JP2010020621A - Program recovery system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a program recovery system for recovering a program at fault while restraining primary processing from being affected. <P>SOLUTION: The program recovery system for recovering a program when a fault occurs in a main domain for executing a predetermined program in a multi-core system for providing at least two domains has, in one or more subdomains different from the main domain, a checking means for checking the state of the main domain; a restoring means for restoring the program when a fault occurs in the main domain; an emergency processing means for performing alternative processing of the program when the fault occurs in the main domain. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a program restoration system and method in a multi-core system.

  In a computer that requires continuous operation, a watchdog timer is known as a method for monitoring whether an OS or a program continues to operate normally. If the OS or program is operating normally, it periodically sends a signal to the watchdog timer. On the other hand, when a failure occurs, no signal is input to the watchdog timer. If no signal is input for a certain period of time, the watchdog timer resets the system in hardware. The system monitoring by such a method has a problem that the computer cannot provide any service during the restart.

On the other hand, Patent Document 1 discloses a technique for partially maintaining service functions using a dual system in order to provide services continuously. In Patent Document 1, each computer in a dual system executes a program that provides a service and a program that detects its own fault with a single CPU. If the fault can be repaired, it is repaired. If possible, perform partial operation while maintaining partial functionality.
JP 2007-140885 A

  However, in the case of the prior art as described above, since the original process and the process of checking for the presence or absence of a failure are performed by one CPU, an adverse effect due to a reduction in CPU allocation time for the original process becomes a problem. sell. In a system that requires strict real-time characteristics, real-time requirements may not be satisfied due to a delay associated with a decrease in CPU allocation time.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a technology for providing a safety function for repairing a program in which a failure has occurred while suppressing an influence on an original process. It is in.

  In order to achieve the above object, the present invention repairs a program in which a failure has occurred by the following means or processing.

  The present invention is a program repair system constructed on a multi-core system, and provides a domain that is at least two virtual execution environments, and repairs a program that is running in a main domain when a failure occurs. It is a program repair system.

  In this specification, a multi-core system means a computer system having a plurality of processor cores. Therefore, a system including a plurality of processor cores in one processor package, a system including a plurality of processors each having one processor core, and a combination thereof correspond to the multi-core system in this specification.

In this specification, a domain represents a virtual area / environment in which a program is executed. Each domain is independent of each other and cannot access other domains in principle. Therefore, even if an abnormality occurs in the program in each domain, it does not affect other domains.

  In such a system, a program for providing a service to a user is executed in the main domain.

  On the other hand, in one or more subdomains different from the main domain, an inspection unit that checks the state of the main domain, a restoration unit that restores the above program when a failure occurs in the main domain, and a failure in the main domain Emergency processing means for performing a substitute process for the program in the event of occurrence of a problem. It is preferable that the inspection unit and the restoration unit are executed in one domain and the emergency processing unit is executed in another domain, but all the units may be executed in one domain.

  According to the present invention, since the multi-core system is adopted, the service providing program and the inspection program can be operated independently. Therefore, the adverse effect on the original processing given by the addition of the safety function can be minimized. In addition, since the substitute process can be performed by the emergency processing means during the restoration of the program, the system can be restored while maintaining at least the minimum functions.

  In the present invention, it is preferable that a main domain that provides a program for providing a service to a user is a domain that cannot access a sub-domain. Further, it is preferable that the sub-domain that performs the program inspection / restoration processing is a domain that can execute only the trusted program and can access the main domain. Since the program for performing the inspection / restoration process guarantees the security of the entire system, it is preferable to execute the program in a domain in which security is ensured so that these programs are not tampered with.

  In the program restoration system according to the present invention, the inspection unit and the program in the main domain are normally executed in parallel, and the restoration unit and the emergency processing unit are executed in parallel at the time of program restoration. Is preferred.

  In this way, even if the inspection process and the restoration process are being executed, the original process and the emergency process are not hindered.

  The program repair system according to the present invention preferably includes, in the main domain, state storage means for storing the state of the main domain and state change means for updating the state storage means. In this case, the above-described inspection unit inspects the state of the main domain with reference to the state storage unit in the main domain.

  In this way, the only process that needs to be performed in the main domain is the process of updating the state storage means in the own domain, and the work cost is low. Moreover, the inspection means can inspect the state of the main domain by referring to the state storage means. Therefore, it is possible to minimize the adverse effect on the original processing given by the addition of the safety function for restoring the program.

  In addition, it is preferable that the state change unit in the present invention updates the state storage unit at a timing when interrupt processing occurs in the main domain.

  Since the interrupt process is an essential function in the main domain and is frequently performed, the state storage means is frequently updated.

  The present invention can be understood as a program repair system having at least a part of the above means. The present invention can also be understood as a program restoration method including at least a part of the above processing or a program for realizing such a method. Each of the above means and processes can be combined with each other as much as possible to constitute the present invention.

