JP5452336B2 - Peripheral device failure simulation system, peripheral device failure simulation method, and peripheral device failure simulation program - Google Patents

Description

  The present invention relates to, for example, a peripheral device failure simulation system, a peripheral device failure simulation method, and a peripheral device failure simulation program that simulate a failure related to a peripheral device.

Software for computer systems that require high availability and reliability, such as control systems and server systems, can be safely shut down or switched to a standby system when an abnormal situation occurs due to a hardware failure. There is a need.
In such a system, it is necessary to sufficiently confirm that the failure processing function as described above operates normally when an abnormality occurs at the test stage.
However, in order to cause a hardware failure, it is necessary to destroy the hardware or change the setting so that an illegal operation occurs. Therefore, it is expensive and there is a problem in the reproducibility of hardware failure.
Therefore, there is a method of simulating a hardware failure only with software by using a virtual machine (VM).

  In the fault simulation method using the conventional VM, an internal machine check interrupt is generated when a specific program address is executed in the VM mode, and the normality of the fault processing function of the apparatus is confirmed (for example, Patent Documents). 1).

JP-A-5-324389

Intel, “Intel64 and IA-32 Architecture Software Developer's Manual”, published in June 2009, Volume 3B p. 19-1 to 25-22

In the fault simulation method using the conventional VM, a pseudo fault can be caused only by generating an internal machine check interrupt when a specific program address is executed. In other words, it is not possible to simulate a failure without an internal machine check interrupt.
For example, a failure cannot be simulated for an operation of an I / O port or a memory mapped I / O for a peripheral device such as a disk device or a network device. In addition, when a failure occurs, it is impossible to identify the peripheral device that has caused the failure by referring to an error bit existing in the I / O port or the memory mapped I / O. In addition, as a normal operation, a failure in which a completion interrupt is delayed due to a retry or the like, a failure in which an unnecessary completion interrupt occurs, or a failure in which a necessary completion interrupt does not occur cannot be simulated.

  An object of the present invention is, for example, to simulate a failure related to an I / O port, a memory-mapped I / O, or an interrupt so that the normality of a failure processing function of the system can be confirmed.

Peripheral device failure simulation system of the present invention,
A test target execution unit that executes a program of the test target system to which the peripheral device is connected;
A fault simulation definition information storage unit for storing fault simulation definition information including a fault value set in a predetermined fault value storage area when a fault occurs in the peripheral device;
A fault simulation setting unit for interrupting the program of the test target system when an access occurs to a predetermined device-corresponding storage area associated with the peripheral device;
A fault simulation execution unit that sets a fault value included in the fault simulation definition information in the fault value storage area when the program of the test target system is interrupted, and restarts the program of the test target system.

  According to the present invention, for example, a failure can be simulated when accessing an I / O port or a memory-mapped I / O (device-compatible storage area). Thereby, the normality of the failure processing function of the system can be confirmed.

1 is a configuration diagram of a hardware failure simulation system 100 according to Embodiment 1. FIG. 6 is a diagram showing failure simulation definition information 121 according to Embodiment 1. FIG. 3 is a flowchart showing a hardware failure simulation method according to the first embodiment. 5 is a flowchart showing fault simulation execution processing (S200) in the first embodiment.

Embodiment 1 FIG.
A mode of simulating a failure of a peripheral device of a test target system using a virtual computer will be described.

FIG. 1 is a configuration diagram of a hardware failure simulation system 100 according to the first embodiment.
The configuration of the hardware failure simulation system 100 according to the first embodiment will be described below with reference to FIG.

  The hardware failure simulation system 100 (an example of a peripheral device failure simulation system) is a computer (also referred to as a computer or a device) that simulates a failure of a peripheral device (for example, a disk device or a network device) connected to the test target system 110. .

The hardware failure simulation system 100 includes a CPU 141 (Central Processing Unit), an input / output memory (I / O port, also referred to as memory mapped I / O), a main memory, and the like as hardware 140.
The input / output memory is used for storing data used by the peripheral device (input / output device) and for exchanging data between the CPU and the peripheral device. The main memory stores data used by peripheral devices and other data (for example, programs and data used in programs).
Hereinafter, the input / output memory is referred to as “I / O 143”, and the main memory is referred to as “memory 142”.

  The hardware failure simulation system 100 executes a VMM 130 (Virtual Machine Monitor) and a test target system 110.

  In the embodiment, what is described as “to part” may be “to process”, “to step”, and “to procedure”, and “to circuit”, “to apparatus”, and “to device”. May be. That is, what is described as “to part” may be implemented by software, hardware, firmware, or a combination thereof.

The VMM 130 is an execution unit that executes software (program) called a virtual machine monitor. The virtual machine monitor uses a computer resource (CPU 141, memory 142, I / O 143, etc.) as a resource of a plurality of computers, virtualizes the computer, and operates the virtualized computer.
The VMM 130 uses a resource of the hardware failure simulation system 100 to execute a virtual machine (VM), and operates the test target system 110 with the virtual machine. By operating the test target system 110 with a virtual computer, the operation of the test target system 110 can be verified without preparing an actual computer on which the test target system 110 operates.

The test target system 110 (an example of a test target execution unit) is a target system that simulates a failure. By simulating the failure, the operation of the test target system 110 when the failure occurs can be verified without actually causing the failure.
The test target system 110 includes an OS 111 (operating system) and an application program 112.

In the virtual machine, the fault simulation control unit 120 operates in addition to the test target system 110.
The failure simulation control unit 120 is a program that operates on a virtual computer. The failure simulation control unit 120 outputs the failure simulation definition information 121 stored in the virtual computer to the VMM 130.

