CN100428196C - A method for fast recovery of computer system - Google Patents

Abstract

The invention belongs to the technical field of computer storage system structure, and is characterized in that it virtualizes storage devices and provides a virtual storage view for the system by using mapping technology. All operations of the system on storage devices are carried out on the virtual view. After the virtual view is removed, the system restores to the real view, thereby realizing the rapid restoration of the system. It contains: Virtual device control program ⑦: This module is the interface between the user and the storage device virtual layer ⑥, through which the user can control and set other functional modules of the system restoration. Storage device virtualization layer ⑥: This module is composed of three sub-modules: virtual driver ② of physical storage device, virtual mapping algorithm ③ and abstraction layer ④ of virtual storage device. This module accesses physical device through the virtual driver ② of sub-module physical storage device , provides a "synthetic" virtual storage view to the file system through the sub-module virtual storage device abstraction layer ④. When it protects and restores the system, it does not involve data backup and recovery operations.

Description

A method for fast recovery of computer system

technical field

A method for quickly restoring a computer system belongs to the technical field of computer storage system structures.

Background technique

With the gradual improvement of the stability of computer hardware, computer failures are increasingly manifested as soft failures, that is, various failures caused by software. These soft failures are generally caused by harmful code attacks, misoperation or software incompatibility. With the popularity of network applications, harmful code attacks have become the main source of soft faults, seriously affecting the use of computers. Although people have invested a lot of research and development work in computer security, any computer system has loopholes and the possibility of collapse, and it is impossible for people to block all computer loopholes or completely avoid wrong operations. In fact, due to various unavoidable factors such as human error, an absolutely safe system does not exist in reality. Therefore, in the case of a computer system crash, how to quickly restore the system to a working state is a very useful method .

In many application software, undo operation has become an indispensable function, such as typesetting software, database software, etc., all have undo operation, which provides great convenience for users to restore wrong operations. Like the undo operation in application software, system restore is an undo operation that acts on the entire computer system. It can not only restore various changes caused by application software to the system, but also restore the changes caused by the operating system to the system. It is A method capable of restoring a computer system to a previous specified state.

In system restoration, it generally involves data backup and recovery operations. These backup data not only occupy a large amount of disk space, but also take a long time for both backup and recovery operations. When the amount of data is increasing Under the circumstances, this method is more and more unsuitable for the requirements of the fast recovery system.

The present invention is a system restoration method for quickly restoring a computer system to a specific state. The method utilizes data mapping technology to realize system protection and fast restoration. Since the method does not involve data backup and restoration operations, it not only occupies the system The resources are small, and the speed of restoring the system is very fast.

Contents of the invention

The purpose of the present invention is to provide a restoration method for quickly restoring the computer system to a specific state when the system is damaged or the user needs it.

The present invention is characterized in that the method is implemented in the computer system according to the following steps:

Step (1) Dynamically divide the storage space owned by the computer system into two areas according to the following steps, all allocated space forms a system storage area, and all unallocated space forms a temporary storage area, and the system storage area contains prohibited external operations. For the target data to be restored that is protected by direct modification, the mapping data of the target data that has undergone modification operations including adding, deleting, and modifying the target data is stored in the temporary storage area. The data in the system storage area and the temporary storage area are synthesized and processed through the mapping algorithm including the virtual read algorithm and the virtual write algorithm;

In step (1.1), take the hard disk as its basic storage unit sector and perform linear addressing according to the logical block address LBA to represent the hard disk sector address as: 0, 1, 2, ..., MaxLBA, where MaxLBA Indicates the total number of sectors of the hard disk minus 1;

Step (1.2) uses 2 to the N (N=1, 2, 3...) sectors as a basic unit, which is called a BLOCK block, and divides the entire hard disk into [MaxLBA/2 ^N ]+1 BLOCK;

Step (1.3) Each BLOCK is represented by two numbers DAT and MAP: DAT is composed of 2 bits, indicating that the four states of the BLOCK are: idle, modified, protected and mapped, wherein 00 indicates that the BLOCK block is idle, Belongs to the temporary storage area; 01 indicates that the BLOCK block was originally a free block, which has been modified and belongs to the temporary storage area; 10 indicates that the BLOCK block is a protected block and belongs to the system storage area; 11 indicates that the BLOCK block has been mapped. Indicates that the block was originally a protected block and was "modified". The read and write operations on this block need to be relocated according to the address pointer in the MAP; when N=5, the MAP consists of 64 bits, of which 32 bits represent BLOCK Mapping status of each sector in the block, its value is 1, indicating that the sector has been mapped, otherwise it is unmapped, other bits in MAP indicate the mapping address corresponding to the mapping, if the block is not mapped, it is 0, mapping The address is represented by pMAP. The mapping refers to mapping the data that is protected in the system storage area so that it needs to be restored when the system is restored to the temporary storage area and saved in the temporary area after the modification operation. These are stored in the temporary area after mapping The data is called mapping data, the mapping address pMAP represents the corresponding mapping address of each BLOCK block in the temporary storage area, and pBLOCK represents the actual block address of each BLOCK in the system storage area;

