值可以添加在第一任务结构体的功能安全应用(DPE APP)的标识位上，该指示值可以为“1”，也可以为其他数值，指示值的具体取值，本申请中不做限定。
如图4所示，在内核中创建了第一任务结构体，该任务结构体的功能安全应用的标识位上的值为“1”，标识该目标进程是功能安全应用的进程，另外，该第一任务结构体中还存放有目标进程的上下文。
304、运行进程的装置在执行该目标进程的可执行文件过程中，还会从虚拟地址空间为目标进程分配虚拟地址，从内核的存储资源上为该目标进程分配第一物理地址，然后建立该虚拟地址和第一物理地址的映射关系。
这样，若该目标进程在内核中运行，就可以使用该虚拟地址所指示的虚拟地址空间，以及该第一物理地址所指示的物理地址空间，针对与该目标进程有关的增加、删除、修改或查询等相关操作都可以使用该目标进程的相应的虚拟地址空间和物理地址空间。
该实施例中，可以通过共享内存传递给功能安全分区，这样，目标进程就可以在功能安全分区运行了。既不需要修改内核，又可以确保功能安全应用的进程在功能安全分区运行，实现了功能安全分区与内核的生态兼容。另外，在功能安全分区还可以对目标进程的上下文进行一致性校验，进一步确保了目标进程在功能安全分区初始化时的安全性。
二：将目标进程的运行功能数据迁移到功能安全分区。
在运行功能数据迁移的过程可以参阅图5进行理解。如图5所示，该过程包括：
因为内核与功能安全分区的物理资源是隔离的，在运行功能数据迁移的过程中需要用到共享内存。在内核中可以配置第一代理模块，在功能安全分区中可以配置第二代理模块，该第一代理模块和第二代理模块可以是通过软件实现的，处理器系统可以是通过执行相应的软件，来实现第一代理模块和第二代理模块在内核与功能安全分区中的代理功能。
401、在运行目标进程时，根据指示值，将目标进程的上下文存入共享内存。
402、从内核向功能安全发送第一通知，第一通知用于指示在功能安全分区创建第二任务结构体。
内核与功能安全分区之间的通知可以通过第一代理模块和第二代理模块来发送。如图5所示，第一代理模块向第二代理模块发送第一通知。
403、根据第一通知，创建第二任务结构体。
404、从共享内存读取将目标进程的上下文，对目标进程的上下文进行一致性校验，以得到第一校验值；若第一校验值与第二校验值相同，并将目标进程的上下文存放到第二任务结构体。
第一校验值与第二校验值相同则确定目标进程的上下文为安全数据，第二校验值为对目标进程的初始配置上下文进行一致性校验得到的可信值。
405、第一代理模块触发虚拟机管理器将虚拟地址迁移到功能安全分区，解除虚拟地址 和第一物理地址的映射关系。
406、第一代理模块触发虚拟机管理器建立虚拟地址与第二物理地址的映射关系。
三：在功能安全分区运行目标进程。
在功能安全分区运行目标进程的过程可以包括：系统调用的处理过程和缺页异常的处理过程。下面分别进行介绍。
1、系统调用的处理过程。
系统调用的处理过程可以参阅图6A进行理解。如图6A所示，该过程可以包括：
501、第二代理模块在功能安全分区运行目标进程，调用功能安全分区的系统调用指令。
502、第二代理模块从功能安全分区将系统调用指令的上下文存入共享内存。
该步骤可以是通过第二代理模块将系统调用指令的上下文存入共享内存。
503、第二代理模块从功能安全分区向内核发送第二通知，第二通知用于指示发生系统调用。
504、第一代理模块从共享内存读取系统调用指令的上下文。
505、第一代理模块根据系统调用指令的上下文调用内核的系统调用指令进行系统调用，得到系统调用的返回值。
506、第一代理模块将返回值放入共享内存。
507、第二代理模块从共享内存将系统调用的返回值读取到功能安全分区；对系统调用的返回值进行一致性校验，以得到第三校验值；若第三校验值与第四校验值相同，则确定系统调用的返回值为安全数据，第四校验值为根据与系统调用相对应的原始文件进行一致性校验得到的可信值。
508、第二代理模块使用该返回值完成功能安全分区的系统调用过程。
该实施例通过共享内存，可以在功能安全分区与内核之间传递系统调用指令的上下文，这样，在功能安全分区的系统调用可以通过内核的系统调用过程来实现，从而确保了功能安全分区与内核的生态兼容。
2、缺页异常的处理过程。
缺页异常的处理过程可以参阅图6B进行理解。如图6B所示，该过程可以包括：
601、第二代理模块在功能安全分区运行目标进程发生缺页异常。
602、第二代理模块从功能安全分区将缺页异常的上下文存入共享内存。
该步骤可以是通过第二代理模块将缺页异常的上下文存入共享内存。
603、第二代理模块从功能安全分区向内核发送第三通知，第三通知用于指示发生缺页异常。
该第二通知可以是通过第二代理模块向第一代理模块发送的。