  According to the present invention, it is possible to detect and repair the occurrence of a program failure while suppressing the influence on the original processing.

  Exemplary embodiments of the present invention will be described in detail below with reference to the drawings.

  The present embodiment is a processing system having a multiprocessor core CPU and having a plurality of domains. Each domain is basically an execution environment independent of each other and cannot access other domains. However, by providing a mechanism for controlling access between domains, it is possible to provide a domain in which access to other domains is permitted. For example, ARM's TrustZone (registered trademark) technology can provide a secure domain and a non-secure domain, and therefore, by using TrustZone on a multi-core processor, this processing system having a plurality of domains can be suitably realized.

  A schematic diagram of various programs operating in the processing system is shown in FIG. In this system, two domains are provided, a secure domain 120 and a non-secure domain 130. Also, a monitor program 110 is provided that operates in a privileged mode and manages all changes between the secure domain 120 and the non-secure domain 130 in both directions.

  Within the secure domain 120, a secure operating system (OS) 122 is executed, on which a plurality of safety application programs (AP) 124, 126 are executed. The safety domain 120 is an environment in which only a trusted program can be executed, and the safety OS 122 and the safety APs 124 and 126 are programs whose reliability is guaranteed.

  In the non-secure domain 130, a non-secure OS 132 is executed, and a plurality of non-secure APs 134 and 136 are executed thereon. These non-secure APs 134 and 136 are executed in cooperation with the non-secure OS 132.

  Since these execution environments are independent of each other, even if an abnormality occurs in one domain, it does not adversely affect other domains. Since the monitor program 110 prohibits access from the non-secure domain 130 side to the secure domain 120 side, the secure domain 120 cannot be tampered with even if the non-secure APs 134 and 136 are tampered with. On the other hand, since access from the secure domain 120 side to the non-secure domain 130 side is permitted, the secure APs 124 and 126 access the memory allocated to the non-secure domain 130 to check whether they are operating normally, It can be reset.

  In addition, since this processing system employs a multi-core processor, the secure APs 124 and 126 in the secure domain 120 and the non-secure APs 134 and 136 in the non-secure domain 130 can be executed in parallel.

<Functional configuration>
Next, the functional configuration of the program repair system according to the present embodiment will be described with reference to FIG. In this system, three domains are defined: a main domain 10, an inspection domain 20, and an emergency processing domain 30.

  The main domain 10 is a domain in which an application program that provides a service function to a user is executed, and corresponds to the above-described non-secure domain.

  Further, the inspection domain 20 is a domain in which a program for restoring the main domain 10 is executed when the service function state of the main domain 10 is normal and an abnormality occurs. Equivalent to. Further, the emergency processing domain 30 is a domain in which a program for performing a service function substitution process is executed during the restoration of the main domain 10, and corresponds to the above-described safety domain. Here, although the inspection domain 20 and the emergency processing domain 30 are different domains, they may be configured as one domain (safety domain).

  The inspection domain 20 and the emergency processing domain 30 need not be tampered with. By making these domains secure domains independent of non-secure domains, it is possible to prevent tampering with programs in malicious non-secure domains. Furthermore, in order to prevent falsification of the program image itself stored in the ROM, it is preferable to prevent attacks and accidents by using secure boot. Secure boot is a technology that ensures that the platform has not been tampered with while verifying the boot ROM and BIOS that are activated immediately after power-on, and establishing a chain of trust in the boot process.

  The main domain 10 includes an interrupt processing unit 11, a main domain state change unit 12, and a main domain state storage unit 13 in addition to an application program that provides a service function to a user.

  The inspection domain 20 includes a main domain state reference unit 21, a main domain state comparison unit 22, a main domain pre-state storage unit 23, a comparison processing control unit 24, an emergency state control unit 25, and a main domain restoration unit 26.

  The emergency processing domain 30 has emergency processing software 31.

  In addition, although each said function part implement | achieves the function by the program stored in ROM being performed by CPU, a part may be mounted as hardware.

  Each functional unit will be described together with a flowchart showing the processing contents. FIG. 3 is a flowchart showing processing by the main domain 10, FIG. 4 is inspection processing by the inspection domain 20, and FIG. 5 is a flowchart showing restoration processing by the inspection domain 20 and emergency processing by the emergency processing domain 30.

<Main domain processing>
First, each functional unit of the main domain 10 will be described with reference to the flowchart of FIG. In the main domain 10, when an interrupt occurs, an interrupt signal is notified to the interrupt processing unit 11. Such an interrupt signal is generated when a page fault or I / O control is performed in the main domain. The interrupt processing unit 11 activates the main domain state changing unit 12 before the original processing for the interrupt signal (step S10).

