Request processing method and device

Abstract

A request processing method, device and system, the method comprising: acquiring a first access request of a first process, the first access request indicating access to a memory space corresponding to a first address; obtaining a first process identifier of the first process and a first memory identifier of the first address; and when it is determined that the first process has the access permission of the memory space where the first address is located through a target mapping relation according to the first process identifier and the first memory identifier, executing access to the first address according to the first access request. According to the method, access of the process to the shared memory is allowed only when the mapping relation indicates that the identifier of the process and the identifier of the address carried in the access request have the mapping relation, and isolation between different shared memory domains is achieved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for processing a request. Background Art

[0002] As the most efficient communication method between processes, shared memory is widely used in complex ICT business scenarios. In order to improve the efficiency of shared memory and facilitate management, there is a usage scenario where the component will apply for a large shared memory from the operating system in advance, and then perform secondary management and allocation in user mode, thereby reducing the performance impact caused by frequent application and release of shared memory by business components and falling into kernel mode. This usage scenario has some security and reliability risks: because shared memory domains are not isolated from each other, the entire shared memory is visible and accessible to all business processes, and data between business processes is prone to unintentional or malicious modification, resulting in business operation errors or even crashes. Summary of the invention

[0003] The embodiments of the present application provide a method, device and system for processing requests, which can achieve isolation between shared memories.

[0004] In order to achieve the above objectives, the embodiments of the present application adopt the following technical solutions:

[0005] In a first aspect, an embodiment of the present application provides a method for processing a request, the method comprising: obtaining a first access request of a first process, the first access request indicating access to a memory space corresponding to a first address, and the memory space is a shared memory; obtaining a first process identifier of the first process and a first memory identifier of the first address; when it is determined through a target mapping relationship based on the first process identifier and the first memory identifier that the first process has access rights to the memory space where the first address is located, access to the first address is performed according to the first access request; wherein the target mapping relationship comprises a correspondence between multiple process identifiers and multiple memory identifiers, and the target mapping relationship indicates that the process corresponding to the process identifier having the corresponding relationship has access rights to the shared memory where the address corresponding to the memory identifier is located.

[0006] In an embodiment of the present application, in order to achieve isolation between different shared memories, that is, each process can only access the shared memory space allocated to itself (that is, the shared memory with access rights), but cannot access the unallocated shared memory space, thereby improving the reliability and security of the system, the MMU can maintain a process identifier for each process (which can be referred to as a shared memory access identity identifier in this embodiment of the present application), as well as a memory identifier for each memory domain of the shared memory (such as a page table or a memory domain of other granularity) (which can be referred to as a shared memory domain identifier in this embodiment of the present application), and construct a mapping relationship between the process identifier of the process and the memory identifier of the shared memory allocated to the process. Only when the mapping relationship indicates that there is a mapping relationship between the identifier of the process and the identifier of the address carried in the access request, the process is allowed to access the shared memory.

[0007] In a possible implementation, the first memory identifier is an identifier corresponding to a page table where the first address is located.

[0008] In a possible implementation, the method also includes: when the first process is started, writing the first process identifier into the process control block corresponding to the first process, and writing the correspondence between the first address and the first memory identifier into the memory; obtaining the first process identifier of the first process and the first memory identifier of the first address includes: obtaining the first process identifier of the first process from the process control block; obtaining the first memory identifier of the first address from the memory.

[0009] In a possible implementation, the method further includes: when the first process is started, allocating at least one page table as shared memory for the first process, and configuring the first memory identifier as an identifier of the at least one page table, wherein the at least one page table is a page table where the first address is located.

[0010] Through the above method, the shared memory is split according to the page table to implement permission control based on the page table granularity.

[0011] In a possible implementation, when the first process is started, the correspondence between the first process identifier and the first memory identifier is written into the target mapping relationship.

[0012] In a possible implementation, the first access request also carries a target access type; the target mapping relationship also indicates that the shared memory where the process corresponding to the process identifier having the corresponding relationship and the address corresponding to the memory identifier has access rights of the access type; the determining, based on the first process identifier and the first memory identifier, through the target mapping relationship, that the first process has access rights to the memory space where the first address is located includes: determining, based on the first process identifier and the first memory identifier, through the target mapping relationship, that the first process has access rights of the target access type to the memory space where the first address is located.

[0013] In a possible implementation, the determining, based on the first process identifier and the first memory identifier, through a target mapping relationship, that the first process has access rights for the target access type to the memory space where the first address is located includes: determining, based on the first process identifier and the first memory identifier, through a target mapping relationship, that the first process has access rights for the target access type to the memory space where the first address is located, and a permission bit of a virtual memory area (VMA) of the first address indicates that the memory space where the first address is located supports access rights for the target access type.

