CN105589659B

CN105589659B - Data processing system with multiple subsystems and method

Info

Publication number: CN105589659B
Application number: CN201410645117.5A
Authority: CN
Inventors: 钟巨航
Original assignee: Individual
Current assignee: Individual
Priority date: 2014-11-07
Filing date: 2014-11-07
Publication date: 2021-10-12
Anticipated expiration: 2034-11-07
Also published as: CN105589659A

Abstract

A data processing system and its virtual method, is used for providing a plurality of physical or virtual sub data processing systems under the same data processing system interface, each sub data processing system is used for finishing different applications; different sub data processing systems are mutually and safely isolated so as to meet different requirements of applications with different requirements on safety; by arranging a plurality of RAM memories, the switching between the subsystems, particularly the virtual subsystems, has better performance and compatibility.

Description

Data processing system with multiple subsystems and method

The present invention is a continuation of the previous application (No. 200510132889X, title: data processing system and method with multiple subsystems, hereinafter referred to as previous invention) of the inventor, and this specification will include the complete description of the previous application and the improvements of the present invention in order to better describe the present invention. In addition, all the technical features of the invention are included in the specification, and can be cited as the modification of the claims of the invention.

Technical Field

The invention relates to a data processing system and a safety technology, which integrates a plurality of physical or virtual sub data processing systems under the same data processing system interface, so that the data processing system (such as a computer system) can meet different safety requirements of users on different tasks and avoid mutual transmission of potential safety hazards among different tasks. Particularly, the invention improves and balances the switching efficiency and compatibility of the multiple subsystems (relating to the safety of a data processing system, a multiple sub-data processing system, the switching of the multiple subsystems, particularly the switching among the multiple virtual subsystems), so that the safety requirements of users on the data processing system can be better met in a larger range.

While providing protection and verification methods for Firmware (BIOS) that may affect the security of a data processing system.

Background

With the continuous development of information technology, more and more work can be performed through data processing systems (such as computer systems) and networks, which undoubtedly greatly speeds up efficiency and facilitates users.

However, as the definition of data processing system, the most important consideration for the beginning of the data processing is the processing of data (for example, the name of computer comes from its fast computing power), and the security factor is not considered, so that the security problem of data processing system is increasingly prominent, especially in the fields of electronic transaction, information confidentiality, personal privacy and the like, the loss caused by security is increasingly large, and the occurrence of such "disaster" is easier and the globalization trend is more obvious.

In addition to the potential safety hazard of the data processing system, the use habits and requirements of the user are one of the reasons for the safety problem, and many times, the user accesses an unsafe website to cause a security vulnerability, so that important account numbers and passwords of the user are revealed to cause economic loss, which is common.

In other words, users have multiple requirements, and the security requirements are different between the various requirements, such as: the security requirements for daily news and entertainment are low, while the security requirements for electronic transactions are high, and when the two tasks are located in the same data processing system, the 'vulnerability' can be transmitted from the task with low security requirements to the task with high security requirements.

Of course, existing data processing systems consider this, such as Microsoft's browser (Internet Explorer), which divides security into high, medium, and low levels to control different usage environments, but this does not fundamentally solve the problem because: IE itself has many loopholes and has a continuous trend; 2, the Windows operating system has many bugs; 3. the technical requirements for the user are too high. It is because of these factors that people find networks increasingly insecure.

Another possible solution to this problem is to provide a separate data processing system for each application. Obviously, the cost is too high, the efficiency is too low, and the wide practical value is not achieved.

Meanwhile, although the damage to the BIOS is limited to CIH virus, CIH only damages the BIOS system, and BIOS system propagation is not utilized, but the virus cannot be propagated by the BIOS, actually, most of the BIOS systems of the main board, the display card, the SCSI card, the network card, and the like do not have write protection by default and all have an opportunity to obtain a system control right due to the fact that a large amount of FLASH memories are used, so that the possibility that malicious programs can be propagated through the BIOS and damage the data processing system is theoretically provided, and the damage threatens to be larger than that of the existing virus.

Even though css (core System software) BIOS or efi (extensible Firmware interface) BIOS appears later, the same security problem still exists, and in addition, because the most basic BIOS System is required to load the BIOS, the insecurity link is increased.

In order to solve the above problems, the applicant filed the following application: 200510132889X provides a virtual method of a data processing system and a data processing system, which can provide a plurality of physical or virtual sub data processing systems under the same data processing system interface for completing different tasks, each sub system can be switched like television 'channel', and different sub data processing systems can be safely isolated and not mutually influenced; to ensure the basic security of a data processing system, a new method of write protection and verification of a basic input/output system (BIOS) is also provided.

In addition, the invention also provides a switching device for virtualizing the data processing system and a mainboard device for the data processing system with a plurality of subsystems.

Although the prior invention technically solves the security problem of a data processing system, the prior invention has the following two aspects that may have applicability problems:

a. compatibility with legacy systems. The virtual sub-data processing system of the previous invention needs to save the current state of the sub-data processing system at the time of switching, which needs to be improved for old systems and applications which do not have this function, especially for general purpose platforms such as windows xp for which microsoft has stopped providing updates, which means that windows xp is likely not (directly) available for the virtual sub-data processing system of the previous invention (unless microsoft modified for it as previously invented, which is not very likely from the practical point of view)

b. Efficiency. With the memory of the data processing system becoming larger and larger, the smart phone has already reached the level of 3G (3000M) memory, and in an extreme case, when the virtual sub-data processing system is switched, the virtual sub-data processing system may need to store 3G data, and even if the fastest external storage (electronic storage) is used, the virtual sub-data processing system also needs about 6 seconds, and the traditional mechanical storage is used, and more than 30 seconds are needed, so the switching is not good for user experience. (of course, this is only an extreme case, under normal circumstances, the 3G memory is mostly unused, or used as a cache without storage, and in addition, data compression can be used, the stored data is not much, and can be completed in 1-2 seconds under most circumstances)

In addition, the memory usage requirements of different virtual sub-data processing systems are different, most applications, especially those related to security, are single applications, do not need too much memory, and only a general platform, such as windows, IOS or android, has a relatively large memory requirement.

