JPH0895772A - Computer system and program substituting method - Google Patents

Abstract

PURPOSE: To perform the partial substitution of a program in execution without stopping the system. CONSTITUTION: This computer system is equipped with a data structure/ program additional loading means 30 which additionally loads the data structure of the program in execution and part of a modified program, a program execution temporarily stopping means 44 which temporarily stops the program in execution, a data converting and moving means 32 which converts data from the data structure that the program in execution at a stop uses to the additionally loaded structure and moves them, a program control shifting means 36 which modifies part of the program in execution so that control is transferred to the additionally loaded program when the control is passed to the program in execution, and a program execution restarting means 46 which restarts the execution of the temporarily stopped program after the movement of the data and the modification of the program are completed.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer system program replacement method for improving the reliability of a computer system in terms of software.

[0002]

2. Description of the Related Art Large-scale software such as the current OS (operating system), DBMS (database management system), and transaction processing system has reached the scale of several million lines in order to meet various processing requests.

However, the current software development technology is
We don't have enough techniques to remove bugs from programs with millions of lines. Therefore, it is possible that even a program that is actually operating will continue to run with the bug inherent.

Usually, such a bug is discovered in a timely manner, and bug correction information indicating the contents to be corrected is created. The bug fix information is applied to the program and compiled /
Linked and new execution module created.

Conventionally, a new execution module in which a bug is fixed is replaced after waiting for the old execution module before the bug correction information is applied. But OS,
In a long-running system such as a DBMS and a transaction processing system, since the execution modules are rarely stopped, the execution modules are not frequently replaced. Therefore, even if the bug correction information is created, it is difficult to actually apply the bug correction information to the program.

[0006] In the future, it is expected that the chances of non-stop operation of the system will increase, and the above problems will become more serious. Even if the fault-tolerant system can reduce the system down caused by the hardware failure, it is difficult to reduce the system down caused by such a software bug. The problem of software bugs has become more and more serious with the suspension of operations.

[0007]

As described above, in the conventional software development environment, even if a bug of a program is found, bug correction information is created, and a new execution module is created by compiling / linking, bug correction is performed. The execution module had to be replaced after waiting for the opportunity to stop the old execution module before applying the information.
In other words, applying the bug correction information to the program involves stopping the system, and since the bugs could not be sequentially corrected when they were detected, the reliability of the computer system could not be improved quickly. was there.

The present invention has been made in consideration of the above circumstances, and it is an object of the present invention to provide a program replacement method capable of partially replacing a program being executed without stopping the system. To aim.

[0009]

According to the present invention, there is provided a data structure / program additional loading means for additionally loading a data structure of a program being executed and a part of the changed program, and a temporary execution of the program being executed. To the data structure additionally loaded by the data structure / program additional loading means from the data structure used by the program execution suspension means to be stopped by the program execution suspension means and the program being executed stopped by the program execution suspension means. And a data conversion moving means for converting and moving the program, and the program under execution stopped by the program execution temporary stopping means, when control is passed to the program, additional loading is performed by the data structure / program additional loading means. The running program so that control is transferred to the executed program. After the program control transfer means for changing a part of the program, the data transfer by the data conversion transfer means, and the program change by the program control transfer means are completed, the program execution temporary stop means temporarily stops. And a program execution resuming means for resuming execution of the conventional program.

Further, a trap is generated when the data structure before being additionally loaded by the data structure / program additional loading means is accessed, and the data structure is accessed so that the additional loaded data structure is accessed. And a pre-additional data access completion unit for returning from a trap when the access is completed by the conversion by the pre-additional data access unit. To do.

Further, a data reverse conversion move for reversely converting and moving the data from the additionally loaded data structure to which the data has been moved by the data converting / moving means to the data structure used by the program being executed. Means and
Program control transfer stopping means for changing a part of the program being executed so as not to transfer control to the additionally loaded program when the program being executed is given control, and the data structure / program additional load It further comprises a data structure additionally loaded by the means and an additional data structure / program unloading means for unloading the program.