[0014] In a possible implementation, the method further includes: allocating a physical address to the first address based on the first access request triggering a page fault exception; and performing access to the first address according to the first access request includes: performing access to the physical address according to the first access request.

[0015] Through the above method, when a process accesses shared memory and causes a page fault interrupt, the process shared memory access identity and the shared memory domain identifier of the page table to which the accessed address belongs are obtained, and whether the access is allowed is determined based on the permission information of the shared memory domain. The newly added shared memory permission judgment during memory access can be used to implement permission control at the page table granularity within the shared memory.

[0016] In a possible implementation, the method also includes: obtaining a second access request of a second process, the second access request indicating access to a memory space corresponding to a second address, and the memory space is a shared memory; obtaining a second process identifier of the second process and a second memory identifier of the second address; and when it is determined through the target mapping relationship based on the second process identifier and the second memory identifier that the second process does not have access rights to the memory space where the first address is located, returning access failure information to the second process.

[0017] In a second aspect, the present application provides a device for processing a request, the device comprising:

[0018] an acquisition module, configured to acquire a first access request of a first process, wherein the first access request indicates access to a memory space corresponding to a first address, and the memory space is a shared memory; and acquire a first process identifier of the first process and a first memory identifier of the first address;

[0019] A processing module, used to execute access to the first address according to the first access request when it is determined through a target mapping relationship based on the first process identifier and the first memory identifier that the first process has access rights to the memory space where the first address is located; wherein the target mapping relationship includes a correspondence between multiple process identifiers and multiple memory identifiers, and the target mapping relationship indicates that the process corresponding to the process identifier with the corresponding relationship and the shared memory where the address corresponding to the memory identifier is located have access rights.

[0020] In a possible implementation, the first memory identifier is an identifier corresponding to a page table where the first address is located.

[0021] In a possible implementation, the processing module is further configured to:

[0022] When the first process is started, writing the first process identifier into a process control block corresponding to the first process, and writing a corresponding relationship between the first address and the first memory identifier into a memory;

[0023] The processing module is specifically used for:

[0024] Acquire a first process identifier of the first process from the process control block;

[0025] A first memory identifier of the first address is obtained from the memory.

[0026] In a possible implementation, the processing module is further configured to:

[0027] When the first process is started, at least one page table is allocated to the first process as a shared memory, and the first memory identifier is configured as an identifier of the at least one page table, where the at least one page table is a page table where the first address is located.

[0028] In a possible implementation, when the first process is started, the correspondence between the first process identifier and the first memory identifier is written into the target mapping relationship.

[0029] In a possible implementation, the first access request further carries a target access type;

[0030] The target mapping relationship further indicates that: the process corresponding to the process identifier having the corresponding relationship and the shared memory at the address corresponding to the memory identifier have access rights of the access type;

[0031] The processing module is specifically used for:

[0032] According to the first process identifier and the first memory identifier, it is determined through a target mapping relationship that the first process has access rights of the target access type to the memory space where the first address is located.

[0033] In a possible implementation, the processing module is specifically configured to:

[0034] Based on the first process identifier and the first memory identifier, it is determined through the target mapping relationship that the first process has access rights for the target access type to the memory space where the first address is located, and the virtual memory area (VMA) permission bit of the first address indicates that the memory space where the first address is located supports access rights for the target access type.

[0035] In a possible implementation, the processing module is further configured to:

[0036] Based on the first access request triggering a page fault exception, allocating a physical address to the first address;

[0037] The processing module is specifically used for:

[0038] Access to the physical address is performed according to the first access request.

[0039] In a possible implementation, the processing module is further configured to:

[0040] Obtaining a second access request of a second process, where the second access request indicates access to a memory space corresponding to a second address, and the memory space is a shared memory;

[0041] Obtain a second process identifier of the second process and a second memory identifier of the second address;

[0042] When it is determined through the target mapping relationship according to the second process identifier and the second memory identifier that the second process does not have access rights to the memory space where the first address is located, access failure information is returned to the second process.

[0043] In a third aspect, an embodiment of the present application provides a chip, which includes a processing circuit and a storage medium, in which instructions are stored; when the instruction is executed by the processing circuit, the chip executes a method for processing a request as described in any one of the above aspects.

[0044] In a fourth aspect, an embodiment of the present application provides a device for processing requests, the device comprising: a storage medium, a processing circuit, and a memory management unit MMU, the storage medium is coupled to the processing circuit, the storage medium is used to store computer program code, the computer program code comprises computer instructions, and when the computer instructions are executed by the processing circuit, a method for processing requests as described in any one of the above aspects is executed.