The invention content is as follows:

in order to solve the above problems, the present invention provides a new data processing system and a virtual method thereof, which can not only provide a plurality of physical or virtual sub data processing systems under the same data processing system interface for completing different tasks, each subsystem can be switched as a television 'channel', and different sub data processing systems can be safely isolated from each other without mutual influence; and according to the characteristics of the application or platform (operating system) of the subsystem, especially the amount of information (memory), the requirement for response time/speed, and the frequency of switching between subsystems, an independent memory (RAM) or a shared memory is prepared for the subsystem and how to share the subsystem. Therefore, the compatibility and the switching speed of the virtual sub data processing system can be greatly improved.

To ensure the basic security of a data processing system, a new method of write protection and verification of a basic input/output system (BIOS) is also provided.

The technical scheme is as follows:

the technical scheme of the invention is as follows:

a virtualization method for a data processing system for virtualizing the data processing system into a plurality of sub-data processing systems, the method comprising:

the multiple virtual sub-data processing systems have respective operating systems or application systems, and the operating systems or the application systems may be the same or different;

the multiple virtual sub data processing systems multiplex the original data processing system resources in a time-sharing manner;

at any time, at most one virtual sub-data processing system in a plurality of virtual sub-data processing systems sharing the same processor unit can be in a running state, and the virtual sub-data processing system in the running state is a current 'real' data processing system based on the processor unit in eyes of a user; the processor unit may include one CPU or a group of multiple CPUs, and each CPU may be single-core or multi-core.

The user selects the currently running virtual sub data processing system through the switching device;

the virtualization method of the data processing system further comprises a method for securely isolating the external memory of the different virtual sub-data processing systems, and the isolation method may be any one or more or any combination of the following methods:

A. setting a plurality of physically independent external memories to enable different virtual sub-data processing systems to use different physical external memories;

B. virtually partitioning the storage space of a single external memory so that different virtual sub-data processing systems use different virtual sub-memories of the external memory;

C. a method for performing read/write protection on the external memory storage space of the non-working state virtual sub data processing system; for example, the method may be used in the case where the virtual sub-data processing system shares different partitions of the same external memory;

D. a method for disabling the external memory not required by the virtual sub-data processing system in an operating state;

E. a method for performing read/write protection on the external memory storage space which is not needed by the virtual sub-data processing system in the working state;

F. other possible methods;

by isolating the storage spaces of the external memory from each other, the mutual transmission of possible unsafe factors among different virtual sub-data processing systems can be effectively controlled.

The plurality of virtual sub data processing systems can be switched Online (Online) or Offline (Offline); generally, Online (Online) switching generally refers to switching without powering off (or without turning off the power supply), while Offline (Offline) switching refers to switching with powering off (or turning off the power supply);

a method of on-line (Online) switching between a plurality of virtual sub-data processing systems sharing a same processor unit, comprising the steps of:

A. the user sends a switching request of the virtual sub data processing system to the switching device;

B. the switching device sends a system switching-out signal to the current virtual subdata processing system;

C. the current virtual subdata processing system stores the relevant work site;

D. the switching device sets the resources needed by the new virtual subdata processing system and sends a system cut-in signal;

E. the new virtual sub data processing system obtains the control right, restores the original saved work site or restarts or starts according to the mode appointed by the user, the restarting mainly aims at the first cut-in of the system or other conditions without the original saved work site, and the mode appointed by the user is the establishment mode that the user specially appoints the work state after switching;

a method of saving/restoring a job site, comprising:

the method for saving the working site comprises the following steps:

A. the operating system sends a 'save job site' notice to all the tasks currently running;

B. the task running at present cleans up the working space and resources of the task;

C. the operating system cleans the working space and resources of the operating system;

D. saving the most basic system information required by the current working environment;

E. saving the state of all the devices used by the equipment;

the method for restoring the work site comprises the following steps:

A. loading the states of all the used equipment stored in the job site to be restored, and setting the states of the relevant equipment according to the states;

B. loading all the most basic system information which is stored in a work site to be restored and can be used for reconstructing the current work environment, and reconstructing the current work environment;

C. the operating system recovers the working space and resources of the operating system;

D. the operating system sends a 'recovery working site' notice to all the tasks currently running;

the task running at present recovers the working space and resources of the task;

the method for off-line (Offline) switching between the virtual sub-data processing systems comprises the following steps:

A. shutting down the data processing system;

B. the switching device switches to the new virtual subdata processing system hardware;

C. restarting the data processing system;

the virtualization method of any data processing system is characterized by further comprising a method for establishing the working state of the virtual sub-data processing system, where the method for establishing the working state of the virtual sub-data processing system may be any one or more of the following methods:

A. resume (Resume), which refers to a Resume from any of the previously saved worksites, also means that the virtual sub-data processing system can save a worksite at any time;

B. reboot (Reboot/Restart), which means to Restart the virtual sub-data processing system;

C. original Reset (Original Reset), resetting the virtual sub data processing system to the most Original installation state and starting;

D. Install/Reinstall (Install/Reinstall), installing or reinstalling and starting the virtual sub-data processing system;

the establishment of the working state can be performed under the condition that the current virtual sub-data processing system obtains the control right, or can be specified by a user when the virtual sub-data processing system is switched, wherein the specification is specific to the switched-in virtual sub-data processing system.

