WO2017063529A1 - 执行不可屏蔽中断的方法和装置 - Google Patents

执行不可屏蔽中断的方法和装置 Download PDF

Info

Publication number
WO2017063529A1
WO2017063529A1 PCT/CN2016/101592 CN2016101592W WO2017063529A1 WO 2017063529 A1 WO2017063529 A1 WO 2017063529A1 CN 2016101592 W CN2016101592 W CN 2016101592W WO 2017063529 A1 WO2017063529 A1 WO 2017063529A1
Authority
WO
WIPO (PCT)
Prior art keywords
secure
mode
interrupt
user
interrupt request
Prior art date
Application number
PCT/CN2016/101592
Other languages
English (en)
French (fr)
Inventor
马军
丁天虹
童肇哲
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22179800.2A priority Critical patent/EP4123450A1/en
Priority to EP16854908.7A priority patent/EP3306470B1/en
Priority to ES16854908T priority patent/ES2928753T3/es
Publication of WO2017063529A1 publication Critical patent/WO2017063529A1/zh
Priority to US15/947,491 priority patent/US10437632B2/en
Priority to US16/592,144 priority patent/US10970108B2/en
Priority to US17/207,186 priority patent/US11360803B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F1/00—Details not covered by groups G06F3/00 - G06F13/00 and G06F21/00
    • G06F1/24—Resetting means
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0751—Error or fault detection not based on redundancy
    • G06F11/0754—Error or fault detection not based on redundancy by exceeding limits
    • G06F11/0757—Error or fault detection not based on redundancy by exceeding limits by exceeding a time limit, i.e. time-out, e.g. watchdogs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0793—Remedial or corrective actions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/14—Handling requests for interconnection or transfer
    • G06F13/20—Handling requests for interconnection or transfer for access to input/output bus
    • G06F13/24—Handling requests for interconnection or transfer for access to input/output bus using interrupt
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4812—Task transfer initiation or dispatching by interrupt, e.g. masked