[0012]

With this configuration, when a bug in a program is found, bug fix information is created, and a new execution module (program) is created by compiling / linking, old execution before applying the bug fix information is performed. Stop the module,
That is, the execution modules are replaced without waiting for the system to stop.

With respect to the change of the data structure due to the replacement of the program, when the original data structure is accessed, it is converted into the access to the converted data structure. Therefore, together with the execution module (program),
The data is also replaced.

Further, when the bug correction information is inappropriate, the control is returned to the execution module before the bug correction information is applied, and at least it is prevented from becoming worse than the previous state. In this case, it is not necessary to stop the system.

[0015]

An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a schematic configuration of a computer system according to this embodiment. The computer system 10 is provided with a processor 12, a memory 14, and a storage device 16.

The memory 14 stores programs and various data loaded and executed by the processor 12. In FIG. 1, it is assumed that the program 18 being executed is stored before the program replacement according to the present invention. The program 18 being executed is assumed to be composed of a program 20 including an instruction sequence and a data structure 22 processed by the instruction sequence. Further, when the program replacement is executed, the additionally loaded program and a part of the data structure 24 (consisting of the additionally loaded program 26 and the additionally loaded data structure 28) are stored.

Further, the memory 14 stores a program replacement program for realizing the program replacement function according to the present invention, for example, as a part of an OS (operating system). The program replacement function will be described later. Further, the memory 14 stores a part of the program being executed (the original instruction before the program replacement) as the program is replaced.

The storage device 16 is composed of, for example, a hard disk device or the like, and stores a program 18a updated and compiled / linked on the source program, which corresponds to the program 18 being executed stored in the memory 14. It is assumed to be stored.

FIG. 2 is a block diagram showing the structure of the program replacement function realized by the program replacement program. As shown in FIG. 2, the program replacement function is
Data structure / program additional loading means 30, data conversion moving means 32, program control transfer means 36, additional data structure / program unloading means 38, data reverse conversion moving means 40, program control transfer stopping means 42, program execution temporary stopping means 44, program execution resuming means 46, pre-additional data access means 48, and pre-additional data access completion means 52.

Data structure / program additional loading means 3
0, the data conversion moving means 32, and the program control transfer means 36 constitute a program replacement unit 54 that functions when replacing the program being executed.

Further, the additional data structure / program unloading means 38, the data reverse conversion moving means 40, and the program control transition stopping means 42 are programs for returning the program replaced by each function of the program replacing section 54 to the original state. The reverse replacement unit 56 is configured.

Data structure / program additional loading means 3
0 loads the program 18a to be replaced with respect to the running program 18 into the memory 14 (the additionally loaded program 26 and the additionally loaded data structure 2).
8) to do.

When executing the program replacement, the data conversion / moving means 32 additionally loads the data of the data structure 22 of the program 18 being executed into the memory 14 by the data structure / program additional loading means 30. The data structure 28 of the program being executed is converted into and written into, and the access is prohibited. The data conversion moving means 32 converts the data structure into information about conversion rules (conversion rule information 3).
4) is referred to, and based on the conversion rule information 34, the information (movement rule information 50) regarding the position where the converted and written data exists is created. The movement rule information 50
Is referred to when the access conversion is performed by the pre-additional data access unit 48.

The program control transfer means 36 does not execute the instruction of the program to be replaced in the running program 18, and the data structure / program additional loading means 3
A part of the instructions of the program is changed so that the program additionally loaded in the memory 14 by 0 is executed.

The additional data structure / program unloading means 38 includes the data structure and the part 24 of the program additionally loaded by the data structure / program additional loading means 30 for program replacement, for example, because an error is included. It is to be unloaded when the execution of the additionally loaded program / data structure is stopped.

When the replaced program is returned to the original program, the data reverse conversion moving means 40 reads the data in the additionally loaded data structure 28, reversely converts it into the original data structure 22, and writes it. The original data structure 22 is set in an access permitted state so that it can be accessed.

The program control transition stopping means 42 reversely converts the instruction changed by the program control transition means 36 into the original instruction before the replacement so that the program before the program replacement is executed. It is a thing.