A data processing system is characterized by at least comprising two or more sub data processing systems;

the processor units of the plurality of sub data processing systems are physically positioned in the same case;

any of the sub data processing systems may have a physically independent processor unit, or may be a virtual sub data processing system sharing a processor unit;

the processor unit may include one CPU or a group of multiple CPUs, and each CPU may be single-core or multi-core.

All or part of the plurality of sub data processing systems share at least one display device or at least one input device;

the data processing system is characterized by further comprising a switching device (600) for selecting the sub data processing system currently used or operated by the user;

the switching may be off-line (Offline) switching under the condition of power-off (or power-off), or on-line (Online) switching under the condition of not power-off (or power-off);

by the device, the sub data processing system can share input/output equipment such as display equipment, a keyboard, a mouse and the like to the maximum extent, and can enable a user to carry out related operations under relatively consistent operating environments, so that the cost is saved, and the operation is simplified.

The data processing system is characterized in that the external memories fixed by the different sub data processing systems and used for system boot are different external memories or different sub memories formed by virtual separation of the same external memory; the "external memory fixed for system boot" refers to a non-temporary external memory for booting under a normal working behavior, which is relatively fixed for a period of time, and is generally a hard disk or an electronic disk.

The data processing system of the invention is characterized in that, for the Firmware (Firmware) device which is reprogrammable by the sub-data processing system and can obtain the execution opportunity of the sub-data processing system processor unit, the device can be write-protected or partially write-protected, or the Firmware (Firmware) content can be verified by non-falsification. The Firmware is usually found in the Basic Input Output System (BIOS) or other set of service programs located between the hardware and the operating system for operating the hardware.

A selection switch apparatus (601) for supporting virtualization of a data processing system, comprising:

a control input interface (701) for receiving a selection signal from a user, the interface having properties similar to a channel interface of a television set and relatively single selection content, so that the interface may be mechanical, electronic, wired, wireless, encoded or direct;

a control unit (700) for controlling the switching of the different virtual sub-data processing systems according to a user's selection signal, which unit can be implemented with logic circuits, micro-controllers or discrete components/integrated circuits due to its relatively simple function;

a host interface (703) for communicating with a data processing system host, since the control unit (700) has very little communication with the host and is simple, such as: the system is switched out, the system is switched out completely, and the system is switched in, so that the interface can be any general or special interface, such as ISA, PCI, USB, RS232, parallel port, 1394 interface, I2C and other various special or general interfaces;

a control output interface (702), which is used to provide the selection signal required by other devices in the process of switching the virtual sub-data processing system, such as the selection switching signal of multiple hard disks, the signal is generated by the control unit according to the selection signal of the user, and can be mechanical, electronic, wired, wireless, coded signal, or direct selection signal;

the control unit (700) is connected with the control input interface (701), the control output interface (702) and the host interface (703);

the control input interface (701), the control output interface (702) and the host interface (703) can partially or completely multiplex the same interface bus, and can also respectively use different interfaces, for example, an I2C bus widely used in household appliances can be suitable for the same;

the selection switch device (601) can be integrated on a mainboard, thereby forming a mainboard supporting virtual functions, and the data processing system constructed by the mainboard supporting virtual functions can be virtualized into a plurality of sub data processing systems.

A multi-unit motherboard, comprising at least two or more physically-meaningful daughter motherboard units, each daughter motherboard unit being capable of being used to construct a physical data processing system host, each daughter motherboard unit being a normal motherboard or a motherboard with virtual functions, the multi-unit motherboard being used to construct a data processing system with multiple subsystems, the multi-unit motherboard further comprising a selection device (602), the selection device being configured to support subsystem selection and switching, the selection device (602) comprising:

a control input interface (711) for receiving a selection signal from a user, the interface being either mechanical, electronic, wired, wireless, encoded, or direct;

a shared interface switching unit (710) for selectively switching one or more interfaces sharing the same device or interface according to a selection signal of a user, wherein the interface to be selectively switched may be an interface provided on a motherboard or an interface expanded by an expansion card, and the interface may be any kind of wired or wireless interface because the selective switching is based on the selection and switching of a physical signal channel;

the shared interface switching unit at least has one shared display output interface or at least has one shared input equipment interface;

the multi-unit mainboard is characterized by further comprising a control output interface (712) for providing a selection signal required by other sub-mainboard units or equipment in the subsystem switching process, for example, for a mainboard with a virtual function, which needs the selection signal; the interface can be mechanical, electronic, wired, wireless, coded or direct selection signal;

the control output interface (712) and the control input interface (711) can multiplex the same interface bus, and can also respectively use different interfaces;

the interface switched by the shared interface switching unit (710) can be set and adjusted by a user, that is, the user can decide which interfaces can not be selected to be switched (i.e. not shared), and the setting can be performed by a BIOS or a jumper switch.