  The failure simulation definition information 121 is data including information on a failure to be simulated.

For example, the failure simulation definition information 121 includes the following information.
The fault simulation definition information 121 includes a fault value set in a predetermined fault value storage area when a fault occurs in a peripheral device ((1e) “0” bit set, (1f) “1” bit set described later) ). For example, the fault value storage area is a specific area in the memory 142, a specific area in the I / O 143, and a CPU register.
The failure simulation definition information 121 includes the number of simulations for simulating a failure ((1i) number of simulations described later).
The failure simulation definition information 121 includes target device specifying information indicating a specific peripheral device as a target device for simulating a failure among a plurality of peripheral devices ((1h) simulation condition described later).
The failure simulation definition information 121 includes an identifier for identifying an interrupt of a peripheral device to be simulated (described later (2a) interrupt number).
The fault simulation definition information 121 includes a delay time for delaying an interrupt from a peripheral device ((3c) delay time described later).
The failure simulation definition information 121 includes an identifier for identifying an interrupt of a peripheral device to be discarded (to be described later (3a) interrupt number).

  The VMM 130 includes a failure simulation setting unit 131, a failure simulation execution unit 132, an address correction processing unit 133, and a simulation execution determination unit 134 as failure simulation functions.

  The failure simulation setting unit 131 (an example of the failure simulation definition information storage unit) stores the failure simulation definition information 121.

The failure simulation setting unit 131 (an example of the failure simulation setting unit), when access to a predetermined device-corresponding storage area associated with a peripheral device occurs, the program (OS 111, application program 112) of the test target system 110. ) Is set to be interrupted. For example, the device correspondence storage area is a specific area in the I / O 143 or the memory 142.
The fault simulation setting unit 131 interrupts the program of the test target system 110 when an interrupt of a peripheral device occurs and interrupt information is stored in a predetermined interrupt information storage area (interrupt setting area described later). For example, the interrupt information storage area is a specific area in the I / O 143 or the memory 142.
The failure simulation setting unit 131 performs a setting to generate a peripheral device interrupt according to a predetermined interrupt setting and interrupt the program of the test target system 110.

  The failure simulation execution unit 132 (an example of the failure simulation execution unit) sets the failure value included in the failure simulation definition information 121 in the failure value storage area when the program of the test target system 110 is interrupted, and Resume the program.

The failure simulation execution unit 132 stores the number of times the failure value is set in the failure value storage area as the number of simulation executions.
The fault simulation execution unit 132 compares the simulation execution count with the simulation count, sets the fault value in the fault value storage area when the simulation execution count is less than the simulation count, and the simulation execution count is equal to or greater than the simulation count. In this case, the failure value is not set in the failure value storage area.

The failure simulation execution unit 132 stores a failure value as a failure value when the access device (peripheral device) corresponding to the access that has occurred in the device correspondence storage area is the same peripheral device as the target device indicated in the target device identification information. Set to area.
The failure simulation execution unit 132 does not set a failure value in the failure value storage area when the access device is a peripheral device different from the target device indicated in the target device identification information.

The failure simulation execution unit 132 deletes the interrupt information stored in the interrupt information storage area when the peripheral system interrupt occurs and the program of the test target system 110 is interrupted, and the test is performed when a predetermined delay time has elapsed. A delay timer that interrupts the program of the target system 110 is started.
The failure simulation execution unit 132 restarts the program of the test target system 110.
The failure simulation execution unit 132 sets the interrupt information stored in the interrupt information storage area when the program of the test target system 110 is interrupted by the delay timer in the interrupt information storage area, and restarts the program of the test target system 110. .

  When the peripheral device interrupt occurs and the program of the test target system 110 is interrupted, the failure simulation execution unit 132 deletes the interrupt information stored in the interrupt information storage area and restarts the program of the test target system 110.

The address correction processing unit 133 corrects the address of the I / O 143 and the memory 142.
For example, the address correction processing unit 133 converts a physical address into a virtual address.

The simulation execution determination unit 134 (an example of a failure simulation execution unit) determines whether or not the failure simulation execution unit 132 simulates a failure.
For example, the simulation execution determination unit 134 causes the failure simulation execution unit 132 to simulate a failure when the number of simulation executions is less than the number of simulations, and gives a failure to the failure simulation execution unit 132 when the number of simulation executions is equal to or greater than the number of simulations. Do not simulate.
In addition, the simulation execution determination unit 134 identifies a peripheral device corresponding to an access that has occurred in the device corresponding storage area when the program of the test target system 110 is interrupted as an access device. The simulation execution determination unit 134 causes the failure simulation execution unit 132 to simulate a failure when the identified access device is the same peripheral device as the target device indicated in the target device identification information, and the identified access device becomes the target device identification information. If the peripheral device is different from the indicated target device, the failure simulation execution unit 132 does not simulate the failure.

FIG. 2 is a diagram showing the failure simulation definition information 121 in the first embodiment.
The failure simulation definition information 121 in the first embodiment will be described below with reference to FIG.

  The fault simulation definition information 121 includes (1) access fault information, (2) interrupt information, and (3) interrupt fault information.

(1) Access failure information is information indicating a failure to be simulated when an access occurs to a peripheral device memory (I / O 143, memory 142).
(1) Access failure information includes (1a) access target, (1b) address, (1c) size, (1d) address correction information, (1e) “0” bit set, (1f) “1” bit set, (1g ) Log output flag, (1h) simulation condition, and (1i) simulation count.