Then, the main domain state change unit 12 updates the contents of the main domain state storage unit 13 (step S11). The data stored in the main domain state storage unit 13 is referred to as a state value of the main domain 10 or simply a state value. Since interrupt signals are frequently generated, if the main domain 10 is operating normally, the state value of the main domain state storage unit 13 is constantly updated. The update of the state value by the main domain state changing unit 12 is
It is desirable not to take duplicate values for a short period of time. For example, the main domain state changing unit 12 may simply increment the state value.

  When the state value of the main domain 10 is updated, the interrupt processing unit 11 executes original processing for the interrupt signal (step S13). Although the state value is updated before interrupt signal processing here, the state may be updated after interrupt signal processing.

<Inspection processing by inspection domain>
Next, each functional unit of the inspection domain 20 will be described with reference to the flowchart of FIG. In the inspection domain 20, the main domain 10 is periodically inspected, and if an abnormality has occurred, the main domain 10 is restored. Since the present system operates in a multi-core system, the processing of the main domain and the processing of the inspection domain can be executed in parallel, and the inspection processing by the inspection domain does not adversely affect the operation of the main domain.

  First, the comparison process control unit 24 is activated (step S20), and the process is started. The comparison process control unit 24 activates the main domain state comparison unit 22 (step S21). The main domain state comparison unit 22 refers to the main domain pre-state storage unit 23 (step S22). As will be described later, since the state value of the domain is stored in the state storage unit 23 before the main domain every time the inspection process is performed, the state value after the latest inspection process can be acquired. Further, the main domain state reference unit 21 refers to the main domain state storage unit 13 and acquires the current state value of the main domain (step S23). As described above, since the inspection domain has a higher security level than the main domain, it is possible to refer to the main domain from the inspection domain.

  Then, the main domain state comparison unit 22 compares the state value immediately before the main domain acquired in step S22 with the current state value of the main domain acquired in step S23 (step S24). Since the state value of the main domain is updated as needed by the main domain state changing unit 12 while the main domain is operating normally, the two state values acquired at different timings are different. Conversely, when the two state values match, it can be considered that an abnormality has occurred in the main domain. In this way, it can be determined whether the main domain is operating or has stopped due to a failure.

  Therefore, if the two state values are different as a comparison result in step S24 (S25: NO), it is determined that the main domain is normal, and the state value acquired this time is stored in the main domain pre-state storage unit 23. The process ends (step S26). Then, after a certain time has passed, the inspection process is executed again.

  On the other hand, if the two state values match as a comparison result in step S24 (S25: YES), it is determined that an abnormality has occurred in the main domain, and the restoration process is started (step S27). The restoration process will be described below.

<Restoration process by inspection domain and emergency process by emergency process domain>
When it is detected that an abnormality has occurred in the main domain 10, the main domain state comparison unit 22 stops the main domain 10, and the emergency state control unit 25 activates the emergency processing domain 30 (step S30). The emergency processing software 31 executes an alternative process for a program that provides a service to the user of the main domain 10 (step S31). The emergency processing software 31 may provide a function equivalent to that of the main domain software. However, if a large-capacity program is stored in preparation for emergency processing, the memory use efficiency is poor. It is sufficient to provide only the minimum necessary functions.

  Then, the main domain restoring unit 26 restores the software of the main domain (step S32). This can be executed, for example, by restarting the service providing program of the main domain or restarting the OS of the main domain. While waiting until the main domain 10 is restored (step S33), the emergency processing software 31 continues to provide services during this period. Since this system is a multi-core system, the restoration process of the main domain 10 and the emergency processing software 31 can be executed in parallel, and the provision of services can be continued even while the main domain 10 is being restored. .

  When the primary domain 10 is restored, the primary domain state reference unit 21 refers to the primary domain state storage unit 13 and stores the state value in the pre-main domain state storage unit 23 (step S34). As a result, the subsequent inspection process can be performed correctly. Further, the main domain restoring unit 26 determines the next activation timing of the comparison processing control unit 24 (step S35). Thus, the process of the main domain restoring unit 26 is finished.

  Then, by switching from the emergency processing domain 30 to the main domain 10 (step S36), the program that provides the service to the user is returned to the original one, and the normal state is restored. Thereafter, the comparison processing control unit 24 is executed at a predetermined interval and monitors the main domain 10 again.

<Operation and effect of this embodiment>
In the program repair system of this embodiment, a main domain that operates a service function and a test domain that monitors the main domain can be executed in parallel using a multi-core system in which each core operates in parallel. Therefore, it is possible to suppress the adverse effect of the inspection processing by the inspection domain on the processing of the main domain.

  In addition, the only process that the main domain side has to perform for this inspection process is the update process of the main domain state storage unit when an interrupt occurs. Since this process is a process with a light load, adverse effects on the main domain can be reduced. Since interrupts occur frequently, the status value is updated from time to time. Further, since it is only necessary to add state update processing to the interrupt handler, program change on the main domain side can be minimized.