604、第一代理模块从共享内存读取缺页异常的上下文。
605、第一代理模块根据缺页异常的上下文调用内核中缺页异常处理函数，以及根据缺页异常处理函数进行缺页异常处理，以得到处理结果。
该步骤包括：执行缺页异常处理函数为目标进程分配物理页，并配置物理页的页表；第一代理模块触发虚拟机管理器建立虚拟地址与第三物理地址的映射关系，第三物理地址 为在第一物理地址的基础上增加物理页的地址后得到的；根据物理页的页表修改目标进程的页表权限值，页表权限值用于指示目标进程被允许使用的页表的范围。这样可以确保目标进程在发生缺页异常后正常运行。
606、第一代理模块将处理结果写入共享内存。
607、第二代理模块从共享内存读取缺页异常的处理结果，并对该处理结果进行校验，若检验通过，则将该处理结果返回给目标进程继续执行。
该步骤的校验过程与上述步骤507相同，此处不再重复。
608、第二代理模块使用该处理结果完成功能安全分区的缺页异常得处理过程。
该实施例在发生缺页异常时，可以在功能安全分区与内核之间传递系缺页异常的上下文，这样，在功能安全分区的缺页异常可以通过内核的缺页异常处理过程来实现，从而确保了功能安全分区与内核的生态兼容。
另外，上述实施例中，还可以对返回值或处理结果进行一致性校验，这样进一步确保了数据的安全性。
另外，上述实施例中的目标进程可以包括线程和协程，本申请实施例提供的方案可以对线程和协程做统一调度，该过程可以参阅图7进行理解，如图7所示，该过程可以包括：
701、内核中的线程实体创建线程。
702、功能安全分区中的协程实体创建协程。
协程是微线程。
703、通过第一代理模块和第二代理模块将线程从内核传递到功能安全分区。
704、将线程放入统一调度器。
功能安全分区种包括统一调度器。
705、将协程放入统一调度器。
统一调度器可以统一调度线程和协程。
相比于现有技术中要通过线程调度器来调度线程，协程调度器来调度协程，在调度协程时，需要先切换到协程所在的线程，然后再切换到协程进性调度，需要进行两级切换，开销较大，而且内核存在较多干扰，无法保证调度的确定性。该种可能的实现方式种，通过统一调度器的统一调度，避免了两级调度，减少了开销，而且，统一调度器位于功能安全分区，不会受到干扰，确保了调度的确定性。
以上图3至图7的多个实施例描述了从进程启动到进程在功能安全分区运行的过程，下面以图8所示的自动驾驶车载平台中的地图场景为例，进一步介绍本申请实施例运行进程的方法。
如图8所示，在自动驾驶车载平台中包括功能安全应用、中间件、操作系统和硬件层。
功能安全应用可以包括地图引擎(map engine)应用、定位(localization)应用、感知(preception)应用、预测(prediction)应用和计划(planning)应用。
中间件包括各种功能安全应用的进程启动和运行的相应配置文件。
操作系统包括内核和功能安全分区。
硬件层包括计算单元(computer unit)、摄像头(camera)、存储器(memory)和传感 器(sensor),该计算单元可以是处理器，该传感器可以包括雷达(lidar)。
上述为实现地图引擎应用的功能，所执行的流程包括：
S1、响应地图引擎应用的地图加载请求，读取中间件中的地图文件。
在地图引擎应用的进程被启动后，监听定位事件，当有定位事件发生时发出地图加载请求。
该定位事件可以是全球定位系统(global positioning system，GPS)事件。
S2、中间件处理地图加载请求，根据GPS参数，将相应的地图文件加载到内存中，并触发功能安全分区中mmap系统调用。
S3、功能安全分区通过代理(例如：上述实施例中的第二代理模块)及共享内存将该mmap系统调用的上下文传递给内核。
S4、内核处理mmap系统调用请求，在只读内存段中，通过文件系统读取地图文件。
S5、内核映射地图文件至地图引擎应用在功能安全分区的地址空间，将返回值传递给功能安全分区。
S6、功能安全分区中的代理(例如：上述实施例中的第二代理模块)根据地图路径获取一致性校验值，且计算内存中地图文件的一致性校验值，经过比较后，发现两者一致则校验通过，则将返回值传递给中间件。
S7、中间件在系统调用处理完成后，发出读取地图成功事件，由地图引擎回调进行读取。
该场景中是以运行进程进行系统调用为例进行说明的，其他相关的运行进程的过程(例如：缺页异常)也可以结合前述实施例中的描述和该图8场景的过程进行理解。