(1a) The access target indicates the type of the memory (I / O 143, memory 142) whose access is to be detected.
(1b) The address indicates the address of the access area.
(1c) The size indicates the size of the access area.
(1d) Address correction information indicates information for (1b) address correction. For example, (1b) indicates whether the address is a physical address or a virtual address. Further, (1b) indicates whether the address is an offset value.
(1e) The “0” bit set indicates a plurality of bit positions for setting “0”.
(1f) The “1” bit set indicates a plurality of bit positions for setting “1”.
(1g) The log output flag indicates whether or not simulated fault information is recorded as a log.
(1h) The simulation condition indicates information for specifying a peripheral device to be simulated for a fault.
(1i) The number of simulations indicates the number of times to simulate a failure.

(2) The interrupt information is information indicating a simulated interrupt.
(2) The interrupt information includes (2a) an interrupt number and (2b) a log output flag.

(2a) The interrupt number indicates a number assigned to a peripheral device to be simulated for an interrupt.
(2b) The log output flag indicates whether or not simulated interrupt information is recorded as a log.

(3) The interrupt failure information is information indicating the failure of the simulated interrupt.
(3) Interrupt failure information includes (3a) interrupt number, (3b) processing content, (3c) delay time, and (3d) log output flag.

(3a) The interrupt number indicates a number for identifying a target interrupt that simulates a failure.
(3b) The processing content indicates the type of failure (delay, discard) to be simulated.
(3c) The delay time indicates a time for delaying the interrupt.
(3d) The log output flag indicates whether or not simulated fault information is recorded as a log.

The failure simulation definition information 121 is prepared for each failure to be simulated, and one failure simulation definition information 121 is set with any one or a combination of (1) access failure information, (2) interrupt information, and (3) interrupt failure information.
For example, (1) access failure information and (2) interrupt information are set in one failure simulation definition information 121, and (3) interrupt failure information is set in another failure simulation definition information 121.

FIG. 3 is a flowchart illustrating the hardware failure simulation method according to the first embodiment.
A hardware failure simulation method according to the first embodiment will be described below with reference to FIG.

The test target system 110 and the VMM 130 are loaded into the memory 142 of the hardware failure simulation system 100 and activated.
Also, a plurality of failure simulation definition information 121 (see FIG. 2) is generated by the user and stored in advance in an area in the memory 142 allocated to the test target system 110 or a disk device (for example, a magnetic disk device). And

The CPU 141 of the hardware failure simulation system 100 operates the test target system 110 and the VMM 130 while switching between the mode for operating the test target system 110 and the mode for operating the VMM 130.
When the operation mode of the test target system 110 is switched to the operation mode of the VMM 130, the processing of the test target system 110 is interrupted.
The interrupted process is resumed when the test target system 110 returns to the operation mode.

For example, the Intel Architecture Processor (IA processor) has an Intel Virtualization Technology (VT) function as a virtualization support function. The VMM 130 can be mounted by using this Intel VT function. Intel is a registered trademark.
The Intel VT function is described in Non-Patent Document 1.
In the VT function, the VMM 130 operates in the VMX root operation mode, and the test target system 110 operates in the VMX non-root operation mode.

When the operation mode of the test target system 110 is switched to the operation mode of the VMM 130 (when VM exit occurs), the OS 111 of the test target system 110 interrupts the processing. At this time, the context of the OS 111 of the test target system 110 set in the CPU 141 is saved in an area in the memory 142 managed by the VMM 130.
Then, the context saved at the time of returning from the operation mode of the VMM 130 to the operation mode of the test target system 110 is set in the CPU 141, and the OS 111 of the test target system 110 resumes processing from the state when it was interrupted.
A context is data set in each register of the CPU 141.

In S101, the user inputs a failure simulation start command to the test target system 110 using an input device (keyboard, mouse, etc.). At this time, the CPU 141 is in the operation mode state of the test target system 110.
The OS 111 of the test target system 110 activates the failure simulation control unit 120 as one of application programs.
After S101, the process proceeds to S111.

In S <b> 111, the failure simulation control unit 120 outputs a plurality of failure simulation definition information 121 to the failure simulation setting unit 131 of the VMM 130.
For example, the failure simulation control unit 120 calls the failure simulation setting unit 131 by using the memory address of the failure simulation definition information 121 as an argument, using the VMALL instruction of the IA processor. The VMMCALL instruction is an instruction for calling the VMX root operation mode from the VMX non-root operation mode. The memory address of the failure simulation definition information 121 is an address indicating an area in the memory 142 in which the failure simulation definition information 121 is stored.
After S111, the operation mode of the test target system 110 is switched to the operation mode of the VMM 130, and the process proceeds to S112.

In S <b> 112, the failure simulation setting unit 131 stores a plurality of pieces of failure simulation definition information 121 output from the failure simulation control unit 120 in an area in the memory 142 assigned to the VMM 130.
After S112, the operation mode of the VMM 130 returns to the operation mode of the test target system 110, and the process proceeds to S113.

In S <b> 113, the failure simulation control unit 120 outputs a failure simulation start request to the failure simulation setting unit 131 of the VMM 130.
After S113, the operation mode of the test target system 110 is switched to the operation mode of the VMM 130, and the process proceeds to S121.

In S 121, the failure simulation setting unit 131 selects one failure simulation definition information 121 and determines the simulation content set in the selected failure simulation definition information 121.
If the simulated content is (1) access failure information, the process proceeds to S124.
If the simulated content is (2) interrupt information, the process proceeds to S122.
If the simulated content is (3) interrupt failure information, the process proceeds to S126.