Definitions

  • Embodiments of the present invention relate to the field of servers and, more particularly, to a method and apparatus for performing non-maskable interrupts.
  • NMI Non Maskable Interrupt
  • the NMI is an interrupt that cannot be masked by the Central Processing Unit (CPU).
  • the CPU must respond with a valid NMI regardless of the state of the Interrupt Flag (IF) bit in the status register.
  • IF Interrupt Flag
  • NMI is usually used for fault handling, such as coprocessor operation errors, memory check errors, input/output (I/O) port check errors, etc., to save operating system (OS) errors. Status and exception information, etc. Therefore, NMI is a very important problem location method in the current server field, and it is also a very important feature for the product itself.
  • the current X86 and Million Instructions Per Second (MIPS) architectures have corresponding NMI implementation mechanisms. Mainly timing trigger or an interrupt triggered by a hardware fault, the interrupt can not be shielded, even if the system has a deadlock, it can respond to the interrupt.
  • the architectures such as X86 and MIPS enable the system to perform data storage related to NMI in non-secure mode, as well as user-defined processing such as writing system logs and feeding dogs.
  • ARM Advanced RISC Machine
  • the existing arm-v8 specification and software solution does not provide support for the NMI mechanism. Therefore, there is a need to provide a way to implement the NMI mechanism without hardware support.
  • Embodiments of the present invention provide a method and apparatus for performing a non-maskable interrupt, which can implement an NMI mechanism simply without relying on hardware in an ARM architecture.
  • the present invention provides a method of performing a non-maskable interrupt, comprising: obtaining a secure interrupt request in a non-secure mode, and interrupting operation of an operating system OS, the secure interrupt request being unmaskable;
  • the interrupt request enters a safe mode in which an interrupt context of the OS state at the time of the operation interruption of the OS is saved; returning the non-secure mode to perform a user-defined process; after the user-defined process is completed, re-entering the a security mode in which the OS state is restored according to the interrupt context; the non-secure mode is returned again, and the operation of the OS is continued.
  • the corresponding register and the exception vector table may be pre-configured so that the non-maskable interrupt process can be executed after the secure interrupt request is obtained.
  • the FIQ bit of the pre-configured SCR_EL3 register is 1, so that when the secure interrupt request FIQ is obtained, the system knows that the non-maskable interrupt should be executed, and then turns to the exception vector table to find the mode to which it should be routed.
  • Pre-configuration of the exception vector table can initialize the address to VBAR_EL3, causing the system to enter non-secure mode when performing a non-maskable interrupt.
  • the method for performing the non-maskable interrupt enters the safe mode to save the interrupt context of the OS state when the interrupt is interrupted, returns to the non-secure mode, performs the user-defined processing, and then enters the safe mode again to restore the OS state, and restores. After the OS state, it returns to the non-secure mode again to continue the operation of the OS, so that the NMI process can be simply implemented without relying on hardware.
  • returning the non-secure mode to perform a user-defined process including: after the saving of the interrupt context is completed in the security mode, according to the security mode
  • the exception return address returns to the non-secure mode, and a user defined function is executed to complete the user defined process.
  • the non-secure mode is returned to the non-secure mode according to the abnormal return address of the security mode, and user definition is performed.
  • the method further includes: calling an interface function when the kernel kernel of the non-secure mode is started, the interface function to the user in the security mode by a secure monitoring call SMC instruction The address of the defined function is recorded in the exception return address.
  • the method further includes pre-configuring an address of the save function in an exception vector table of the security mode, where the save function is configured to save the interrupt context of an OS state when the operation of the OS is interrupted; Entering a security mode by the secure interrupt request, in which the interrupt context of the OS state when the operation of the OS is interrupted is saved, including: when the secure interrupt request is generated, the secure interrupt request cannot be blocked And executing the save function according to the address of the save function entering the security mode.
  • the security interrupt request enters a security mode, and the OS is saved in the security mode
  • the interruption context of the OS state when the operation is interrupted may include: capturing the security interrupt request by the security monitoring Secure Monitor software running in the security mode to enter a security mode, and saving in the security mode by using the Secure Monitor software The interrupt context of the OS state when the operation of the OS is interrupted.
  • the present invention provides an apparatus for performing a non-maskable interrupt, comprising an interrupt module, a save module, a first execution module, a recovery module, and a second execution module for performing the first aspect and its corresponding implementation The implementation of the non-maskable interrupt method.
  • the interrupt module is configured to acquire a secure interrupt request in an unsecured mode and interrupt the operation of the operating system OS.
  • the save module is configured to enter the secure mode by using the secure interrupt request, and save the OS in the secure mode.
  • Interruption context of the OS state when the operation is interrupted a first execution module for returning the non-secure mode to perform user-defined processing; and a recovery module, for re-entering the security mode after the user-defined process is completed
  • the interrupt context restores the OS state; the second execution module is configured to return to the non-secure mode and continue to perform the operation of the OS.
  • the device for performing the non-maskable interrupt referred to in the second aspect may be a central processing unit CPU.
  • the first execution module is specifically configured to: after completing the saving of the interrupt context in the security mode, return an address according to the abnormality of the security mode Returning to the non-secure mode, a user defined function is executed to complete the user defined process.
  • the device further includes: an interface calling module, The exception return address of the secure mode is returned to the non-secure mode, and is executed when the kernel kernel of the non-secure mode is started before the user-defined function is executed to complete the user-defined process.
  • An interface function that records an address of the user-defined function in the safe return mode in the abnormal return address of the secure mode by a secure monitoring call SMC instruction.
  • the saving module is specifically configured to: capture by the security monitoring Secure Monitor software running in the security mode
  • the secure interrupt request enters a secure mode in which the interrupt context of the OS state at the time of the operation interruption of the OS is saved in the secure mode by the Secure Monitor software.
  • the apparatus further includes: a pre-configuration module, configured in the abnormal vector table of the security mode Pre-configuring an address of the save function, the save function is configured to save the interrupt context of the OS state when the operation of the OS is interrupted; the save module is specifically configured to: when the secure interrupt request is generated, the secure interrupt The request may not be masked, and the save function is executed directly into the secure mode according to the address of the save function pre-configured according to the pre-configured module.
  • a pre-configuration module configured in the abnormal vector table of the security mode Pre-configuring an address of the save function, the save function is configured to save the interrupt context of the OS state when the operation of the OS is interrupted; the save module is specifically configured to: when the secure interrupt request is generated, the secure interrupt The request may not be masked, and the save function is executed directly into the secure mode according to the address of the save function pre-configured according to the pre-configured module.
  • the present invention provides an apparatus for performing a non-maskable interrupt, comprising a processor, a memory and a transceiver, the memory for storing an instruction, the processor for executing the memory stored instruction to control transmission and reception
  • the apparatus performs the reception and transmission of signals, and when the processor executes the instructions stored by the memory, the method for performing the first aspect and its corresponding implementation.
  • the transceiver may be an interface for receiving a secure interrupt request sent by the hardware to the CPU.
  • the secure interrupt request is a fast interrupt request FIQ.
  • the user-defined process can be a user-defined instruction that can be executed in a non-secure mode in a non-maskable process.
  • the user-defined process may include at least one of saving a system log, reporting a status of the OS, and feeding a dog.
  • the non-secure mode includes at least one of an exception level EL0 and EL1 of an advanced reduced instruction set machine ARM architecture, the security mode including the ARM architecture EL3.
  • the safety interrupt request is generated by the OS timing triggering watchdog or triggered by a hardware failure to generate a watchdog.
  • a method and apparatus for performing a non-maskable interrupt correspondingly preconfiguring a security interrupt request, and being capable of receiving a screen of a hardware (eg, MASK) when acquiring a security interrupt request Shield, directly enter the safe mode to execute the interrupt context of the interrupt process, and then switch between the safe mode and the non-secure mode through the security mode security monitoring software, to implement subsequent user-defined processing, OS state recovery, and continue to perform OS operations. Therefore, the non-maskable interrupt flow can be simply implemented without relying on hardware.
  • a hardware eg, MASK
  • FIG. 1 is a schematic flow diagram of a method of performing a non-maskable interrupt, in accordance with one embodiment of the present invention.
  • FIG. 2 is a schematic flow chart of a method of performing a non-maskable interrupt in accordance with another embodiment of the present invention.
  • FIG. 3 is a schematic flow chart of a method of performing a non-maskable interrupt in accordance with another embodiment of the present invention.
  • FIG. 4 is a schematic flow chart of a pre-configuration of an FIQ in accordance with one embodiment of the present invention.
  • Figure 5 is a schematic flow diagram of a pre-configuration of a user defined function in accordance with one embodiment of the present invention.
  • FIG. 6 is a schematic block diagram of an apparatus for performing a non-maskable interrupt, in accordance with one embodiment of the present invention.
  • FIG. 7 is a schematic block diagram of an apparatus for performing a non-maskable interrupt in accordance with another embodiment of the present invention.
  • NMI Non Maskable Interrupt, the central processor (Central) Processing Unit, CPU) Interrupts that cannot be masked. Regardless of the state of the Interrupt Flag (IF) bit in the Status Register, the CPU must respond with a valid NMI.
  • NMI is usually used for fault handling, such as coprocessor operation errors, memory check errors, input/output (I/O) port check errors, etc., to save operating system (OS) errors. Status and exception information, etc.
  • EL0 Exception Level 0 refers to the environment in which the application software runs in the ARM architecture. It belongs to the non-secure mode and is also called the non-secure world.
  • EL1 Exception Level 1, which refers to the environment in which the kernel (kernel) runs in the ARM architecture and belongs to the non-secure mode.
  • the kernel is the operating system kernel, which refers to the core part of most operating systems (OS). It consists of the parts of the OS that manage memory, files, peripherals, and system resources.
  • OS operating systems
  • the kernel is typically used to run processes and provide communication between processes.
  • EL3 Exception Level 3, generally used in the ARM architecture to run security monitoring (Secure Monitor) software, such as the open source software Trust Firmware available from the network, EL3 belongs to the security mode, also known as the security world.
  • security monitoring Secure Monitor
  • Secure Interrupt Request An interrupt that can be handled by code in safe mode.
  • FIQ Fast Interrupt Request
  • IRQ Interrupt Request
  • the method of the embodiment of the present invention can be applied to an ARM architecture, for example, to an ARM64 architecture. It can also be applied to systems other than ARM architecture. As long as the security monitoring software can be run or a system similar to a security interrupt can be generated, the idea of the present invention can be utilized to implement the NMI mechanism.
  • the method for performing non-maskable interrupt in the embodiment of the present invention performs corresponding pre-configuration of the security interrupt request, and can obtain the security interrupt request without being shielded by hardware (for example, MASK), and directly enters the interrupt mode context of the safe mode execution interrupt process. And then through the security mode security monitoring software to switch between the safe mode and the non-secure mode, to implement subsequent user-defined processing, OS state recovery, and continue to perform OS operations, etc., so that non-maskable interrupts can be implemented simply without relying on hardware Process.
  • hardware for example, MASK
  • Figure 1 is a method of performing a non-maskable interrupt in accordance with one embodiment of the present invention.
  • method 100 can include:
  • the corresponding register and the exception vector table may be pre-configured so that the non-maskable interrupt process can be executed after the secure interrupt request is obtained.
  • the FIQ bit of the pre-configured SCR_EL3 register is 1, so that when the secure interrupt request FIQ is obtained, the system knows that the non-maskable interrupt should be executed, and then turns to the exception vector table to find the mode to which it should be routed.
  • Pre-configuration of the exception vector table can initialize the address to VBAR_EL3, causing the system to enter non-secure mode when performing a non-maskable interrupt.
  • the user-defined process can be a user-defined instruction that can be executed in a non-secure mode in a non-maskable process.
  • the method for performing the non-maskable interrupt enters the safe mode to save the interrupt context of the OS state when the interrupt is interrupted, returns to the non-secure mode, performs the user-defined processing, and then enters the safe mode again to restore the OS state, and restores the OS state again.
  • Returning to the non-secure mode continues the operation of the OS so that the NMI can be implemented simply without relying on hardware.
  • the security interrupt request in the embodiment of the present invention may be a fast interrupt request FIQ, or may be another type of security interrupt request that can be processed by the code of the security mode, which is not limited by the embodiment of the present invention.
  • FIQ fast interrupt request
  • This manual uses FIQ as an example to illustrate, and other security interrupt requests are similar, and will not be repeated here.
  • the description of the ARM architecture is taken as an example.
  • the non-secure mode in the ARM architecture may include at least one of EL0 and EL1, and the security mode may include EL3.
  • Figures 2 and 3 show schematic flow diagrams of performing non-maskable interrupts in accordance with an embodiment of the present invention.
  • the process of performing a non-maskable interrupt can include the following steps:
  • the watchdog generates a secure interrupt request, and the secure interrupt request may be FIQ.
  • the security interrupt request may be generated by the OS timing triggering watchdog, or by The embodiment of the present invention does not limit the generation of the watchdog generated by the hardware failure.
  • the OS needs to periodically save the state of the OS, thereby periodically triggering the watchdog to generate the FIQ.
  • the hardware can be various types of hardware devices that generate interrupts, also known as Interrupt Sources, and can include network cards (ie, network interface boards, also known as communication adapters, or network adapters, or network interface cards (Network). Interface Card, NIC)), hard disk (SATA) and watchdog.
  • the watchdog can be triggered to generate FIQ when hardware failure occurs.
  • the Generic Interrupt Controller captures the interrupt request and sends the FIQ to the interface of the Central Processing Unit (CPU). At this time, regardless of the state of the CPU, the work response is stopped, that is, the operation of the OS is interrupted, and the FIQ is processed.
  • GIC is a hardware module used to control and report interrupts, and is a general module in the ARM architecture.
  • FIQ causes the CPU to enter EL3 mode, FIQ can not be shielded, and is captured by security monitoring software (such as trust firmware) running in EL3 mode. After the security monitoring software captures the FIQ, the CPU determines the address of the save function in the EL3 mode according to the exception vector table of the EL3 mode.
  • security monitoring software such as trust firmware
  • the FIQ cannot be shielded, so that the CPU entering the EL3 mode can be implemented by pre-configuration, which is specifically described in the pre-configured flow 300 below.
  • the interrupt context is related data generated when the system is interrupted.
  • the interrupt context may include: the state of X0-X30, the state of ELR_EL3, SPSR_EL3, and the like.
