Resource sharing method, terminal, and computer-readable medium

Abstract

The present disclosure provides a resource sharing method, including: associating a first kernel interface in a first container with a virtual interface in a second container, where processes in the first container communicate with each other via the first kernel interface; and controlling a process in the second container to call the virtual interface so that an application in the second container accesses a target process in the first container. The present disclosure further provides a terminal and a computer-readable medium.

Description

[Technical Field]

[0001] This application claims priority to Chinese patent application CN202111405213.9, entitled "RESOURCE SHARING METHOD, TERMINAL, AND COMPUTER-READABLE MEDIUM," filed on November 24, 2021, the entire contents of which are incorporated herein by reference.

[0002] The present disclosure relates to the field of computer technology, and features relate to a resource sharing method, a terminal, and a computer-readable medium. [Background technology]

[0003] An operating system is often designed to run in multiple containers, and the operating system and upper level applications can run independently in multiple containers. In order to save system memory and power consumption and improve system operation speed, multiple containers usually need to share some base services. Therefore, it is necessary to enable a container to access required services by penetrating other containers. However, currently, inter-container penetration is not very practical. Summary of the Invention [Problem to be solved by the invention]

[0004] Embodiments of the present disclosure provide a resource sharing method, a terminal, and a computer-readable medium. [Means for solving the problem]

[0005] In a first aspect, an embodiment of the present disclosure provides a resource sharing method including: associating a first kernel interface in a first container with a virtual interface in a second container, wherein processes in the first container communicate with each other via the first kernel interface; and controlling a process in the second container to invoke the virtual interface so that an application in the second container accesses a target process in the first container.

[0006] In a second aspect, an embodiment of the present disclosure provides a terminal comprising one or more processors, a memory storing one or more programs that, when executed by the one or more processors, cause the one or more processors to perform a resource sharing method in an embodiment of the present disclosure, and one or more I / O interfaces connected between the processors and the memory and configured to enable information interaction between the processors and the memory.

[0007] In a third aspect, an embodiment of the present disclosure provides a computer-readable medium having stored thereon a computer program that, when executed by a processor, performs a resource sharing method in an embodiment of the present disclosure. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a flowchart of a resource sharing method according to the present disclosure. [Figure 2] FIG. 2 is another flowchart of a resource sharing method according to the present disclosure. [Figure 3] FIG. 3 is another flowchart of a resource sharing method according to the present disclosure. [Figure 4] FIG. 4 is another flowchart of a resource sharing method according to the present disclosure. [Figure 5] FIG. 5 is a flowchart of some of the steps in a resource sharing method according to the present disclosure. [Figure 6] FIG. 6 is a flowchart of some of the steps in a resource sharing method according to the present disclosure. [Figure 7] FIG. 7 is another flowchart of a resource sharing method according to the present disclosure. [Figure 8] FIG. 8 is a configuration block diagram of a terminal according to the present disclosure. [Figure 9] FIG. 9 is a block diagram of a computer-readable medium according to the present disclosure. [Figure 10] FIG. 10 is a structural schematic diagram of an inter-container feedthrough according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0009] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the following detailed description of the resource sharing method, terminal and computer-readable medium of the present disclosure is provided in combination with the accompanying drawings.

[0010] Although exemplary embodiments are described more fully below with reference to the drawings, the exemplary embodiments may be embodied in different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0011] Each embodiment and each feature in each embodiment of the present disclosure can be combined with each other unless they are inconsistent.

[0012] For example, as used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0013] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the disclosure. For example, as used herein, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly dictates otherwise. Furthermore, it should be understood that the use of the terms "comprising" and / or "consisting of" herein specifies the presence of said features, wholes, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or groups thereof.

[0014] Unless otherwise limited, all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by those skilled in the art. It is also understood that terms as defined in commonly used dictionaries should be interpreted to have a meaning consistent with their meaning in the context of the relevant art and this disclosure, and should not be interpreted as having an idealized or overly formal meaning unless expressly so limited herein.

[0015] In a multi-container Android system, inter-container penetration is mainly achieved by the Android system's binder mechanism. Binder is a set of inter-process communication (IPC) frameworks provided by the Android system, used to send messages and share and synchronize memory between multiple processes. In a multi-container Android system, different containers share a binder service manager. An application process in one container can access a service process in the target container by obtaining the target container's ServiceManager, thereby achieving inter-container penetration through binder.