However, when a plurality of simulation contents are set in the failure simulation definition information 121, preprocessing described below is executed for each simulation content.
For example, when (1) access failure information and (2) interrupt information are set in the failure simulation definition information 121, (1) after executing preprocessing (S124, S125) for the access failure information, (2) Preprocessing for interrupt information (S122, S123) is executed.

  Further, the preprocessing (S121 to S126) is executed for each failure simulation definition information 121. That is, the preprocessing (S121 to S126) is repeated the same number of times as the number of failure simulation definition information 121.

In S122, the fault simulation setting unit 131 sets an interrupt to the CPU 141 (for example, a CPU register) so as to generate an interrupt of the peripheral device specified by the (2a) interrupt number of the fault simulation definition information 121.
For example, the interrupt setting is performed using a VM-entry interrupt-information field of the Intel VT function.

  When the interrupt setting is performed, an interrupt is generated for the test target system 110 when the operation mode of the test target system 110 is switched. When an interrupt occurs to the test target system 110, the OS 111 of the test target system 110 activates an interrupt handler (program).

  After S122, the process proceeds to S123.

In S123, the failure simulation setting unit 131 determines whether or not to output a log based on the (2b) log output flag of the failure simulation definition information 121.
When log output is required, the failure simulation setting unit 131 records the contents of the interrupt setting (S122) as a log. The log may be recorded directly in a log file generated in the disk device, or may be recorded in a log file after being accumulated in the memory 142.
When log output is unnecessary, the failure simulation setting unit 131 does not output a log.
After S123, the operation mode of the VMM 130 returns to the operation mode of the test target system 110, and the process proceeds to S131.

In S131, an interrupt is generated in the test target system 110 in accordance with the interrupt setting set in S122.
As described above, by performing the interrupt setting (S122), it is possible to generate an interrupt specified in (2) interrupt information of the failure simulation definition information 121.

In S124, the address correction processing unit 133 corrects the address (1b) based on the (1d) address correction information of the failure simulation definition information 121.
For example, when a value indicating that (1b) address is a physical address is set in (1d) address correction information, the address correction processing unit 133 converts (1b) the address into a virtual address.
In addition, when (1d) address correction information is set to a value indicating that (1b) the address is an offset value, (1b) the address is added as an offset value to the hardware setting address to identify the address. . It is assumed that the hardware setting address is stored in the memory 142 in advance.
After S124, the process proceeds to S125.

  In S125, the failure simulation setting unit 131 calls the CPU 141 so that the failure simulation execution unit 132 is called immediately before or after the access (reading or writing) is performed on the address corrected in S124. Set up.

For example, (1a) When the I / O 143 is designated as the access target, the access call setting is performed as follows.
The failure simulation setting unit 131 uses the I / O bitmap to make a setting such that the VM exit is activated when an access to the (corrected) address of the I / O 143 occurs. Further, the failure simulation setting unit 131 sets the entry address of the failure simulation execution unit 132 to host RIP.
By performing such an access call setting, the failure simulation execution unit 132 can be called when an access occurs to the (corrected) address of the I / O 143.

(1a) When the memory 142 is designated as the access target, the access call setting is performed as follows.
The failure simulation setting unit 131 uses the debug register to make a setting such that a debug exception occurs when an access to the (corrected) address of the memory 142 occurs. Further, the failure simulation setting unit 131 uses the exception bitmap of the Intel VT function to perform setting so that the failure simulation execution unit 132 is called when a debug exception occurs.
By performing such an access call setting, the failure simulation execution unit 132 can be called when an access to the address (after correction) of the memory 142 occurs.

The fault simulation setting unit 131 may generate an access violation exception (also referred to as a memory protection exception) using a memory management unit (MMU) instead of generating a debug exception using a debug register. Good. By using the memory management unit, an access violation exception can be generated when a page area including a designated program address or memory address is accessed.
For example, the failure simulation setting unit 131 rewrites the page table of the OS 111 of the test target system 110 to generate an access violation exception. Further, the hardware failure simulation system 100 has a copy of all or part of the page table of the OS 111 in the memory area of the VMM 130, and the failure simulation setting unit 131 rewrites the copy to generate an access violation exception.
The failure simulation setting unit 131 makes settings so that the failure simulation execution unit 132 is called when an access violation exception occurs using the exception bitmap of the Intel VT function.

  Non-patent document 1 describes I / O bitmap, VM exit, host RIP, debug register, exception bitmap, and the like.

  After S125, the operation mode of the VMM 130 returns to the operation mode of the test target system 110, and the process proceeds to S132.

  In S126, the failure simulation setting unit 131 calls the CPU 141 to call the interrupt so that the failure simulation execution unit 132 is called when an interrupt of the peripheral device specified by the (3a) interrupt number of the failure simulation definition information 121 occurs. Set up.

For example, the failure simulation setting unit 131 performs interrupt call setting using external-interrupt exiting (see Non-Patent Document 1) of the Intel VT function.
When this function is used, fault simulation is executed when an interrupt occurs from any peripheral device, regardless of whether the peripheral device that generated the interrupt is (3a) the peripheral device specified by the interrupt number. Part 132 is called. Therefore, when called, the failure simulation setting unit 131 determines whether or not the peripheral device that generated the interrupt is the peripheral device specified by (3a) the interrupt number.

  After S126, the process returns from the operation mode of the VMM 130 to the operation mode of the test target system 110, and the process proceeds to S132.