The program execution suspension means 44, when performing the program replacement in the program replacement section 54,
When the program reverse replacement unit 56 performs the reverse replacement of the program, the program execution currently being executed by the processor 12 is temporarily stopped.

The program execution resuming means 46 is provided for the program replacing section 5 while the program execution currently being executed is being suspended by the program execution suspending means 44.
After the program replacement in step 4 or the program reverse replacement section 56 completes the reverse replacement of the program, the execution of the program being executed is restarted.

The pre-additional data access means 48 is
Triggered by a trap generated when accessing prohibited data, it converts an access to an access prohibited data structure into an access to an additionally loaded and replaced data structure.

Pre-additional data access completion means 52
Is for returning a trap generated when accessing the access-prohibited data by the conversion by the pre-additional data access means 48 to the normal state and returning from the trap. .

Next, the operation of this embodiment will be described with reference to the flow charts shown in FIGS. First, the operation of replacing a part of the program being executed will be described with reference to FIG.

In the computer system 10, a program 18 is loaded on the memory 14 and the processor 12 executes the program. The program 18 being executed is composed of a program including an instruction sequence and a data structure processed by the instruction sequence. Here, it is assumed that it is necessary to change the part 20 of the program 18 and the part 22 of the data structure of the program 18 being executed, for example, because a bug is detected.

Therefore, a part 20 of the program to be changed
And a program 1 obtained by updating / compiling / linking only a part 22 of the data structure on the source program.
8a is prepared in the storage device 16.

Data structure / program additional loading means 3
0 additionally loads the updated program 18a stored in the storage device 16 onto the memory 14 (step A). A part of the program and data structure additionally loaded on the memory 14 is 24. The additional loaded program and data structure portion 24 includes an additional loaded program 26 and an additional loaded data structure 28.

However, simply by additionally loading the updated program and a part 24 of the data structure onto the memory 14, the program 18 being executed is not affected by anything, and the meaning of changing the program is significant. There is no. Therefore, the following program replacement processing is executed.

First, the program execution suspension means 44
Causes the execution of the running program 18 to be temporarily stopped (step A2). When the program 18 being executed is stopped, the data conversion moving means 32 reads the data in the data structure 22 of the program being executed, and based on the conversion rule information 34, changes the data corresponding to the converted data structure. The data is converted and written in the additionally loaded data structure 28 (step A3). Then, the data structure 22 of the program being executed is put in an access prohibited state so that it cannot be accessed. The data structure conversion rule information 34 is created when only the part 20 of the program to be changed and the part 22 of the data structure are updated on the source program and compiled / linked, and program replacement is started. Before, it is stored in the memory 14. Conversion rule information 3
The details of 4 will be described later.

Further, the program control transfer means 36 replaces the instruction of the entry point indicating the position where the program replacement is to be performed in the program 20 being executed with an instruction that unconditionally branches to the entry point of the additionally loaded program 26 ( Step A4). The program control transfer means 36 also stores the original instruction before it is replaced with the instruction that branches unconditionally.

As a result, the program E and the data structure 22 of the program 18 being executed are changed, and the preparation for executing the program / data structure is completed. Therefore, the program execution resuming means 46 executes the program 18 being executed. It is restarted (step A5).

FIG. 5 shows a specific example of program replacement. FIG. 5A is a state before the program is updated, and FIG.
(B) shows the state after the program is updated. As shown in FIG. 5A, the pre-update program 20 is a processing routine including an instruction to “store the value of a register”, is executed by a request from another calling side, and executes a series of instructions. Will return to the caller when is completed. The instruction of the entry point of the program 20 before the update is the instruction of “saving the value of the register”.

When the program replacement as described above is executed, as shown in FIG.
The instruction "store the value of the register" at the entry point is replaced with an instruction that unconditionally branches to the updated program 26.

The instruction before program replacement ("save register value") is previously stored before replacement. By saving the instruction before replacement, the entry point of the program before update that has been replaced by the unconditional branch instruction when performing the reverse conversion process to restore the updated program described later Can be undone.