[0045] In a fifth aspect, an embodiment of the present application provides a device for processing requests, the device comprising: a storage medium and a processing circuit, the storage medium being coupled to the processing circuit, the storage medium being used to store computer program code, the computer program code comprising computer instructions, and when the computer instructions are executed by the processing circuit, instructing the bus end device to execute a method for processing a request as described in any one of the above aspects.

[0046] In a sixth aspect, a communication device is provided, comprising: a processor; the processor is used to couple with a memory, and after reading instructions in the memory, execute a method for processing a request as described in any one of the above aspects according to the instructions.

[0047] In a seventh aspect, an embodiment of the present application provides a communication device, which may be a chip system, which includes a processor and may also include a memory, for implementing the functions of the method described in any of the above aspects. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0048] In an eighth aspect, a communication device is provided, which may be a circuit system, the circuit system including a processing circuit, and the processing circuit is configured to execute any method as in any of the above aspects.

[0049] In the ninth aspect, an embodiment of the present application also provides a computer-readable storage medium, including instructions, which, when executed on a computer, enable the computer to execute any of the above methods.

[0050] In the tenth aspect, an embodiment of the present application also provides a computer program product, including instructions, which, when executed on a computer, enables the computer to execute any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of a method for processing a request provided in an embodiment of the present application;

[0052] Figure 2 A schematic diagram of an architecture for processing requests provided in an embodiment of the present application;

[0053] Figure 3 A schematic diagram of an architecture for processing requests provided in an embodiment of the present application;

[0054] Figure 4 A schematic diagram of a method for processing a request provided in an embodiment of the present application;

[0055] Figure 5a A schematic diagram of a method for processing a request provided in an embodiment of the present application;

[0056] Figure 5b A schematic diagram of a method for processing a request provided in an embodiment of the present application;

[0057] Figure 6 A schematic diagram of a device for processing requests provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] First, some expressions that may appear in this application are explained.

[0059] “First” and “second” and the like are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0060] "At least one" means one or more, while "plurality" means two or more.

[0061] "And / or" describes the association relationship of associated objects, indicating that there can be three types of relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0062] The character “ / ” generally indicates that the related objects are in an “or” relationship. For example, A / B can mean A or B.

[0063] In addition, the terms "include", "comprising", and "having" mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products, or devices.

[0064] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples or explanations. Any implementation (such as the embodiments in this application) or design of "exemplary" or "for example" should not be interpreted as being more preferred or more advantageous than other implementations or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0065] In the specification and drawings of this application, the terms "of", "relevant" and "corresponding" may sometimes be used interchangeably. It should be pointed out that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0066] Below, some terms that appear in this application are briefly described.

[0067] Instance: An instance is a software module that can run an application or system program. The software module can only be called an instance when it is run by the operating system. Otherwise, it is just a piece of code. Instances have many forms, such as processes and threads. Instances run on nodes.

[0068] Node: A node is a device that has at least one of the two functions of processing data and storing data. An operating system runs on the node, and the node can be distinguished by the operating system, that is, different nodes run different operating systems. In other words, the hardware and software used for the operation of an operating system can be visually attributed to the same node. In this application, a node can be a complete physical machine. For example, a terminal, or a network device, such as a server, a server agent, etc. A node can also be a device in a physical machine. For example, a processor, memory, and storage. When a physical machine includes two nodes, the two nodes run different operating systems. For example, the physical machine includes a central processing unit (Central Processing Uint, CPU) running operating system 1 and a graphics processing unit (Graphics Processing Unit) running operating system 2, then the central processing unit and the graphics processing unit can be considered to belong to different nodes. When a node is a device, it is a relatively independent individual in hardware. "Independent individuals" can be understood as circuits or modules with specialized functions, and the device is packaged or assembled on a physical machine. Data access in this application can be understood as a node accessing data maintained by another node through an instance. Devices in a node refer to the parts or components in the node. For example, when the node is a physical machine, the CPU and memory are both devices in the node. A physical machine refers to a computer packaged into a product, such as a server, desktop computer, All-In-One PC (AIO), laptop, or smartphone.

[0069] Terminal: may include desktop, laptop, handheld, and vehicle-mounted user equipment (UE) devices, such as smart phones, cellular phones, desktop computers, tablet computers, smart TVs, smart TV boxes, ultra-mobile personal computers (UMPC), laptops, personal digital assistants (PDA), portable multimedia players (PMP), dedicated media players, consumer communication devices, wearable devices (such as smart watches), AR (augmented reality) / VR (virtual reality) devices, and other types of communication devices.