In S132, the test target system 110 resumes operation.
As described above, by performing the access call setting (S125), the failure simulation execution unit 132 can be called when an access specified in (1) access failure information of the failure simulation definition information 121 occurs.
Further, by performing the interrupt call setting (S126), the fault simulation execution unit 132 can be called when an interrupt specified in (3) interrupt fault information of the fault simulation definition information 121 occurs.

When (1) access specified in the access failure information or (3) interrupt specified in the interrupt failure information occurs, the failure simulation execution unit 132 is called.
The fault simulation execution unit 132 simulates (1) a fault specified in the access fault information or (3) a fault specified in the interrupt fault information (S200: fault simulation execution process).
The failure simulation execution process (S200) will be described later.

In S <b> 141, the user inputs a failure simulation stop command to the test target system 110 using the input device. At this time, the CPU 141 is in the operation mode state of the test target system 110.
The failure simulation control unit 120 outputs a failure simulation stop request to the failure simulation setting unit 131 of the VMM 130.
After S141, the operation mode of the test target system 110 is switched to the operation mode of the VMM 130, and the process proceeds to S142.

In S142, the failure simulation setting unit 131 clears the setting of the CPU 141 and cancels the interrupt setting (S122), the access call setting (S125), and the interrupt call setting (S126).
After S142, the operation returns from the operation mode of the VMM 130 to the operation mode of the test target system 110, and the process proceeds to S143.

  In S143, the test target system 110 resumes operation, and the failure is not simulated.

FIG. 4 is a flowchart showing fault simulation execution processing (S200) in the first embodiment.
The failure simulation execution process (S200) in the first embodiment will be described below with reference to FIG.

In S201, when an access specified in (1) access failure information of the failure simulation definition information 121 occurs, the failure simulation execution unit 132 of the VMM 130 is called by the access call setting (S125) described in FIG.
Further, when an interrupt specified in (3) interrupt failure information of the failure simulation definition information 121 occurs, the failure simulation execution unit 132 of the VMM 130 is called by the interrupt call setting (S126) described in FIG.
At this time, the CPU 141 switches from the operation mode of the test target system 110 to the operation mode of the VMM 130.

  After S201, the process proceeds to S211.

In S211, the failure simulation execution unit 132 determines which of (1) the access specified in the access failure information and (3) the interrupt specified in the interrupt failure information is a factor.
For example, the failure simulation execution unit 132 refers to a predetermined memory area used in the Intel VT function and determines a call factor.

If the call factor is (1) access specified in the access failure information, the process proceeds to S221.
If the call factor is an interrupt specified in (3) interrupt failure information, the process proceeds to 231. However, if the generated interrupt is different from the interrupt specified in (3) interrupt failure information, the subsequent processing is not performed and the failure simulation execution processing (S200) ends.

In S221, the failure simulation execution unit 132 analyzes the access command and obtains access information.
For example, the failure simulation execution unit 132 specifies to which peripheral device the memory (I / O 143, memory 142) assigned is the access.
Further, the failure simulation execution unit 132 identifies an area (CPU register, memory 142) in which a value to be written is set.
Further, the failure simulation execution unit 132 specifies a value to be written.
After S221, the process proceeds to S222.

In S222, the failure simulation execution unit 132 calls the simulation execution determination unit 134.
The simulation execution determination unit 134 determines whether to simulate a failure based on (1h) simulation conditions and (1i) the number of simulations in the failure simulation definition information 121.

For example, assume that (1h) a specific address and a specific value in the I / O 143 or the memory 142 are specified as simulation conditions.
The simulation execution determination unit 134 determines that a failure is simulated if a specified value is set for a specified address, and determines that a failure is not simulated if a specified value is not set for a specified address. To do.
The first area (for example, address 200) of the I / O 143 and the memory 142 is shared by a plurality of peripheral devices, and the type of the peripheral device corresponding to the data set in the first area is the second area (for example, , 100) may be set. In this case, even if an access occurs in the first area specified in the (1) access failure information of the failure simulation definition information 121, the generated access is not necessarily an access to a peripheral device that wants to simulate the failure.
The user may specify in the (1h) simulation condition of the failure simulation definition information 121 the address (100th address) of the second area where the type of the peripheral device is set and the type of the peripheral device for which the failure is to be simulated. As a result, a failure can be simulated when an access to a peripheral device for which the failure is to be simulated occurs.

The simulation execution determination unit 134 determines that the failure is simulated if the number of times that the failure is simulated does not reach (1i) the number of simulations, and if the number of times that the failure is simulated reaches (1i) the number of simulations, the failure is determined. Judged not to simulate.
For example, the simulation execution determination unit 134 counts (increments) the number of simulation executions of the access factor every time a failure is simulated in S224 described later. Then, the simulation execution determination unit 134 determines whether or not to simulate a failure by comparing the simulation execution count with (1i) the simulation count.
There is a failure in which an error bit set when a failure occurs is cleared after failure processing. When simulating such a failure, you do not always want to set the error bit.
By setting (1i) the number of simulations in the failure simulation definition information 121, the user can set error bits as many times as (1i) the number of simulations.

If a failure is simulated (YES), the process proceeds to S223.
If the failure is not simulated (NO), the process proceeds to S225.

In S223, the failure simulation execution unit 132 executes the contents of the access command based on the analysis result of S221.
However, when the failure simulation execution unit 132 is called after the access command is executed, the failure simulation execution unit 132 does not execute the contents of the access command.
After S223, the process proceeds to S224.

  In S224, the failure simulation execution unit 132 sets (1e) the error bit “0” in the bit set indicated by the “0” bit set, and (1f) sets the error bit “0” in the bit set indicated by the “1” bit set. 1 ”is set. Error bits “0” and “1” indicate the occurrence of a specific failure for the peripheral device.

