COMPUTER SYSTEM WITH TUNNELING

Abstract

A computer system with a CPU, at least one guest operating system and a controller kernel. The controller kernel includes a socket for running an application on the controller kernel itself. The controller kernel also includes a video integration module so that video output data from the guest OS may be combined with video output data from the guest OS. In this way, a user of the guest OS can use an application by tunneling, and without the need to virtualize the video output data of the application running on the controller kernel in order to incorporate it with the video output data of the guest OS. This is especially preferred when the controller kernel is written in a different form than the guest OS, such as when the controller kernel is in LINUX and the guest OS is in a Windows form because it allows a guest OS of one form (for example, Windows) to reliably, quickly, efficiently and robustly run applications written in another form (for example, LINUX).

Description

RELATED APPLICATION

The present application claims priority to U.S. provisional patent application No. 60/973,923, filed on Sep. 20, 2007; all of the foregoing patent-related document(s) are hereby incorporated by reference herein in their respective entirety(ies).

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to computer systems with a computer running multiple operating systems and more particularly to computer systems with a computer running multiple containerized (see DEFINITIONS section) operating systems to be respectively used by multiple terminals (see DEFINITIONS section).

2. Description of the Related Art

It is conventional to have a computer, such as a modified PC desktop type host computer, which controls and operates a plurality of terminals. In fact, mainframe computers dating back to at least the 1970s operated in this way. More recently, each terminal has been given its own operating system and/or instance of an operating system. These kind of systems are herein called multi-terminal systems.

It is conventional to use a hypervisor to run multiple operating systems on a single computer. A hypervisor (or virtual machine monitor) is a virtualization platform that allows multiple operating systems to run on a host computer at the same time. Some hypervisors take the form of software that runs directly on a given hardware platform as an operating system control program. With this kind of hypervisor, the guest operating system runs at the second level above the hardware. Other hypervisors take the form of software that runs within an operating system environment.

Hypervisors have conventionally been used in multi-terminal systems where each terminal has a dedicated guest operating system on a single host computer. In these conventional multi-terminal systems, I/O devices communicate I/O data through the hypervisor to perform basic I/O operations (see DEFINITIONS section). More specifically: (i) data from the I/O devices is communicated through the hypervisor to the computing hardware of the host computer; and (ii) from the computing hardware (if any) is communicated through the hypervisor to the I/O devices. Because the hypervisor is a virtualization platform, this means that the I/O devices must be virtualized in the software of the hypervisor and/or the guest operating system so that the communication of I/O data through the hypervisor can take place.

FIG. 1 shows prior art computer system 100 including: desktop PC 102 and four terminals 104a, 104b, 104c and 104d. Desktop PC 102 includes: video card 110; I/O ports 112; CPU 114; host operating system (“OS”) 116; virtualizing middleware 118, four guest OS's (see DEFINITIONS section) 120a, 120b, 120c, 120d; and four guest applications 122a, 122b, 122c and 122d. Each terminal 104 includes: display 130 and keyboard-mouse-audio (“KMA”) devices 132. Host OS may be any type of OS, such as Windows, Apple or POSIX (see DEFINITIONS section). As shown in FIG. 1, host OS 116 runs at security level (see DEFINITIONS section) L0, which may be, for example in an x86 CPU architecture, Ring Zero. This means that host OS 116 exchanges instructions directly with CPU 116 in native form (see DEFINITIONS section).

The guest OS's 120a, 120b, 120c, 120d are used to respectively control the four terminals 104a, 104b, 104c, 104d. This means that the four guest OS's: (i) control the visual displays respectively shown on displays 130a, 130b, 130c, 130d; (ii) receive input from the four keyboards 132a, 132b, 132c, 132d; (iii) receive input from the four mice 132a, 132b, 132c, 132d; and (iv) control audio for the four audio output devices (for example, speakers, headphones) 132a, 132b, 132c, 132d. The four guest OS's 120a, 120b, 120c, 120d are containerized virtual machines so that work by one user on one terminal does not affect or interfere with work by another user on another terminal. As shown in FIG. 1, they can respectively run their own application(s) 122a, 122b, 122c, 122d in an independent manner.

However, the four guest OS's are virtual machines, running at a security level 13, which is above the OS security level (see DEFINITIONS section) L0. For example, in an x86 architecture, the guest OS's 120a, 120b, 120c, 120d would be running at Ring Three. This is an indirect form of communication with the CPU 114. Furthermore, the instructions exchanged between the guest OS's and the CPU are virtualized by virtualizing middleware 118, which may take the form of a hypervisor or virtual machine manager (“VMM”). For example, some of the exchanged instructions relate to basic I/O operations. When the exchanged instructions are virtualized by virtualizing middleware 118, the instructions are taken out of their native form and put in a virtualized form. This virtualized form is generally a lot more code intensive than native form. This virtualization makes operations slower and more prone to error than similar exchanges between a host OS, running at the OS security level and the CPU.

It is conventional to run one type of operating system, buts still use application(s) written for an operating system of a different type. Some conventional systems for doing that will now be discussed.

FIG. 8 shows prior art computer system 140 including: CPU 142; POSIX operating system (OS) 144; and Berkeley Software Distribution (BSD) application 148. POSIX OS 144 includes a BSD socket (see DEFINITIONS section) 146 programmed to allow the BSD application 148 to run on the POSIX OS 144. However, systems according to the architecture of system 140 are not always easily achieved as will now be explained in connection with FIG. 9.