从整体上来看，可以由运行应用的装置执行上述步骤201至204、步骤301至304，步骤401至406，步骤501至507，步骤601至607，以及步骤701至705，以及上述场景示例中的S1至S7的流程。因为内核与功能安全分区的物理资源是隔离的，若是内核由第一处理装置来管理，功能安全分区由第二处理装置来管理，从第一处理装置和第二处理装置的角度来看，上述步骤201至203可以是由第一处理装置来执行的，步骤204是由第二处理装置来执行的。上述步骤301、302、303和304可以是由第一处理装置来执行的。上述步骤401和402可以是由第一处理装置来执行的，步骤403和404可以是由第二处理装置来执行的，上述步骤405和406可以是由第一处理装置来执行的。上述步骤501和502可以是由第二处理装置来执行的，步骤503、504和505可以是由第一处理装置来执行的，上述步骤506和507可以是由第二处理装置来执行的。上述步骤601和602可以是由第二处理装置来执行的，步骤603、604、605和606可以是由第一处理装置来执行的，上述步骤607可以是由第二处理装置来执行的。上述步骤701和703可以是由第一处理装置来执行的，上述步骤702、704和705可以是由第二处理装置来执行的。第一处理装置和第二处理装置包含于终端设备。
以上描述了本申请实施例提供的运行进程的方法，下面结合附图介绍本申请实施例提供的运行进程的装置。
如图9所示，本申请实施例提供的运行进程的装置80的一实施例包括：接收单元801、第一处理单元802、第二处理单元803、第三处理单元804和发送单元805。
接收单元801，用于接收进程启动请求，进程启动请求用于指示启动目标进程。
第一处理单元802，用于根据接收单元801接收的进程启动请求，在内核执行目标进程的可执行文件，得到支持目标进程在内核运行的第一运行功能数据。
第二处理单元803，用于将第一处理单元802得到的第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，功能安全分区和内核位于同一特权层。
第三处理单元804，用于基于第二处理单元803得到的第二运行功能数据，在功能安全分区运行目标进程。
本申请实施例提供的方案，功能安全分区和内核都位于内核层，这样，在进程运行时，不需要从用户层切换到内核层才能调用内核层的服务，从而减少了特权层切换带来的性能开销，提升了处理器及终端设备的性能。
可选地，第一运行功能数据包括目标进程的虚拟地址，虚拟地址和第一物理地址的映射关系，以及目标进程的上下文，第一物理地址是目标进程在内核的存储资源中被分配的物理地址；第二运行功能数据包括目标进程的虚拟地址，虚拟地址和第二物理地址的映射关系，以及目标进程的上下文，第二物理地址是目标进程在功能安全分区的存储资源中被分配的物理地址。
可选地，第二处理单元803，用于触发虚拟机管理器将虚拟地址迁移到功能安全分区，解除虚拟地址和第一物理地址的映射关系，并建立虚拟地址与第二物理地址的映射关系；将目标进程的上下文通过共享内存传递给功能安全分区，共享内存为内核和功能安全分区共享的内存。
可选地，第一处理单元802，还用于在内核执行目标进程的可执行文件时，在内核创建第一任务结构体，第一任务结构体用于存放目标进程的上下文；在第一任务结构体中添加指示值，指示值用于指示所述目标进程需要运行在所述功能安全分区。
发送单元805，用于在运行目标进程时，根据指示值，从内核向功能安全发送第一通知，第一通知用于指示在功能安全分区创建第二任务结构体。
第三处理单元804，用于根据第一通知，创建第二任务结构体，并将目标进程的上下文存放到第二任务结构体。
可选地，第三处理单元804，还用于从共享内存将目标进程的上下文读取到功能安全分区；对目标进程的上下文进行一致性校验，以得到第一校验值；若第一校验值与第二校验值相同，则确定目标进程的上下文为安全数据，第二校验值为对目标进程的初始配置上下文进行一致性校验得到的可信值。
可选地，第三处理单元804，用于若目标进程在运行时调用功能安全分区的系统调用指令，则从功能安全分区将系统调用指令的上下文存入共享内存。
发送单元805，用于从功能安全分区向内核发送第二通知，第二通知用于指示发生系统调用。
第二处理单元803，还用于从共享内存读取系统调用指令的上下文，并根据系统调用指令的上下文调用内核的系统调用指令进行系统调用，得到系统调用的返回值；通过共享内存将系统调用的返回值传递给功能安全分区。
可选地，第三处理单元804，还用于从共享内存将系统调用的返回值读取到功能安全分区；对系统调用的返回值进行一致性校验，以得到第三校验值；若第三校验值与第四校验值相同，则确定系统调用的返回值为安全数据，第四校验值为根据与系统调用相对应的原始文件进行一致性校验得到的可信值。
可选地，第三处理单元804，还用于若目标进程在运行时发生缺页异常，则从功能安全分区将缺页异常的上下文存入共享内存。
发送单元805，用于从功能安全分区向内核发送第三通知，第三通知用于指示发生缺页异常。