However, setting an error bit in a bit set means setting an error bit in a specific area corresponding to the bit set. The error bit set in the area corresponding to the bit set is set to a predetermined bit set for the test target system 110 when the operation mode of the test target system 110 is returned. For example, the area corresponding to the bit set is a predetermined part in the context of the test target system 110 saved when the operation mode of the VMM 130 is switched.
It is assumed that the failure simulation execution unit 132 can specify an area corresponding to the bit set based on the analysis result of S221.

  After S224, the process proceeds to S225.

In S225, the failure simulation execution unit 132 determines whether or not to output a log based on the (1g) log output flag of the failure simulation definition information 121.
When log output is necessary, the failure simulation execution unit 132 stores simulated failure information as a log. The (1) access failure information of the failure simulation definition information 121, the failure simulation content of S224, the access content of S223, the analysis result of S221, etc. are examples of information recorded as a log.
When the log output is unnecessary, the failure simulation execution unit 132 does not record the log.
After S225, the process returns from the operation mode of the VMM 130 to the operation mode of the test target system 110, and the process proceeds to S226.

In S226, the OS 111 of the test target system 110 detects a failure based on the bit set set in S224, and the application program 112 executes a predetermined failure process according to the detected failure.
The user can confirm whether or not the failure processing function of the test target system 110 operates correctly by verifying the failure processing result (failure message, setting value of the memory 142, etc.).

In step S <b> 231, the failure simulation execution unit 132 determines which failure to simulate, interrupt delay or interrupt discard, based on the (3b) processing content of the failure simulation definition information 121.
When simulating an interrupt delay, the process proceeds to S232.
When simulating discarding an interrupt, the process proceeds to S233.

In S232, the failure simulation execution unit 132 saves the set value of the interrupt setting area of the I / O 143 and the memory 142 to another area of the memory 142, and clears the interrupt setting area. The interrupt setting area is a predetermined area in which a value indicating the content of the interrupt that has occurred is set.
The failure simulation execution unit 132 sets the (3c) delay time of the failure simulation definition information 121 and starts the timer function of the hardware 140.
The failure simulation execution unit 132 sets an interrupt call to the CPU 141 so that the failure simulation execution unit 132 is called when a timer interrupt of the hardware 140 occurs. For example, similarly to the failure simulation setting unit 131 in S126, the failure simulation execution unit 132 performs interrupt call setting using external-interrupt exiting (see Non-Patent Document 1) of the Intel VT function.

  Since predetermined areas of the I / O 143 and the memory 142 are cleared, the OS 111 of the test target system 110 does not detect an interrupt when the test target system 110 returns to the operation mode, and the interrupt handler is not activated. However, the failure simulation execution unit 132 is called again by a timer interrupt when the delay time (3c) has elapsed.

  After S232, the process proceeds to S234.

In S233, the failure simulation execution unit 132 clears the I / O 143 and the interrupt setting area of the memory 142.
When returning to the operation mode of the test target system 110, the OS 111 of the test target system 110 does not detect the interrupt, and the interrupt handler is not activated.
After S233, the process proceeds to S234.

In S234, the failure simulation execution unit 132 determines whether or not to output a log based on the (3d) log output flag of the failure simulation definition information 121.
When log output is necessary, the failure simulation execution unit 132 stores simulated failure information as a log. The (3) interrupt failure information of the failure simulation definition information 121 is an example of information recorded as a log. The user can also record an interrupt log without delaying the interrupt by setting “0” seconds to the (3c) delay time of the failure simulation definition information 121.
When the log output is unnecessary, the failure simulation execution unit 132 does not record the log.
After S234, the process returns from the operation mode of the VMM 130 to the operation mode of the test target system 110, and the process proceeds to S235.

  In S235, the OS 111 of the test target system 110 does not detect the interrupt and does not start the interrupt handler because the interrupt setting area is cleared in S232 or S233.

  When simulating the discard of interrupt (S233), a failure occurs in the test target system 110 due to the discard of the interrupt, and the OS 111 and the application program 112 of the test target system 110 execute predetermined failure processing. The user can confirm whether or not the failure processing function of the test target system 110 operates correctly by verifying the result of the failure processing.

When the interrupt delay (S232) is simulated, (3c) a timer interrupt is generated when the delay time elapses, and the failure simulation execution unit 132 of the VMM 130 is called.
At this time, the operation mode of the test target system 110 is switched to the operation mode of the VMM 130, and the process proceeds to S236.

In S236, the failure simulation execution unit 132 sets the installation value saved in the interrupt setting area of the I / O 143 or the memory 142 in S232 in the interrupt setting area.
After S236, the operation mode of the VMM 130 returns to the operation mode of the test target system 110, and the process proceeds to S237.

In S237, the OS 111 of the test target system 110 detects an interrupt that occurred (3c) before the delay time based on the set value in the interrupt setting area, and activates an interrupt handler according to the detected interrupt. The interrupt handler (3c) executes predetermined interrupt processing for the interrupt that occurred before the delay time.
The user can confirm whether or not the failure processing function of the test target system 110 operates correctly by verifying the interrupt processing result (error message, setting value of the memory 142, etc.).

  The above fault simulation execution processing (S201 to S237) is performed until the user specifies stoppage of fault simulation in S141 (see FIG. 3), or the access specified in (1) access fault information of the fault simulation definition information 121 or (3) Executed whenever an interrupt specified in the interrupt failure information occurs.