[0070] Identification: used to distinguish one kind or one thing from other things of the same or different kinds. For example, the identification of a node, the identification of a network, the identification of a network card. The identification can be a name, a number, or a distinguishing feature, such as a type identification. The present application does not restrict the implementation of various identifications, as long as a distinction can be made. For example, in some implementations of the present application, the identification of the virtual address space of the instance is used as the identification of the instance, rather than the common method of using the name or number of the instance as the identification of the instance.

[0071] Address space: Also called storage space, it refers to one or more segments of addresses that can be used by a device or instance. For example, the virtual address space of a device or instance is the one or more segments of virtual addresses that can be used by the device or instance, that is, the one or more segments of virtual addresses that belong to the device or instance. The virtual address space of a device or instance is allocated by the operating system where the device or instance is located. For another example, the physical address space of a device or instance is one or more segments of physical addresses allocated to the device or instance. When the device or instance is in this physical address space, other devices or instances cannot use the addresses in this physical address space. The physical address space of an instance is allocated by the operating system running the instance. This allocation may be dynamic, for example, as the instance runs, the occupied physical address space becomes larger and larger, but there will be an upper limit. The size and range of the physical address space of a device are usually fixed.

[0072] Page table: A data structure that can be used to record the mapping relationship between two types of data. It is usually used to convert virtual addresses into physical addresses. A hierarchical page table is also a type of page table. The page table is stored in a storage medium. The base address of the page table, also referred to as the page table base address, refers to the starting address of the physical address of the page table. The size of the page table determines the value range of the virtual address corresponding to the page table. The virtual address in the page table is the virtual address of the instance or device using the page table, which is used to indicate the offset of the physical address of a certain position (or a certain table entry) in the page table relative to the base address of the page table. The data stored at a certain position in the page table is the physical address in the physical address space of the instance or device using the page table. A page table includes multiple table entries, each of which can indicate a mapping relationship between a virtual address and a physical address of an instance or device using the page table. It should be understood that the table entry mentioned here is a functional description, and the specific implementation method of the table entry is not limited in this application. For example, the mapping relationship between a virtual address and a physical address may be cross-level, and the mapping relationship between a virtual address and a physical address may also be indirect. This application does not limit the specific implementation method of the page table. For example, it can be a multi-level page table, a hash table, etc.

[0073] The page table of a process: also referred to as the process page table, records the mapping relationship between the virtual address in the virtual address space of a process and the physical address in the physical address space of the process.

[0074] Bus: The bus in the prior art is the internal structure of a computer and a public communication trunk for transmitting information between various functional components in the computer. The bus of a computer can be divided into a data bus, an address bus and a control bus, which are used to transmit data, the address of the data and the control signal respectively. In this application, the bus is the abbreviation of High Performance Interconnect Bus (HPIB), which can not only connect various components inside a computer, but also replace the network and be laid between different computers to connect different computers. Each computer is connected to the high-performance interconnect bus through a bus terminal device, which is equivalent to a communication module such as a network card or a baseband antenna in network technology. This application describes how to use the function of the bus itself to complete the processing of requests for reading or writing data, that is, a method for accessing a remote storage medium after the hardware is laid. This application does not describe the specific structure of the HPIB and the bus terminal device in detail.

[0075] Process ID: used to identify the identity of a process during shared memory access. Different processes have different identities.

[0076] Shared memory identifier: used to identify the memory domain to which each page table in the shared memory belongs, divide the page tables into different memory domains, and perform permission control based on the memory domains.

[0077] As the most efficient communication method between processes, shared memory is widely used in complex ICT business scenarios. In order to improve the efficiency of shared memory and facilitate management, there is a usage scenario where the component will apply for a large shared memory from the operating system in advance, and then perform secondary management and allocation in user mode, thereby reducing the performance impact caused by frequent requests for shared memory release by business components falling into kernel mode. This usage scenario has some security and reliability risks: the entire shared memory is visible and accessible to all business processes, and data between business processes is prone to unintentional or malicious modification, resulting in business operation errors or even crashes.

[0078] To solve the above problems, refer to Figure 1 , Figure 1 A method for processing a request, the method comprising:

[0079] 101. Obtain a first access request of a first process, where the first access request indicates access to a memory space corresponding to a first address, and the memory space is a shared memory.

[0080] Among them, the embodiments of the present application can be applied to, but are not limited to, scenarios where multiple processes use the same shared memory for inter-process communication.

[0081] like Figure 2 As shown, the same shared memory corresponding to multiple processes can be mapped into their own process space, and one of the areas can be used for communication through negotiation. For example, process 1 and process 2 communicate through shared memory block 1, and process 3 and process 4 communicate through shared memory block 2.