FIG. 9 shows a possible prior art computer system 150 including: CPU 152; Windows operating system (OS) 154; and LINUX application 148. Windows OS 154 includes a LINUX API 156 programmed to allow the LINUX application 158 to run on the Windows OS 154. This system 150 is denominated as “possible” prior art because it is a type of system that seems to be seldom, if ever, actually practiced. This may be due to difficulties in updating the LINUX API 156 to stay current with the underlying Windows OS 154 and/or overlying LINUX application 158, and/or difficulties involving proprietary code issues.

FIG. 10 shows prior art computer system 160 including: local computer 162; network 164 and POSIX application server computer 166. Local computer 162 includes: CPU 168; network interface card (NIC) 170; Windows operating system 172; and XMing module 174. POSIX application server computer 166 includes: CPU 178; network interface card (NIC) 186; POSIX operating system 180; and POSIX application 184. POSIX OS 184 includes a POSIX socket 182 programmed to allow the POSIX application 184 to run on the POSIX OS 180. System 160 overcomes the difficulties of running a POSIX (for example, LINUX) application by a user who is using a Windows operating system. The remote POSIX application server computer 186 can run the POSIX application(s) because it has the appropriate POSIX OS and socket(s). Inputs to this remote POSIX application(s) and outputs from this remote POSIX application are respectively sent and received through NIC's 170, 186 and network 164. The special Windows manager module XMing 174 at local computer 162 incorporates data received from the remote POSIX application server computer 166 as a window in the Windows display generated by Windows OS 172.

One disadvantage is that the inputs and outputs of the POSIX application(s) must be packetized and de-packetized by NIC's 170, 186 and sent through the switches of network 164. This makes the running of the POSIX application effectively slower and less reliable from the perspective of the user of local computer 162.

FIG. 11 shows system 188, which is a variation on system 160. Computer system 188 includes: local computer 189; video output 190; CPU 191; POSIX host OS 192; virtualizing middleware 193; Windows guest OS 194 and POSIX application 196. POSIX host OS 192 includes socket 197 for running POSIX application 196 right at the local computer 189. Instead of sending POSIX application output data back to XMing 195 through actual NIC's and the switches of an actual network, the output data of the POSIX application is instead sent through virtual network module 198 (including virtual switches) and virtual NIC 199 included in the virtualizing middleware 193. Once again, though this solution takes time both because of the de-packetizing/packetizing involved, and also because virtualization is a code-intensive process that causes relatively large instructions to be transmitted through the system to achieve the POSIX application effectively running on Windows operating system. It is also noted that other instructions (for example, I/O device related instructions) that must be exchanged between the Windows guest OS 194 and CPU 191 are also virtualized by the virtualizing middleware, which is a further disadvantage of prior art system 188.

Other publications potentially of interest include: (i) US published patent application 2008/0092145 (“Sun”); (ii) US published patent application 2006/0267857 (“Zhang”); (iii) US patent application 2007/0174414 (“Song”); (iv) Applica PC Sharing Zero Client Network Computing Remote Workstation powered by Applica Inc. (see www.applica.com website, cached versions 31 Jul. 2007 and earlier); (v) US patent application 2003/0018892 (“Tello”); (vi) US patent application 2007/0097130 (“Margulis”); (vii) US patent application 2008/0168479 (“Purtell”); (viii) U.S. Pat. No. 5,903,752 (“Dingwall”); (ix) US patent application 2007/0028082 (“Lien”); (x) US patent application 2008/0077917 (“Chen”); (xi) US published patent application 2007/0078891 (“Lescouet”); (xii) US published patent application 2007/0204265 (“Oshins”); (xiii) US published patent application 2007/0057953 (“Green”); (ix) US patent application 2004/0073912 (“Meza”); (x) US patent application 2007/0043928 (“Panesar”); and/or (xi) US patent application 2007/0174410 (“Croft”).

Description Of the Related Art Section Disclaimer: To the extent that specific publications are discussed above in this Description of the Related Art Section, these discussions should not be taken as an admission that the discussed publications (for example, published patents) are prior art for patent law purposes. For example, some or all of the discussed publications may not be sufficiently early in time, may not reflect subject matter developed early enough in time and/or may not be sufficiently enabling so as to amount to prior art for patent law purposes. To the extent that specific publications are discussed above in this Description of the Related Art Section, they are all hereby incorporated by reference into this document in their respective entirety(ies).

BRIEF SUMMARY OF THE INVENTION

The present invention is directed to a computer system with a CPU, at least one guest operating system and a controller kernel. The controller kernel includes a socket for running an application on the controller kernel itself. The controller kernel also includes a video integration module so that video output data from the guest OS may be combined with video output data from the guest OS. In this way, a user of the guest OS can use an application by tunneling, and without the need to virtualize the video output data of the application running on the controller kernel in order to incorporate it with the video output data of the guest OS. This is especially preferred when the controller kernel is written in a different form than the guest OS, such as when the controller kernel is in LINUX and the guest OS is in a Windows form because it allows a guest OS of one form (for example, Windows) to reliably, quickly, efficiently and robustly run applications written in another form (for example, LINUX).