  • X0-X30 is a general-purpose register
  • ELR_EL3 is an address returned from an EL3 exception to another level
  • SPSR_EL3 is a state returned by an EL3 exception.
  • SP_EL0 refers to data in the stack point (SP) of the EL0 level
  • SP_EL1 refers to data in the SP for the EL1 level
  • SP_EL2 refers to data in the SP for the EL2 level.
  • the abnormal return address needs to be pre-configured by registration when the system is initialized, specifically This is described in the pre-configured process 400 below.
  • the kernel executes a user-defined function to complete user-defined processing.
  • the user-defined process can be a user-defined instruction that can be executed in a non-secure mode in a non-maskable process.
  • User-defined processing which can be customized by the user according to the needs of the system, for example, may include: saving system logs, reporting the status of the OS, and feeding the dog to complete some usual subsequent processing of the interruption, for example, saving the system. Log, report the status of this interrupted OS, clear the timer of Watch Dog, and so on.
  • the user-defined process may also include some other processing defined by the user, which is not limited by the embodiment of the present invention.
  • the user-defined function can include the address of the function that was entered when entering EL3 mode again.
  • the user-defined process of the embodiment of the present invention cannot be implemented, and thus needs to be returned to the non-secure mode (EL1 mode) for execution.
  • S270 after the user-defined processing is completed, enter the EL3, that is, the security mode, from the EL1 through the common Secure Monitor Call (SMC) command in the ARM architecture, and enter the function of S260.
  • the function may be a recovery function for restoring the OS state according to the interrupt context, but the embodiment of the present invention is not limited thereto.
  • Secure Monitor software is a type of software that can run in EL3 mode.
  • the Secure Monitor software can be used when the CPU switches between safe mode and non-secure mode.
  • the Secure Monitor software is mainly responsible for the safe and stable switching of the context when the CPU switches between the two modes. Therefore, the implementation of the NMI mechanism of the embodiment of the present invention can be regarded as being implemented based on software.
  • the Secure Monitor software is used as an example for the description of the Trust Firmware software.
  • other Secure Monitor software may be used, which is not limited in the embodiment of the present invention.
  • the system in order to make the system executable non-maskable interrupt, the system needs to be in the EL3 mode.
  • To run the trust firmware software During system startup, the FIQ needs to be pre-configured during the initialization of the trust firmware to be used as a secure interrupt request.
  • the S120 enters the security mode by using the secure interrupt request, and the interrupt context of the OS state when the operation of the OS is interrupted in the safe mode may include: performing security monitoring through the security mode.
  • the Monitor software captures the secure interrupt request to enter a secure mode, and in the secure mode, the Secure Monitor software saves the interrupt context of the OS state when the OS is interrupted.
  • the pre-configuration process of the FIQ may be the process 300 shown in FIG. 4, including:
  • the configuration includes that the GICC FIQEn is 1, that is, the Group0 interrupt is in the FIQ form; the GICC FIQBypDisGrp0 bit is set to 0. Enable Group0 and Group1 of GICD, set the interrupt enable of all security interrupt requests before setting the interrupt, and set the priority to be indistinguishable.
  • GICC PMR ie do not block any interrupts. Set the interrupt priority level corresponding to the safety interrupt number to 0, which is the highest priority. Set the interrupt packet register, that is, set the corresponding security interrupt number to Group0.
  • the method 100 may further include:
  • the save function is used to save the interrupt context of the OS state when the operation of the OS is interrupted;
  • the interrupt context of the OS state when the operation of the OS is interrupted may be:
  • the secure interrupt request When the secure interrupt request is generated, the secure interrupt request may not be masked, and the save function is executed according to the address entering the secure mode.
  • pre-configured process may also be performed not during the initialization of the trust firmware, but in other processes initiated by the system. Alternatively, the above processes may be performed separately at different startup stages of the system, and the order of pre-configuration may not be limited to the order given by process 300.
  • the user-defined function in the non-secure mode (in the EL1 mode kernel) is returned according to the abnormal return address.
  • the abnormal return address can be as The flow 400 shown in FIG. 5 is preconfigured for registering the interrupt interface function of the NMI of the OS running in the non-secure mode to the secure mode.
  • S420 calling an interrupt interface function (for example, can be register_nmi_handler).
  • This function transfers the address of the user-defined function (for example, nmi_handler) executed by EL1 mode to the EL3 mode trust firmware software through the SMC instruction and records it.
  • the interrupt interface function can send two parameters to the trust firmware software through the SMC instruction.
  • Parameter 0 is the address of the user-defined function, where the user-defined function can be a function customized by the user according to needs;
  • parameter 1 is the SMC function identifier (ID), for example, the SMC call specification can be set to 0x83000000.
  • ID the SMC function identifier
  • 0x83000000 may be an identification ID defined by an Original Equipment Manufacture (OEM), which conforms to the SMC calling specification, and implements a function to save the address of the user-defined function.
  • OEM Original Equipment Manufacture
  • the system enters the trust firmware software in EL3 mode, confirms the SMC function ID and saves the user-defined function nmi_handler.
  • the method further includes:
  • the interface function is called when the kernel of the non-secure mode is started, and the interface function records the address of the user-defined function in the security return mode by the security monitoring call SMC instruction in the abnormal return address.
  • the address of the user-defined function may be transmitted to the trust firmware software by other means, such as interruption, etc., which is not limited by the embodiment of the present invention.
  • the IRQ can still be generated according to the existing manner. It is masked by the corresponding hardware, such as IRQ MASK, so that the non-secure mode such as EL0 running by the application software and EL1 running by the kernel is not aware of the interrupt.
  • the embodiment of the present invention does not limit the implementation manner of the non-maskable interrupt.
  • FIGS. 1 through 5 A method of performing a non-maskable interrupt according to an embodiment of the present invention is described in detail above with reference to FIGS. 1 through 5.
  • FIGS. 6 and 7. An execution non-maskable according to an embodiment of the present invention will be described with reference to FIGS. 6 and 7. Broken device.
  • the apparatus 500 for performing non-maskable interrupts includes:
  • the interrupt module 510 is configured to obtain a secure interrupt request in the non-secure mode and interrupt the operation of the operating system OS, and the secure interrupt request cannot be blocked;
  • the saving module 520 is configured to enter a security mode by using the secure interrupt request, in which the interrupt context of the OS state when the operation of the OS is interrupted is saved;
  • the first execution module 530 is configured to return the non-secure mode to perform user-defined processing
  • the recovery module 540 is configured to re-enter the security mode after the user-defined process is completed, and restore the OS state according to the interrupt context in the security mode;
  • the second execution module 550 is configured to return to the non-secure mode again and continue to perform the operation of the OS.
  • the apparatus for performing the non-maskable interrupt enters the safe mode to save the interrupt context of the OS state at the time of the interrupt, returns to the non-secure mode, performs the user-defined processing, and then enters the safe mode again to restore the OS state, and restores the OS state. After returning to the non-secure mode again, the operation of the OS is continued, so that the NMI can be simply implemented without depending on the hardware.
  • the secure interrupt request may be a fast interrupt request FIQ.
  • the user-defined process may include: saving at least one of a system log, a status of reporting the OS, and a feeding dog.
  • the non-secure mode may include at least one of the abnormal levels EL0 and EL1 of the ARM instruction frame of the advanced reduced instruction set machine, and the security mode may include the EL3 of the ARM architecture.
  • the safety interrupt request may be generated by the OS timing triggering watchdog, or may be triggered by a hardware failure to generate a watchdog.
  • the first execution module 530 is specifically configured to:
  • the non-secure mode is returned according to the exception return address of the secure mode, and the user-defined function is executed to complete the user-defined process.
  • the apparatus 500 may further include:
  • An interface calling module configured to return the non-secure mode according to the abnormal return address of the security mode at the first execution module 530, and execute the user-defined function to complete the user-defined process before the kernel kernel of the non-secure mode starts
  • An interface function that records the address of the user-defined function in the security mode by the security monitoring call SMC instruction in the abnormal return destination In the address.
  • the apparatus 500 further includes:
  • a pre-configuration module configured to pre-configure an address of the save function in the exception vector table of the security mode, where the save function is used to save the interrupt context of the OS state when the operation of the OS is interrupted;
  • the save module 520 is specifically configured to:
  • the secure interrupt request When the secure interrupt request is generated, the secure interrupt request may not be masked, and the save function is executed according to the address of the save function pre-configured according to the pre-configured module.
  • the saving module 520 is specifically configured to:
  • the secure interrupt request is captured by the secure monitoring software running in the secure mode to enter a secure mode, and the interrupt context of the OS state when the operation of the OS is interrupted is saved by the Secure Monitor software in the secure mode .
  • the apparatus 500 of the embodiment of the present invention may be a CPU.
  • each module in the apparatus 500 is merely illustrative, only one logical function partitioning, and may be further divided in actual implementation.
  • Each module can exist alone or in combination.
  • each module in device 500 can be integrated into a general module of the CPU for performing a non-maskable interrupt flow.
  • apparatus 500 of the embodiments of the present invention may correspond to performing the subject of performing non-maskable interrupts in the embodiments of the present invention, and the above and other operations and/or functions of the respective modules in the apparatus 500 are respectively implemented in order to implement FIG.
  • the corresponding flow in FIG. 5 is not described here for brevity.
  • the apparatus for performing the non-maskable interrupt enters the safe mode to save the interrupt context of the OS state at the time of the interrupt, returns to the non-secure mode, performs the user-defined processing, and then enters the safe mode again to restore the OS state, and restores the OS state. After returning to the non-secure mode again, the operation of the OS is continued, so that the NMI can be simply implemented without depending on the hardware.
  • the obtaining of the security interrupt request in the non-secure mode may be implemented by the transceiver, and the functions implemented by the interrupt module 510, the saving module 520, the first executing module 530, the recovery module 540, and the second executing module 550 may be implemented.
  • apparatus 600 for performing a non-maskable interrupt can include a processor 610, a transceiver 620, and a memory 630.
  • the memory 630 can be used to store code and the like executed by the processor 610.
  • the transceiver 620 can be an interface for receiving a secure interrupt request sent by the hardware such as a watchdog to the CPU.
  • bus system 640 which may include, in addition to the data bus, a power bus, a control bus, a status signal bus, and the like.
  • the apparatus 600 shown in FIG. 7 is capable of implementing the various processes implemented in the foregoing embodiments of FIGS. 1 through 5.
  • the apparatus 600 includes a processor 610, a transceiver 620 for storing instructions, and a memory 630 for executing instructions stored by the memory 630 to control the transceiver 620 to receive and transmit signals when processed.
  • the processor 610 executes the instructions stored by the memory 630
  • the apparatus 600 is configured to perform the method of performing a non-maskable interrupt in an embodiment of the present invention.
  • the transceiver 620 can be configured to obtain a security interrupt request in a non-secure mode, and the security interrupt request cannot be blocked.
  • the processor 610 can be used to:
  • the security mode is entered again, and the OS state is restored according to the interrupt context in the security mode;
  • the method for performing the non-maskable interrupt enters the safe mode to save the interrupt context of the OS state at the time of the interrupt, returns to the non-secure mode, performs the user-defined processing, and then enters the safe mode again to restore the OS state, and restores the OS state. After returning to the non-secure mode again, the operation of the OS is continued, so that the NMI can be simply implemented without depending on the hardware.
  • the secure interrupt request may be a fast interrupt request FIQ.
  • the user-defined process may include: saving at least one of a system log, a status of reporting the OS, and a feeding dog.
  • the non-secure mode may include at least one of the abnormal levels EL0 and EL1 of the ARM instruction frame of the advanced reduced instruction set machine, and the security mode may include the EL3 of the ARM architecture.
  • the safety interrupt request may be generated by the OS timing triggering watchdog, or may be triggered by a hardware failure to generate a watchdog.
  • the processor 610 returns the non-secure mode to perform user-defined processing, which may include:
  • the non-secure mode is returned according to the exception return address of the secure mode, and the user-defined function is executed to complete the user-defined process.
  • the processor 610 returns the non-secure mode according to the abnormal return address according to the security mode, and before executing the user-defined function to complete the user-defined process, the processor 610 may further be configured to:
  • an interface function When the kernel kernel of the non-secure mode is started, an interface function is called, and the interface function records the address of the user-defined function in the security mode to record the address of the user-defined function in the security mode by calling the SMC instruction.
  • the processor 610 is further configured to pre-configure an address of the save function in the exception vector table of the security mode, where the save function is used to save the interrupt context of the OS state when the operation of the OS is interrupted. ;
  • the processor 610 enters the security mode by using the secure interrupt request, and the interrupt context of the OS state when the operation of the OS is interrupted in the safe mode may include:
  • the secure interrupt request When the secure interrupt request is generated, the secure interrupt request may not be masked, and the save function is executed according to the address of the save function entering the secure mode.
  • the processor 610 enters a security mode by using the secure interrupt request, and the interrupt context of the OS state when the operation of the OS is interrupted in the safe mode may include:
  • the security interrupt request is captured by the security monitoring Secure Monitor software running in the security mode to enter a secure mode in which the interrupt context of the OS state at the time of the operation interruption of the OS is saved in the secure mode.
  • apparatus 600 of the embodiment of the present invention may be a CPU.
  • the processor may be an integrated circuit chip with signal processing capabilities.
  • each step of the foregoing method embodiment may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software.
  • the processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programming logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • Software module can It is located in a random storage medium, such as a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register, and the like.
  • the storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.
  • the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (Erasable PROM, EPROM), or an electric Erase programmable read only memory (EEPROM) or flash memory.
  • the volatile memory can be a Random Access Memory (RAM) that acts as an external cache.
  • RAM Random Access Memory
  • many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (Synchronous DRAM).
  • SDRAM Double Data Rate SDRAM
  • DDR SDRAM Double Data Rate SDRAM
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Connection Dynamic Random Access Memory
  • DR RAM direct memory bus random access memory
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • Another point that is shown or discussed between each other The coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Quality & Reliability (AREA)
  • Debugging And Monitoring (AREA)
  • Microcomputers (AREA)
  • Bus Control (AREA)
  • Stored Programmes (AREA)