When the control is transferred to the additionally loaded program 26, the processing is performed as usual. When control is passed to the pre-update program 20 by the additionally loaded updated program 26, the instruction at the entry point is replaced with an unconditional branch instruction to the entry point of the additionally loaded program 26. Therefore, the program 20 is not executed, and the control is transferred to the additionally loaded program 26.

As a result, the normal processing by the program 26 instead of the program 20 is executed. Further, when the additionally loaded program 26 accesses the additionally loaded data structure 28, the additionally loaded program 26 executes the processing as usual.

By the way, when the replaced data structure 22 is accessed from the original running program 18,
Access to the data structure 22 is performed by the data conversion moving means 32.
Since it is prohibited by, a trap will occur.

The pre-additional data access means 48 is called by this trap. The pre-additional data access unit 48 converts the access to the original data structure 22 into the access to the additionally loaded data structure 28 based on the movement rule information 50. Then, after the access is completed, the pre-additional-load data access completion means 52 returns from the trap and resumes the normal processing. The migration rule information 50 is created when the data conversion migration means 32 converts and writes data in the additionally loaded data structure 28, and is stored in the memory 14. Details of the movement rule information 50 and access conversion will be described later.

Next, the operation of inverse conversion for stopping the execution of the replaced program and restoring the updated program will be described with reference to the flowchart shown in FIG. For example, when an error is found in the additionally loaded program 26 or the data structure 28, by returning to the state before executing the program replacement, at least the occurrence of a failure exceeding the influence of the bug in the original program is avoided. Can be made.

When it is desired to stop the execution of the additionally loaded program 26 / data structure 28, first, the program 18 being executed by the program execution suspension means 44 is executed.
(Additionally loaded data structure and program part 24
Execution is suspended (step B1).

When the running program 18 is stopped,
The data reverse conversion moving means 40 reads the data in the additionally loaded data structure 28, converts it into data corresponding to the original data structure based on the conversion rule information 34, and reversely converts it into the original data structure 22. Write (Step B
2). Then, the access permission state is set so that the original data structure 22 can be accessed.

Further, the program control transition stopping means 42
Replaces the instruction at the entry point of the program 20 being executed with the original instruction stored before the replacement with the instruction for unconditional branching (step B3).

As a result, the program 20 and the data structure 22 of the program 18 being executed have returned to the original state, and the program execution resuming means 46 restarts the execution of the program 18 being executed (step B4).

The additional data structure / program unloading means 38 unloads the updated data structure / program additionally loaded into the memory 14 into the storage device 16 (step B5).

Next, details of the conversion rule information of the data structure will be described. The conversion rule information defines the correspondence between the pre-update data structure and the post-update data structure that accompany program replacement. For each data, the data type and the data structure indicating the position where those data exist. A pair with the offset from the beginning is stored in association with each other.

FIG. 6 is a diagram showing a first example of a data structure conversion rule. The data structure A before the update is shown in FIG.
As shown in, the long integer type A1, s
A2 of short integer type, short in
It is assumed to be composed of a tger type A3. In the examples shown in FIGS. 6 and 7, for example, long in
4-byte type, short integer
Let the type be 2 bytes.

The updated data structure a is as shown in FIG.
As shown in (b), a long integer type a
1, long integer type a2, long i
It is assumed to be composed of an integer type a3.

At this time, the conversion rule information Aa is as shown in FIG.
It is defined by the relationship shown in. That is, the variable of the long integer type from the offset 0 of the data structure A is the long from the offset 0 of the data structure a.
Corresponding to an integer type variable, similarly, short integer from offset 4 of data structure A
Type variable is long from offset 4 in data structure a
Corresponding to the integer type variable, the short integer type variable from the offset 6 of the data structure A is the long int from the offset 8 of the data structure a.
It corresponds to the variable of the egger type.

FIG. 7 is a diagram showing a second example of the data structure conversion rule. The data structure B before the update is shown in FIG.
As shown in, the long integer type B1, l
It is assumed that it is composed of an on integer type B2.