Step (1.4) Construct block allocation table BAT and mapping index table MIT:

The BAT table is composed of data composed of DAT representing the state of each BLOCK, indicating the state of each BLOCK block;

The MIT table is composed of data composed of all MAPs representing the mapping address and mapping status of each BLOCK, indicating the mapping status of each BLOCK block and each sector within it;

Step (2) the following modules are set in the computer system: the virtual device control program module located on the user interface is the interface between the user and the storage device virtual layer module, and the user controls and sets other modules for system restoration through this module;

The storage device virtual layer module is interconnected with the file system system, and the file system is interconnected with the virtual device control program module, and the storage device virtual layer module is set in the storage device virtual layer, including: three sequentially interconnected The virtual storage device abstraction layer, the virtual mapping algorithm and the virtual driver of the physical storage device have three sub-modules, among which: the virtual driver sub-module accesses the physical storage device, and the virtual mapping algorithm sub-module is equipped with: virtual write operation algorithm, virtual read Operation algorithm, mapping data submission algorithm and system restoration algorithm, the virtual mapping algorithm sub-module reads and writes the physical storage device through the virtual driver, and converts the original data to be restored in the system storage area and the mapping data in the temporary storage area Synthesize the virtual storage view, and then provide the virtual storage view to the file system through the virtual storage device abstraction layer sub-module;

Step (3) establishes the initial state of BAT and MIT tables:

The initial state of the BAT table is established by the protection program during installation by scanning the file allocation table of the file system to establish the initial state of each item in the BAT table. The initial state of each item in the BAT table is only idle and protected. The MIT table The initial value is 0;

Step (4) Use the virtual write operation algorithm to intercept all write operations of the system to the hard disk according to the following steps, and then perform corresponding mapping transformations to realize dynamic protection of the system:

Step (4.1) the virtual mapping algorithm submodule in the virtual layer of the storage device obtains the logical block address LBA of the sector to be written on the hard disk;

Step (4.2) The virtual mapping algorithm sub-module calculates the actual block address pBLOCK of the BLOCK block where the sector to be written is located and the offset offset of the sector in the BLOCK block according to the following formula, wherein Offset indicates that the sector is in the BLOCK block In the formula, "/" means integer division operation, and "MOD" means modulo operation:

Under the condition that the sector of the BLOCK block is 32, LBA represents the logical block address,

pBLOCK=LBA/32,

Offset = LBA MOD 32,

Step (4.3) finds the state of the BLOCK block where this sector is located in the BAT table according to pBLOCK and Offset;

Step (4.4) judges whether this block is protected state:

If it is in the protected state, search for free BLOCK blocks in the temporary storage area,

A. If found, perform the following steps in sequence:

The state of the original BLOCK block described in the step (4.4.1) step (4.3) is changed into a mapping state;

The state of the free BLOCK block that step (4.4.2) finds is changed into protected state;

Step (4.4.3) put the address pFREE value of the found free BLOCK block into the corresponding mapping address pMAP of the original BLOCK block in the MIT table, and set the corresponding position of the sector in the MIT table to 1;

Step (4.4.4) calculates the concrete mapping address MapLBA=pFREE*32+Offset of this sector in the MIT table, changes over to step (4.6);

B. If no free BLOCK block is found, the return status is set to disk full, and then go to step (4.7)

If step (4.5) is non-protected state, then judge whether the BLOCK block described in step (4.3) is idle state:

If it is idle state, then change the state of this BLOCK block in the BAT table into the modified state, make MapLBA=LBA, then change to step (4.6);

If it is not in the idle state, it is judged whether it is in the modified state;

If it is the modified state, make MapLBA=LBA, then turn to step (4.6);

If it is a mapping state, then the mapping address pMAP of the BLOCK block is obtained in the MIT table, and the corresponding position of the sector in the MIT table is 1, then the mapping address MapLBA=pMAP*32+Offset of the sector is calculated, and Go to step (4.6);

Step (4.6) transfers the obtained MapLBA to the virtual driver of the physical storage device as a physical address, and then writes the corresponding sector by the hard disk driver;

Step (4.7) returns the write operation state;

Step (5) Use the virtual read operation algorithm to intercept all read operations of the system to the hard disk according to the following steps, and read out the data:

Step (5.1) the virtual layer of the storage device obtains the address pBLOCK and offset Offset of the BLOCK block where the sector to be read is located, wherein the calculation method of pBLOCK and Offset is the same as step (4.2);

Step (5.2) check whether the state of the BLOCK block where the sector is located is in the mapping state according to pBLOCK and Offset in the BAT table;

Step (5.3) If the BLOCK block is in the mapping state, perform the following steps in sequence:

Step (5.3.1) checks the state position of this sector according to the corresponding item of pBLOCK in the MIT table;

Step (5.3.2) If the sector has been mapped, then:

The corresponding entry in the MIT table obtains the mapping address pMAP of this block, and calculates the mapping address MapLBA=pMAP*32+Offset of this sector, then executes step (5.5);