第二处理单元803，还用于从共享内存读取缺页异常的上下文，并根据缺页异常的上下文调用内核中缺页异常处理函数，以及根据缺页异常处理函数进行缺页异常处理，以得到处理结果；通过共享内存将处理结果传递给功能安全分区。
需要说明的是，上述发送单元805可以是第一发送单元、第二发送单元或第三发送单元。第一处理单元802、第二处理单元803和第三处理单元804也可以是通过一个处理单元或两个处理单元来实现的。若该运行功能的装置是终端设备或者是终端设备中的计算机系统，那么第一处理单元802和第二处理单元803可以包含于第一处理装置中，该第一处理装置可以通过一个处理器或一个处理核来实现，第三处理单元804可以包含于第二处理装置中，还第二处理装置可以通过另外一个处理器或处理核来实现。第一处理装置和第二处理装置可以有各自独立的接收单元和发送单元。这样可以确保内核的计算资源与功能安全分区的计算资源隔离。
上述运动进程的装置80可以参阅上述运动进程的方法部分的实施例进行理解，本处不再过多赘述。
图10所示，为本申请的实施例提供的计算机设备90的一种可能的逻辑结构示意图。该计算机设备可以是前述实施例所描述的终端设备。计算机设备90包括：处理器系统901、通信接口902、存储器903以及总线904。该处理器系统901可以包括第一处理器和第二处理器，该第一处理器对应内核，第二处理器对应功能安全分区。若该处理器系统是一个处理器，那么该第一处理器为一个处理器核。第二处理器为另一个处理器核。存储器903中可以包括第一内存和第二内存，该第一内存对应内核，第二内存对应功能安全分区。处理器系统901、通信接口902以及存储器903通过总线904相互连接。在本申请的实施例中，处理器系统901用于对计算机设备90的动作进行控制管理，例如，处理器系统901用于执行图3中的步骤202至204，以及图4中的步骤301至304，以及图5中的步骤401至406，以及图6A中的步骤501至507，以及图6B中的步骤601至607，以及图7中的步骤701至705和/或用于本文所描述的技术的其他过程。具体第一处理器和第二处理器所执行的步骤可以参阅前述第一处理装置和第二处理装置的步骤进行理解。通信接口902用于支持计算机设备90进行通信。存储器903，用于存储计算机设备90的程序代码和数据。
其中，处理器系统901可以是中央处理器系统单元，通用处理器系统，数字信号处理器系统，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的 逻辑方框，模块和电路。处理器系统也可以是实现计算功能的组合，例如包含一个或多个微处理器系统组合，数字信号处理器系统和微处理器系统的组合等等。总线904可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
如图11所示，本申请实施例提供的计算机设备1000的一种可能的逻辑结构示意图。该计算机设备可以是前述实施例所描述的终端设备。该计算机设备1000包括：硬件层1001和虚拟机(virtual machine，VM)层1002，该VM层可以包括一个或多个VM。该硬件层1001为VM提供硬件资源，支撑VM运行，该VM的功能和与本申请相关的过程可以参阅上述图1至图8中的相应描述进行理解。该硬件层1001包括处理器、通信接口以及存储器等硬件资源。
在本申请的另一实施例中，还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当设备的至少一个处理器执行该计算机执行指令时，设备执行上述图1至图8部分实施例所描述的运行进程的方法。
在本申请的另一实施例中，还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备执行上述图1至图8部分实施例所描述的运行进程的方法。
在本申请的另一实施例中，还提供一种芯片系统，该芯片系统包括处理器，用于支持运行进程的装置实现上述图1至图8部分实施例所描述的运行进程的方法。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存运行进程的装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请实施例所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元 上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请实施例各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (20)