Abstract

一种执行不可屏蔽中断的方法和装置（500，600），该方法包括：在非安全模式下获取安全中断请求，并中断操作系统OS的操作，该安全中断请求不可被屏蔽（S110）；通过所述安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文（S120）；返回该非安全模式执行用户定义处理（S130）；在该用户定义处理完成后，再次进入该安全模式，在该安全模式下根据该中断上下文恢复该OS状态（S140）；再次返回该非安全模式，继续执行该OS的操作（S150）。该执行不可屏蔽中断的方法和装置，可以不依赖于硬件简单地实现NMI。

Description

执行不可屏蔽中断的方法和装置 技术领域
本发明实施例涉及服务器领域，并且更具体地，涉及一种执行不可屏蔽中断的方法和装置。
背景技术
服务器一般对系统稳定性有着极高的要求。在系统正常运行时候能够定时保存系统的状态，同时也需要在系统异常的时候能够保存一些关键数据，为定位系统出错原因提供数据支撑。因为系统正常运行时，可以有多种方法和手段来保存系统数据，但是系统异常时——最严重的就是死机时，所有常规方法和手段已经不可行，所有中断也无法响应。此时需要不可屏蔽中断(Non Maskable Interrupt，NMI)机制来保存数据。
NMI即中央处理器(Central Processing Unit，CPU)不能屏蔽的中断，无论状态寄存器中的中断标识(Interrupt Flag，IF)位的状态如何，CPU收到有效的NMI必须进行响应。NMI通常用于故障处理，例如协处理器运算出错、存储器校验出错、输入/输出(Input/Output，I/O)端口校验出错等，用于保存操作系统(Operating System，OS)的错误状态和异常信息等。因此NMI是当前服务器领域非常重要的问题定位手段，对产品本身来说，也是非常重要的特性。
当前的X86和单字长定点指令平均执行速度(Million Instructions Per Second，MIPS)等架构都有对应的NMI实现机制。主要是定时触发或由硬件故障触发一个中断，该中断无法被屏蔽，即使系统已经发生死锁，也能响应中断。X86和MIPS等架构通过硬件手段使得系统在非安全模式中执行NMI涉及的数据保存，以及书写系统日志和喂狗等用户定义处理。但是在进阶精简指令集机器(Advanced RISC Machine，ARM)架构中，没有对应的硬件使得可以在非安全模式中来实现NMI。并且现有的arm-v8规范和软件解决方案也没有提供对NMI机制的支持。因此需要在没有硬件支持的情况下提供一种方法来实现NMI机制。
发明内容
本发明实施例提供一种执行不可屏蔽中断的方法和装置，能够在ARM架构中不依赖于硬件简单地实现NMI机制。
第一方面，本发明提供了一种执行不可屏蔽中断的方法，包括：在非安全模式下获取安全中断请求，并中断操作系统OS的操作，所述安全中断请求不可被屏蔽；通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文；返回所述非安全模式执行用户定义处理；在所述用户定义处理完成后，再次进入所述安全模式，在所述安全模式下根据所述中断上下文恢复所述OS状态；再次返回所述非安全模式，继续执行所述OS的操作。
其中，在执行该方法之前，可以对相应的寄存器和异常向量表进行预配置，使得在获取安全中断请求后能够执行不可屏蔽中断流程。
例如，在ARM架构中，预配置SCR_EL3寄存器的FIQ位为1，使得当获取安全中断请求FIQ时，系统能够知道应执行不可屏蔽中断，从而转向异常向量表查找应路由至的模式。对异常向量表的预配置则可以将地址初始化为VBAR_EL3，使得系统在执行不可屏蔽中断时进入非安全模式。
基于上述技术方案，本发明实施例的执行不可屏蔽中断的方法通过安全中断请求进入安全模式保存中断时OS状态的中断上下文，返回非安全模式执行用户定义处理后再次进入安全模式恢复OS状态，恢复OS状态后再次返回非安全模式继续执行OS的操作，从而可以不依赖于硬件简单地实现NMI流程。
结合第一方面，在第一方面的一种实现方式中，返回所述非安全模式执行用户定义处理，包括：在所述安全模式下完成所述中断上下文的保存后，根据所述安全模式的异常返回地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理。
结合第一方面或其上述相应的实现方式的任一种，在第一方面的另一种实现方式中，在所述根据所述安全模式的异常返回地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理之前，所述方法还包括：在所述非安全模式的内核kernel启动时调用接口函数，所述接口函数通过安全监控呼叫SMC指令在所述安全模式将所述用户定义函数的地址记录在所述异常返回地址中。
结合第一方面或其上述相应的实现方式的任一种，在第一方面的另一种 实现方式中，所述方法还包括：在所述安全模式的异常向量表中预配置保存函数的地址，所述保存函数用于保存所述OS的操作中断时OS状态的所述中断上下文；所述通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文，包括：当产生所述安全中断请求时，所述安全中断请求不可被屏蔽，根据所述保存函数的地址进入安全模式执行所述保存函数。
结合第一方面或其上述相应的实现方式的任一种，在第一方面的另一种实现方式中，所述通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文，可以包括：通过所述安全模式中运行的安全监测Secure Monitor软件捕获所述安全中断请求以进入安全模式，通过所述Secure Monitor软件在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文。
第二方面，本发明提供了一种执行不可屏蔽中断的装置，包括中断模块、保存模块、第一执行模块、恢复模块和第二执行模块，以用于执行第一方面及其相应的实现方式的执行不可屏蔽中断的方法。其中，中断模块，用于在非安全模式下获取安全中断请求，并中断操作系统OS的操作；保存模块，用于通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文；第一执行模块，用于返回所述非安全模式执行用户定义处理；恢复模块，用于在所述用户定义处理完成后，再次进入所述安全模式根据所述中断上下文恢复所述OS状态；第二执行模块，用于返回所述非安全模式，继续执行所述OS的操作。
其中，第二方面中所指的执行不可屏蔽中断的装置可以是中央处理器CPU。
结合第二方面，在第二方面的一种实现方式中，所述第一执行模块具体用于：在所述安全模式下完成所述中断上下文的保存后，根据所述安全模式的异常返回地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理。
结合第二方面或其上述相应的实现方式的任一种，在第二方面的另一种实现方式中，所述装置还包括：接口调用模块，用于在所述第一执行模块根据所述安全模式的异常返回地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理之前，在所述非安全模式的内核kernel启动时调用 接口函数，所述接口函数通过安全监控呼叫SMC指令在所述安全模式将所述用户定义函数的地址记录在所述安全模式的所述异常返回地址中。
结合第二方面或其上述相应的实现方式的任一种，在第二方面的另一种实现方式中，所述保存模块具体用于：通过所述安全模式中运行的安全监测Secure Monitor软件捕获所述安全中断请求以进入安全模式，通过所述Secure Monitor软件在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文。
结合第二方面或其上述相应的实现方式的任一种，在第二方面的另一种实现方式中，所述装置还包括：预配置模块，用于在所述安全模式的异常向量表中预配置保存函数的地址，所述保存函数用于保存所述OS的操作中断时OS状态的所述中断上下文；所述保存模块具体用于：当产生所述安全中断请求时，所述安全中断请求不可被屏蔽，根据根据所述预配置模块预配置的所述保存函数的地址直接进入安全模式执行所述保存函数。
第三方面，本发明提供了一种执行不可屏蔽中断的装置，包括处理器、存储器和收发器，所述存储器用于存储指令，所述处理器用于执行所述存储器存储的指令，以控制收发器进行信号的接收和发送，当处理器执行所述存储器存储的指令时，以用于执行第一方面及其相应的实现方式的方法。
其中，在第三方面的执行不可屏蔽中断的装置中，收发器可以为一个接口，用于接收硬件向CPU发送的安全中断请求。
在第一方面至第三方面及相应的实现方式中，所述安全中断请求为快速中断请求FIQ。
在第一方面至第三方面及相应的实现方式中，用户定义处理可以是用户定义的，能够在不可屏蔽流程中的非安全模式下执行的指令。所述用户定义处理可以包括：保存系统日志、上报OS的状态和喂狗中的至少一种。
在第一方面至第三方面及相应的实现方式中，所述非安全模式包括进阶精简指令集机器ARM架构的异常等级EL0和EL1中的至少一种，所述安全模式包括所述ARM架构的EL3。
在第一方面至第三方面及相应的实现方式中，所述安全中断请求是所述OS定时触发看门狗生成的，或者是由于硬件故障触发看门狗生成的。
本发明实施例的执行不可屏蔽中断的方法和装置，对安全中断请求进行相应的预配置，在获取安全中断请求时能够不受到硬件(例如MASK)的屏 蔽，直接进入安全模式执行中断流程的中断上下文保存，继而通过安全模式的安全监测软件在安全模式与非安全模式下切换，实现后续的用户定义处理、OS状态恢复以及继续执行OS的操作等处理，因而可以不依赖于硬件简单地实现不可屏蔽中断流程。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是根据本发明一个实施例的执行不可屏蔽中断的方法的示意性流程图。
图2是根据本发明另一个实施例的执行不可屏蔽中断的方法的示意性流程图。
图3是根据本发明另一个实施例的执行不可屏蔽中断的方法的示意性流程图。
图4是根据本发明一个实施例的FIQ的预配置的示意性流程图。
图5是根据本发明一个实施例的用户定义函数的预配置的示意性流程图。
图6是根据本发明一个实施例的执行不可屏蔽中断的装置的示意性框图。
图7是根据本发明另一个实施例的执行不可屏蔽中断的装置的示意性框图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
下面对本发明实施例涉及的几个基本概念进行简要地介绍。