Step (5.3.3) if this sector is not mapped, make MapLBA=LBA, directly go to step (5.5);

Step (5.4) If the BLOCK block is in an unmapped state, then MapLBA=LBA, then perform step (5.5);

Step (5.5) transfers MapLBA to the virtual driver program of physical storage device as physical address, then reads corresponding sector by hard disk driver program, returns read operation state again;

Step (6). Use the mapping data submission algorithm according to the following steps to merge the data in the temporary storage area into the system storage area:

Step (6.1) scans the first BLOCK block of the hard disk;

Step (6.2) checks the state of this BLOCK block in BAT table;

Step (6.3) If it is in the mapping state, follow the steps below:

Step (6.3.1) checks the status bit of each sector of the BLOCK block in the corresponding item of the MIT table, and judges whether the sector has been mapped;

If step (6.3.2) is mapped, copy the data of the corresponding sector in the corresponding mapping block in the temporary storage area to the sector selected in the step (6.3.1) according to the mapping address of the sector; if not mapping, then perform step (6.3.3);

Step (6.3.3) judges whether all sectors in the selected BLOCK in step (6.2) have been checked, if not checked, continue to perform step (6.3.1), otherwise, perform step (6.4);

Step (6.4) judges whether all BLOCK blocks in the hard disk have been scanned, if not, scan the next BLOCK block in the hard disk, and then go to step (6.2), otherwise go to step (7)

Step (7) discards the data in the temporary storage area with the data restoration algorithm according to the following steps:

Step (7.1) clears BAT table and MIT table to 0;

Step (7.2) rescans the disk, constructs a new BAT table, and completes data submission or restoration.

The invention is a method for restoring the system, which is used for quickly recovering the system to a specific state when the system is damaged or required by users. The method uses mapping technology to provide a virtual storage view for the computer system. All the operations of the system on the storage device are carried out on the virtual view. Main features of the present invention are as follows:

1. Strong protection ability

The invention is a kind of system protection based on the storage device, which is located under the file system, not only can protect the damage operation through the file system, but also can restore the system when the system cannot be started.

2. Wide range of applications

The method can be applied to various storage devices and operating systems, not only to various PCs and servers, but also to various terminal devices, such as mobile phones, ATMs and other systems with storage devices. The method can be implemented not only in pure hardware, but also in pure software or a combination of software and hardware.

3. Fast restoration speed

Different from the existing restore method, the method protects the system through mapping. When protecting and restoring the system, it does not involve data backup and restore operations, so the restore speed is fast. For example, the time required to restore data on a hard disk with a capacity of 60G is only ten seconds.

4. Small additional space

This method does not back up the original data, and the additional storage space it occupies is mainly the storage space occupied by the control table. The additional disk space occupied by this method accounts for about 0.05% of the entire disk space.

5. Little impact on system performance

Compared with the existing system restoration method, since this method does not involve data backup operation, its main operation is table look-up operation. It can be seen from theoretical analysis and experimental results that it has relatively little impact on system performance.

Description of drawings

Fig. 1. The principle diagram of the realization of the method of the present invention, in this figure, the data in the "system storage" represents protected data, that is, the data that needs to be restored when restoring; the data in the "temporary storage" is to store the mapping In the area of data, the modification operations such as addition, deletion, and modification of system storage data in the present invention are all mapped in the temporary storage area; "synthetic view" means the virtual view that the system "sees" after being processed by the algorithm provided by the present invention ; "file view" means the view presented by the file system after expressing the "synthetic view" in the form of a file.

Figure 2. The state transition of DAT and MAP corresponding to a BLOCK. The "direct write" in the figure means that the sector to be written by the system is located in the BLOCK block represented by this DAT and MAP. "Mapping write" means that the BLOCK block where the sector to be written by the system is located is protected, that is, the state of the DAT corresponding to the BLOCK block is protected.

Figure 3. Virtual write operation algorithm, which shows the detailed algorithm of virtual write operation.

Figure 4. Virtual read operation algorithm, which shows the detailed algorithm of virtual read operation.

Figure 5. Mapping the data submission algorithm, which shows the data submission algorithm.

Figure 6. Restore algorithm, which shows the algorithm of system restore.

Fig. 7. The pure software implementation architecture of the system restoration method, in which the parts in bold are related modules of the method of the present invention. The other parts are system modules. The storage device virtualization layer ⑥ is composed of three sub-modules: the virtual driver ② of the physical storage device, the virtual mapping algorithm ③ and the abstraction layer ④ of the virtual storage device. The storage device virtualization layer ⑥ accesses the physical device through the virtual driver ② sub-module of the physical storage device , the storage device virtualization layer ⑥ provides a "synthetic" virtual storage view to the file system through the virtual storage device abstraction layer ④ sub-module. The virtual device control program ⑦ is a user control interface program through which the user can control and set other functional modules of the system restoration.

Fig. 8. The pure hardware implementation architecture of the system restoration method. In this figure, the storage device virtualization layer ⑥ in Fig. 7 is implemented with a single module storage device virtual mapping algorithm and interface ⑥.