  1. 一种运行进程的方法，其特征在于，包括：
    接收进程启动请求，所述进程启动请求用于指示启动目标进程；
    根据所述进程启动请求，在内核执行所述目标进程的可执行文件，得到支持所述目标进程在所述内核运行的第一运行功能数据；
    将所述第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，所述功能安全分区和所述内核位于同一特权层；
    基于所述第二运行功能数据，在所述功能安全分区运行所述目标进程。
  2. 根据权利要求1所述的方法，其特征在于，
    所述第一运行功能数据包括所述目标进程的虚拟地址，所述虚拟地址和第一物理地址的映射关系，以及所述目标进程的上下文，所述第一物理地址是所述目标进程在所述内核的存储资源中被分配的物理地址；
    所述第二运行功能数据包括所述目标进程的虚拟地址，所述虚拟地址和第二物理地址的映射关系，以及所述目标进程的上下文，所述第二物理地址是所述目标进程在所述功能安全分区的存储资源中被分配的物理地址。
  3. 根据权利要求2所述的方法，其特征在于，所述将所述第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，包括：
    触发虚拟机管理器将所述虚拟地址迁移到所述功能安全分区，解除所述虚拟地址和第一物理地址的映射关系，并建立所述虚拟地址与第二物理地址的映射关系；
    将所述目标进程的上下文通过共享内存传递给所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    在内核执行所述目标进程的可执行文件时，在所述内核创建第一任务结构体，所述第一任务结构体用于存放所述目标进程的上下文；
    在所述第一任务结构体中添加指示值，所述指示值用于指示所述目标进程需要运行在所述功能安全分区；
    在运行所述目标进程时，根据所述指示值，从所述内核向所述功能安全发送第一通知，所述第一通知用于指示在所述功能安全分区创建第二任务结构体；
    根据所述第一通知，创建第二任务结构体，并将所述目标进程的上下文存放到所述第二任务结构体。
  5. 根据权利要求3或4所述的方法，其特征在于，所述方法还包括：
    从所述共享内存将所述目标进程的上下文读取到所述功能安全分区；
    对所述目标进程的上下文进行一致性校验，以得到第一校验值；
    若所述第一校验值与第二校验值相同，则确定所述目标进程的上下文为安全数据，所述第二校验值为对所述目标进程的初始配置上下文进行一致性校验得到的可信值。
  6. 根据权利要求3-5任一项所述的方法，其特征在于，所述方法还包括：
    若所述目标进程在运行时调用所述功能安全分区的系统调用指令，则从所述功能安全 分区将所述系统调用指令的上下文存入所述共享内存；
    从所述功能安全分区向所述内核发送第二通知，所述第二通知用于指示发生系统调用；
    从所述共享内存读取所述系统调用指令的上下文，并根据所述系统调用指令的上下文调用所述内核的系统调用指令进行系统调用，得到系统调用的返回值；
    通过所述共享内存将所述系统调用的返回值传递给功能安全分区。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    从所述共享内存将所述系统调用的返回值读取到所述功能安全分区；
    对所述系统调用的返回值进行一致性校验，以得到第三校验值；
    若所述第三校验值与第四校验值相同，则确定所述系统调用的返回值为安全数据，所述第四校验值为根据与所述系统调用相对应的原始文件进行一致性校验得到的可信值。
  8. 根据权利要求3-6任一项所述的方法，其特征在于，所述方法还包括：
    若所述目标进程在运行时发生缺页异常，则从所述功能安全分区将所述缺页异常的上下文存入所述共享内存；
    从所述功能安全分区向所述内核发送第三通知，所述第三通知用于指示发生缺页异常；
    从所述共享内存读取所述缺页异常的上下文，并根据所述缺页异常的上下文调用所述内核中缺页异常处理函数，以及根据所述缺页异常处理函数进行缺页异常处理，以得到处理结果；
    通过所述共享内存将所述处理结果传递给功能安全分区。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，
    所述目标进程包括线程和协程，所述线程在所述内核被创建，并运行在所述功能安全分区，所述协程在所述功能安全分区被创建，并运行在所述功能安全分区；
    所述功能安全分区种包括统一调度器，所述统一调度器用于对所述线程和所述协程进行统一调度。
  10. 一种运行进程的装置，其特征在于，包括：
    接收单元，用于接收进程启动请求，所述进程启动请求用于指示启动目标进程；
    第一处理单元，用于根据所述接收单元接收的进程启动请求，在内核执行所述目标进程的可执行文件，得到支持所述目标进程在所述内核运行的第一运行功能数据；
    第二处理单元，用于将所述第一处理单元得到的第一运行功能数据迁移到功能安全分区，得到第二运行功能数据，所述功能安全分区和所述内核位于同一特权层；
    第三处理单元，用于基于所述第二处理单元得到的第二运行功能数据，在所述功能安全分区运行所述目标进程。
  11. 根据权利要求10所述的装置，其特征在于，
    所述第一运行功能数据包括所述目标进程的虚拟地址，所述虚拟地址和第一物理地址的映射关系，以及所述目标进程的上下文，所述第一物理地址是所述目标进程在所述内核的存储资源中被分配的物理地址；