[0082] A first process (the first process may be an instance of a process, a thread, etc.) may send an access request for a memory space to the MMU (for example, a first access request in an embodiment of the present application), wherein the first access request may carry a first address, the first address may be a virtual address, and the first address corresponds to a shared memory.

[0083] In an embodiment of the present application, in order to achieve isolation between different shared memories, that is, each process can only access the shared memory space allocated to itself (that is, the shared memory with access rights), but cannot access the unallocated shared memory space, thereby improving the reliability and security of the system, the MMU can maintain a process identifier for each process (which can be referred to as a shared memory access identity identifier in this embodiment of the present application), as well as a memory identifier for each memory domain of the shared memory (such as a page table or a memory domain of other granularity) (which can be referred to as a shared memory domain identifier in this embodiment of the present application), and construct a mapping relationship between the process identifier of the process and the memory identifier of the shared memory allocated to the process. Only when the mapping relationship indicates that there is a mapping relationship between the identifier of the process and the identifier of the address carried in the access request, the process is allowed to access the shared memory.

[0084] In a possible implementation, when the first process is started, a first identifier may be allocated to the first process, and the first process identifier may be written into a process control block (task struct) corresponding to the first process.

[0085] In one possible implementation, when the first process is started, a memory domain of a shared memory (for example, a first address or a memory domain where the first address is located, and the memory domain may be but is not limited to a page table) can be allocated for the first process, and an identifier of the memory domain (that is, a first memory identifier) ​​can be set, and the correspondence between the memory domain (for example, a page table where the first address is located) and the first memory identifier can be written into the memory (that is, the correspondence between the first process identifier and the first memory identifier can be written into the target mapping relationship).

[0086] In a possible implementation, when the first process is started, at least one page table can be allocated to the first process as shared memory, and the first memory identifier can be configured as an identifier of the at least one page table, where the at least one page table is the page table where the first address is located.

[0087] For example, refer to Figure 3 , Figure 3 This is a schematic diagram of an application architecture of the present application, wherein a shared memory domain permission management component maintains permission information of each shared memory domain, and declares which shared memory access identities can access each shared memory domain.

[0088] Reference Figure 4 ,The implementation process of process startup in Linux system is as follows: ,The first step is the original process startup process of Linux system. ,The second step is to set the shared memory access identity for the ,process. Generally speaking, each process has a unique identity, but ,specially, processes with the same shared memory access rights can be set to the same shared ,memory access identity.

[0089] Reference Figure 5a , Figure 5a The application of a shared memory segment is shown in the figure. The implementation process of the shared memory segment application is as follows: In the first step, the process initiates an application for a shared memory segment. In the second step, a continuous free memory segment of a specified size is found from the specified shared memory and allocated to the process. In the third step, a shared memory domain identifier is set for the page table corresponding to the allocated continuous memory segment. In the fourth step, according to which processes need to access the allocated memory segment, the shared memory domain set in step three is set to be accessible by the corresponding shared memory access identity. For example, if the allocated memory segment is set to shared memory domain identifier A, and the memory segment needs to be accessed by process 1 and process 2, process 1 is set to shared memory access identity identifier 1, and process 2 (which may also access other shared memories, so the identities are not necessarily the same) is set to shared memory access identity identifier 2, then shared memory domain A is set to be accessible by shared memory access identity 1 and shared memory access identity 2.

[0090] Through the above method, each shared memory domain can dynamically configure which shared memory access identities are allowed to access it, so as to achieve flexible and configurable permissions at the page table and process granularity.

[0091] 102. Obtain a first process identifier of the first process and a first memory identifier of the first address.

[0092] After obtaining the first process access request of the first process, the first identifier of the first process can be obtained, for example, the first process identifier of the first process can be obtained from the process control block, and the first memory identifier corresponding to the first address can also be obtained, for example, the first memory identifier of the first address can be obtained from the memory, and more specifically, the first memory identifier corresponding to the page table where the first address is located can be obtained.

[0093] 103. When it is determined through a target mapping relationship based on the first process identifier and the first memory identifier that the first process has access rights to the memory space where the first address is located, access to the first address is performed according to the first access request; wherein the target mapping relationship includes a correspondence between multiple process identifiers and multiple memory identifiers, and the target mapping relationship indicates that the process corresponding to the process identifier having the corresponding relationship and the shared memory where the address corresponding to the memory identifier is located have access rights.

[0094] Specifically, a shared memory permission control component can be added to the MMU. When a process accesses a shared memory address, the process's shared memory access identity and the shared memory domain identifier of the page table to which the access address belongs are obtained. The target mapping relationship can be used as the permission information of the shared memory domain, and then it can be determined whether the access is allowed based on the permission information of the shared memory domain.