Fig. 9. The combined software and hardware implementation architecture of the system restoration method, the mapping algorithm 8 located in the computer system BIOS or EFI is realized by hardware, other modules are realized by software, and each functional module is the same as the functional module in Fig. 7 .

表示存在系统还原情况下的实验结果，表示没有系统还原情况下的实验结果，图(a-d)中Iometer的读写块大小分别为1K、4K、8K和16K。Figure 10(ad). The experimental results of system restoration on the performance of storage devices, in the figure

Indicates the experimental results in the presence of system restore, Indicates the experimental results without system restoration. The read and write block sizes of Iometer in (ad) are 1K, 4K, 8K and 16K respectively.

Detailed ways

The present invention virtualizes the storage device and uses mapping technology to provide a virtual storage view for the system. All operations of the system on the storage device are performed on the virtual view. After the virtual view is removed, the system restores to the real view, thereby realizing Quick restore of the system. It contains:

Virtual device control program ⑦: This module is the interface between the user and the storage device virtual layer ⑥, through which the user can control and set other functional modules of the system restoration.

Storage device virtualization layer ⑥: This module consists of three sub-modules: virtual driver of physical storage device ②, virtual mapping algorithm ③ and abstraction layer of virtual storage device ④. This module accesses physical devices through sub-module virtual driver of physical storage device ② , provides a "synthetic" virtual storage view to the file system through the sub-module virtual storage device abstraction layer ④.

The invention divides the storage space owned by the system into two areas: all the allocated space forms the system storage area, and all the unallocated space, that is, the free space forms the temporary storage area. At the same time, the target data to be restored is "protected", prohibiting external operations from directly modifying it, and mapping all modification operations to the target data to the temporary storage area, and through the given virtual read operation algorithm and virtual write operation algorithm. The original data and the mapped data are "synthesized" to achieve the purpose of "modification". See Figure 1 for the principle of implementation. In Figure 1, the data in "system storage" represents the protected data, that is, the data that needs to be restored when restoring, and the modification operations (including adding, deleting, modifying, etc.) to the system stored data are mapped in the temporary storage area In the process of "synthesis", a virtual view is provided for the file system. From the perspective of the file system, all modification operations have been successfully completed, so that "write" operations can be performed in the "read-only" system storage area up. It can be seen from the above principles that as long as the "synthesis" operation is removed, system restoration can be realized. Since no additional backup data and data recovery operations are involved, the present invention not only has relatively little impact on system performance, but also has a very fast restoration speed. If the user wants to submit the modification operation to the system storage area, the data in the temporary storage area can be merged into the system storage area only by following the mapping data submission algorithm provided by the present invention.

In the following description, for the convenience of discussion, the hard disk is selected as the specific storage device. For other types of storage devices, the method proposed by the present invention is also applicable, but the basic storage unit of the storage device is determined by the specific storage device.

The hard disk is linearly addressed according to the logical block address LBA (Logical Block Area) based on its basic storage unit sector. The address of the hard disk sector after addressing is expressed as: 0, 1, 2..., MaxLBA, where The MaxLBA indicates that the total number of sectors of the hard disk is reduced by 1, and then 32 (this value is variable, but it is best to be 2 to the N (N=1, 2, 3...) power, so as to be consistent with the number of clusters in the current operating system As a basic unit, a sector is called a BLOCK block, which divides the entire hard disk into [MaxLBA/32]+1 BLOCK blocks. Each BLOCK is represented by two numbers, called DAT and MAP respectively. The DAT corresponding to each BLOCK consists of 2 bits, which are used to indicate the four states of the BLOCK: idle, modified, protected and mapped. Each MAP consists of 64 bits (the number should be adjusted accordingly as the size of the BLOCK block changes), and is used to store the mapping address of the BLOCK block and the mapping status of each sector in the BLOCK block, of which 32 bits represent BLOCK The mapping status of each sector in the block, a certain bit is 1 to indicate that the sector has been mapped, otherwise it is unmapped, and other bits in the MAP are used to indicate the corresponding mapping address of the BLOCK block (0 if the block is not mapped ), called pMAP. The data composed of all DATs representing the BLOCK state is called the Block Allocation Table BAT (Block Allocation Table), and the data composed of all the MAPs representing the BLOCK mapping address and sector mapping state is called the Mapping Index Table MIT (Mapping Index Table). Each BLOCK on the hard disk has a DAT and a MAP number in the BAT table and the MIT table, and there is a one-to-one correspondence between them, and there is a one-to-one mapping relationship between them.

The protection algorithm is based on the data of the BAT and MIT tables to map the sector addresses of the hard disk, especially the BAT table, which records the state of the BLOCK block and determines various operations of the mapping transformation. For each data DAT representing a BLOCK block in the BAT table, the four states represented are:

00表示此BLOCK块空闲，属于临时存储区域。

00 means that this BLOCK block is free and belongs to the temporary storage area.

01表示此BLOCK块原为空闲块，现已作过修改，属于临时存储区域。

01 means that this BLOCK block was originally a free block, which has been modified and belongs to the temporary storage area.

10 indicates that this BLOCK block is a protected block and belongs to the system storage area.

11表示此BLOCK块已被映射，说明该块原为受保护块并且被“修改”，对该块的读写操作均需根据MAP中的地址指针来重定位。

11 indicates that the BLOCK block has been mapped, indicating that the block was originally a protected block and was "modified", and the read and write operations on the block need to be relocated according to the address pointer in the MAP.

The state transition of DAT and MAP representing a certain BLOCK block is shown in Figure 2. The "direct write" in the figure means that the sector to be written by the application program or operating system is located in the BLOCK block represented by this DAT or MAP . The "mapping write" in the transition from idle state to protected state means that the BLOCK block where the sector to be written by the application program or operating system is located is protected, that is, the state of the DAT corresponding to the BLOCK block is in the protected state. In this case, the write operation algorithm searches for free BLOCK blocks on the hard disk, then sets the state of the DAT corresponding to the original BLOCK block to the mapping state, sets the DAT corresponding to the found free BLOCK block to the protection state, and then sets The starting LBA value of the BLOCK block is written into the pMAP in the corresponding MAP, and the position corresponding to the sector position in the MAP is set to 1.

Although there are many ways to operate storage devices, they all belong to the scope of "read" and "write" operations in essence. Therefore, in order to realize virtual disk operations, it is only necessary to implement virtual read operations and virtual write operations. Can. For the convenience of expression, the following algorithm only takes processing one sector as an example. If multiple sectors need to be processed, just repeat the algorithm. In the following algorithm description, Offset indicates the offset of a certain sector in the block, that is, which sector is the sector in the BLOCK block; pBLOCK indicates the actual block address corresponding to each BLOCK block; pMAP indicates BLOCK Mapping address corresponding to the block; MapLBA indicates the logical address after sector mapping; pFREE indicates the block address of the free block, "/" in the formula indicates integer division operation, and "MOD" indicates modulo operation.

Virtual write operation algorithm: This method intercepts all write operations of the system to the storage device, and then performs corresponding mapping transformation according to the given algorithm, so as to realize the dynamic protection of the system. The specific description of the algorithm is shown in Figure 3.

Virtual read operation algorithm: This method intercepts all read operations of the storage device by the system, and then completes the data read operation according to the given algorithm. The specific description of the algorithm is shown in Figure 4.

Mapped data submission algorithm: During system recovery, in order to restore the system to the current state, the data stored in the temporary storage area needs to be submitted to the system storage area. Thus, the data in the temporary storage area is merged into the system storage area. Since the data submission operation involves the copy operation of all mapping data, the time required to submit the data is related to the amount of submitted data. For a detailed description of the submission algorithm, see Figure 5.

System restoration algorithm: Since all write operations to the storage device are virtualized, all "modified" data in the system can be restored by removing the "synthetic" operation when restoration is required. We know from the virtual reading and writing algorithm that all "synthetic" operations are processed according to the data in the BAT and MIT tables. Therefore, as long as the data in the BAT and MIT tables are cleared to 0, the purpose of restoring the system can be achieved. Since the recovery operation (such as copying, etc.) of "modified" data is not involved in the restoration, the time required for system restoration is the time for clearing BAT and MIT and rebuilding the BAT table, so the restoration speed is very fast. In fact, the principle adopted by the present invention determines that it also has an implicit restoration mode: self-recovery restoration mode. When the system restore program itself is attacked and the system crashes, when the system restarts, due to the failure of the virtual layer of the storage device, the "synthesis" operation no longer exists, and the system will automatically restore to the state at the time of the last submission. Accompanying drawing 6 has given the specific restoration algorithm.

To implement the above algorithm, a very important step is to establish the initial state of the BAT and MIT tables. The initial state of the BAT table is established by the protection program by scanning the allocation table of the file system during installation. For example, for FAT16 and FAT32 type file systems, the current disk allocation state can be obtained by scanning the corresponding FAT table; for the NTFS file system, you can Get the current disk allocation status, etc. by scanning the bitmap file. The initial state of each item in the BAT table is only idle and protected, and the initial value of the MIT table is 0.

The above algorithm can be implemented in a pure hardware manner, or in a pure software manner, or in a combination of software and hardware.

In the implementation of pure software, specific analysis needs to be carried out according to the operating system installed in the computer system. The dependent architecture is shown in Figure 7. As long as it is ensured that during the startup and operation of the computer system, all storage device operations are under the control of the virtual read-write algorithm proposed by the present invention.

In the pure hardware implementation mode, the storage device virtual layer ⑥ in the accompanying drawing 7 is implemented in a single module form, and the specific architecture is shown in the accompanying drawing 8, wherein the mapping algorithm adopts the algorithm provided by the present invention, and the interface is mainly The virtual device control program ⑦ located in the software layer provides the ability to control the storage device virtual layer ⑥, such as stopping or starting virtualization.

In the combination of software and hardware, the virtual mapping algorithm is implemented at two levels, and the virtual mapping algorithm ⑧ is implemented in the basic input and output system BIOS of the computer system. If the operating system installed in the computer system performs all operations on the storage device Both are performed through the BIOS, so the upper layer software no longer needs to implement the virtual mapping algorithm, and only needs to provide the virtual device control program ⑦ for the virtual mapping algorithm ⑧ to realize system restoration; operation, and the storage device is operated by the driver program carried by the operating system after starting, then the present invention not only realizes the virtual mapping algorithm 8 in the BIOS, but also needs to realize the storage device virtual layer 6 according to the architecture provided in accompanying drawing 9. For example, on the system that Windows or Linux/Unix are installed, realize that the combination of software and hardware proposed by the present invention realizes system restoration, then 6. and 8. must be realized simultaneously; It is not necessary to implement ⑥ if the system restoration is realized by hardware combination.

The additional storage space occupied by this algorithm is mainly the storage space occupied by the BAT table and the MIT table. Since the storage space occupied by the program implementing this algorithm is very small, it is ignored in the following analysis. In the calculation below, each sector is calculated as 512 bytes, and the size of each BLOCK is calculated as 32 sectors.

1) The space occupied by the BAT table

Because every 2 bits in the BAT table represent a BLOCK, one sector can represent 512*8/2=2048 BLOCKs, that is, it can represent 2048*32=65536 sectors. Therefore, the disk space occupied by the BAT table occupies the entire The ratio of disk space is 1/65536=0.0015%.

2) The space occupied by the MIT table

Because every 64 bits in the MIT table represents a BLOCK, so a sector can represent 512*8/64=64 BLOCKs, that is, it can represent 64*32=2048 sectors, therefore, the disk space occupied by the MIT table occupies the entire The ratio of disk space is 1/2048=0.0488%.

Combining 1) and 2) the additional disk space occupied by the Zhiben algorithm accounts for about 0.0015%+0.0488%=0.0503% of the entire disk space.

The additional system resources occupied by this algorithm mainly include the occupation of memory and CPU, among which the occupation of CPU time is mainly concentrated on the time of searching BAT and MIT tables; as for the occupation of memory, the part of this algorithm that needs to reside in memory depends on the usage The program that has been implemented in C language needs about 6K, but in order to speed up the search for BAT and MIT tables, a certain amount of space needs to be reserved in the memory to store the recently commonly used BAT and MIT table data, so that the data on the disk can be read and written. The number of BAT and MIT tables is minimized. The larger the space, the more data that can be stored in the recently used BAT table and MIT table, the faster the search speed, and the less CPU usage, but the more memory the protection program takes up, the smaller the available memory for the system, so , there is an optimal value problem. According to the actual test results, when the allocated memory space accounts for 3/%%% of the disk space (60G hard disk, 180K memory needs to be allocated for buffering BAT table and MIT table) protection The impact of the program on system performance has been reduced to a very small degree, and the effect of increasing the buffer is no longer obvious.

In order to verify the actual effect of the present invention and the impact on system performance, we have implemented it on Windows with pure software, and tested the functions and performance of the present invention respectively, wherein various destructive operations in the function test are mainly realized by programming , The performance test adopts the standard test program Iometer. The test environment is: 1.2GHz Intel Celeron CPU, 256Mbytes memory, Windows 2000 and 60G Seagate IDE hard disk (ST360021). The functional test results are shown in Table 1, and the performance test results are shown in Figure 10(a-d).

Table 1. Test results of system restore function

destruction operation Operation result Can it be recovered Delete Files Done, file missing Can Modify the file Done, the file has been modified Can format disk Done, disk data lost Can Destroy the master boot sector Done, the system cannot start Can

Because the method of the present invention mainly affects the read and write operations of the disk, in the performance test, the same test environment and the same parameter configuration are used to test the throughput of the disk under the situation of installing and not installing the system restoration software developed by the present invention respectively quantity. The read and write methods for the disk adopt sequential read (% random operation = 0, % read operation = 100), sequential write (% random operation = 0, % read operation = 0), random read and write (0<% random operation <100), where "random operation%" refers to the random probability of read and write operations, and "read operation%" refers to the proportion of read operations. Figures 10(a-d) show the test results when the read/write block sizes of the Iometer are 1K, 4K, 8K and 16K, respectively.

It can be seen from the figure that in the case of sequential read and write (% random operation = 0), this method has a certain impact on disk throughput, but with the increase of read and write randomness, this method has a certain impact on disk throughput. The impact gradually decreases, and then it also helps to improve throughput. Theoretically speaking, since this method requires additional table lookup operations, it will definitely affect the throughput of the disk. However, considering that the continuous read and write speed of the disk is much faster than the discontinuous read and write speed, this method can The system's random write operation to the disk forms continuous blocks during mapping, which improves the read and write speed of the system to a certain extent, so the abnormal result in the figure appears.

From the above analysis and the actual test results on Windows, the system restoration method proposed by the present invention generally occupies less system resources and has less impact on the overall performance of the system.

Claims (3)

1. the method for a computer system fast restore is characterized in that this method realizes successively according to the following steps in computer system:

The storage space that step (1) has computer system according to the following steps dynamically is divided into two zones, system's storage area is formed in all spaces of having distributed, the temporary storage area is formed in all unappropriated spaces, described system storage area contains forbids that peripheral operation is directly revised it and the target data to be restored that is protected, in the temporary storage area storage is that this target data was carried out comprising increase, deletion, the mapping (enum) data of the target data of the retouching operation in being modified in, simultaneously described system storage area interior with the temporary storage area in data by comprising the virtual algorithm of reading, the virtual algorithm of writing synthesizes processing at interior mapping algorithm;

Step (1.1) is hard disk a unit with its basic storage cell sector, and the hard disk sector address table that carries out after linearity addresses according to logical block block address LBA is shown: 0,1,2 ..., MaxLBA, MaxLBA wherein represent that total sector number of hard disk subtracts 1;

Step (1.2) is with 2 N (N=1,2,3 ...) a power sector is as a base unit, is called the BLOCK piece, and DISK to Image is divided into [MaxLBA/2 ^N]+1 BLOCK;

Each BLOCK of step (1.3) represents with two number DAT and MAP: DAT forms by 2, and the residing four kinds of states of expression BLOCK are: free time, modification, protected and mapping status wherein 00 this BLOCK piece free time of expression, belong to the temporary storage area; 01 this BLOCK piece of expression was free block originally, had now done modification, belonged to the temporary storage area; 10 these BLOCK pieces of expression are protected, belong to system's storage area; 11 these BLOCK pieces of expression are mapped, illustrate that this piece was protected and by " modifications " originally, to the read-write operation of this piece all need come reorientation according to the address pointer among the MAP; When N=5, MAP forms by 64, the mapping status of each sector in the 32 bit representation BLOCK pieces wherein, its value is that 1 this sector of expression is shone upon, otherwise be not mapping, other bit representation among the MAP should shine upon corresponding mapping address, if this piece does not shine upon, then be 0, mapping address is represented with pMAP, described mapping is meant protected in the system memory block so that the data map that need reduce when the system reducing is kept in this temporary realm through behind the retouching operation to the temporary storage area, these are called mapping (enum) data through the data that mapping is kept in the temporary realm, mapping address pMAP represents the mapping address of each BLOCK piece correspondence in the temporary storage area, and pBLOCK represents the actual block address of described each BLOCK in system's storage area;

Step (1.4) tectonic block allocation table BAT and map index table MIT:

The BAT table is made of the data that the DAT that represents all each BLOCK states forms, and represents the residing state of each BLOCK piece;

The MIT table is made of all data of representing that the MAP of each BLOCK mapping address and mapping status forms, represents the mapping status of each BLOCK piece and interior each sector thereof;

Step (2) is provided with lower module in described computer system: being located at the virtual unit control program module of user interface, is the interface of user and memory device virtual level module, and the user is by this module controls and other module that system reducing is used is set;

Memory device virtual level module, with the file system system interconnection, and this document system interconnects with described virtual unit control program module, described memory device virtual level module is located at the memory device virtual level, comprise: three virtual memory facilities level of abstractions that interconnect successively, the virtual device driver of virtual map algorithm and physical storage device is totally three submodules, wherein: virtual device driver submodule visit physical storage device, virtual map algorithm submodule is provided with: virtual write operation algorithm, virtual read operation algorithm, mapping (enum) data is submitted algorithm and system reducing algorithm to, this virtual map algorithm submodule carries out read-write operation by virtual device driver to physical storage device, the protected former data to be restored and the synthetic virtual store view of mapping (enum) data of temporary storage area in system's storage area, provide this virtual store view by virtual memory facilities level of abstraction submodule to file system again;

Step (3) is set up the original state of BAT and MIT table:

The original state of BAT table is set up in this BAT table each original state when mounted by defence program by the file allocation table of scanning document system, the original state of each has only idle and the protection two states in the BAT table, and the initial value of MIT table is 0;

Step (4) is used virtual write operation algorithm intercepting system all write operations to hard disk according to the following steps, remakes corresponding mapping transformation, realizes the dynamic protection to system:

Virtual map algorithm submodule in step (4.1) the memory device virtual level obtains will writing on the hard disk LBA (Logical Block Addressing) LBA of sector;

Step (4.2) virtual map algorithm submodule is calculated as follows the actual block address pBLOCK and the side-play amount Offset of this sector in the BLOCK piece of the BLOCK piece that will write the place, sector, wherein Offset represents that this sector is which sector in the BLOCK piece, computing is divided exactly in "/" expression in the formula, and " MOD " represents modular arithmetic:

Be under 32 the condition in the sector of BLOCK piece, LBA presentation logic block address,

pBLOCK＝LBA/32，

Offset＝LBA?MOD?32，

Step (4.3) checks in the state of the BLOCK piece at this place, sector in the BAT table according to pBLOCK and Offset;

Step (4.4) judges whether this piece is guard mode:

If guard mode, at the BLOCK of scratchpad area (SPA) domain lookup free time piece,

A. if find, just carry out following steps successively:

The state of the described former BLOCK piece of step (4.4.1) step (4.3) changes mapping status into;

The state of the idle BLOCK piece that step (4.4.2) finds changes guard mode into;

Step (4.4.3) is put into former BLOCK piece to the address pFREE value of the idle BLOCK piece that finds at the corresponding mapping address pMAP of MIT table, and the correspondence position 1 of this sector in the MIT table;

Step (4.4.4) is calculated the concrete mapping address MapLBA=pFREE*32+Offset of this sector in the MIT table, changes step (4.6) over to;

B. if do not find idle BLOCK piece, just return state is set to disk expires, and changes step (4.7) over to;

Step (4.5) if non-guard mode, then whether the described BLOCK piece of determining step (4.3) is idle condition:

If idle condition then changes the state of this BLOCK piece in the BAT table into the modification state, make MapLBA=LBA, change step (4.6) again over to;

If busy state then judges whether to be the modification state;

If the modification state makes MapLBA=LBA, change step (4.6) again over to;

If mapping status then obtains the mapping address pMAP of this BLOCK piece, and the correspondence position 1 of this sector in the MIT table, then calculates the mapping address MapLBA=pMAP*32+Offset of this sector, and change step (4.6) in the MIT table;

Step (4.6) is delivered to the virtual device driver of physical storage device to resulting MapLBA as physical address, writes corresponding sector by the hard drive program again;

Step (4.7) is returned the write operation state;

Step (5) is used all read operations to hard disk of virtual read operation algorithm intercepting system according to the following steps, and sense data:

Step (5.1) memory device virtual level obtains reading the address pBLOCK and the side-play amount Offset of the BLOCK piece at place, sector, the wherein same step of the computing method of pBLOCK and Offset (4.2);

Whether step (5.2) is in mapping status according to pBLOCK and Offset look into this place, sector BLOCK piece in the BAT table state;

Step (5.3) is carried out according to the following steps successively if this BLOCK piece is in mapping status:

Step (5.3.1) is looked into the mode bit of this sector according to the respective items of pBLOCK in the MIT table;

Step (5.3.2) is shone upon as if this sector, then:

Respective items in the MIT table obtains the mapping address pMAP of this piece, and calculates the mapping address MapLBA=pMAP*32+Offset of this sector, then execution in step (5.5);

Step (5.3.3) makes MapLBA=LBA if this sector is not shone upon, and directly changes step (5.5);

Step (5.4) is if this BLOCK piece is in not mapping status, and then MapLBA=LBA follows execution in step (5.5);

Step (5.5) is delivered to the virtual device driver of physical storage device to MapLBA as physical address, reads respective sectors by the hard drive program again, returns the read operation state again;

Step (6). submit algorithm to mapping (enum) data according to the following steps, the data in the temporary storage area are merged to system's storage area:

First BLOCK piece of step (6.1) scanning hard disk;

Step (6.2) is looked into the state of this BLOCK piece in the BAT table;

Step (6.3) is if mapping status, execution according to the following steps:

The respective items that step (6.3.1) is shown at MIT is looked into the mode bit of each sector of this BLOCK piece, judges whether this sector is shone upon;

Step (6.3.2) is if shine upon, according to the mapping address of this sector corresponding sectors of data in the corresponding mapping block in the temporary storage area copied in the step (6.3.1) in the selected sector; If do not shine upon, then execution in step (6.3.3);

Whether all sectors in step (6.3.3) determining step (6.2) among selected BLOCK inspected finish, if inspection finishes, continue execution in step (6.3.1), otherwise, execution in step (6.4);

Whether step (6.4) judges BLOCK pieces all in hard disk been scanned, if been scanned not then scans next BLOCK piece in the hard disk, changes step (6.2) then, otherwise changes step (7);

Step (7) is used the reduction of data algorithm according to the following steps, and the data in the temporary storage area are abandoned:

Step (7.1) is BAT table and MIT table clearly 0;

Step (7.2) rescans disk, constructs new BAT table, and data are submitted to or reduction finishes.

2. the method for a kind of computer system fast restore according to claim 1, it is characterized in that: the memory device virtual module in the described step (2) is realized with single modular form, be embodied in a physical storage device, this physical storage device is formed by the storage medium of the controller of memory device virtual map algorithm and interface, physical storage device and physical storage device intercommunication successively.

3. the method for a kind of computer system fast restore according to claim 1, it is characterized in that: described virtual map algorithm is realized at two levels respectively, realizes virtual algorithm and realize the fast restore method respectively by following two kinds of situations in the basic I/O system of lowest level between system physical memory device driver and physical storage device:

If computer operating system all realizes that by the virtual map algorithm in basic I/O system then upper layer software (applications) no longer needs to realize the virtual map algorithm to all operations of hard disk, only need provide and to finish system reducing the control program of virtual map algorithm;

If computer operating system is operated hard disk by basic I/O system when starting, hard disk is operated by the driver that operating system carries and start the back, then system not only will realize the virtual map algorithm in basic I/O system, and upper layer software (applications) also needs to realize the virtual map algorithm.

Images