Some preferred embodiments of the present invention include multiple guest operating systems that exchange instructions in native form (see DEFINITIONS section) with the CPU under control of the controller kernel. Some preferred embodiments of the present invention include multiple, containerized (see DEFINITIONS section) guest operating systems so that the application(s) running on the controller kernel can be separately and independently run by the various guest OS's. Some preferred embodiments of the present invention include both multiple guest OS's and multiple terminals (see DEFINITIONS section) respectively run by the guest OS's. Some preferred embodiments of the present invention include software module(s) to help search for applications suitable to run on the controller kernel. Some preferred embodiments of the present invention include software module(s) to help filter which applications are permitted to be run on the controller kernel.

Various embodiments of the present invention may exhibit one or more of the following objects, features and/or advantages:

(1) reliably, quickly, efficiently and/or robustly run application(s) written in one form (for example, LINUX) to run in conjunction with an operating system of another form (for example, Windows);

(2) run application(s) written in one form (for example, LINUX) to run in conjunction with an operating system of another form (for example, Windows) without virtualizing the application related data; and/or

(3) run application(s) written in one form (for example, LINUX) to run in conjunction with an operating system of another form (for example, Windows) without packetizing the video output data of the application(s) and/or without sending it through a virtual switch.

According to a first aspect of the present invention, a computer system includes processing hardware, a first guest operating system, a controller kernel, and a first application program. the controller kernel runs on the processing hardware, with the controller kernel being programmed to allow the first guest operating system to receive first native form video frame data from the processing hardware through the controller kernel, and with the controller kernel including a first socket. The first application program is programmed to generate first application display data when it runs. The first socket is programmed to run the first application program. The controller kernel is programmed to receive the first application display data and to incorporate the first application display data into the first native form video frame data.

According to a further aspect of the present invention, a computer includes processing hardware, a first OS memory portion, a controller memory portion, and a first application memory portion. The first OS memory portion is programmed with a first guest operating system. The controller memory portion is programmed with a controller kernel running on the processing hardware, with the controller kernel being programmed to allow the first guest operating system to receive first native form video frame data from the processing hardware through the controller kernel, and with the controller kernel including a first socket. The first application memory portion is programmed with a first application program programmed to generate first application display data when it runs. The first socket is programmed to run the first application program. The processing hardware is programmed to receive the first application display data and to incorporate the first application display data into the first native form video frame data.

According to a further aspect of the present invention, a process includes the following steps: (i) providing a computer system comprising processing hardware, a first guest operating system, a controller kernel, a first application program, with the controller kernel comprising a first socket; (ii) running the controller kernel on the processing hardware; (iii) running the first application program on the first socket; (iv) generating, by the first application program, first application display data; (v) sending the first application display data from the socket to the processing hardware; and (vi) incorporating, by the processing hardware, the first application display data into a first native form video frame data.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be more fully understood and appreciated by reading the following Detailed Description in conjunction with the accompanying drawings, in which:

FIG. 1 is a schematic of a prior art computer system;

FIG. 2 is a perspective external view of a first embodiment of a computer system according to the present invention;

FIG. 3 is a schematic of the first embodiment computer system;

FIG. 4 is a more detailed schematic of a portion of the first embodiment computer system;

FIGS. 5A, 5B, 5C and 5D are a flowchart of a first embodiment of a method according to the present invention;

FIG. 6 is a of a second embodiment of a computer system according to the present invention; and

FIGS. 7A and 7B are a flowchart of a second embodiment of a method according to the present invention;

FIG. 8 is a schematic of another prior art computer system;

FIG. 9 is a schematic of another prior art computer system;

FIG. 10 is a schematic of another prior art computer system;

FIG. 11 is a schematic of another prior art computer system;

FIG. 12 is a of a third embodiment of a computer system according to the present invention; and

FIG. 13 is a of a fourth embodiment of a computer system according to the present invention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 2 shows computer system 200 according to the present invention, including desktop PC 202 and four terminals 204a, 204b, 204c and 204d. Desktop PC 202 could alternatively be any other type of computer now known or to be developed in the future, such as a laptop, a tablet, a mini computer, a mainframe computer, a super computer, a blade, etc. Terminals 204 each includes I/O devices in the form of a display, a keyboard, a mouse and an audio device. The display is the primary output device and may be any type of display now known or to be developed in the future, such as an LCD display or a CRT display. Alternatively or additionally, other output devices could be present, such as printers, lights (LEDs) and/or vibrating output devices. The keyboard, mouse and audio speakers are the primary input devices, but they may include output capabilities as well. Alternatively or additionally, there may be other output devices of any type now known or to be developed in the future, such as drawing tablets, joysticks, footpads, eyetracking input devices, touchscreens, etc.

Preferably, the display of each terminal 204 is connected to be in display data communication with desktop PC 202 by a standard parallel display connection, but may be connected by any appropriate data connection now known or to be developed in the future, such as a wireless connection. Preferably, the input devices of terminal 204 are connected to desktop PC 202 by a USB connection. Alternatively, they may be connected by any means now known or to be developed in the future, such as PS2 connection or wireless connection. One or more USB hubs may be used between desktop PC 202 and the input devices of terminals 204.

Terminals 204 are preferably ultra thin terminals (see DEFINITIONS section). Alternatively, some or all terminals 204 could include a client computer with memory and processing capability. Terminals 204 may also include an I/O port for a portable memory, such as a USB port for a detachably attachable USB flash memory or jump drive.