  The failure simulation definition information 121 may be output from the failure simulation control unit 120 to the failure simulation setting unit 131 together with the failure simulation start request (S113) or may be stored in advance in the memory area of the VMM 130.

A failure simulation start condition may be added to the failure simulation definition information 121 and the failure may be simulated when the start condition specified in the failure simulation definition information 121 is satisfied.
For example, the user can (a) unconditionally (immediately), (b) any I / O 143, control register, access to MSR (Model Specific Register), (c) any interrupt, (d) ) The failure simulation definition information 121 is set with the passage of an arbitrary time as a start condition.
The user may set (e) execution of an arbitrary program address or occurrence of access to an arbitrary memory address in the failure simulation definition information 121 as a start condition.
The failure simulation execution unit 132 determines whether or not to simulate a failure based on the failure simulation start condition specified in the failure simulation definition information 121, and simulates a failure when it is determined to simulate the failure (S221 to S221). S234).
The failure simulation setting unit 131 may determine a start condition, and perform interrupt setting (S122) or interrupt call setting (S125, S126) when the start condition is satisfied.

The failure simulation termination condition may be added to the failure simulation definition information 121 and the failure simulation may be terminated when the termination condition specified in the failure simulation definition information 121 is satisfied.
For example, the user sets (b) to (e) described above as the start condition in the failure simulation definition information 121 as the end condition.
Further, the user may set the failure simulation definition information 121 with (f) the number of executions of failure simulation and (g) the occurrence of a failure simulation stop request as an end condition.
The failure simulation execution unit 132 determines whether or not to complete the failure simulation based on the failure simulation end condition specified in the failure simulation definition information 121. When the failure simulation is finished, the failure simulation setting unit 131 cancels the failure simulation setting (S142).

The user may assign an index number (an example of identification information) to each of the plurality of failure simulation definition information 121 and specify the index number of the specific failure simulation definition information 121 in the hardware failure simulation system 100. The hardware failure simulation system 100 processes only the failure simulation definition information 121 specified by the user.
As a result, the user can cause the hardware failure simulation system 100 to simulate only a specific failure.

The hardware failure simulation system 100 may be executed by a plurality of CPUs 141 using a multi CPU or a multi-core CPU.
In this case, the test target system 110 and the VMM 130 are executed using one CPU 141, and the failure simulation control unit 120 is executed using the other CPU 141.
Thereby, the failure processing function of the test target system 110 can be tested without giving the influence of the failure simulation control unit 120 to the test target system 110.

  In the first embodiment, for example, the following hardware failure simulation system 100 and hardware failure simulation method have been described.

The hardware failure simulation system 100 includes failure simulation definition information 121, a failure simulation control unit 120, a failure simulation setting unit 131, a failure simulation execution unit 132, an address correction processing unit 133, and a simulation execution determination unit 134.
The fault simulation definition information 121 is information that defines fault simulation contents.
The failure simulation control unit 120 transmits failure simulation definition information 121 to the failure simulation setting unit 131.
The failure simulation setting unit 131 performs settings according to the failure simulation definition information 121 so as to call the failure simulation execution unit 132 when an access to the I / O 143 or the memory 142 that should simulate a failure or an interrupt occurs.
The failure simulation execution unit 132 simulates a failure according to the failure simulation definition information 121.
The address correction processing unit 133 corrects the address (1b) described in the failure simulation definition information 121.
The simulation execution determination unit 134 determines whether to simulate a failure according to (1i) the number of simulations and (1h) simulation conditions described in the failure simulation definition information 121.

  The hardware failure simulation system 100 simulates a failure in the I / O 143 and the memory 142 according to the simulation content stored in the failure simulation definition information 121. Thereby, the user can confirm the normality of the failure processing function of the system with respect to the operation of the I / O 143 and the memory 142 regardless of the presence or absence of the internal machine check interrupt.

  Since the hardware failure simulation system 100 simulates the error bit existing in the I / O 143 and the memory 142 related to each device when the failure occurs, the failure simulation is performed up to the point where the device has caused the failure. it can. Thereby, the user can confirm the normality of the failure processing function of the system.

  The hardware failure simulation system 100 has a failure such that an I / O completion interrupt from the device is delayed due to a retry or the like of a normal operation, an unnecessary interrupt occurs, and a necessary I / O completion interrupt does not occur. Can also be simulated.

  The user can perform various types of failure simulations simply by rewriting the simulation contents of the failure simulation definition information 121.

  The user can repeatedly simulate the same failure from when the failure simulation start request is transmitted until the stop request is transmitted.

  The hardware failure simulation system 100 can cause the test target system 110 to behave as if an interrupt that has not actually occurred is generated. As a result, the user can generate an interrupt that occurs only when a hardware failure has occurred only with software without modifying the hardware.

  The hardware failure simulation system 100 can delay the actually generated interrupt to be transmitted to the test target system 110, and not to notify the test target system 110 that the actually generated interrupt has not occurred. Become.

  The hardware failure simulation system 100 can acquire an access log to the I / O 143 and the memory 142 and an interrupt occurrence log regardless of whether or not the failure is simulated.

  100 hardware fault simulation system, 110 test target system, 111 OS, 112 application program, 120 fault simulation control section, 121 fault simulation definition information, 130 VMM, 131 fault simulation setting section, 132 fault simulation execution section, 133 address correction processing Part, 134 simulation execution determination part, 140 hardware, 141 CPU, 142 memory, 143 I / O.