The updated data structure b is shown in FIG.
As shown in (b), a long integer type b
1, long integer type b2, long i
It is assumed to be composed of an integer type b3.

At this time, the conversion rule Bb is defined by the relationship shown in FIG. 7 (c). That is, a long integer type variable from offset 0 of data structure B is a long int from offset 0 of data structure b.
Corresponding to the variable of the integer type, the variable of the long integer type from the offset 4 of the data structure B corresponds to the variable of the long integer type from the offset 4 of the data structure b, and l from the offset 8 of the data structure b.
A new variable of the ong integer type is added.

The data conversion moving means 32, based on the conversion rule information as shown in FIG. 6C or 7C,
Data of the data structure 22 of the program 18 being executed is
It can be converted and written according to the additionally loaded data structure 28.

Further, the data reverse conversion moving means 40 can similarly convert the data of the additionally loaded data structure 28 into the original data structure 22 and write it based on the conversion rule information. , Can be returned to the original state before the program replacement.

In FIG. 6 and FIG. 7, the integer
Only the data type of the type is shown, but it can be applied to other data types. Next, the movement rule information and access to the additionally loaded data structure (access conversion) will be described in detail. The migration rule information defines the correspondence relationship between the data positions in the pre-update data structure and the post-update data structure associated with program replacement, and the combination of the start address where the data is located and their data length. It is associated and stored.

FIG. 8 is a diagram showing an example of access to the additionally loaded data structure. Note that in FIG. 8, access control is performed on a page-by-page basis. For access control, for example, a protection bit provided for each page is set to "1" to prohibit access.

FIG. 8A shows a page P including the data structure (data structure 22) before update, and it is assumed that the access is prohibited due to the program replacement. In this page P, there is a data structure A consisting of long integer type variables at address X and two sho at address Y.
There is a data structure B consisting of rt integer type variables.

FIG. 8B shows a page Q including the updated data structure (data structure 28) in an accessible state. In this page Q, there are two longs at address Z.
There is a data structure b consisting of integer type variables. The data structure b is an update of the data structure B in FIG.

Since page P is in an access prohibited state, a trap occurs when accessing all the data structures existing on this page. When the trap occurs, the pre-additional-load data access unit 48 is called. The pre-additional-load data access unit 48 checks the movement rule information R as shown in FIG. 8C during the trap processing.

The data access means 48 before additional loading is
When the trap occurs, it is possible to determine whether to access the data structure on the page or to access another data structure because the data structure has been updated by referring to the movement rule information R. .

For example, the data structure A at address X of page P
When a trap is generated by accessing the X, since the data structure A from the address X is not registered in the movement rule R, the pre-additional-load data access unit 48 uses the X on page P
The data structure A of the address is accessed.

On the other hand, when the data structure B of the address Y is accessed and a trap occurs, the data structure B from the address Y is accessed.
Is registered in the movement rule R, the pre-additional-load data access unit 48 causes the data structure b at address Z on page Q to be accessed instead of the data structure B at address Y on page P.

In this way, since the access is converted according to the movement rule information, it is possible to correctly access the additionally loaded data structure 28 when the program is replaced.

In this way, the program 18 being executed is
When a bug is detected in the system, the bug fix information is created, and when the program to which this bug fix information is applied is compiled and linked again to create a new execution module, the running program is stopped. It can be corrected by replacing the additionally loaded program 26 and data structure 28 by the program replacement function without waiting for the opportunity to stop.

For the additionally loaded data structure 28, a trap is generated when the original data structure 22 before being additionally loaded is accessed, and access conversion is performed in the trap processing. Controlled to be accessible.

Further, even if an error is found in the additionally loaded program 26 or data structure 28, the control can be returned to the state before applying the bug correction information without waiting for the opportunity to stop the system.

[0074]

As described above in detail, according to the present invention, it is possible to partially replace the program being executed without stopping the system.

[Brief description of drawings]

FIG. 1 is a block diagram showing a schematic configuration of a computer system according to an embodiment of the present invention.