[0095] It should be understood that the target mapping relationship may also indicate that the shared memory where the process corresponding to the process identifier having the corresponding relationship and the address corresponding to the memory identifier has access rights of the access type, and the access type may be readable, writable, readable and writable, etc.

[0096] In a possible implementation, the first access request also carries a target access type. When determining, based on the first process identifier and the first memory identifier, through a target mapping relationship, that the first process has access rights to the memory space where the first address is located, it includes: determining, based on the first process identifier and the first memory identifier, through a target mapping relationship, that the first process has access rights to the target access type to the memory space where the first address is located.

[0097] In a possible implementation, a second access request of the second process can also be obtained, wherein the second access request indicates access to the memory space corresponding to the second address, and the memory space is a shared memory; the second process identifier of the second process and the second memory identifier of the second address are obtained; and when it is determined through the target mapping relationship based on the second process identifier and the second memory identifier that the second process does not have access rights to the memory space where the first address is located, access failure information is returned to the second process.

[0098] In one possible implementation, as a condition for determining that the first process has the permission to access the first address, in addition to the above-mentioned information determined based on the target mapping relationship, VMA permissions may also be included. Specifically, it can be determined through the target mapping relationship based on the first process identifier and the first memory identifier that the first process has the access right to perform the target access type on the memory space where the first address is located, and the virtual memory area (VMA) permission bit of the first address indicates that the memory space where the first address is located supports the access right of the target access type.

[0099] In a possible implementation, if the first access request is the first access request, a page fault exception may be triggered and a physical address may be allocated thereto. Specifically, a physical address may be allocated to the first address based on the page fault exception being triggered by the first access request.

[0100] Reference Figure 5b , Figure 5bThis is a flow chart of the first access to shared memory. The implementation process of the first access to shared memory is as follows: Step 1. When the process accesses shared memory for the first time, a page fault exception is triggered. Step 2. After entering the page fault exception handling process, it will first determine whether the access is allowed based on the access type and VMA permission bit. Step 3. After completing the VMA permission judgment, an additional shared memory domain permission judgment will be performed. Step 4. After the permission judgment is passed, the system will perform page fault processing, allocate a physical memory page for the accessed address, and write the mapping from the virtual address to the physical address into the page table. Step 5. Take the intersection of the permission judgment results of step 2 and step 3 (read-only / read-write / no access allowed) and write it into the PTE table entry permission bit.

[0101] Through the above method, when a process accesses shared memory and causes a page fault interrupt, the process shared memory access identity and the shared memory domain identifier of the page table to which the accessed address belongs are obtained, and whether the access is allowed is determined based on the permission information of the shared memory domain. The newly added shared memory permission judgment during memory access can be used to implement permission control at the page table granularity within the shared memory.

[0102] Reference Figure 6 , Figure 6 The structure of a device for processing a request provided in an embodiment of the present application is schematically shown, wherein the device 600 includes:

[0103] The acquisition module 601 is used to acquire a first access request of a first process, where the first access request indicates access to a memory space corresponding to a first address, and the memory space is a shared memory; and acquire a first process identifier of the first process and a first memory identifier of the first address;

[0104] Among them, the introduction of the acquisition module 601 can refer to the description of step 101 in the above embodiment, and will not be repeated here.

[0105] Processing module 602 is used to perform access to the first address according to the first access request when it is determined through a target mapping relationship based on the first process identifier and the first memory identifier that the first process has access rights to the memory space where the first address is located; wherein the target mapping relationship includes a correspondence between multiple process identifiers and multiple memory identifiers, and the target mapping relationship indicates that the process corresponding to the process identifier having the corresponding relationship and the shared memory where the address corresponding to the memory identifier is located have access rights.

[0106] The introduction of the processing module 602 can refer to the description of steps 102 and 103 in the above embodiment, which will not be repeated here.

[0107] In a possible implementation, the first memory identifier is an identifier corresponding to a page table where the first address is located.

[0108] In a possible implementation, the processing module 602 is further configured to:

[0109] When the first process is started, writing the first process identifier into a process control block corresponding to the first process, and writing a corresponding relationship between the first address and the first memory identifier into a memory;

[0110] The processing module 602 is specifically used for:

[0111] Acquire a first process identifier of the first process from the process control block;

[0112] A first memory identifier of the first address is obtained from the memory.

[0113] In a possible implementation, the processing module 602 is further configured to:

[0114] When the first process is started, at least one page table is allocated to the first process as a shared memory, and the first memory identifier is configured as an identifier of the at least one page table, where the at least one page table is a page table where the first address is located.

[0115] In a possible implementation, when the first process is started, the correspondence between the first process identifier and the first memory identifier is written into the target mapping relationship.