Claims (12)

A test target execution unit that executes a program of the test target system to which the peripheral device is connected;
A fault simulation definition information storage unit for storing fault simulation definition information including a fault value set in a predetermined fault value storage area when a fault occurs in the peripheral device;
A fault simulation setting unit for interrupting the program of the test target system when an access occurs to a predetermined device-corresponding storage area associated with the peripheral device;
A fault simulation execution unit that sets a fault value included in the fault simulation definition information in the fault value storage area when the program of the test target system is interrupted and restarts the program of the test target system; Peripheral equipment failure simulation system. The failure simulation definition information includes the number of simulations to simulate a failure,
The fault simulation execution unit stores the number of times the fault value is set in the fault value storage area as a simulation execution count, compares the simulation execution count with the simulation count, and the simulation execution count is the simulation count. The failure value is set in the failure value storage area when the number is less than, and the failure value is not set in the failure value storage area when the simulation execution count is equal to or greater than the simulation count. The peripheral device failure simulation system according to 1. The failure simulation definition information includes target device specifying information indicating a specific peripheral device as a target device among a plurality of peripheral devices,
The failure simulation setting unit interrupts the program of the test target system when an access occurs to a device corresponding storage area associated with a plurality of peripheral devices,
The failure simulation execution unit specifies, as an access device, a peripheral device corresponding to an access that has occurred in the device-compatible storage area when the program of the test target system is interrupted, and the specified access device specifies the target device When the fault device is the same peripheral device as the target device indicated in the information, the fault value is set in the fault value storage area, and the specified access device is a different peripheral device from the target device indicated in the target device specifying information The peripheral device failure simulation system according to claim 1, wherein the failure value is not set in the failure value storage area. The fault simulation setting unit interrupts the program of the test target system when an interrupt of the peripheral device occurs and interrupt information is stored in a predetermined interrupt information storage area,
The failure simulation execution unit deletes the interrupt information stored in the interrupt information storage area when a program of the test target system is interrupted due to an interruption of the peripheral device, and a predetermined delay time has elapsed. The delay timer that interrupts the program of the test target system is started, the program of the test target system is restarted, and the program of the test target system is interrupted by the delay timer and stored in the interrupt information storage area. The peripheral device fault simulation system according to claim 1, wherein the interrupt information is set in the interrupt information storage area and the program of the test target system is restarted. The fault simulation setting unit interrupts the program of the test target system when an interrupt of the peripheral device occurs and interrupt information is stored in a predetermined interrupt information storage area,
The failure simulation execution unit erases the interrupt information stored in the interrupt information storage area and resumes the program of the test target system when the interrupt of the peripheral device occurs and the program of the test target system is interrupted. The peripheral device failure simulation system according to any one of claims 1 to 3, wherein: 6. The peripheral device failure simulation system according to claim 4, wherein the failure simulation setting unit generates an interrupt of the peripheral device according to a predetermined interrupt setting, and interrupts the program of the test target system. The test target execution unit executes the program of the test target system to which the peripheral device is connected,
The fault simulation definition information storage unit stores fault simulation definition information including a fault value set in a predetermined fault value storage area when a fault occurs in the peripheral device,
The failure simulation setting unit interrupts the program of the test target system when an access occurs to a predetermined device correspondence storage area associated with the peripheral device,
The fault simulation execution unit sets a fault value included in the fault simulation definition information in the fault value storage area when the program of the test target system is interrupted, and restarts the program of the test target system. Peripheral device failure simulation method. A test target execution unit that executes a program of the test target system to which the peripheral device is connected;
A fault simulation setting unit that interrupts the program of the test target system when an interrupt of the peripheral device occurs and interrupt information is stored in a predetermined interrupt information storage area;
When the program of the test target system is interrupted, the interrupt information stored in the interrupt information storage area is erased, and when a predetermined delay time elapses, a delay timer that interrupts the program of the test target system is started, The program of the test target system is resumed, and the interrupt information stored in the interrupt information storage area when the program of the test target system is interrupted by the delay timer is set in the interrupt information storage area, and the test target A peripheral device failure simulation system comprising a failure simulation execution unit for resuming a system program. The test target execution unit executes the program of the test target system to which the peripheral device is connected,
The fault simulation setting unit interrupts the program of the test target system when an interrupt of the peripheral device occurs and interrupt information is stored in a predetermined interrupt information storage area,
The failure simulation execution unit erases the interrupt information stored in the interrupt information storage area when the program of the test target system is interrupted, and interrupts the program of the test target system when a predetermined delay time has elapsed. A delay timer is started, the program of the test target system is restarted, and the interrupt information stored in the interrupt information storage area when the program of the test target system is interrupted by the delay timer is stored in the interrupt information storage area. A peripheral device failure simulation method comprising: setting and restarting the program of the test target system. A test target execution unit that executes a program of the test target system to which the peripheral device is connected;
A fault simulation setting unit that interrupts the program of the test target system when an interrupt of the peripheral device occurs and interrupt information is stored in a predetermined interrupt information storage area;
A peripheral device comprising: a failure simulation execution unit that erases the interrupt information stored in the interrupt information storage area and restarts the program of the test target system when the program of the test target system is interrupted Fault simulation system. The test target execution unit executes the program of the test target system to which the peripheral device is connected,
The fault simulation setting unit interrupts the program of the test target system when an interrupt of the peripheral device occurs and interrupt information is stored in a predetermined interrupt information storage area,
The failure simulation execution unit erases the interrupt information stored in the interrupt information storage area and restarts the program of the test target system when the program of the test target system is interrupted. Method.   A peripheral device failure simulation program for causing a computer to execute the peripheral device failure simulation method according to any one of claims 7, 9, and 11.

Images