FIG. 2 is a block diagram showing the configuration of a program replacement function according to the present invention.

FIG. 3 is a flowchart for explaining a program replacement operation in this embodiment.

FIG. 4 is a flowchart for explaining the operation of the program reverse conversion in the present embodiment.

FIG. 5 is a diagram showing a specific example of program replacement in the present embodiment.

FIG. 6 is a diagram showing a first example of a data structure conversion rule in the present embodiment.

FIG. 7 is a diagram showing a second example of a data structure conversion rule in the present embodiment.

FIG. 8 is a diagram for explaining an access (access conversion) to an additionally loaded data structure in the present embodiment.

[Explanation of symbols]

10 ... Computer system, 12 ... Processor, 14 ... Memory, 16 ... Storage device, 18 ... Running program, 2
0, 26 ... Program, 22, 28 ... Data structure, 24
… Part of the additionally loaded program and data structure, 3
0 ... Data structure / program additional loading means, 32 ... Data conversion moving means, 34 ... Conversion rule information, 36 ... Program control transfer means, 38 ... Additional data structure / program unloading means, 40 ... Data reverse conversion moving means, 42 …
Program control transition stopping means, 44 ... Program execution temporary stopping means, 46 ... Program execution restarting means, 48 ... Pre-additional data access means, 50 ... Moving rule information,
52 ... Pre-additional data access completion means, 54 ... Program replacement section, 56 ... Program reverse replacement section

Claims (6)

[Claims] 1. In a computer system, a data structure / program additional loading means for additionally loading a data structure of a program being executed and a part of the changed program, and a program for temporarily stopping the program being executed. Data is converted from the data structure used by the execution suspension means and the program being executed stopped by the program execution suspension means to the data structure additionally loaded by the data structure / program additional loading means. The data conversion moving means for moving, and the program being executed stopped by the program execution temporary stopping means, when control is passed to the program, the program additionally loaded by the data structure / program additional loading means Control is transferred to the running professional After the program control transfer means for changing a part of the RAM, the movement of the data by the data conversion transfer means, and the change of the program by the program control transfer means are completed, the program execution temporary stop means temporarily stops. And a program execution resuming means for resuming execution of the conventional program. 2. A trap is generated when the data structure before being additionally loaded by the data structure / program additional loading means is accessed, and the data structure is accessed so that the additional loaded data structure is accessed. And a pre-additional data access completion unit for returning from the trap when the access is completed by the conversion by the pre-additional data access unit. The computer system according to claim 1. 3. A data reverse conversion move for reversely converting and moving the data from the additionally loaded data structure to which the data has been moved by the data conversion moving means to the data structure used by the program being executed. Means for changing control of a part of the program being executed so as not to transfer control to the additionally loaded program when the program being executed is given control; The computer system according to claim 1 or 2, further comprising: a data structure additionally loaded by the program additional loading means, and an additional data structure / program unloading means for unloading the program. 4. In a computer system, a data structure of a program being executed and a part of the changed program are additionally loaded, the program being executed is temporarily stopped, and the stopped program being executed is The data is converted from the used data structure to the additionally loaded data structure and moved, and when control is passed to the running program, the execution is performed so that control is transferred to the additionally loaded program. A method of replacing a program, characterized in that a part of an internal program is changed, and after the movement of the data and the change of the program are completed, the execution of the temporarily stopped program is resumed. 5. The data before the additional loading by a part of the running program after the movement of the data and the change of the program are completed and the execution of the temporarily stopped program is resumed. A trap is generated when the structure is accessed, the access is converted so that the data is accessed to the additionally loaded data structure, and when the access is completed by this conversion, the trap is returned to move the data. 5. The program replacement method according to claim 4, wherein the accessed data is accessed. 6. After the data movement and the program change are completed, and the execution of the temporarily stopped program is resumed, the additionally loaded data structure is used by the executing program. The data is converted back to the existing data structure and moved, and when control is passed to the running program, a part of the running program is changed so as not to pass control to the additionally loaded program. 5. The method according to claim 4, further comprising unloading the additionally loaded data structure and the program.