    所述第二运行功能数据包括所述目标进程的虚拟地址，所述虚拟地址和第二物理地址的映射关系，以及所述目标进程的上下文，所述第二物理地址是所述目标进程在所述功能 安全分区的存储资源中被分配的物理地址。
  12. 根据权利要求11所述的装置，其特征在于，
    第二处理单元，用于触发虚拟机管理器将所述虚拟地址迁移到所述功能安全分区，解除所述虚拟地址和第一物理地址的映射关系，并建立所述虚拟地址与第二物理地址的映射关系；将所述目标进程的上下文通过共享内存传递给所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。
  13. 根据权利要求12所述的装置，其特征在于，所述装置还包括第一发送单元，
    所述第一处理单元，还用于在内核执行所述目标进程的可执行文件时，在所述内核创建第一任务结构体，所述第一任务结构体用于存放所述目标进程的上下文；在所述第一任务结构体中添加指示值，所述指示值用于指示所述目标进程需要运行在所述功能安全分区；
    所述第一发送单元，用于在运行所述目标进程时，根据所述指示值，从所述内核向所述功能安全发送第一通知，所述第一通知用于指示在所述功能安全分区创建第二任务结构体；
    所述第三处理单元，用于根据所述第一通知，创建第二任务结构体，并将所述目标进程的上下文存放到所述第二任务结构体。
  14. 根据权利要求12或13所述的装置，其特征在于，
    所述第三处理单元，还用于从所述共享内存将所述目标进程的上下文读取到所述功能安全分区；对所述目标进程的上下文进行一致性校验，以得到第一校验值；若所述第一校验值与第二校验值相同，则确定所述目标进程的上下文为安全数据，所述第二校验值为对所述目标进程的初始配置上下文进行一致性校验得到的可信值。
  15. 根据权利要求12-14任一项所述的装置，其特征在于，所述装置还包括第二发送单元，
    所述第三处理单元，用于若所述目标进程在运行时调用所述功能安全分区的系统调用指令，则从所述功能安全分区将所述系统调用指令的上下文存入所述共享内存；
    所述第二发送单元，用于从所述功能安全分区向所述内核发送第二通知，所述第二通知用于指示发生系统调用；
    所述第二处理单元，还用于从所述共享内存读取所述系统调用指令的上下文，并根据所述系统调用指令的上下文调用所述内核的系统调用指令进行系统调用，得到系统调用的返回值；通过所述共享内存将所述系统调用的返回值传递给功能安全分区。
  16. 根据权利要求15所述的装置，其特征在于，
    所述第三处理单元，还用于从所述共享内存将所述系统调用的返回值读取到所述功能安全分区；对所述系统调用的返回值进行一致性校验，以得到第三校验值；若所述第三校验值与第四校验值相同，则确定所述系统调用的返回值为安全数据，所述第四校验值为根据与所述系统调用相对应的原始文件进行一致性校验得到的可信值。
  17. 根据权利要求12-16任一项所述的装置，其特征在于，所述装置还包括第三发送单元，
    所述第三处理单元，还用于若所述目标进程在运行时发生缺页异常，则从所述功能安 全分区将所述缺页异常的上下文存入所述共享内存；
    所述第三发送单元，用于从所述功能安全分区向所述内核发送第三通知，所述第三通知用于指示发生缺页异常；
    所述第二处理单元，还用于从所述共享内存读取所述缺页异常的上下文，并根据所述缺页异常的上下文调用所述内核中缺页异常处理函数，以及根据所述缺页异常处理函数进行缺页异常处理，以得到处理结果；通过所述共享内存将所述处理结果传递给功能安全分区。
  18. 一种计算设备，其特征在于，包括处理器和存储有计算机程序的计算机可读存储介质；
    所述处理器与所述计算机可读存储介质耦合，所述计算机程序被所述处理器执行时实现如权利要求1-9任一项所述的方法。
  19. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1-9任一项所述的方法。
  20. 一种芯片系统，其特征在于，包括处理器，所述处理器被调用用于执行如权利要求1-9任一项所述的方法。
PCT/CN2021/095905 2020-06-30 2021-05-26 一种运行进程的方法及装置 WO2022001506A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2022581002A JP2023532324A (ja) 2020-06-30 2021-05-26 プロセス実行方法および装置
EP21832604.9A EP4160399A4 (en) 2020-06-30 2021-05-26 METHOD AND DEVICE FOR EXECUTING A PROCESS
US18/148,954 US20230146364A1 (en) 2020-06-30 2022-12-30 Process running method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010616278.7A CN113867828A (zh) 2020-06-30 2020-06-30 一种运行进程的方法及装置
CN202010616278.7 2020-06-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/148,954 Continuation US20230146364A1 (en) 2020-06-30 2022-12-30 Process running method and apparatus