[0016] As a result of research, the inventors of the present disclosure have found that in a multi-container operating system, if the components in each container that allow application processes and service processes to communicate in the kernel are isolated from each other and cannot access each other, inter-container penetration cannot be achieved. For example, in some versions of the Android system kernel, the binder is designed as a file system, and the binder file systems of different containers are isolated from each other, and containers cannot access each other's ServiceManagers, so inter-container penetration cannot be achieved based on the above binder mechanism.

[0017] Some related technologies implement container interoperability in the Android system by deleting the binder file system, which allows multiple containers to share a ServiceManager and use the binder mechanism described above to achieve container interoperability. However, deleting the binder file system impacts compatibility with subsequent binder file system-related features. Furthermore, after deleting the binder file system, maintenance must be performed on the specific request messages of various service processes, which requires a deep understanding of the specific services, making development and maintenance more difficult.

[0018] In view of this, with reference to FIG. 1, an embodiment of the present disclosure provides a resource sharing method, which may include, but is not limited to, the following operations S1 to S2.

[0019] S1: Associate a first kernel interface in a first container with a virtual interface in a second container, where processes in the first container communicate with each other via the first kernel interface.

[0020] S2: Control a process in the second container to invoke the virtual interface so that an application in the second container accesses a target process in the first container.

[0021] In the embodiments of the present disclosure, the operating systems of the first container and the second container are not particularly limited, and in some embodiments, the operating systems of the first container and the second container may be the Android system.

[0022] In an embodiment of the present disclosure, any container includes a file system interface and a kernel interface associated with each other, where the file system interface is used by a process to access the kernel interface, and the kernel interface is used by different processes to communicate within the kernel. By accessing the kernel interface, a process can communicate with a service process in the kernel, thereby allowing an application to invoke a corresponding service.

[0023] In the embodiments of the present disclosure, "associating a first kernel interface in a first container with a virtual interface in a second container" means performing an associated operation that allows a process in the second container to access the first kernel interface in the first container by invoking the virtual interface.

[0024] In the embodiments of the present disclosure, there are no particular limitations on how to associate the first kernel interface in the first container with the virtual interface in the second container. For example, the virtual interface may be implemented as an object, and the first kernel interface may also be implemented as an object. "Associating the first kernel interface with the virtual interface" means associating an object called the virtual interface with an object called the first kernel interface, for example, by assigning the object called the first kernel interface to a member variable of the object called the virtual interface.

[0025] In embodiments of the present disclosure, kernel interfaces of different containers may be isolated from each other or may be shared with each other. For example, in a multi-container Android system, the Android system may include a binder file system, and the binder file systems of different containers are isolated from each other. The Android system may not include a binder file system, and the Service Managers of different containers may be shared with each other.

[0026] The embodiments of the present disclosure are not particularly limited in this regard.

[0027] In the embodiment of the present disclosure, the process may be an application process of any application in the operating system, or may be a service process in the operating system, although the embodiment of the present disclosure is not particularly limited in this respect.

[0028] In some embodiments, in operation S2, an application process in the second container communicates with a target process, a service process, in the first container by invoking a virtual interface, whereby an application corresponding to the application process in the second container invokes a service corresponding to the service process in the first container.

[0029] In an embodiment of the present disclosure, a virtual interface in a second container is associated with a first kernel interface in a first container, and a process in the second container invokes the virtual interface, thereby allowing the process in the second container to access the first kernel interface in the first container and further communicate with the process in the first container and invoke the corresponding service. This enables inter-container penetration regardless of whether different processes can share kernel communication components. Furthermore, while realizing container penetration, there is no need to maintain specific request messages for various processes, reducing development and maintenance difficulties and improving practicality. Furthermore, the embodiment of the present disclosure can achieve inter-container penetration without modifying the operating system structure of each container, thereby improving efficiency and helping to ensure the security of each container's operating system.

[0030] In an embodiment of the present disclosure, the virtual interface is an interface through which a process in the second container communicates with a process in the first container. The virtual interface may be an existing interface in the second container, such as a second file system interface in the second container, or may be a newly created interface in the second container. The embodiment of the present disclosure is not particularly limited in this respect.

[0031] Correspondingly, in some embodiments, referring to FIG. 2, before operation S1, the resource sharing method further includes the following operation S3:

[0032] S3: Create the virtual interface in the second container.

[0033] By creating a new virtual interface in the second container, the second file system interface in the second container can be left intact, thereby avoiding impact on functions based on the second file system interface and ensuring compatibility.

[0034] In some embodiments, referring to FIG. 3, operation S1 includes, but is not limited to, operation S11.

[0035] S11: Assign the first kernel interface to the virtual interface.

[0036] For example, the first kernel interface is an object, and the virtual interface is also an object, and "assigning the first kernel interface to the virtual interface" means assigning the object called the first kernel interface to a member variable of the object called the virtual interface.

[0037] In some embodiments, the resource sharing method further includes obtaining the first kernel interface.

[0038] The embodiments of the present disclosure do not particularly limit how the first kernel interface is obtained. In some embodiments, the first kernel interface can be directly extracted in the first container. In some embodiments, the first kernel interface is obtained based on an association relationship between the first file system interface in the first container and the first kernel.

[0039] Correspondingly, in some embodiments, referring to FIG. 4, before operation S1, the resource sharing method further includes the following operation S4.

[0040] S4: Obtain the first kernel interface based on an association relationship between a first file system interface in a first container and the first kernel interface, where a process in the first container accesses the first kernel interface through the first file system interface.

[0041] The embodiments of the present disclosure do not particularly limit the representation format of the association relationship between the first file system interface and the first kernel interface. In some embodiments, the association relationship between the first file system interface and the first kernel interface is characterized using a target pointer from the first file system interface to the first kernel interface.

[0042] Correspondingly, in some embodiments, with reference to FIG. 5, operation S4 includes, but is not limited to, the following operations S41 to S42.

[0043] S41: Obtain a target pointer from the first file system interface to the first kernel interface, where the target pointer characterizes an association relationship between the first file system interface and the first kernel interface.

[0044] S42: Obtain the first kernel interface based on the target pointer.

[0045] In some embodiments, when the first container is launched, during the establishment of the first file system interface and the first kernel interface, an association relationship between the first file system interface and the first kernel interface is recorded.

[0046] Correspondingly, in some embodiments, referring to FIG. 6, before operation S4, the resource sharing method further includes the following operations S51 to S53.

[0047] S51: In response to the activation of the first container, the first file system interface is created.

[0048] S52: The first kernel interface is created.

[0049] S53: Associate the first file system interface with the first kernel interface to determine an association relationship between the first file system interface and the first kernel interface.

[0050] In some embodiments, referring to FIG. 7, operation S2 includes the following operation S21:

[0051] S21: Modify an application in the second container that accesses a second file system interface in the second container to access the virtual interface, where a process in the second container accesses a second kernel interface in the second container through the second file system interface.

[0052] In some embodiments, the first kernel interface and the second kernel interface are isolated from each other.

[0053] In a second aspect, referring to FIG. 8, an embodiment of the present disclosure provides a terminal comprising one or more processors 101 and a memory 102 storing one or more programs that, when executed by the one or more processors 101, cause the one or more processors 101 to implement any one of the resource sharing methods described above.

[0054] In addition, a terminal according to an embodiment of the present disclosure may further include one or more I / O interfaces 103 connected between the processor and the memory and configured to enable information interaction between the processor 101 and the memory 102.

[0055] The processor 101 is a device having data processing capabilities, and includes, but is not limited to, a central processing unit (CPU). The memory 102 is a device having data storage capabilities, and includes, but is not limited to, a random access memory (RAM, more specifically, SDRAM, DDR, etc.), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory (FLASH), etc. The I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102 and enables information interaction between the processor 101 and the memory 102, and includes, but is not limited to, a data bus.

[0056] In some embodiments, the processor 101, memory 102, and I / O interface 103 are connected to each other and to other components of the computing device via a bus 104.

[0057] In a third aspect, with reference to FIG. 9, an embodiment of the present disclosure provides a computer-readable medium having stored thereon a computer program that, when executed by a processor, implements any one of the resource sharing methods described above.

[0058] In order to enable those skilled in the art to understand the technical solutions according to the embodiments of the present disclosure more clearly, the following detailed description will be given using specific examples to describe the technical solutions according to the embodiments of the present disclosure in detail.

[0059] Example 1 In this embodiment, the first container and the second container are started sequentially, and the operating systems of the first container and the second container may be any operating systems. Note that in this embodiment, "the first container and the second container are started sequentially" is merely an illustrative example, and in a specific implementation, the start-up order of the first container and the second container is not particularly limited.

[0060] When the first container starts, it creates a first file system interface, which is an interface for internal inter-process communication access of the first container.

[0061] When the first container is started, it creates a first kernel interface, which is a driving member for realizing inter-kernel process communication, i.e., the inter-process communication function of the operating system is realized in this member.

[0062] Associating a first file system interface in a first container with a first kernel interface in the first container. "Associating a first file system interface with a first kernel interface" means associating an object called the first file system interface with an object called the first kernel interface, for example, assigning the object called the first kernel interface to a member variable in an object structure called the first file system interface. After the association, processes in the first container can communicate with each other. For example, a camera application in the first container can access a camera service in the first container by calling the first file system interface.

[0063] When the second container starts, it generates a virtual interface, which is an external interface for realizing inter-process communication between the processes in the second container and the processes in the first container.

[0064] Associate the virtual interface of the second container with the first kernel interface of the first container. "Associating the virtual interface with the first kernel interface" means associating the object called the virtual interface with the object called the first kernel interface, for example, assigning the object called the first kernel interface to a member variable in the structure of the object called the virtual interface.

[0065] An application in the second container can directly access the corresponding service of the first container by calling the virtual interface, for example, a camera application in the second container can directly access the camera service of the first container by calling the virtual interface.

[0066] In the following examples 2 and 3, a terminal dual-container Android system is used as an example. The working container is the first container in the embodiment of the present disclosure, and the living container is the second container in the embodiment of the present disclosure. The binder file system node is the file system interface in the embodiment of the present disclosure, the binder entity device node is the kernel interface in the embodiment of the present disclosure, and the virtual binder file system node is the virtual interface in the embodiment of the present disclosure.

[0067] Note that the following Examples 2 and 3 are explanations of some specific application scenarios in the embodiments of the present disclosure, and are intended to explain the embodiments of the present disclosure, but are not intended to limit the embodiments of the present disclosure.

[0068] Example 2 When the working container starts, it creates a first binder file system and records a pointer to a first binder entity device node of a first binder file system node under the first binder file system.

[0069] When the life container starts, it creates a second binder file system, creates a new virtual binder file system node named "binder_home_to_work", and assigns a pointer to the first binder entity device node of the first binder file system node under the first binder file system to the virtual binder file system node.

[0070] If an application in the live container needs to access a service in the work container, the second binder file system node "open / dev / binderfs / hwbinder" that the application process in the live container was accessing is modified to the virtual binder file system node "open / dev / binderfs / binder_home_to_work".

[0071] In this embodiment, even if a binder file system exists in the Android system and the binder is completely isolated, binder penetration can be achieved. When realizing binder penetration, there is no need to understand the specific detailed flow of the service business; it is only necessary to modify the calling interface, which improves convenience and security and ensures system compatibility.

[0072] Example 3 10 is a structural schematic diagram of the inter-container passage in the embodiment of the present disclosure. In this embodiment, the working container 201 and the living container 202 can be activated sequentially.

[0073] When the working container 201 starts up, it creates a first binder file system node labeled " / dev / binderfs / hwbinder", which is the interface for the working container 201's internal inter-process communication access.

[0074] The working container 201 creates a first binder entity device node named "hwbinder_node", which is the driving element for realizing process communication in the kernel, i.e., all inter-process communication functions of the operating system are realized within this element.

[0075] A first binder file system node / dev / binderfs / hwbinder in the working container 201 is associated with a first binder entity device node hwbinder_node in the working container 201. Here, "associating the first binder file system node with the first binder entity device node" means associating an object called the first binder file system node with an object called the first binder entity device node; for example, assigning the object called the first binder entity device node hwbinder_node to a member variable in the structure of the object called the first binder file system node / dev / binderfs / hwbinder. After the association, processes within the working container 201 can communicate between processes; for example, a camera application in the working container 201 can access the service camera provider in the working container 201 by calling the first binder file system node / dev / binderfs / hwbinder.

[0076] When the live container 202 starts up, it creates a virtual binder file system node called " / dev / binderfs / hwbinder_home_to_work", which is an external interface that allows inter-process communication between processes in the live container 202 and processes in the work container 201.

[0077] The virtual binder file system node / dev / binderfs / hwbinder_home_to_work of the life container 202 is associated with the first binder entity device node hwbinder_node in the work container 201. Here, "associating the virtual binder file system node with the first binder entity device node" means associating an object called the virtual binder file system node with an object called the first binder entity device node, and for example, assigning the object called the first binder entity device node hwbinder_node to a member variable in the structure of the object called the virtual binder file system node / dev / binderfs / hwbinder_home_to_work.

[0078] A camera application (or any other suitable application) in the live container 202 can directly access the corresponding service (e.g., the camera provider service) in the work container 201 by calling open / dev / binderfs / hwbinder_home_to_work.

[0079] Those skilled in the art will understand that all or some of the steps of the methods, systems, and functional modules / units of the apparatuses disclosed above can be implemented as software, firmware, hardware, or any suitable combination thereof. In hardware embodiments, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components. For example, one physical component may have multiple functions, or one function or step may be performed cooperatively by several physical components. Some or all of the physical components may be implemented as software executed by a processor, such as a central processor, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as a dedicated integrated circuit. Such software may be located on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and that can be accessed by a computer. Additionally, those skilled in the art will know that communication media generally include computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and can include any information delivery media.

[0080] Although exemplary embodiments are disclosed herein and specific terms are employed, they are used in a general, illustrative sense only and should be construed in that sense only and not for purposes of limitation. It will be apparent to those skilled in the art that, in some instances, features, characteristics, and / or elements described in connection with particular embodiments may be used alone or in combination with features, characteristics, and / or elements described in connection with other embodiments, unless otherwise specified. Accordingly, those skilled in the art will recognize that various changes in form and detail may be made without departing from the scope of the present disclosure, as set forth in the appended claims.

Claims

1. associating a first kernel interface in a first container with a virtual interface in a second container, wherein processes in the first container communicate with each other via the first kernel interface; enabling an application in the second container to access the first kernel interface by invoking the virtual interface, and controlling a process in the second container to invoke the virtual interface to access the first kernel interface for communicating with a target process in the first container; A resource sharing method applied to computers.

2. Before associating the first kernel interface in the first container with the virtual interface in the second container, the resource sharing method includes: creating the virtual interface in the second container; The resource sharing method of claim 1 .

3. The step of associating the first kernel interface in the first container with the virtual interface in the second container includes: assigning the first kernel interface to the virtual interface; The resource sharing method of claim 1 .

4. Before associating the first kernel interface in the first container with the virtual interface in the second container, the resource sharing method includes: and further comprising obtaining the first kernel interface based on an association relationship between a first file system interface and the first kernel interface in the first container, wherein a process in the first container accesses the first kernel interface through the first file system interface. The resource sharing method of claim 1 .

5. The step of obtaining the first kernel interface based on an association relationship between a first file system interface in the first container and the first kernel interface includes: obtaining a target pointer from the first file system interface to the first kernel interface, the target pointer characterizing an association relationship between the first file system interface and the first kernel interface; obtaining the first kernel interface based on the target pointer; The resource sharing method according to claim 4 .

6. Before the step of obtaining the first kernel interface based on an association relationship between a first file system interface in the first container and the first kernel interface, the resource sharing method includes: creating the first file system interface in response to launching the first container; creating the first kernel interface; and associating the first file system interface with the first kernel interface to determine an association relationship between the first file system interface and the first kernel interface. The resource sharing method according to claim 4 .

7. The step of controlling a process in the second container to invoke the virtual interface includes: modifying an application in the second container that accesses a second file system interface in the second container to access the virtual interface, so that a process in the second container accesses a second kernel interface in the second container via the second file system interface; The resource sharing method of claim 1 .

8. the first kernel interface and the second kernel interface are isolated from each other; The resource sharing method according to claim 7 .

9. one or more processors; a memory storing one or more programs that, when executed by the one or more processors, cause the one or more processors to implement the resource sharing method according to any one of claims 1 to 8; Terminal.

10. A computer-readable medium having stored thereon a computer program which, when executed by a processor, implements the resource sharing method according to any one of claims 1 to 8.

Images