NMI：不可屏蔽中断(Non Maskable Interrupt)，即中央处理器(Central  Processing Unit，CPU)不能屏蔽的中断，无论状态寄存器中的中断标识(Interrupt Flag，IF)位的状态如何，CPU收到有效的NMI必须进行响应。NMI通常用于故障处理，例如协处理器运算出错、存储器校验出错、输入/输出(Input/Output，I/O)端口校验出错等，用于保存操作系统(Operating System，OS)的错误状态和异常信息等。
EL0：异常等级(Exception Level)0，是指ARM架构中应用软件运行的环境，属于非安全模式，也称作非安全世界。
EL1：异常等级(Exception Level)1，是指ARM架构中内核(kernel)运行的环境，属于非安全模式。其中，kernel为操作系统内核，是指大多数操作系统(Operating System，OS)的核心部分。它由OS中用于管理存储器、文件、外设和系统资源的部分组成。kernel通常用于运行进程，并提供进程间的通信。
EL3：Exception Level 3，一般用于ARM架构中运行安全监控(Secure Monitor)软件，例如可从网络获取的开源软件Trust Firmware等，EL3属于安全模式，也称作安全世界。
安全中断请求：是指可以被安全模式的代码处理的中断。
FIQ：快速中断请求(Fast Interrupt Request，FIQ)，系统在中断时做一些优化来达到快速和实时的目的。FIQ必须尽快处理，处理结束后离开这个模式。中断请求(Interrupt Request，IRQ)可以被FIQ中断，但IRQ不能中断FIQ。
本发明实施例的方法可以应用于ARM架构中，例如，应用于ARM64架构。也可以应用于非ARM架构的系统中，只要可以运行安全监测软件或者可以产生类似于安全中断的系统，都可以利用本发明的思想来实现NMI机制。
本发明实施例的执行不可屏蔽中断的方法，对安全中断请求进行相应的预配置，在获取安全中断请求时能够不受到硬件(例如MASK)的屏蔽，直接进入安全模式执行中断流程的中断上下文保存，继而通过安全模式的安全监测软件在安全模式与非安全模式下切换，实现后续的用户定义处理、OS状态恢复以及继续执行OS的操作等处理，因而可以不依赖于硬件简单地实现不可屏蔽中断流程。
具体而言，图1是根据本发明一个实施例的执行不可屏蔽中断的方法 100的示意性流程图，方法100可以包括：
S110，在非安全模式下获取安全中断请求，并中断操作系统OS的操作，该安全中断请求不可被屏蔽；
S120，通过该安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文；
S130，返回该非安全模式执行用户定义处理；
S140，在该用户定义处理完成后，再次进入该安全模式，在该安全模式下根据该中断上下文恢复该OS状态；
S150，再次返回该非安全模式，继续执行该OS的操作。
其中，在执行该方法之前，可以对相应的寄存器和异常向量表进行预配置，使得在获取安全中断请求后能够执行不可屏蔽中断流程。
例如，在ARM架构中，预配置SCR_EL3寄存器的FIQ位为1，使得当获取安全中断请求FIQ时，系统能够知道应执行不可屏蔽中断，从而转向异常向量表查找应路由至的模式。对异常向量表的预配置则可以将地址初始化为VBAR_EL3，使得系统在执行不可屏蔽中断时进入非安全模式。
应理解，用户定义处理可以是用户定义的，能够在不可屏蔽流程中的非安全模式下执行的指令。
本发明实施例的执行不可屏蔽中断的方法，通过安全中断请求进入安全模式保存中断时OS状态的中断上下文，返回非安全模式执行用户定义处理后再次进入安全模式恢复OS状态，恢复OS状态后再次返回非安全模式继续执行OS的操作，从而可以不依赖于硬件简单地实现NMI。
其中，本发明实施例中的安全中断请求可以为快速中断请求FIQ，也可以为可以被安全模式的代码处理的其它类型的安全中断请求，本发明实施例对此不作限定。本说明书以FIQ为例进行说明，其它安全中断请求的情况与之类似，不再一一赘述。
其中，本说明书以ARM架构为例进行说明。ARM架构中非安全模式可以包括EL0和EL1中的至少一种，安全模式可以包括EL3。
具体而言，图2和图3示出了本发明实施例的执行不可屏蔽中断的示意性流程图。执行不可屏蔽中断的过程可以包括以下步骤：
S210，看门狗(Watch Dog)生成安全中断请求，该安全中断请求可以是FIQ。其中，安全中断请求可以是OS定时触发看门狗生成的，或者是由 于硬件故障触发看门狗生成的，本发明实施例对此不作限定。
OS为了保证运行的稳定性，需要定时保存OS的状态，从而定时触发看门狗生成FIQ。
硬件可以是产生中断的各类硬件设备，又称作中断源(Interrupt Source)，可以包括网卡(即网络接口板，又称为通信适配器，或网络适配器(Network Adapter)，或网络接口卡(Network Interface Card，NIC))，硬盘(SATA)以及看门狗等。当硬件发生故障时可以触发看门狗生成FIQ。
S220，当看门狗产生FIQ以后，通用中断控制器(Generic Interrupt Controller，GIC)会捕捉到这种中断请求，将该FIQ发送到中央处理器(Central Processing Unit，CPU)的接口。此时不论CPU处于什么状态，都会停止工作响应，即中断OS的操作，并处理该FIQ。
其中，GIC是用来对中断进行控制和上报的硬件模块，是ARM架构中的通用模块。
S230，FIQ导致CPU进入到EL3模式，FIQ不可被屏蔽，被运行在EL3模式的安全监控软件(例如trust firmware)所捕获。在安全监控软件捕获到FIQ后，CPU根据EL3模式的异常向量表，确定保存函数在EL3模式中的地址。
其中，FIQ不可被屏蔽，使得CPU进入到EL3模式可以通过预配置实现，具体在下文中的预配置的流程300中介绍。
S240，执行上述保存函数，在EL3模式下保存OS的操作中断时OS状态的中断上下文(Context，或称为场景)。
其中，中断上下文为系统中断时产生的相关数据。通常，中断上下文可以包括：X0-X30的状态、ELR_EL3、SPSR_EL3的状态等。其中，X0-X30是通用寄存器、ELR_EL3为从EL3异常返回至其它层级的地址、SPSR_EL3为EL3异常返回的状态。
S250，在完成中断上下文的保存后，根据异常返回地址返回非安全模式(EL1模式的kernel中)的用户定义函数。在返回非安全模式前，可以将保存的中断上下文连同SP_EL0、SP_EL1、SP_EL2等再保存一个备份。其中，SP_EL0是指EL0层级的堆栈点(Stack Point，SP)中的数据、SP_EL1是指EL1层级用的SP中的数据、SP_EL2是指EL2层级用的SP中的数据。
其中，异常返回地址需要在系统初始化时通过注册进行预配置，具体在 下文中的预配置的流程400中介绍。
S260，在EL1模式中kernel执行用户定义函数以完成用户定义处理。
其中，用户定义处理可以是用户定义的，能够在不可屏蔽流程中的非安全模式下执行的指令。用户定义处理，可以由用户根据系统的需要定制，例如可以包括：保存系统日志、上报OS的状态和喂狗中的至少一种，以完成本次中断的一些惯常的后续处理，例如，保存系统日志，上报本次中断OS的状态，清空Watch Dog的计时器告等等。
用户定义处理还可以包括用户定义的一些其它处理，本发明实施例对此不作限定。用户定义函数中可以包括再次进入EL3模式时，所进入的函数的地址。
ARM架构的EL3模式下，不能实现本发明实施例的用户定义处理，因而需返回非安全模式(EL1模式)中来执行。
S250和S260，可以对应于S130返回该非安全模式执行用户定义处理，包括：在该安全模式下完成该中断上下文的保存后，根据该安全模式的异常返回地址返回该非安全模式，执行用户定义函数以完成该用户定义处理。
S270，在用户定义处理完成后，通过ARM架构中通用的安全监控呼叫(Secure Monitor Call，SMC)指令再次从EL1进入EL3，即安全模式，进入S260该的函数。该函数可以为恢复函数，用于根据中断上下文恢复OS状态，但本发明实施例不限于此。
S280，在中断上下文恢复后，返回非安全模式，继续执行中断产生时OS的操作。
应理解，本发明实施例的方法运行在EL3模式时，可以通过Secure Monitor软件完成相应的处理。Secure Monitor软件是可以运行在EL3模式下的一类软件。当CPU在安全模式和非安全模式之间进行切换时均可经过Secure Monitor软件。Secure Monitor软件主要负责CPU在两种模式之间转换时上下文(Context)安全稳定的切换。因而，本发明实施例的实现NMI机制可视为是基于软件实现的。
本发明实施例中，以Secure Monitor软件为Trust Firmware软件为例进行描述，当然也可以使用其他的Secure Monitor软件，本发明实施例对此不作限定。
本发明实施例中，为使得系统可执行不可屏蔽中断，在EL3模式系统需 要运行trust firmware软件。在系统启动过程中，在对trust firmware初始化过程中需对FIQ进行预配置，使其能够作为安全中断请求来使用。
因此，在本发明实施例中，S120通过该安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文，可以包括：通过该安全模式中运行的安全监测Secure Monitor软件捕获该安全中断请求以进入安全模式，并且通过该Secure Monitor软件在该安全模式下保存该OS的操作中断时OS状态的中断上下文。
具体地，例如，FIQ的预配置过程可以如图4所示的流程300，包括：
S310，在系统启动阶段，初始化异常向量表，将异常向量表(runtime_exceptions)的地址初始化为VBAR_EL3。由此，当捕获FIQ时，CPU可以根据异常向量表进入EL3模式。
S320，配置SCR_EL3寄存器的FIQ位为1。由此，当FIQ产生时，系统可知应执行不可屏蔽中断，从而转向至异常向量表查找应路由至的模式。
S330，对系统的硬件进行配置，定义由FIQ产生的中断的特性。其中，包括配置GICC FIQEn为1，即Group0的中断为FIQ形式；设置GICC的FIQBypDisGrp0位为0。使能GICD的Group0和Group1，设置中断前将所有安全中断请求的中断使能清除，同时优先级设置为不区分。设置GICC PMR，即不屏蔽任何中断。设置对应安全中断号的中断优先级为0，即最高优先级。设置中断分组寄存器，即设置对应的安全中断号为Group0。
对应上述方法100，方法100还可以包括：
在该安全模式的异常向量表中预配置保存函数的地址，该保存函数用于保存该OS的操作中断时OS状态的中断上下文；
S120通过该安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文，可以包括：
当产生该安全中断请求时，该安全中断请求不可被屏蔽，根据该地址进入安全模式执行该保存函数。