FIG. 3 is a schematic of system 200 including desktop PC 202; terminals 204; video card 210; I/O ports 212; CPU 214; POSIX kernel 215; four guest OS's 220a, 220b, 220c, 220d; four guest applications 222a, 222b, 222c, 222d; four displays 230a, 230b, 230c, 230d; and four sets of KMA devices 232a, 232b, 232c, 232d.

Video card 210 has at least four outputs to supply display data to the four display devices 230a, 230b, 230c, 230d. Although not shown, video card 210 may have at least one additional output for: (i) additional terminals; and/or (ii) use with the POSIX kernel and/or any host operating system that may be present. The video card may take the form of multiple video cards.

The CPU may be any type of processing hardware, such as x86 architecture or other Windows type, Apple type, Sun type, etc. The hardware structure of the CPU will determine the native form for the instructions that it gives and receives. For this reason, the guest OS's 220a, 220b, 220c, 220d must be fully compatible with CPU 214. Importantly, there is substantially no virtualizing middleware layer in desktop PC 202 to correct for any incompatibilities.

The POSIX kernel is preferably a LINUX kernel because LINUX is open source and also because a LINUX kernel can be expanded to run LINUX applications. Alternative, the kernel may be written in other formats to be compatible with the CPU such as Windows or BSD.

The PC 202 preferably includes a software algorithm (not shown) that loads the POSIX kernel (Linux 2.6 preferably) onto an available motherboard EEPROM instead of the currently installed proprietary BIOS. The kernel, along with several other helpful C based programs preferably run in 32 bit mode, as opposed to the current method of running the BIOS in 16 bit mode. These programs preferably include BusyBox, uClibc, and XII. The result is a greatly decreased boot time. All of this is preferably run in the cache memory of the CPU instead of normal DRAM. The reason for this is that DRAM is normally initialized by the BIOS and can't be used until it is initialized. The first program that runs is also written in C and it is what initializes and uses this CPU memory.

Once this is loaded, a larger module is called. This would typically be invoked from the hard drive. The POSIX kernel 215 does not necessarily have any sockets or run any applications. It may only runs sub-modules that control multiple video, keyboard, mouse, and the audio devices for multiple, concurrent local connections. Current technology will allow only one user to use the system at a time using one set of keyboard, mice, and monitors. These modules have been modified to allow multiple inputs (keyboards and mice) and outputs (audio and video) devices to be used independently and concurrently. Preferably, the terminals 204 are not remotely located, but, in some embodiments of the invention, they may be.

Preferably, the terminals are located on the same machine and the output goes directly via the system bus to the associated devices resulting in multi-user system with very little slow-down. It utilizes the excess CPU power that is available to control multiple sessions just like in a “thin client” environment. The difference is that in a “thin client” environment the output is converted to TCP-IP protocol and sent via a network connection. This conversion and packeteering of video results in slow screen redraws. This ability to run multiple “sessions” is currently available with Linux (XII) and Windows (RDP), on remote machines but the remote machines must have the necessary hardware and software necessary to locally control the keyboard, mouse, audio and video devices. Because everything is preferably loaded from the local EEPROM, boot up from power-on to login is approximately 6 seconds. This compares favorably to current Windows, MacIntosh, or Linux startup times of 30-50 seconds.

These modifications allow for a natural separation of the “sessions” to a great degree. Because of this, the invention is able to take advantage of the scheduling components and modularity of Linux to use it as a supervisor for other operating systems to run concurrently. This can efficiently install one guest operating system (for example, a Windows guest OS) in conjunction with each set of keyboards, mice, and monitors.

FIGS. 7A and 7B are a flowchart showing exemplary process flow for the exchange of instructions between the guest OS's 220 and the CPU 214 through the POSIX kernel 215 according to the present invention. This flowchart will now be discussed in narrative terms, after which discussion, FIG. 3 will be further discussed. Using a modified Linux interrupt service code, . . . /kernel/entry-v.s, the idle loop, . . . /kernel/process.c, and a modified Interrupt Descriptor Table, this can control and tell if a system “session” is: (i) running; (ii) not running; or (iii) pre-empted. The kernel has priority for all actions, but since it is only providing low throughput I/O control and video rendering (video is mostly handled by the GPU on the video card), preemption by the host kernel is very low in proportion to time allowed for the “clients.”

Since the architecture is the same for both the host (Linux kernel) and the local “client” (x86-32 bit or 64 bit) operating system, there is little need for emulation of hardware and most instructions can be run directly on the applicable hardware. All CPU requests can be dynamically scheduled by the controller kernel and run in Ring Zero of the machine. If a protected call, privileged instruction, system trap, or page fault is presented that will not run properly or does not have permission to run in this unified system then it is moved to Ring Three. Ring Three is normally unused on an Intel system. All memory calls are directed to protected and pre-allocated memory locations. All hardware except video, ethernet, and audio devices is directly accessed by the “client” OS. Video, ethernet, and audio devices are virtualized, off-the-shelf drivers. Raw I/O from these devices is sent through the modified Linux idle loop and Interrupt Descriptor Table to the “real” hardware in a prioritized fashion. This allows a number of segregated “sessions” to be run at near native speed.