  Also, by providing emergency processing software and operating this emergency processing program when restoring the main domain program, it is possible to continue providing the minimum functions during the restoration processing.

  As described above, in the program repair system of this embodiment, an extra load is not given during normal times, and the provision of service functions can be continued even when an abnormality occurs. That is, it is possible to repair a program in which a failure has occurred while minimizing the adverse effect on the original processing.

(Modification)
In the above embodiment, the state value is updated and stored in the main domain, and the restoration domain monitors the change in this value to determine whether or not the main domain is operating normally. However, checking whether or not the main domain is operating normally is not limited to such a method. For example, the inspection domain stores the correct hash value of the program in the main domain, and determines whether or not the hash value of the program matches the stored hash value at the time of inspection. Good. According to this method, it is possible to detect falsification of a program in the main domain. In this way, alteration of the program also corresponds to “failure”.

  Further, the mechanism for providing a plurality of domains is not limited to the method of dividing the domains by the monitor software as described in FIG. For example, as shown in FIG. 6, a unique RAM area is allocated to each core, and each of them operates the OS. Domain separation can be realized by prohibiting access from one core to a RAM area allocated to another core using a filter provided between the chip and the bus. Further, if access is permitted from one core to another core, it is possible to distinguish between a secure domain and a non-secure domain.

  Further, as shown in FIG. 7, the host OS may be executed on the multi-core system, the virtual machine environment (program) may be realized therein, and the guest OS may be executed on the virtual machine environment to divide the domains. . Each guest OS is a virtually independent execution environment. Although the guest OS cannot access the host OS, the host OS can access the guest OS. Therefore, the host OS can be a secure domain and the guest OS can be a non-secure domain.

It is a figure explaining a safety domain and a non-safety domain. It is a figure which shows the functional block diagram of the program restoration system which concerns on this embodiment. It is a flowchart which shows the flow of the process by a main domain. It is a flowchart which shows the flow of the inspection process by an inspection domain. It is a flowchart which shows the flow of the restoration process by a test | inspection domain, and the emergency process by an emergency process domain. It is a figure which shows another example which implement | achieves a safety domain and a non-safety domain. It is a figure which shows another example which implement | achieves a safety domain and a non-safety domain.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Main domain 11 Interrupt processing part 12 Main domain state change part 13 Main domain state memory | storage part 20 Inspection domain 21 Main domain state reference part 22 Main domain state comparison part 23 Main domain previous state memory part 24 Comparison process control part 25 Emergency state control 26 Main domain restoration unit 30 Emergency processing domain 31 Emergency processing software

Claims (10)

In a multi-core system that provides at least two domains, when a failure occurs in a main domain that executes a predetermined program, a program repair system that repairs the program,
In one or more subdomains different from the primary domain,
Inspection means for inspecting the state of the main domain;
A restoring means for restoring the program when a failure occurs in the primary domain;
Emergency processing means for executing alternative processing of the program when a failure occurs in the main domain;
A program repair system comprising: The primary domain is inaccessible to the subdomain;
The sub-domain can only execute trusted programs and can access the primary domain;
The program repair system according to claim 1. Normally, the inspection means and the program are executed in parallel,
At the time of program restoration, the restoration means and the emergency processing means are executed in parallel.
The program restoration system according to claim 1 or 2, wherein State storage means for storing the state of the main domain;
State changing means for updating the state storage means;
In the main domain,
The program repair system according to any one of claims 1 to 3, wherein the checking unit checks the state of the main domain with reference to the state storage unit. The program restoration system according to claim 4, wherein the state change unit updates the state storage unit at a timing when an interrupt process occurs in the main domain. In a multi-core system providing at least two domains, when a failure occurs in a main domain that executes a predetermined program, a program repair method for repairing the program,
Within one or more subdomains different from the main domain,
Inspecting the state of the main domain;
Restoring the program in the event of a failure in the primary domain;
Executing a replacement process of the program when a failure occurs in the main domain;
A program repairing method characterized by executing The primary domain is inaccessible to the subdomain;
The sub-domain can only execute trusted programs and can access the primary domain;
The program repair method according to claim 6. Usually, the step of inspecting and the program are executed in parallel,
8. The program restoration method according to claim 6, wherein at the time of program restoration, the step of restoring and the step of performing the substitution process are executed in parallel. In the main domain, execute a step of updating the state storage means for storing the state of the main domain,
The program repair method according to claim 6, wherein in the checking step, the state of the main domain is checked with reference to the state storage unit. The program repair method according to claim 9, wherein the step of updating the state storage unit is performed at a timing at which an interrupt process occurs in the main domain.

Images