应理解，上述预配置的过程也可以不在trust firmware初始化时执行，而是在系统启动的其他过程中执行。或者可以将上述流程分开在系统不同的启动阶段来执行，并且预配置的顺序可以不局限于流程300所给出的顺序。
本发明实施例中，在完成中断上下文的保存后，根据异常返回地址返回非安全模式(EL1模式的kernel中)的用户定义函数。异常返回地址可以如 图5所示的流程400进行预配置，用于将运行在非安全模式下的OS的NMI的中断接口函数注册到安全模式下。
S410，启动kernel，装载除kernel以外的其他模块的代码。
S420，调用中断接口函数(例如可以为register_nmi_handler)。该函数通过SMC指令将EL1模式执行的用户定义函数(例如可以为nmi_handler)的地址传送到EL3模式的trust firmware软件中并被记录下来。
具体地，中断接口函数可以通过SMC指令向trust firmware软件发送两个参数。参数0为用户定义函数的地址，其中用户定义函数可以为用户根据需要定制的函数；参数1为SMC函数标识(ID)，例如可以参考SMC调用规范设为0x83000000。其中，0x83000000可以是原始设备制造商(Original Equipment Manufacture，OEM)定义的标识ID，其符合SMC调用规范，实现的功能为保存用户定义函数的地址。继而，系统进入EL3模式的trust firmware软件，确认SMC函数ID并保存用户定义函数nmi_handler。
相应地，在该根据该安全模式的异常返回地址返回该非安全模式，执行用户定义函数以完成用户定义处理之前，该方法还包括：
在该非安全模式的kernel的启动时调用接口函数，该接口函数通过安全监控呼叫SMC指令在该安全模式，将该用户定义函数的地址记录在该异常返回地址中。
应理解，本发明实施例中也可以通过其他方式，例如中断等方式来将该用户定义函数的地址传递给trust firmware软件，本发明实施例对此不作限定。
此外，在本发明实施例的ARM架构中，当系统产生其他类型的中断时，即非不可屏蔽中断时，仍然可以依照现有的方式，生成IRQ。由相应的硬件，如IRQ MASK对其进行屏蔽，从而使得应用软件所运行的EL0和kernel运行的EL1等非安全模式不感知该中断。本发明实施例对非不可屏蔽中断的实施方式不作限定。
还应理解，在本发明的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
上文中结合图1至图5详细描述了根据本发明实施例的执行不可屏蔽中断的方法，下面将结合图6和图7描述根据本发明实施例的执行不可屏蔽中 断的装置。
如图6所示，该执行不可屏蔽中断的装置500包括：
中断模块510，用于在非安全模式下获取安全中断请求，并中断操作系统OS的操作，该安全中断请求不可被屏蔽；
保存模块520，用于通过该安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文；
第一执行模块530，用于返回该非安全模式执行用户定义处理；
恢复模块540，用于在该用户定义处理完成后，再次进入该安全模式，在该安全模式下根据该中断上下文恢复该OS状态；
第二执行模块550，用于再次返回该非安全模式，继续执行该OS的操作。
因此，本发明实施例的执行不可屏蔽中断的装置，通过安全中断请求进入安全模式保存中断时OS状态的中断上下文，返回非安全模式执行用户定义处理后再次进入安全模式恢复OS状态，恢复OS状态后再次返回非安全模式继续执行OS的操作，从而可以不依赖于硬件简单地实现NMI。
在本发明实施例中，该安全中断请求可以为快速中断请求FIQ。
在本发明实施例中，该用户定义处理可以包括：保存系统日志、上报OS的状态和喂狗中的至少一种。
在本发明实施例中，该非安全模式可以包括进阶精简指令集机器ARM架构的异常等级EL0和EL1中的至少一种，该安全模式可以包括该ARM架构的EL3。
在本发明实施例中，该安全中断请求可以是该OS定时触发看门狗生成的，或者可以是由于硬件故障触发看门狗生成的。
可选地，作为一个实施例，该第一执行模块530具体可以用于：
在该安全模式下完成该中断上下文的保存后，根据该安全模式的异常返回地址返回该非安全模式，执行用户定义函数以完成该用户定义处理。
可选地，作为一个实施例，该装置500还可以包括：
接口调用模块，用于在该第一执行模块530根据该安全模式的异常返回地址返回该非安全模式，执行用户定义函数以完成该用户定义处理之前，在该非安全模式的内核kernel启动时调用接口函数，该接口函数通过安全监控呼叫SMC指令在该安全模式将该用户定义函数的地址记录在该异常返回地 址中。
可选地，作为一个实施例，该装置500还包括：
预配置模块，用于在该安全模式的异常向量表中预配置保存函数的地址，该保存函数用于保存该OS的操作中断时OS状态的该中断上下文；
该保存模块520具体用于：
当产生该安全中断请求时，该安全中断请求不可被屏蔽，根据根据该预配置模块预配置的该保存函数的地址进入安全模式执行该保存函数。
可选地，作为一个实施例，该保存模块520具体可以用于：
通过所述安全模式中运行的安全监测Secure Monitor软件捕获所述安全中断请求以进入安全模式，并且通过所述Secure Monitor软件在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文。
应理解，本发明实施例的装置500可以为CPU。
还应理解，装置500中的各模块的划分仅仅是示意性的，仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。各模块可以单独存在，也可以进行结合。优选地，装置500中的各模块可以集成到CPU的一个总模块中，用于执行不可屏蔽中断流程。
还应理解，本发明实施例的装置500可对应于执行本发明实施例中的执行不可屏蔽中断的主体，并且装置500中的各个模块的上述和其它操作和/或功能分别为了实现图1至图5中的相应流程，为了简洁，在此不再赘述。
因此，本发明实施例的执行不可屏蔽中断的装置，通过安全中断请求进入安全模式保存中断时OS状态的中断上下文，返回非安全模式执行用户定义处理后再次进入安全模式恢复OS状态，恢复OS状态后再次返回非安全模式继续执行OS的操作，从而可以不依赖于硬件简单地实现NMI。
在本发明实施例中，在非安全模式下获取安全中断请求可以由收发器实现，中断模块510、保存模块520、第一执行模块530、恢复模块540和第二执行模块550所实现的功能可以由处理器实现。如图7所示，执行不可屏蔽中断的装置600可以包括处理器610、收发器620和存储器630。其中，存储器630可以用于存储处理器610执行的代码等，收发器620可以为一个接口，用于接收看门狗等硬件向CPU发送的安全中断请求。
装置600中的各个组件通过总线系统640耦合在一起，其中总线系统640除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。
图7所示的装置600能够实现前述图1至图5的实施例中所实现的各个过程。装置600包括处理器610、收发器620和存储器630，该存储器630用于存储指令，该处理器610用于执行该存储器630存储的指令，以控制收发器620进行信号的接收和发送，当处理器610执行该存储器630存储的指令时，该装置600用于完成本发明实施例的执行不可屏蔽中断的方法。
其中，收发器620可以用于在非安全模式下获取安全中断请求，该安全中断请求不可被屏蔽；
处理器610可以用于：
中断操作系统OS的操作；
通过该安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文；
返回该非安全模式执行用户定义处理；
在该用户定义处理完成后，再次进入该安全模式，在该安全模式下根据该中断上下文恢复该OS状态；
再次返回该非安全模式，继续执行该OS的操作。
因此，本发明实施例的执行不可屏蔽中断的方法，通过安全中断请求进入安全模式保存中断时OS状态的中断上下文，返回非安全模式执行用户定义处理后再次进入安全模式恢复OS状态，恢复OS状态后再次返回非安全模式继续执行OS的操作，从而可以不依赖于硬件简单地实现NMI。
在本发明实施例中，该安全中断请求可以为快速中断请求FIQ。
在本发明实施例中，该用户定义处理可以包括：保存系统日志、上报OS的状态和喂狗中的至少一种。
在本发明实施例中，该非安全模式可以包括进阶精简指令集机器ARM架构的异常等级EL0和EL1中的至少一种，该安全模式可以包括该ARM架构的EL3。
在本发明实施例中，该安全中断请求可以是该OS定时触发看门狗生成的，或者可以是由于硬件故障触发看门狗生成的。
可选地，作为一个实施例，处理器610返回该非安全模式执行用户定义处理，可以包括：
在该安全模式下完成该中断上下文的保存后，根据该安全模式的异常返回地址返回该非安全模式，执行用户定义函数以完成该用户定义处理。
可选地，作为一个实施例，处理器610在该根据该安全模式的异常返回地址返回该非安全模式，执行用户定义函数以完成该用户定义处理之前，还可以用于：
在该非安全模式的内核kernel启动时调用接口函数，该接口函数通过安全监控呼叫SMC指令在该安全模式将该用户定义函数的地址记录在该异常返回地址中。
可选地，作为一个实施例，处理器610还可以用于在该安全模式的异常向量表中预配置保存函数的地址，该保存函数用于保存该OS的操作中断时OS状态的该中断上下文；
处理器610通过该安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文，可以包括：
当产生该安全中断请求时，该安全中断请求不可被屏蔽，根据该保存函数的地址进入安全模式执行该保存函数。
可选地，作为一个实施例，处理器610通过该安全中断请求进入安全模式，在该安全模式下保存该OS的操作中断时OS状态的中断上下文，可以包括：
通过该安全模式中运行的安全监测Secure Monitor软件捕获该安全中断请求以进入安全模式，通过该Secure Monitor软件在该安全模式下保存该OS的操作中断时OS状态的中断上下文。
应理解，本发明实施例的装置600可以为CPU。
应注意，本发明上述方法实施例可以应用于处理器中，或者由处理器实现。处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以 位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本发明实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间 的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。