A security control method of a basic input/output system (BIOS), comprising a method of write protection, characterized in that the method of write protection comprises the following:

A. dividing the space of the BIOS into functions;

B. setting write protection devices for the divided functional intervals respectively;

the write-protection means must be set locally by the user or must be set with authorization by the user

Generally, the BIOS may be divided into a plurality of spaces, for example, the current motherboard BIOS may include a program area and an ESCD data area, the program area includes a BOOT (8K or 16K) area and other programs, the current write protection switch for the BIOS is dedicated to the entire BIOS, once the write protection switch is turned on, the ESCD area cannot be read or written, and even the type of the computer and the BIOS chip cannot be determined, such write protection comes at the expense of the performance of the computer.

The write protection function (e.g. write protection to the BOOT area) in the BIOS chip is controlled by the computer chipset, in other words, the protection is only to prevent interference signals or malfunctions, not to prevent viruses.

The method of the present invention can solve the problem by providing separate protection switches for the different zones. These write-protection switches must be set by user authorization;

a safety control method of a basic input/output system (BIOS) comprises a write protection method and is characterized by also comprising a method for checking information in the BIOS;

the verification method comprises the following steps:

A. setting a BIOS information check access interface;

B. selecting a check interval;

C. checking the selection interval through a checking interface;

D. comparing the check result with the safe or clean BIOS of the same version;

any algorithm, such as various algorithms of CRC8/16/32/64, MD5, SHA256/384/512, etc., can be used for checking, and even all contents can be completely read and directly compared.

The method for verifying the information in the BIOS is carried out under the condition that the BIOS is not loaded; therefore, the malicious program in the infected BIOS can be prevented from controlling the computer and influencing the normal operation of the verification. If the verification is carried out under the condition that the BIOS is loaded, the virus in the BIOS can restore the content in the BIOS after the BIOS is loaded, and the virus is infected again before the BIOS is shut down, so that the verification result has no meaning.

On the basis of the previous invention, the invention is improved as follows:

setting two or more RAM memories and corresponding the RAM memories to the virtual sub-data processing system; the correspondence is used by the subsystem, and when the subsystem is in a running state, the RAM memory is the memory thereof (a classic data processing system structure: input device, output device, memory, controller, and arithmetic unit), namely the "memory" in common usage.

At least one of said RAM memories is present corresponding to only one of said virtual sub-data processing systems.

At least one RAM memory is present corresponding to two or more of the virtual sub-data processing systems.

The currently running virtual sub data processing system can only access the RAM memory corresponding to the currently running virtual sub data processing system.

If the RAM memory corresponding to the switched-out virtual sub-data processing system is different from the RAM memory corresponding to the switched-in virtual sub-data processing system, the contents of the RAM memory remain unchanged during the switching-out period, that is, the RAM memory is substantially the same as or equivalent to or substantially mostly the same as or equivalent to the RAM state of the last operating state of the virtual sub-data processing system, and some switching states, such as the state of the device, may be added.

The method of the present invention is characterized in that the switching is Online (Online) switching.

The method of the present invention is characterized in that the switching among the plurality of sub data processing systems uses a switching mode among a plurality of channels of a television.

The method of the present invention is characterized in that the number of the sub data processing systems is at least 3.

The method of the present invention is characterized in that the plurality of sub data processing systems are mutually and safely isolated.

The method of the invention is characterized in that the security isolation refers to performing write protection or partial write protection on a Firmware (Firmware) device which can be reprogrammed and can obtain the execution opportunity of a processor unit of the sub data processing system, or performing non-tampering verification on the content of the Firmware (Firmware);

the write protection must be set locally by the user or must be authorized by the user to be set.

The method of the present invention is characterized in that the security isolation refers to the security isolation of the external memories of different sub data processing systems.

The method of the invention is characterized in that the safety isolation is one or more of the following methods:

F. setting a plurality of physically independent external memories to make different sub data processing systems use different physical external memories;

G. virtually partitioning the storage space of a single external memory so that different sub data processing systems use different virtual sub memories of the external memory;

H. reading or writing protection is carried out on the storage space of an external memory of the sub data processing system in the non-working state;

I. disabling external memory not required for the sub-data processing system in an active state;

J. read or write protection is performed on external memory storage space not needed by the sub-data processing system in an operating state.

The method of the present invention is characterized in that the Online (Online) switching comprises the following steps:

A. the user sends a switching request of the sub data processing system to the switching device;

B. the switching device sends a system switching-out signal to the current sub-data processing system;

C. the current subdata processing system saves the working site;

D. the switching device sets the resources needed by the new sub data processing system and sends a system cut-in signal;

E. the new sub-data processing system gains control and restores its original stored job site.

The method for on-line switching is characterized in that the step E is as follows: the new sub-data processing system gains control and starts up (boot) or restart (reboot) or reset (reset) or in a user-specified manner.

The method of the invention is characterized in that the on-line (Online) switching comprises the steps of saving the switched-out sub data processing system on a working site and restoring the switched-in sub data processing system on the working site.

The method of the present invention is characterized in that the data processing system is a computer system.

The method of the invention is characterized in that the data processing system is a tablet computer.

The method of the invention is characterized in that the data processing system is a smart phone.

The method is characterized in that the data processing system is an intelligent television or a projector.

The method according to the invention is characterized in that the data processing system is any apparatus comprising a data processing system with a display device.

A data processing system comprising a processor unit configured to construct two or more sub-data processing systems sharing the processor unit, the data processing system further comprising:

the selection switching device (600) is used for selecting the sub data processing system currently used or operated by a user, and the selection state of the selection switching device corresponds to the sub data processing system;

two or more RAM memories corresponding to at least one of the sub-data processing systems, the RAM memories:

at least one of said RAM memories corresponding to only one of said sub-data processing systems or at least one of said RAM memories corresponding to a plurality of said sub-data processing systems;

the plurality of sub-data processing systems share, in whole or in part, at least one display device or at least one input device.

The handover is an online handover. The selection switching device supports online switching.

The data processing system of the invention is characterized in that, for the Firmware (Firmware) device which is reprogrammable and can obtain the execution opportunity of the sub-data processing system processor unit, the device is write-protected or partially write-protected, or the Firmware (Firmware) content is verified by non-falsification.

The data processing system of the present invention is characterized in that the different sub data processing systems use different external memories or different virtual sub memories of the same external memory.

The subsystem or sub-data processing system described in this invention can be a virtual sub-data processing system using the method of this invention or the previous invention, or a virtual sub-data processing system using other methods, or a non-virtual sub-data processing system having physically independent processor units.

In the data processing system of the present invention, the currently running (virtual) sub data processing system can only access the corresponding RAM memory.

In the data processing system of the present invention, if the RAM memory corresponding to the switched-out (virtual) sub-data processing system is different from the RAM memory corresponding to the switched-in (virtual) sub-data processing system, the contents of the RAM memory remain unchanged during the switching-out (i.e. the RAM memory is substantially the same as or equivalent to or substantially mostly the same as or equivalent to the RAM memory state of the (virtual) sub-data processing system in the last operating state, and some switching states, such as the state of the CPU or the device, may be added)

A data processing system comprising at least two or more sub-data processing systems and a selection switch means (600);

the selection switching device (600) is used for selecting the currently used or operated sub data processing system by a user;

the data processing system at least comprises 1 set of physically independent processor unit, and is used for forming a plurality of virtually divided sub data processing systems by the method.

The system of the present invention is characterized in that the data processing system comprises 2 sets of physically independent processor units.

The system of the invention is characterized in that the switching device (600) is a switching device (601) comprising:

a control input interface (701) for accepting a selection signal from a user;

a control unit (700) for controlling the switching of different sub data processing systems according to the selection signal of the user;

a host interface (703) for communicating with a data processing system host;

a control output interface (702) for providing selection signals required by other devices in the switching process of the sub data processing system;

the control unit (700) is connected with the control input interface (701), the control output interface (702) and the host interface (703).

The system of the invention is characterized in that the switching device (600) is a switching device (602) comprising:

a control input interface (711) for receiving a selection signal from a user;

a shared interface switching unit (710) for selectively switching one or more interfaces sharing the same device or interface according to a selection signal of a user;

the shared interface switching unit at least has one shared display output interface or at least has one shared input device interface.

The system of the invention is characterized in that the switching device (602) further comprises a control output interface (712) for providing a selection signal required by other equipment during subsystem switching.

The system of the invention is characterized in that the switching between subsystems using different processor units is an Online (Online) switching

The system of the present invention is characterized in that the processor units of the switching device and the sub data processing system are physically located on the same motherboard.

The system of the present invention is characterized in that the data processing system is a computer system.

The system of the invention is characterized in that the data processing system is a tablet computer.

The system of the invention is characterized in that the data processing system is a smart phone.

The system is characterized in that the data processing system is an intelligent television or a projector.

The system according to the invention is characterized in that the data processing system is any apparatus comprising a data processing system with a display device.

a control input interface (701) for receiving a selection signal from a user, the interface being mechanical or electronic, wired or wireless; the selection signal of the user is a coding signal or a direct selection signal;

a control unit (700) for controlling the switching of different virtual sub-data processing systems according to the selection signal of the user;

a host interface (703) for communicating with a data processing system host, the interface being any general purpose or special purpose interface;

a control output interface (702) for providing the selection signal required by other devices in the switching process of the virtual sub-data processing system, the interface is mechanical or electronic, wired or wireless, and the output selection signal is an encoding signal or a direct selection signal;

the control input interface (701), the control output interface (702) and the host interface (703) partially or completely multiplex the same interface bus or respectively use different interfaces;

it is characterized by also comprising: a RAM memory control interface for controlling switching of operating states of at least two or more RAM memories, each of the RAM memories corresponding to at least one selection signal of the selection switching device, and:

at least one of the RAM memories is corresponding to only one selection signal of the selection switching device, or at least one of the RAM memories is corresponding to a plurality of selection signals of the selection switching device;

since the selection signal of the selection switch generally corresponds to the sub-data processing system, by this method, the correspondence between the RAM memory and the sub-data processing system is actually achieved.

The RAM memory control interface, the control input interface (701), the control output interface (702) and the host interface (703) are partially or completely multiplexed with the same interface bus, or different interfaces are respectively used.

If the RAM memory corresponding to the switched-out virtual sub-data processing system is different from the RAM memory corresponding to the switched-in virtual sub-data processing system, the content of the RAM memory remains unchanged during the switching-out period (i.e. the RAM memory is substantially the same as or equivalent to or substantially the same as or equivalent to most of the RAM memory state of the last operation state of the virtual sub-data processing system, and some switching states, such as the state of CPU or equipment, may be added)

A motherboard for use in constructing two or more sub-data processing systems, comprising a processor unit, the motherboard comprising:

two or more RAM memories corresponding to at least one selection state of the selection switching device, and:

at least one of the RAM memories is corresponding to only one selection state of the selection switching device, or at least one of the RAM memories is corresponding to a plurality of selection states of the selection switching device;

all or part of the plurality of sub data processing systems share at least one display device interface or at least one input device interface;

the sub-data processing systems share the processor unit.

The selection switching device supports online switching.

A multi-unit mainboard comprises at least two or more non-virtual sub-mainboard units, wherein each sub-mainboard unit is a mainboard in a common sense or a mainboard with virtual capability, and the multi-unit mainboard is used for constructing a data processing system with a plurality of subsystems.

The switching between sub (data processing) systems of the present invention is formally increased compared to the previous invention, which only relates to switching between (virtual) sub data processing systems of a shared processor unit and between sub data processing systems of a non-shared data processor 2 cases 4 ways:

the on-line switching between the virtual sub-data processing systems sharing the same processor unit needs to be protected and restored on site, and the control part in the required switching device can be realized by using circuits, logic circuits or microcontrollers and the like according to the relevant steps in the virtual method of the data processing system.

For the on-line switching of processing among virtual sub-data processing systems, the on-line switching between the virtual sub-data processing systems and the physical sub-data processing systems, and the on-line switching between the physical sub-data processing systems sharing different processor units, the switched-in/switched-out subsystems work on the respective physical main boards and hard disks, and generally do not need to be protected and restored on site.

For the situation that the switched-in new subsystem is a virtual sub-data processing system, but the new virtual sub-data processing system is not a currently running virtual sub-data processing system on a physical main board (including a processor unit) where the new virtual sub-data processing system is located, at this time, field protection and recovery are also required, and only the field protected object is not the last switched-out subsystem, but is the currently running virtual sub-data processing system on the physical main board where the new virtual sub-data processing system is located.

The inventive change essentially only involves switching between (virtual) sub-data processing systems sharing a processor unit, namely: when two (virtual) sub-data processing systems switched (essentially involved) share the same RAM memory, the related method of the previous invention is used; when the two (virtual) sub-data processing systems switched (essentially involved) use different RAM memories, no matter the work site is saved and the work site is restored, compared with the previous invention, the information in the RAM does not need to be saved to other places (and restored to the RAM from other places), even the state of the device can be saved in the internal memory (RAM) (or restored from the internal memory), and of course, the part of the information (the state of the device) can be saved in the external memory.

Accordingly, the method of saving/restoring the job site can be as simple as "Saving only the shape of all the devices it uses State of the art' and"load all the states of the devices used at the time, saved during the 'save job site', and set the phases in this way Off state of the device ". Similar to the dormant state of windows xp. This is also the purpose of the invention to improve compatibility. Of course, the operating system or the application system performs work cleanup, which can improve the applicability and performance of the system. Such as: some special tasks require procedures (e.g., dial-up to connect and disconnect) if a pause is required.

(what is essentially referred to above means that for example subsystems 1, 3 share the same processor and belong to a virtual subsystem, while subsystem 2 is a physical subsystem that when switching from 1 to 2 and then from 2 to 3 is apparently a switch between 2 and 3, and essentially a switch between 3 and 1, for saving the work site, in particular the contents of the RAM memory)

The processor unit of the present invention may include one CPU, or may include a group of multiple CPUs, and each CPU may be single-core or multi-core.

The RAM memory described in the invention refers to a memory in the constitution (input device, output device, memory, controller, arithmetic unit) of a classical data processing system, and does not include a memory (such as independent video memory, cache) in a device (such as a video card and a CPU).

The plurality of RAM memories can be physically independent memories, or a plurality of RAM memories divided by one physical memory through space, and for the latter, the size of the divided space can be set and changed.

The method and apparatus of the present invention are applicable to any device with a display device including a data processing system, including but not limited to personal computers, smart phones, tablet computers, smart televisions, etc.

It should be noted that the method for setting two or more memories according to the present invention is applicable to any of the methods and apparatuses related to sub (data processing) system switching, especially to virtual sub (data processing) system switching in the foregoing invention, that is, can be combined with them to form a new technical solution.

In addition, if a RAM external memory is additionally arranged in the scheme of the invention, the data storage for saving/restoring the field is only used, and the scheme is also a simple example. But the memory utilization may not be too high at the expense of possibly being higher than the external memory or the inventive solution, which of course depends on the development of memory technology.

Advantageous effects

The method and the system provided by the invention provide different task operating environments aiming at different tasks so as to achieve different safety control requirements, and because the different tasks can be well safely isolated, the propagation of unsafe factors among different applications can be avoided, the safety is well guaranteed, and the method and the system have very general practical significance.

Moreover, the computer system can be electrified, on the basis of keeping the original functions and using modes, the computer can be used like a household appliance (such as a television), different tasks can be switched by simply changing channels, and a picture-in-picture (PIP) function similar to the television can be obtained at a low cost.

The safety control method of the basic input/output system (BIOS) based on the computer system and various components is not always in advance, and provides control over possible future damage and attack ways aiming at the current safety form, thereby further ensuring the safety of the computer system.

By selecting the switching device (601), the existing mainboard can be conveniently reconstructed to support the virtualization of the data system, and the multi-unit mainboard provides an integrated data processing system implementation scheme based on multiple subsystems for users.

In addition to the above effects, the method and system of the present invention can provide better compatibility (application range) and handover performance, and have a better balance between cost and performance. Especially virtual subsystem based switching.

Description of the drawings:

FIG. 1: a data processing system having a plurality of physical sub-data processing systems and a plurality of virtual sub-data processing systems;

in the figure: 201 is a part of a physical sub data processing system located in a case (200), and the physical sub data processing system and the processor unit are provided with a single external storage unit (hard disk) and a single processor unit (located on a mainboard), and 202 is a part of a virtual sub data processing system located in the case (200), and the virtual sub data processing system and the processor unit are shared on the physical mainboard (80) and a plurality of virtual sub hard disks virtually divided by hard disks (81); the plurality of sub data processing systems share all or part of the display (100), the keyboard (300), the optical drive (10), the mouse (20) and the Modem (30) required by the respective subsystems through the switching device (600).

FIG. 2: a data processing system having a physical sub-data processing system and a plurality of virtual sub-data processing systems;

the difference between this figure and FIG. 1 is that the number of physical sub-data processing systems is different, i.e. there are a plurality in FIG. 1, and there are 1 in this figure, and the others are basically the same;

FIG. 3: a data processing system having four virtual sub-data processing systems;

the difference between this figure and figure 2 is that the four sub-data processing systems in this figure are all virtual sub-data processing systems, and there is no physical sub-data processing system, and the four virtual sub-data processing systems share the processor unit located on the physical motherboard (80), but have separate independent hard disks;

FIG. 4: a data processing system having a plurality of physical sub-data processing systems;

the difference between this diagram and fig. 1 is that the four sub-data processing systems in this diagram are all physical sub-data processing systems, and there is no virtual sub-data processing system, and the four physical sub-data processing systems have independent main boards and hard disks;

(in the above-mentioned drawings, the virtual line is shown by a dotted line, and the same part is not described repeatedly)

FIG. 5: the structure of the selection switching device is composed of a block diagram, in the figure, 701: control input interface, 702: control output interface, 700: control unit, 703: a host interface;

FIG. 6: the structure of the selection switching device (602) on the multi-unit motherboard is schematically shown, 711: control input interface, 712: control output interface, 710: shared interface switching unit, 602: selecting a switching device;

101: a shared display interface 40 is a display interface from the sub-main board unit;

301: shared keyboard interface, 50 is the keyboard interface from the sub-motherboard unit;

121: sharing USB interface, 60 is USB interface from sub-main board unit;

FIG. 7: a smart phone (two RAM memories) with multiple virtual sub-data processing systems at the same time;

in the figure: 201. 202, 203, 204 are four virtual sub smart phones sharing the same motherboard, wherein 201 shares 2G memory exclusively, and 202, 203 and 204 share 512M memory; the plurality of child smartphones share the touch screen (and other devices) through the switching device (600).

FIG. 8: personal computer with multiple virtual sub data processing system (two RAM memories)

In the figure: 201. 202, 203 and 204 are four virtual sub-computers sharing the same mainboard, wherein 201 and 202 share a 2G memory, and 203 and 204 share a 512M memory; the plurality of sub-computers share all or part of the display (100), the keyboard (300), the optical drive (10), the mouse (20) and the Modem (30) required by the respective subsystems through the switching device (600).

FIG. 9: the switching device is provided with an RAM memory control interface.

The present invention will be further described with reference to the following examples.

DETAILED DESCRIPTION OF EMBODIMENT (S) OF INVENTION

1. See application No.: 200510132889X specific embodiments of the invention. The virtual sub-data processing system in the described embodiments may incorporate multiple RAM memories of the present invention. For specific methods of incorporation, reference is made to the relevant parts of the technical solutions on pages 12 to 13 of the present description and to the examples below.

2. The invention is additionally provided with the following embodiments:

fig. 7 is a block diagram of a preferred embodiment of the present invention for virtualizing a smartphone into multiple child smartphones. The first virtual sub-phone (201) uses an android or apple system, has an exclusive 2G memory, and can run various applications. The second virtual sub-phone (202) can be set for electronic transaction, the 3 rd and 4 th sub-phones (203, 204) can be set for stock exchange and electronic bank respectively, the four sub-phones share a touch screen and a basic mobile network or WiFi, and the sub-phones (201) share a 2G memory exclusively, so that the data storage amount during switching is small and the switching is fast. The

sub-mobile phones

202, 203 and 204 have single task, can make the system very compact (specially customized, even without an operating system), and can make the mutual switching faster.

Each sub-mobile phone can integrate the basic communication template to avoid missing calls or provide basic mobile network connection, and can also set a certain sub-mobile phone as the special purpose of communication, and other sub-mobile phones only provide a monitoring module which can display incoming calls and short messages, and users can transfer to the special sub-mobile phones of communication to answer calls and read short messages according to the needs.

The embodiment can greatly improve the safety of the mobile phone. And complete safety isolation can be achieved among all applications.

FIG. 8 is another preferred embodiment of the present invention, which is different from the previous embodiment in that two

sub-computers

201 and 202 share 2G memory and can run windows and ios operating systems, respectively, and sub-computers 203 and 204 share 512M memory and can run e-mail and friend-making systems, respectively. In this mode, although it may take a long time to switch between the sub-computers 201 and 202, the switching between the sub-computers 201 and 203, 204, and the switching between the sub-computers 202 and 203, 204 may be fast. In reality, frequent switching between windows and ios is a small probability event.

For the case that windows and ios need to be frequently switched, we can improve the above embodiment, that is, 1G of exclusive memory is set for each of the sub-computers, or 2G of exclusive memory is added, so that the

sub-computers

201 and 202 share 2G of memory individually. (in this mode, there are 3 RAM memories)

The RAM memory control interface shown in fig. 9 can be implemented by mapping, in the control unit (700), the selection labels of the subsystems to chip select signals of the corresponding RAMs (using physically independent RAM memories), or mapping the selection labels of the subsystems to encode signals of the corresponding RAMs (sharing the storage space of one physical memory among a plurality of RAM memories), and for the latter, mapping the storage space of the subsystems to the storage space of the shared physical memory by simple decoding (address and RAM encoding).

In particular, the setting of the number of RAM memories according to the present invention can be set by the user and can be freely increased or decreased. As long as the sum of the individual RAM memory capacities is less than or equal to the storage space of the physical memory they share. For example: setting an address conversion table (the table capacity determines the number of RAM memories which can be divided by a user), taking the RAM numbers as serial numbers, wherein each RAM number corresponds to two long words, the first is a starting address, the second is a length mask, and when decoding, only needing to look up a table according to the RAM codes to take out the starting address, and taking the phase of the original address and the length mask together, and adding the starting address to obtain the actual physical memory internal address.

Claims

1. A virtualization method of a data processing system is used for virtualizing a data processing system sharing a same processor unit into a plurality of virtual sub-data processing systems, wherein the plurality of virtual sub-data processing systems time-share original data processing system resources, at any time, at most only one of the plurality of virtual sub-data processing systems is in an operating state, the virtual sub-data processing systems have respective operating systems or application systems, and:

a step of associating the selection state of the switching device with the virtual sub-data processing system;

switching the corresponding virtual sub data processing system to the currently running virtual sub data processing system by the switching device according to the user instruction;

setting two or more RAM memories and corresponding the RAM memories to at least one virtual sub-data processing system, and:

at least one RAM memory corresponding to only one virtual sub-data processing system and at least one RAM memory corresponding to two or more virtual sub-data processing systems exist, or at least one RAM memory corresponding to two or more virtual sub-data processing systems and at least another RAM memory corresponding to two or more other virtual sub-data processing systems exist;

the RAM memory is generally configured to be independent RAM memory or shared RAM memory and shared according to the amount of information/memory related to the virtual sub-data processing system, the response time/speed requirement, the compatibility with the old system/application, or the frequency of switching between the virtual sub-data processing systems.

2. The method of claim 1, wherein said currently running virtual sub data processing system has access only to said RAM memory corresponding thereto.

3. The method of claim 1, wherein the switching is Online (Online) switching.

4. The method of claim 1, further comprising the step of securely isolating external memory of different virtual sub-data processing systems, wherein said isolation method may be one or more or a combination of the following methods:

a) setting a plurality of physically independent external memories to enable different virtual sub-data processing systems to use different physical external memories;

b) virtually partitioning the storage space of a single external memory so that different virtual sub-data processing systems use different virtual sub-memories of the external memory;

c) reading or writing protection is carried out on the external memory storage space of the virtual sub-data processing system in the non-working state;

d) disabling external memory not needed for the active state of the virtual sub-data processing system;

e) read or write protection is performed on external memory storage not needed by the active virtual sub-data processing system.

5. A data processing system comprising a processor unit configured to construct two or more sub-data processing systems sharing the processor unit, the data processing system further comprising:

the selection switching device is used for selecting the sub data processing system currently used or operated by a user, and the selection state of the selection switching device corresponds to the sub data processing system;

at least one RAM memory is corresponding to only one of the sub-data processing systems, at least one RAM memory is corresponding to two or more sub-data processing systems, or at least one RAM memory is corresponding to two or more sub-data processing systems, at least another RAM memory is corresponding to other two or more sub-data processing systems;

the setting of the RAM memory generally prepares an independent RAM memory or a shared RAM memory for the virtual sub-data processing system and how to share the RAM memory according to the amount of information/memory related to the virtual sub-data processing system, the requirement on response time/speed, the compatibility degree with an old system/application, or the frequency of switching between the virtual sub-data processing systems;

6. A system as claimed in claim 5, wherein for a Firmware (Firmware) device of said sub-data processing system which is reprogrammable and which has access to execution opportunities for the processor unit of the sub-data processing system, the device is write-protected or partially write-protected, or the Firmware (Firmware) content itself is non-tamperably verified.

7. The system of claim 5, wherein said different sub-data processing systems use different external memories or different virtual sub-memories of the same external memory.

8. A selection switch apparatus (601) for supporting virtualization of a data processing system, comprising:

at least one of the RAM memories corresponds to only one selection signal of the selection switching device and at least one of the RAM memories corresponds to two or more selection signals of the selection switching device, or at least one of the RAM memories corresponds to two or more selection signals of the selection switching device and at least another one of the RAM memories corresponds to other two or more selection signals of the selection switching device;

9. A motherboard for use in constructing two or more sub-data processing systems, comprising a processor unit, the motherboard comprising:

at least one of the RAM memories corresponds to only one selection state of the selection switching device and at least one of the RAM memories corresponds to two or more selection states of the selection switching device, or at least one of the RAM memories corresponds to two or more selection states of the selection switching device and at least another one of the RAM memories corresponds to two or more other selection states of the selection switching device;

the sub-data processing systems share the processor unit.

10. A multi-unit motherboard comprising at least two or more non-virtual sub-motherboard units, each of said sub-motherboard units being either a normal-sense motherboard or a motherboard with virtual capabilities, the multi-unit motherboard being configured to implement a data processing system having a plurality of subsystems, wherein at least one of said sub-motherboards is the motherboard of claim 9.