This is done without hardware virtualization extension techniques as currently available with the Intel VT or AMD V/SVM CPU chips, hardware emulation (VMWARE, QEMU, Bochs, etc.), or hypervisors like Xen or KVM (these require modification of source code). Finally, products like Cooperative Linux and UserMode Linux work with Windows as the host and Linux as the “guest” because the guest in this case (Linux) can be modified to give up control of the hardware when Windows asks for it. Since Windows can't easily be modified this concept has not been realized in reverse, for example Linux as host and Windows as guest. This aspect of the present invention is the reverse of this in that Linux is the host and Windows is the guest.

It may be difficult to modify the guest OS (for example, Windows) to give up control when the host (supervisor) asks for it, we can use /kernel/process.c (idle loop) and /kernel/entry-v.s (interrupt service) and the Interrupt Descriptor Table to trap privileged instructions and force the guest (Windows) to wait, until it is no longer preempted. In other words, we have modified the controller kernel (Linux) to put the requests of the guest (Windows) into the Linux idle loop if the guest is preempted. Since the host is not running applications, since it is only controlling I/O, the wait time during this preemption period is very short and it is not apparent to the user. Finally, when privileged instructions are trapped to Ring Three, the instructions are recompiled (sometimes on the fly) using QEMU recompilation code so that the next time this situation repeats itself, the trap is not needed.

Now that the operation of POSIX kernel has been explained in detail, discussion will return to FIG. 3. The guest OS's 220 are preferably Windows OS's, such as Windows XP or Windows Vista. Alternatively, any type of guest OS now known or to be developed in the future may be used. In some embodiments of the invention, there will be but a single guest OS. For example, Windows Vista has been found to run faster when run through the POSIX kernel according to the present invention. In some embodiments of the invention, the guest OS's will be different from each other. For example, there may be a Windows XP OS, a Windows Vista OS, an Ubuntu LINUX OS and a BSD OS. Systems with multiple OS's may be preferred in embodiments of the present invention where there are not multiple terminals, but rather a single set of I/O devices connected to desktop PC 202 in the conventional way. In these single terminal embodiments, a single user can switch between various operating systems at will, taking advantage of native applications 222 for a variety of operating systems on a single physical machine.

FIG. 4 shows a more detailed schematic of POSIX kernel 215 including: critical portion 215a; non-critical portion 215b; interrupt descriptor table 250; idle loop 252; and POSIX socket 254. Critical portion 215a is critical because this is the portion that passes instructions in native form between CPU 214 and guest OS's 220. In a sense, critical portion 215a takes the place of the virtualizing middleware of the prior art, with the important differences that: (i) the POSIX kernel passes instructions in native form, rather than translating them into virtualized or emulated form at intermediate portions of the exchange; and/or (ii) the POSIX kernel permits the guest OS's to run at an OS security level (for example, Ring Zero or Ring One), rather than a higher security level (see FIG. 3 at reference numeral LO). It is noted that applications running on top of the guest OS's will run at a higher security level (see FIG. 3 at reference numeral L3), such as, for example, Ring Three. In other words, despite the presence of the kernel, guest OS's run at the security level that a host OS would normally run at in a conventional computer.

In this preferred embodiment of the present invention, the POSIX kernel accomplishes the exchange of native form instructions using interrupt descriptor table 250 and idle loop 252. Interrupt descriptor table 250 receives requests for service from each of the guest OS's. At any given time it will return a positive service code to one of the guest OS's and it will return a negative service code to all the other guest OS's. The guest OS that receives back a positive return code will exchange instructions in native form with the CPU through idle loop 252. The other guest OS's, receiving back a negative return code from interrupt descriptor table 250 will be pre-empted and will remain running until they get back a positive return code.

Preferably, and as shown in the flow chart of FIGS. 5A to D, the interrupt descriptor table cycles through all the guest OS's over a cycle time period, so that each guest OS can exchange instructions with the CPU in sequence over the course of a single cycle. This is especially preferred in embodiments of the present invention having multiple terminals, so that different users at the different terminals under control of their respective guest OS's can work concurrently. Alternatively, the interrupt descriptor table could provide for other time division allocations between the various guest OS's. For example, a user could provide user input to switch between guest OS's. This form of time division allocation is preferred in single terminal, multiple operating system embodiments. There may be still other methods of time division allocation, such as random allocation (probably not preferred) or allocation based on detected activity levels at the various terminals.

Non-critical portion 215b shows that the controller kernel may be extended beyond the bare functionality required to control the exchange of instructions between the guest OS's and the CPU. For example, a POSIX socket may be added to allow POSIX applications to run on the kernel itself. Although the kernel is called a kernel herein, it may be extended to the point where it can be considered as a host operating system, but according to the present invention, these extensions should not interfere (that is virtualize or emulate) instructions being exchanged through the kernel in native form between the guest OS(es) and the CPU.

FIGS. 5A to 5D show an embodiment of process flow for one cycle for the exchange of instructions in native form between guest OS's 220 and CPU 214 through a kernel including an interrupt descriptor table and an idle loop. The process includes: a first portion (steps S302, S304, S306, S308, S310, S312, S314, S316, S318); a second portion (steps S320, S322, S324, S326, S328, S330, S332, S334, S336); a third portion (steps S338, S340, S342, S344, S346, S348, S350, S352, S354); and a fourth portion (steps S356, S358, S360, S362, S364, S366, S368, S370, S372).

The cycle has four portions because four guest OS's (and no host OS's) are running—each portion allows the exchange of instructions between one of the four guest OS's and the CPU so that all four operating systems can run concurrently and so that multiple users can respectively use the multiple operating systems as if they had a dedicated computer instead of an ultra thin terminal.

Preferably, the entire cycle allows each OS to get a new video frame about every 30 microseconds (MS). In this way, each terminal display gets a about 30 frames per second (fps), which results in a smooth display. Above 30 frames per second, there is little, if any, improvement in the appearance of the video, but below 30 fps, the display can begin to appear choppy and/or aesthetically irritating. Because the cycle time, in this four portion embodiment is preferably about 30 MS to maintain a good 30 fps frame rate in the displays, this means that each cycle portion is about 30/4 MS, which equals about 8 MS. With current CPUs, 8 MS out of 30 MS is sufficient to handle most common applications that would be run at the various guest OS's, such as word processing, educational software, retail kiosk software, etc. As CPU's get faster over time, due to improvements such as multiple cores, it will become practical to have a greater number of guest operating systems on a single desktop computer—perhaps as many as 40 OS's or more.

FIG. 6 is a schematic of a second embodiment computer system 400 according to the present invention including: guest OS 402a; guest OS 402b; guest OS 402c; guest OS 402d; hardware control sub-modules 408; controller kernel 410; hard drive 414; hardware layer; and EEPROM 418. Hardware control sub-modules 408 include the following sub-modules: network interface card (NIC) 434; keyboard 436; mouse 438; audio 440; video 442, memory 444 and CPU 446. Controller kernel 410 includes the following portions: kernel process module 448; kernel entry module 450; idle loop 452; interrupt service code 454; and interrupt descriptor table 456. Hardware layer 416 includes the following portions: network interface card (NIC) 420; keyboard 422; mouse 424; audio 426; video 428, memory 430 and CPU 432.

As shown by the guest OS boxes 402, the operating systems are containerized. As shown schematically by arrow 404, the presentation layer in this embodiment is Windows. As shown schematically by arrow 406, there are OS containers and virtual drivers for NIC, audio and video. Additionally, there may be additional modules, such as video acceleration modules. The hardware control sub-modules 408 are direct access drivers and may additionally include other sub-modules, such as a video acceleration module. The EEPROM 418 is the normal location for BIOS, but in this embodiment of the present invention is loaded with the controller kernel 410 and X11. EEPROM 418 invokes the hard drive after the initial boot up. The control kernel is invoked from hard drive 414 during the original EEPROM 418 boot. At the NIC portion 420, it is noted that each card preferably has its own MAC address and own IP address.

FIGS. 7A and 7B, discussed above, show a more detailed embodiment of the process flow through an interrupt descriptor table and idle loop in a LINUX controller kernel according to the present invention. Figures &A and 7B include LINUX control kernel level steps 502; Head 1 steps 504 and Head 2 steps 506.

FIG. 12 shows computer system 600 according to the present invention, including: CPU 614; POSIX controller kernel 615; guest OS 620; POSIX application A 658; POSIX application B 660; POSIX application C 662; and video output 691. The POSIX controller kernel includes: video integration module 650; POSIX socket A 652; POSIX socket B 654; and POSIX socket C 656. In preferred embodiments of the invention, guest OS 620 is either in a non-POSIX form, or at least in a form that is a different variant of POSIX (for example, LINUX) than that of the controller kernel (which might be UNIX).

The controller kernel 615 may be largely similar to the kernels of previous embodiments discussed above. The video integration module 650: (i) accepts video output data in native form guest OS 620; (ii) accepts video output data in native form from POSIX applications 658, 600, 662 (through their respective sockets 652, 654, 656); and (iii) combines and/or integrates this video data to form a single display in native form. The single display generated at item (iii) is then sent through the CPU 615 to video output 691.

The controller kernel may also communicate additional data in native form (such as I/O device related data) between guest OS 620 and POSIX applications 658, 660, 658. Advantageously, the data (and especially the video data) is not packetized, put in emulated form, virtualized and/or communicated through a virtual switch. Also, the guest operating system does not require a special windows manager, like XMing, and needs only to use its native windows manager in creating its video output data. This direct form of data communication through the kernel between a guest OS running on the kernel and other applications running directly on the kernel is tunneling according to the present invention.

FIG. 13 shows computer system 700 according to the present invention including: CPU 714; video card 713; three terminal displays 730a,b,c; LINUX controller kernel 715; three guest Windows OS's 720a,b,c; LINUX application A 758; LINUX application B 760; and LINUX application C 762. The kernel 715 includes: video integration module 750; LINUX application socket A 752; LINUX application socket B 754; LINUX application socket C 756; LINUX application filter module 770; and LINUX application search module 772. Each guest OS 720a,b,c includes: LINUX application filter module 774a,b,c; and LINUX application search module 776a,b,c.

In system 700, the three containerized guest OS's are used to run three independent terminals. Video integration module 750 integrates video data in native form from each of the guest OS's 714a,b,c and from any applicable LINUX applications 758, 760, 762 to form combined video output data to be displayed on the displays 730a,b,c of the various terminals. Terminal 730c shows such a combined display including: LINUX window A 780; Windows window A 782; an LINUX window B 784. In this way, users of each terminal are in an independent and familiar computing environment created by their respective guest OS, but also have access to various LINUX applications as well through the tunneling of the present invention.

In system 700, both the guest OS's 720 and the kernel 715 have search modules. Alternatively, the search module could be only in the guest OS's, only in the kernel, run as an application on top of the various guest OS's or run as an application on the kernel. Regardless of its location(s) in the system, the search modules are modules that help users of the guest OS's find desirable applications that can run on the kernel through tunneling. This can be especially advantageous when the kernel can run open source applications because these are numerous and can be hard to find without help.

In system 700, both the guest OS's 720 and the kernel 715 have filter modules. Alternatively, the filter module could be only in the guest OS's, only in the kernel, run as an application on top of the various guest OS's or run as an application on the kernel. Regardless of its location(s) in the system, the filter module can be used so that a system administrator or other interested party can prevent undesired applications from being run on and/or accessed through the kernel. The filter may be opt-out style (that is, in the form of a list of forbidden applications) or opt-in style (that is, in the form of a closed list of approved applications). Instead of merely forbidding/approving the applications, the filter may alternatively or additionally provide password protection and/or metering for the applications run on the controller kernel. This filtering can be especially advantageous in a child's educational environment for many possible reasons: (i) help select best pedagogical tools for the child; (ii) help prevent minor from accessing harmful matter; (iii) prevent confusion and being overwhelmed by too many open source applications; (iv) allow selective access depending on the identity of the teacher or student; and (v) allow limited time, time period and/or bandwidth access for applications that are partially or wholly entertainment oriented.

Definitions

The following definitions are provided to facilitate claim interpretation:

Present invention: means at least some embodiments of the present invention; references to various feature(s) of the “present invention” throughout this document do not mean that all claimed embodiments or methods include the referenced feature(s).

First, second, third, etc. (“ordinals”): Unless otherwise noted, ordinals only serve to distinguish or identify (e.g., various members of a group); the mere use of ordinals implies neither a consecutive numerical limit nor a serial limitation.

receive/provide/send/input/output: unless otherwise explicitly specified, these words should not be taken to imply: (i) any particular degree of directness with respect to the relationship between their objects and subjects; and/or (ii) absence of intermediate components, actions and/or things interposed between their objects and subjects.

containerized: code portions running at least substantially independently of each other.

terminal/terminal hardware set: a set of computer peripheral hardware that includes at least one input device that can be used by a human user to input data and at least one output device that outputs data to a human user in human user readable form.

ultra thin terminal: any terminal or terminal hardware set that has substantially no memory; generally ultra thin terminals will have no more processing capability than the amount of processing capability needed to run a video display, but this is not necessarily required.

basic I/O operations: operations related to receiving input from or delivering output to a human user; basic I/O operations relate to control of I/O devices including, but not limited to keyboards, mice, visual displays and/or printers.

guest OS: a guest OS may be considered as a guest OS regardless of whether: (i) a host OS exists in the computer system; (ii) the existence or non-existence of other OS's on the system; and/or (iii) whether the guest OS is contained within one or more subsuming OS's.

security level: a level of privileges and permissions for accessing or exchanging instructions with processing hardware; for example, some types of processing hardware define security levels as Ring Zero (level of greatest permissions and privilege), Ring One, Ring Two, and so on; not all security levels may be used in a given computer system.

OS security level: any security level defined in a given system that is consistent with normal operations of a typical operating system running directly on the processing hardware (and not as a virtual machine); for example, for an Intel/Windows type of processing hardware Ring Zero, Ring One and perhaps Ring Two would be considered as “OS security levels,” but Ring Three and higher would not.

native form: a form of instructions that can be operatively received by and/or is output from processing hardware directly and without any sort of translation or modification to form by software running on the hardware; generally speaking, different processing hardware types are characterized by different native forms.

POSIX: includes, but is not limited to, LINUX.

processing hardware: typically takes the form of a central processing unit, but it is not necessarily so limited; processing hardware is not limited to any specific type and/or manufacturer (for examples, Intel/Windows, Apple, Sun, Motorola); processing hardware may include multiple cores, and different cores may or may not be allocated to different guest operating systems and/or groups of operating systems.

socket: any socket and/or API now known or to be developed in the future, with out regard to: (i) whether the socket is considered to be included within and/or integral with its underlying OS.

Kernel: a kernel may take the form of an operating system.

Operating system: an operating system may take the form of a kernel.

Computer system: any computer system without regard to: (i) whether the constituent elements of the system are located within proximity to each other; and/or (ii) whether the constituent elements are located in the same housing.

Exchange instructions: includes: (i) two way exchanges of instructions flowing in both directions between two elements; and/or (ii) one way transmission of instructions flowing in a single direction from one element to another.

Memory portion: any portion of a memory structure or structures, including, but not necessarily limited to, hard drive space, flash drive, jump drive, solid state memory, cache memory, DRAM, RAM and/or ROM; memory portions are not limited to: (i) portions with consecutive physical addresses; (ii) portions with consecutive logical address; (iii) portions located within a single piece of hardware; (iv) portions located so that the entire portion is in the same locational proximity; and/or (v) portions located entirely on a single piece of hardware (for example, in a single DRAM).

cycle: any process that returns to its beginning and then repeats itself at least once in the same sequence.

selectively allow: the selectivity may be implemented in many, various ways, such as regular cycling, user input directed, dynamically scheduled, random, etc.

pre-empt: includes, but is not limited to, delay, queue, interrupt, etc.

To the extent that the definitions provided above are consistent with ordinary, plain, and accustomed meanings (as generally shown by documents such as dictionaries and/or technical lexicons), the above definitions shall be considered supplemental in nature. To the extent that the definitions provided above are inconsistent with ordinary, plain, and accustomed meanings (as generally shown by documents such as dictionaries and/or technical lexicons), the above definitions shall control. If the definitions provided above are broader than the ordinary, plain, and accustomed meanings in some aspect, then the above definitions shall be considered to broaden the claim accordingly.

To the extent that a patentee may act as its own lexicographer under applicable law, it is hereby further directed that all words appearing in the claims section, except for the above-defined words, shall take on their ordinary, plain, and accustomed meanings (as generally shown by documents such as dictionaries and/or technical lexicons), and shall not be considered to be specially defined in this specification. In the situation where a word or term used in the claims has more than one alternative ordinary, plain and accustomed meaning, the broadest definition that is consistent with technological feasibility and not directly inconsistent with the specification shall control.

Unless otherwise explicitly provided in the claim language, steps in method steps or process claims need only be performed in the same time order as the order the steps are recited in the claim only to the extent that impossibility or extreme feasibility problems dictate that the recited step order (or portion of the recited step order) be used. This prohibition on inferring method step order merely from the order of step recitation in a claim applies even if the steps are labeled as (a), (b) and so on. This broad interpretation with respect to step order is to be used regardless of whether the alternative time ordering(s) of the claimed steps is particularly mentioned or discussed in this document.

Claims

1. A computer system comprising:

processing hardware;

a first guest operating system;

a controller kernel running on the processing hardware, with the controller kernel being programmed to allow the first guest operating system to receive first native form video frame data from the processing hardware through the controller kernel, with the controller kernel comprising a first socket; and

a first application program programmed to generate first application display data when it runs;

wherein:

the first socket is programmed to run the first application program; and

the controller kernel is programmed to receive the first application display data and to incorporate the first application display data into the first native form video frame data.

2. The system of claim 2 wherein the controller kernel is further programmed to send the first native form video frame data through the controller kernel to the first guest operating system.

3. The system of claim 2 wherein the first guest operating system comprises a display manager module that is native to the guest operating system, with the display manager module being programmed to receive the first native form video frame data.

4. The system of claim 1 further comprising:

a first display structured to display a plurality of successive frames of a display over time; and

a video card programmed to receive the first native form video frame data, to generate a first frame display signal corresponding to the first native form video frame data and to send the first frame display signal to the first display;

wherein the first display is structured and/or programmed to display a frame of the plurality of successive frames corresponding to the first frame display signal.

5. The system of claim 4 wherein the first frame display signal is analog.

6. The system of claim 4 wherein the first frame display signal is digital.

7. The system of claim 1 wherein the controller kernel is in POSIX.

8. The system of claim 1 wherein the first guest operating system is of a Windows type.

9. The system of claim 8 wherein the controller kernel is LINUX.

10. The system of claim 7 wherein the controller kernel is LINUX.

11. The system of claim 1 further comprising a first user input device structured and electrically connected to receive a raw input data from a user, wherein:

the first guest operating system is further programmed to receive the raw input data from the first user input device and to convert it into user input data in native form;

the controller kernel is further programmed to receive the user input data in native form; and

the first socket is programmed to use the user input to at least partially control the manner in which the application program runs.

12. The system of claim 11 wherein the first user input device is a keyboard.

13. The system of claim 1 further comprising:

a second guest operating system; and

a second application program programmed to generate second application display data when it runs;

wherein:

the controller kernel is further programmed to allow the second guest operating system to receive second native form video frame data from the processing hardware through the controller kernel, with the controller kernel further comprising a second socket;

the second socket is programmed to run the application program; and

the processing hardware is programmed to receive the second application display data and to incorporate the second application display data into the second native form video frame data.

14. The system of claim 1 further comprising a second display structured to display a plurality of successive frames of a display over time, wherein:

the video card is further programmed to receive the second native form video frame data, to generate a second frame display signal corresponding to the second native form video frame data and to send the second frame display signal to the second display;

wherein the second display is structured and/or programmed to display a frame of the plurality of successive frames corresponding to the second frame display signal.

15. A computer comprising:

processing hardware;

a first OS memory portion programmed with a first guest operating system;

a controller memory portion programmed with a controller kernel running on the processing hardware, with the controller kernel being programmed to allow the first guest operating system to receive first native form video frame data from the processing hardware through the controller kernel, with the controller kernel comprising a first socket; and

a first application memory portion programmed with a first application program programmed to generate first application display data when it runs;

wherein:

the first socket is programmed to run the first application program; and

the processing hardware is programmed to receive the first application display data and to incorporate the first application display data into the first native form video frame data.

16. The system of claim 15 wherein the controller kernel is in POSIX.

17. The system of claim 16 wherein the first guest operating system is of a Windows type.

18. A process comprising the steps of:

providing a computer system comprising processing hardware, a first guest operating system, a controller kernel, a first application program, with the controller kernel comprising a first socket;

running the controller kernel on the processing hardware;

running the first application program on the first socket;

generating, by the first application program, first application display data;

sending the first application display data from the socket to the processing hardware; and

incorporating, by the processing hardware, the first application display data into a first native form video frame data.

19. The method of claim 18 further comprising the step of:

sending the first native form video frame data from the processing hardware to the first guest operating system through the controller kernel.

20. The system of claim 18 wherein:

the controller kernel is in POSIX; and

the first guest operating system is of a Windows type.