Claims (20)

  1. 一种执行不可屏蔽中断的方法，其特征在于，包括：
    在非安全模式下获取安全中断请求，并中断操作系统OS的操作，所述安全中断请求不可被屏蔽；
    通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文；
    返回所述非安全模式执行用户定义处理；
    在所述用户定义处理完成后，再次进入所述安全模式，在所述安全模式下根据所述中断上下文恢复所述OS状态；
    再次返回所述非安全模式，继续执行所述OS的操作。
  2. 根据权利要求1所述的方法，其特征在于，所述返回所述非安全模式执行用户定义处理，包括：
    在所述安全模式下完成所述中断上下文的保存后，根据所述安全模式的异常返回地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理。
  3. 根据权利要求2所述的方法，其特征在于，在所述根据所述安全模式的异常返回地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理之前，所述方法还包括：
    在所述非安全模式的内核kernel启动时调用接口函数，所述接口函数通过安全监控呼叫SMC指令在所述安全模式将所述用户定义函数的地址记录在所述异常返回地址中。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述安全中断请求为快速中断请求FIQ。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述用户定义处理包括：保存系统日志、上报OS的状态和喂狗中的至少一种。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述方法还包括：
    在所述安全模式的异常向量表中预配置保存函数的地址，所述保存函数用于保存所述OS的操作中断时OS状态的所述中断上下文；
    所述通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文，包括：
    当产生所述安全中断请求时，所述安全中断请求不可被屏蔽，根据所述保存函数的地址进入安全模式执行所述保存函数。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文，包括：
    通过所述安全模式中运行的安全监测Secure Monitor软件捕获所述安全中断请求以进入安全模式，通过所述Secure Monitor软件在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述非安全模式包括进阶精简指令集机器ARM架构的异常等级EL0和EL1中的至少一种，所述安全模式包括所述ARM架构的EL3。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述安全中断请求是所述OS定时触发看门狗生成的，或者是由于硬件故障触发看门狗生成的。
  10. 一种执行不可屏蔽中断的装置，其特征在于，包括：
    中断模块，用于在非安全模式下获取安全中断请求，并中断操作系统OS的操作，所述安全中断请求不可被屏蔽；
    保存模块，用于通过所述安全中断请求进入安全模式，在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文；
    第一执行模块，用于返回所述非安全模式执行用户定义处理；
    恢复模块，用于在所述用户定义处理完成后，再次进入所述安全模式，在所述安全模式下根据所述中断上下文恢复所述OS状态；
    第二执行模块，用于再次返回所述非安全模式，继续执行所述OS的操作。
  11. 根据权利要求10所述的装置，其特征在于，所述第一执行模块具体用于：
    在所述安全模式下完成所述中断上下文的保存后，根据所述安全模式的异常返回地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理。
  12. 根据权利要求11所述的装置，其特征在于，所述装置还包括：
    接口调用模块，用于在所述第一执行模块根据所述安全模式的异常返回 地址返回所述非安全模式，执行用户定义函数以完成所述用户定义处理之前，在所述非安全模式的内核kernel启动时调用接口函数，所述接口函数通过安全监控呼叫SMC指令在所述安全模式将所述用户定义函数的地址记录在所述异常返回地址中。
  13. 根据权利要求10至12中任一项所述的装置，其特征在于，所述安全中断请求为快速中断请求FIQ。
  14. 根据权利要求10至13中任一项所述的装置，其特征在于，所述用户定义处理包括：保存系统日志、上报OS的状态和喂狗中的至少一种。
  15. 根据权利要求10至14中任一项所述的装置，其特征在于，所述装置还包括：
    预配置模块，用于在所述安全模式的异常向量表中预配置保存函数的地址，所述保存函数用于保存所述OS的操作中断时OS状态的所述中断上下文；
    所述保存模块具体用于：
    当产生所述安全中断请求时，所述安全中断请求不可被屏蔽，根据所述预配置模块预配置的所述保存函数的地址进入安全模式执行所述保存函数。
  16. 根据权利要求10至15中任一项所述的装置，其特征在于，所述保存模块具体用于：
    通过所述安全模式中运行的安全监测Secure Monitor软件捕获所述安全中断请求以进入安全模式，通过所述Secure Monitor软件在所述安全模式下保存所述OS的操作中断时OS状态的中断上下文。
  17. 根据权利要求10至16中任一项所述的装置，其特征在于，所述非安全模式包括进阶精简指令集机器ARM架构的异常等级EL0和EL1中的至少一种，所述安全模式包括所述ARM架构的EL3。
  18. 根据权利要求10至17中任一项所述的装置，其特征在于，所述安全中断请求是所述OS定时触发看门狗生成的，或者是由于硬件故障触发看门狗生成的。
  19. 根据权利要求10至18中任一项所述的装置，其特征在于，所述装置为中央处理器CPU。
  20. 一种执行不可屏蔽中断的装置，其特征在于，包括处理器、收发器和存储器，
    所述存储器用于存储指令，所述处理器用于执行所述存储器存储的指令，以控制收发器进行信号的接收和发送，当处理器执行所述存储器存储的指令时，所述装置用于完成如权利要求1至9中任一项所述的方法。
PCT/CN2016/101592 2015-10-16 2016-10-09 执行不可屏蔽中断的方法和装置 WO2017063529A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
EP22179800.2A EP4123450A1 (en) 2015-10-16 2016-10-09 Method and apparatus for executing non-maskable interrupt
EP16854908.7A EP3306470B1 (en) 2015-10-16 2016-10-09 Method and apparatus for executing non-maskable interrupt
ES16854908T ES2928753T3 (es) 2015-10-16 2016-10-09 Método y aparato para ejecutar una interrupción no enmascarable
US15/947,491 US10437632B2 (en) 2015-10-16 2018-04-06 Method and apparatus for executing non-maskable interrupt
US16/592,144 US10970108B2 (en) 2015-10-16 2019-10-03 Method and apparatus for executing non-maskable interrupt
US17/207,186 US11360803B2 (en) 2015-10-16 2021-03-19 Method and apparatus for executing non-maskable interrupt