Publications (1)

Publication Number Publication Date
WO2022001506A1 true WO2022001506A1 (zh) 2022-01-06

Family

ID=78981558

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/095905 WO2022001506A1 (zh) 2020-06-30 2021-05-26 一种运行进程的方法及装置

Country Status (5)

Country Link
US (1) US20230146364A1 (zh)
EP (1) EP4160399A4 (zh)
JP (1) JP2023532324A (zh)
CN (1) CN113867828A (zh)
WO (1) WO2022001506A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115081033A (zh) * 2022-07-20 2022-09-20 南方电网数字电网研究院有限公司 一种数字配电网边缘计算装置业务安全隔离方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116204458A (zh) * 2021-11-30 2023-06-02 华为技术有限公司 一种运行进程的方法及装置
CN116775234A (zh) * 2022-03-11 2023-09-19 华为技术有限公司 一种进程的执行状态切换方法及装置
CN116450207A (zh) * 2023-06-14 2023-07-18 北京鉴智科技有限公司 自动驾驶感知处理方法、装置、电子设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1782993A (zh) * 2004-12-03 2006-06-07 微软公司 改进的操作系统性能
CN103324887A (zh) * 2013-07-05 2013-09-25 百度在线网络技术（北京）有限公司 移动终端的安全防御装置、方法和移动终端
CN104102535A (zh) * 2013-04-01 2014-10-15 华为技术有限公司 进程迁移方法和可迁移操作系统
CN104216862A (zh) * 2013-05-29 2014-12-17 华为技术有限公司 一种用户进程与系统服务之间的通信方法、装置
CN110597640A (zh) * 2019-08-29 2019-12-20 深圳市优必选科技股份有限公司 进程间的数据传输方法、装置、终端及计算机存储介质
US20200097323A1 (en) * 2018-09-26 2020-03-26 International Business Machines Corporation Container migration

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6349355B1 (en) * 1997-02-06 2002-02-19 Microsoft Corporation Sharing executable modules between user and kernel threads
CN108959916B (zh) * 2017-05-22 2022-01-14 华为技术有限公司 用于访问安全世界的方法、装置和系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1782993A (zh) * 2004-12-03 2006-06-07 微软公司 改进的操作系统性能
CN104102535A (zh) * 2013-04-01 2014-10-15 华为技术有限公司 进程迁移方法和可迁移操作系统
CN104216862A (zh) * 2013-05-29 2014-12-17 华为技术有限公司 一种用户进程与系统服务之间的通信方法、装置
CN103324887A (zh) * 2013-07-05 2013-09-25 百度在线网络技术（北京）有限公司 移动终端的安全防御装置、方法和移动终端
US20200097323A1 (en) * 2018-09-26 2020-03-26 International Business Machines Corporation Container migration
CN110597640A (zh) * 2019-08-29 2019-12-20 深圳市优必选科技股份有限公司 进程间的数据传输方法、装置、终端及计算机存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115081033A (zh) * 2022-07-20 2022-09-20 南方电网数字电网研究院有限公司 一种数字配电网边缘计算装置业务安全隔离方法

Also Published As

Publication number Publication date
JP2023532324A (ja) 2023-07-27
EP4160399A4 (en) 2023-10-25
CN113867828A (zh) 2021-12-31
US20230146364A1 (en) 2023-05-11
EP4160399A1 (en) 2023-04-05

Similar Documents

Publication Publication Date Title
WO2022001506A1 (zh) 一种运行进程的方法及装置
KR102004060B1 (ko) 자율 주행 차량을 작동하는 컴퓨팅 노드들 사이의 효율적 통신
JP5602814B2 (ja) 仮想アーキテクチャにおいて使用される装置、方法及びシステム
US7149832B2 (en) System and method for interrupt handling
EP3195176B1 (en) Trusted execution environment extensible computing device interface
WO2023098536A1 (zh) 一种运行进程的方法及装置
US20080065854A1 (en) Method and apparatus for accessing physical memory belonging to virtual machines from a user level monitor
US20090241109A1 (en) Context Agent Injection Using Virtual Machine Introspection
CN111783106B (zh) 经由多层文件系统状态检测文件系统修改的系统和方法
US20120131375A1 (en) Executing a Kernel Device Driver as a User Space Process
CN113821360A (zh) 定位信息的获取方法、装置、电子设备及存储介质
US20210389966A1 (en) Micro kernel based extensible hypervisor and embedded system
EP4155949A1 (en) Method and apparatus for isolating kernel from task
EP3436947B1 (en) Secure driver platform
JP2021532495A (ja) 仮想マシン・メモリの安全なアクセス
Van't Hof et al. Androne: Virtual drone computing in the cloud
CN113010265A (zh) Pod的调度方法、调度器、存储插件及系统
CN111382450A (zh) 安全可靠的虚拟化域特定硬件加速器
US20230342503A1 (en) Security Isolation Apparatus and Method
JP6059330B2 (ja) アプリケーション転送システム、アプリケーション転送方法、端末、およびプログラム
US11392512B2 (en) USB method and apparatus in a virtualization environment with multi-VM
KR20230087336A (ko) 가상화 시스템 및 그 구동 방법
WO2023020069A1 (zh) 虚拟机管理方法及相关系统、存储介质
WO2020028509A1 (en) Method and apparatus for software isolation and security utilizing multi-soc orchestration
CN108549395B (zh) 水下无人自主航行器导航控制系统及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21832604

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022581002

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021832604

Country of ref document: EP

Effective date: 20221230

NENP Non-entry into the national phase

Ref country code: DE