[0116] In a possible implementation, the first access request further carries a target access type;

[0117] The target mapping relationship further indicates that: the process corresponding to the process identifier having the corresponding relationship and the shared memory at the address corresponding to the memory identifier have access rights of the access type;

[0118] The processing module 602 is specifically used for:

[0119] According to the first process identifier and the first memory identifier, it is determined through a target mapping relationship that the first process has access rights of the target access type to the memory space where the first address is located.

[0120] In a possible implementation, the processing module 602 is specifically configured to:

[0121] Based on the first process identifier and the first memory identifier, it is determined through the target mapping relationship that the first process has access rights for the target access type to the memory space where the first address is located, and the virtual memory area (VMA) permission bit of the first address indicates that the memory space where the first address is located supports access rights for the target access type.

[0122] In a possible implementation, the processing module 602 is further configured to:

[0123] Based on the first access request triggering a page fault exception, allocating a physical address to the first address;

[0124] The processing module 602 is specifically used for:

[0125] Access to the physical address is performed according to the first access request.

[0126] In a possible implementation, the processing module 602 is further configured to:

[0127] Obtaining a second access request of a second process, where the second access request indicates access to a memory space corresponding to a second address, and the memory space is a shared memory;

[0128] Obtain a second process identifier of the second process and a second memory identifier of the second address;

[0129] When it is determined through the target mapping relationship according to the second process identifier and the second memory identifier that the second process does not have access rights to the memory space where the first address is located, access failure information is returned to the second process.

[0130] The present application also provides a chip system, which is applied to the above-mentioned device. The chip system includes: one or more interface circuits and one or more processors. The interface circuit and the processor are interconnected through a line. The interface circuit is used to receive a signal from the memory of the device and send the signal to the processor. The signal includes a computer instruction stored in the memory. When the processor executes the computer instruction, the above-mentioned device executes Figure 1 The method in the corresponding embodiment.

[0131] The embodiment of the present application also provides a computer storage medium, which includes computer instructions. When the computer instructions are executed on a device, the device executes Figure 1 The method in the corresponding embodiment.

[0132] The present application also provides a computer program product, which, when executed on a computer, enables a device to execute Figure 1 The method in the corresponding embodiment.

[0133] Among them, the devices, chip systems, computer storage media or computer program products provided in this application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0134] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0135] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0136] The unit described as a separate component may or may not be physically separated, and the component shown as a unit may be one physical unit or multiple physical units, that is, it may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0137] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0138] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute all or part of the steps of the method of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0139] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method for processing a request, characterized in that: The method comprises: Obtaining a first access request of a first process, where the first access request indicates access to a memory space corresponding to a first address, and the memory space is a shared memory; Obtain a first process identifier of the first process and a first memory identifier of the first address; When it is determined through a target mapping relationship based on the first process identifier and the first memory identifier that the first process has access rights to the memory space where the first address is located, access to the first address is performed according to the first access request; wherein the target mapping relationship includes a correspondence between multiple process identifiers and multiple memory identifiers, and the target mapping relationship indicates that the process corresponding to the process identifier having the corresponding relationship and the shared memory where the address corresponding to the memory identifier is located have access rights.

2. The method according to claim 1, characterized in that: The first memory identifier is an identifier corresponding to the page table where the first address is located.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: When the first process is started, writing the first process identifier into a process control block corresponding to the first process, and writing a corresponding relationship between the first address and the first memory identifier into a memory; The obtaining the first process identifier of the first process and the first memory identifier of the first address includes: Acquire a first process identifier of the first process from the process control block; A first memory identifier of the first address is obtained from the memory.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: When the first process is started, at least one page table is allocated to the first process as a shared memory, and the first memory identifier is configured as an identifier of the at least one page table, where the at least one page table is a page table where the first address is located.

5. The method according to any one of claims 1 to 4, characterized in that: When the first process is started, the correspondence between the first process identifier and the first memory identifier is written into the target mapping relationship.

6. The method according to any one of claims 1 to 5, characterized in that: The first access request also carries a target access type; The target mapping relationship further indicates that: the process corresponding to the process identifier having the corresponding relationship and the shared memory at the address corresponding to the memory identifier have access rights of the access type; The determining, based on the first process identifier and the first memory identifier, through a target mapping relationship, that the first process has access rights to the memory space where the first address is located includes: According to the first process identifier and the first memory identifier, it is determined through a target mapping relationship that the first process has access rights of the target access type to the memory space where the first address is located.

7. The method according to claim 6, characterized in that The determining, based on the first process identifier and the first memory identifier, through a target mapping relationship, that the first process has access rights of the target access type to the memory space where the first address is located includes: Based on the first process identifier and the first memory identifier, it is determined through the target mapping relationship that the first process has access rights for the target access type to the memory space where the first address is located, and the virtual memory area (VMA) permission bit of the first address indicates that the memory space where the first address is located supports access rights for the target access type.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Based on the first access request triggering a page fault exception, allocating a physical address to the first address; The step of accessing the first address according to the first access request includes: Access to the physical address is performed according to the first access request.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Obtaining a second access request of a second process, where the second access request indicates access to a memory space corresponding to a second address, and the memory space is a shared memory; Obtain a second process identifier of the second process and a second memory identifier of the second address; When it is determined through the target mapping relationship according to the second process identifier and the second memory identifier that the second process does not have access rights to the memory space where the first address is located, access failure information is returned to the second process.

10. A device for processing a request, characterized in that: The device comprises: an acquisition module, configured to acquire a first access request of a first process, wherein the first access request indicates access to a memory space corresponding to a first address, and the memory space is a shared memory; and acquire a first process identifier of the first process and a first memory identifier of the first address; A processing module, used to execute access to the first address according to the first access request when it is determined through a target mapping relationship based on the first process identifier and the first memory identifier that the first process has access rights to the memory space where the first address is located; wherein the target mapping relationship includes a correspondence between multiple process identifiers and multiple memory identifiers, and the target mapping relationship indicates that the process corresponding to the process identifier with the corresponding relationship and the shared memory where the address corresponding to the memory identifier is located have access rights.

11. The device according to claim 10, characterized in that The first memory identifier is an identifier corresponding to the page table where the first address is located.

12. The device according to claim 10 or 11, characterized in that The processing module is further used for: When the first process is started, writing the first process identifier into a process control block corresponding to the first process, and writing a corresponding relationship between the first address and the first memory identifier into a memory; The processing module is specifically used for: Acquire a first process identifier of the first process from the process control block; A first memory identifier of the first address is obtained from the memory.

13. The device according to any one of claims 10 to 12, characterized in that: The processing module is further used for: When the first process is started, at least one page table is allocated to the first process as a shared memory, and the first memory identifier is configured as an identifier of the at least one page table, where the at least one page table is a page table where the first address is located.

14. The device according to any one of claims 10 to 13, characterized in that: When the first process is started, the correspondence between the first process identifier and the first memory identifier is written into the target mapping relationship.

15. The device according to any one of claims 10 to 14, characterized in that: The first access request also carries a target access type; The target mapping relationship further indicates that: the process corresponding to the process identifier having the corresponding relationship and the shared memory at the address corresponding to the memory identifier have access rights of the access type; The processing module is specifically used for: According to the first process identifier and the first memory identifier, it is determined through a target mapping relationship that the first process has access rights of the target access type to the memory space where the first address is located.

16. The device according to claim 15, characterized in that The processing module is specifically used for: Based on the first process identifier and the first memory identifier, it is determined through the target mapping relationship that the first process has access rights for the target access type to the memory space where the first address is located, and the virtual memory area (VMA) permission bit of the first address indicates that the memory space where the first address is located supports access rights for the target access type.

17. The device according to any one of claims 10 to 16, characterized in that The processing module is further used for: Based on the first access request triggering a page fault exception, allocating a physical address to the first address; The processing module is specifically used for: Access to the physical address is performed according to the first access request.

18. The device according to any one of claims 10 to 17, characterized in that The processing module is further used for: Obtaining a second access request of a second process, where the second access request indicates access to a memory space corresponding to a second address, and the memory space is a shared memory; Obtain a second process identifier of the second process and a second memory identifier of the second address; When it is determined through the target mapping relationship according to the second process identifier and the second memory identifier that the second process does not have access rights to the memory space where the first address is located, access failure information is returned to the second process.

19. A chip, characterized in that: The chip includes a processing circuit and an interface circuit, the interface circuit is interconnected with the processing circuit through lines, the interface circuit is used to receive a signal from a storage medium and send the signal to the processor, the signal includes a computer instruction stored in the storage medium; when the computer instruction is executed by the processing circuit, the chip executes the method for processing a request as described in any one of claims 1 to 9.

20. A device for processing a request, characterized in that The device includes: a storage medium, a processing circuit, and a memory management unit MMU, wherein the storage medium is coupled to the processing circuit, and the storage medium is used to store computer program code, wherein the computer program code includes computer instructions, and when the computer instructions are executed by the processing circuit, the method for processing requests as described in any one of claims 1 to 9 is executed.

21. A computer storage medium, characterized in that The method comprises computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method for processing a request according to any one of claims 1 to 9.

22. A computer program product, characterized in that The invention comprises a computer program for implementing the method according to any one of claims 1 to 9 when the computer program is executed by one or more processors.

Images