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510677146.4A CN105279021B (zh) 2015-10-16 2015-10-16 执行不可屏蔽中断的方法和装置
CN201510677146.4 2015-10-16

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/947,491 Continuation US10437632B2 (en) 2015-10-16 2018-04-06 Method and apparatus for executing non-maskable interrupt

Publications (1)

Publication Number Publication Date
WO2017063529A1 true WO2017063529A1 (zh) 2017-04-20

Family

ID=55148073

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101592 WO2017063529A1 (zh) 2015-10-16 2016-10-09 执行不可屏蔽中断的方法和装置

Country Status (5)

Country Link
US (3) US10437632B2 (zh)
EP (2) EP3306470B1 (zh)
CN (2) CN105279021B (zh)
ES (1) ES2928753T3 (zh)
WO (1) WO2017063529A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117331676A (zh) * 2023-11-30 2024-01-02 上海兆芯集成电路股份有限公司 系统管理模式进入方法、处理器和计算机系统

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105279021B (zh) 2015-10-16 2019-05-07 华为技术有限公司 执行不可屏蔽中断的方法和装置
KR101936565B1 (ko) * 2016-11-14 2019-01-09 엘에스산전 주식회사 인버터에서 인터럽트 제어방법
CN108090376B (zh) * 2016-11-23 2021-01-12 厦门雅迅网络股份有限公司 基于TrustZone的CAN总线数据防护方法及系统
CN107103257B (zh) * 2017-05-16 2020-06-16 陕西国博政通信息科技有限公司 计算机入侵防范方法
CN107507552B (zh) * 2017-09-05 2019-08-09 京东方科技集团股份有限公司 一种信号处理方法和时序控制电路
CN109947550B (zh) * 2019-03-18 2023-07-28 晶晨半导体(上海)股份有限公司 一种适用于risc-v架构的非屏蔽中断处理系统及方法
US10860438B1 (en) * 2019-06-27 2020-12-08 EMC IP Holding Company LLC Stream level uninterrupted backup operation using an interrupt service routine approach
US11354182B1 (en) * 2019-12-10 2022-06-07 Cisco Technology, Inc. Internal watchdog two stage extension
CN110990229B (zh) * 2019-12-17 2023-07-18 北京天融信网络安全技术有限公司 一种系统信息采集方法及装置
CN114416408A (zh) * 2021-12-13 2022-04-29 飞腾信息技术有限公司 一种中断处理方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1070496A (zh) * 1991-08-30 1993-03-31 英特尔公司 自动暂停状态重启动的透明系统中断
US20080098264A1 (en) * 2003-10-30 2008-04-24 Day Michael N Program debug method and apparatus
CN102483713A (zh) * 2009-08-04 2012-05-30 富士通株式会社 复位方法以及监视装置
CN102591719A (zh) * 2011-01-17 2012-07-18 上海华虹集成电路有限责任公司 一种基于8051cpu系统的中断扩展方法
CN102708015A (zh) * 2012-05-15 2012-10-03 江苏中科梦兰电子科技有限公司 基于cpu不可屏蔽中断系统问题诊断的调试方法
CN105279021A (zh) * 2015-10-16 2016-01-27 华为技术有限公司 执行不可屏蔽中断的方法和装置

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1331539B1 (en) * 2002-01-16 2016-09-28 Texas Instruments France Secure mode for processors supporting MMU and interrupts
US7130951B1 (en) * 2002-04-18 2006-10-31 Advanced Micro Devices, Inc. Method for selectively disabling interrupts on a secure execution mode-capable processor
US7165135B1 (en) * 2002-04-18 2007-01-16 Advanced Micro Devices, Inc. Method and apparatus for controlling interrupts in a secure execution mode-capable processor
US7603551B2 (en) * 2003-04-18 2009-10-13 Advanced Micro Devices, Inc. Initialization of a computer system including a secure execution mode-capable processor
US7117284B2 (en) * 2002-11-18 2006-10-03 Arm Limited Vectored interrupt control within a system having a secure domain and a non-secure domain
US20050193259A1 (en) 2004-02-17 2005-09-01 Martinez Juan I. System and method for reboot reporting
US7950020B2 (en) * 2006-03-16 2011-05-24 Ntt Docomo, Inc. Secure operating system switching
US7730248B2 (en) * 2007-12-13 2010-06-01 Texas Instruments Incorporated Interrupt morphing and configuration, circuits, systems and processes
US8051467B2 (en) * 2008-08-26 2011-11-01 Atmel Corporation Secure information processing
US9405637B2 (en) * 2011-01-18 2016-08-02 Texas Instruments Incorporated Locking/unlocking CPUs to operate in safety mode or performance mode without rebooting
US9112793B2 (en) 2012-05-31 2015-08-18 International Business Machines Corporation End-to-end multipathing through network having switching devices compatible with different protocols
JP6117068B2 (ja) * 2013-09-20 2017-04-19 株式会社東芝 情報処理装置、およびプログラム

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1070496A (zh) * 1991-08-30 1993-03-31 英特尔公司 自动暂停状态重启动的透明系统中断
US20080098264A1 (en) * 2003-10-30 2008-04-24 Day Michael N Program debug method and apparatus
CN102483713A (zh) * 2009-08-04 2012-05-30 富士通株式会社 复位方法以及监视装置
CN102591719A (zh) * 2011-01-17 2012-07-18 上海华虹集成电路有限责任公司 一种基于8051cpu系统的中断扩展方法
CN102708015A (zh) * 2012-05-15 2012-10-03 江苏中科梦兰电子科技有限公司 基于cpu不可屏蔽中断系统问题诊断的调试方法
CN105279021A (zh) * 2015-10-16 2016-01-27 华为技术有限公司 执行不可屏蔽中断的方法和装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117331676A (zh) * 2023-11-30 2024-01-02 上海兆芯集成电路股份有限公司 系统管理模式进入方法、处理器和计算机系统
CN117331676B (zh) * 2023-11-30 2024-03-19 上海兆芯集成电路股份有限公司 系统管理模式进入方法、处理器和计算机系统

Also Published As

Publication number Publication date
CN110209615A (zh) 2019-09-06
EP3306470B1 (en) 2022-07-27
CN105279021A (zh) 2016-01-27
CN105279021B (zh) 2019-05-07
EP3306470A4 (en) 2018-08-08
ES2928753T3 (es) 2022-11-22
CN110209615B (zh) 2023-09-12
US11360803B2 (en) 2022-06-14
US20180225143A1 (en) 2018-08-09
EP3306470A1 (en) 2018-04-11
EP4123450A1 (en) 2023-01-25
US10970108B2 (en) 2021-04-06
US20210208925A1 (en) 2021-07-08
US10437632B2 (en) 2019-10-08
US20200034187A1 (en) 2020-01-30

Similar Documents

Publication Publication Date Title
WO2017063529A1 (zh) 执行不可屏蔽中断的方法和装置
CN110334521B (zh) 可信计算系统构建方法、装置、可信计算系统及处理器
EP3373178A1 (en) Comparison of execution context data signatures with references
US9461927B2 (en) Method, device, and system for delaying packets during a network-triggered wake of a computing device
CN112486585B (zh) 恢复fpga芯片中的逻辑的方法、系统和fpga设备
US9565168B1 (en) System and method of a trusted computing operation mode
US9262631B2 (en) Embedded device and control method thereof
WO2019062420A1 (zh) 监控进程的方法和装置
KR20170013319A (ko) 데이터 관리 방법, 노드, 그리고 데이터베이스 클러스터를 위한 시스템
JP2012190460A (ja) プロセッサのフォールト・トレランスを改善するための装置
US20170185791A1 (en) Application program interface (API) monitoring bypass
CN110870286B (zh) 容错处理的方法、装置和服务器
US9479478B2 (en) Method for operating a communication module, and communication module
JP2017078998A (ja) 情報処理装置およびログ管理方法、並びにコンピュータ・プログラム
EP3619635B1 (en) Execution of subset of driver code in separate protection domain
EP3246821B1 (en) Semiconductor device and its memory access control method
CN115827522A (zh) Bios的设置方法、bios芯片和电子设备
CN108229209B (zh) 一种双cpu构架的bmc芯片及其自主安全提高方法
WO2016145774A1 (zh) 电子设备的启动方法和装置
US11599480B2 (en) Replacing compromised data in a self-healing system
US20240028713A1 (en) Trust-based workspace instantiation
EP4386536A1 (en) Data processing method and apparatus
JP2017211980A (ja) 半導体装置及びそのメモリアクセス制御方法
KR102066122B1 (ko) 유저 애플리케이션 동작 중 발생한 시그널을 재현하는 방법 및 이를 이용하는 시스템 및 프로그램
CN117667465A (zh) 代码共享方法、装置、交换机、多主机系统、设备和介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16854908

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2016854908

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE