Hardware implementation of an application-level watchdog timer

• US 20030037172A1
• Filed: 08/17/2001
• Published: 02/20/2003
• Est. Priority Date: 08/17/2001
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Emerson, Theodore F., Lacombe, John
• Granted Patent: US 7,003,775 B2
• Time in Patent Office: Days
• US Class Current: 719/310
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs

Abstract

An application watchdog, comprising a dedicated watchdog counter in the hardware layer and a watchdog driver operating in the kernel mode layer of the computer operating system. The driver comprises a system thread configured to monitor a plurality of designated user applications operating in the user mode of the operating system and a message passing interface for receiving periodic signals from each of the user applications. The driver also uses an interface for transmitting timer reset commands to the dedicated watchdog counter. If the system thread receives a message from each of the designated user applications within an allotted period of time, the watchdog driver sends a timer reset command to the dedicated watchdog counter. Otherwise, the dedicated watchdog counter fails to receive the reset command and subsequently issues a system reset command. Early warning signals may be issued prior to system reset to alert system management.

Claims

1. A computer system, comprising at least one processor, a system memory coupled to said processor, at least one input/output device coupled to said processor, and a watchdog timer device, wherein the computer system executes:

an operating system with at least two protection layers;

one or more key computer applications; and

an application watchdog driver that monitors user designated computer applications for periodic messages;

wherein if the watchdog driver receives a periodic message from all user-designated computer applications in a predetermined period of time, the watchdog driver delivers a command to clear the watchdog timer device.

2. The computer system of claim 1 further comprising:

a message passing interface that transmits signals between the two protection layers;

wherein the watchdog driver executes in one protection layer and the application executes in another protection layer and wherein the periodic message is transmitted from the application to the application watchdog driver through the message passing interface.

3. The computer system of claim 2 wherein:

the message passing interface is a shared memory queue.

4. The computer system of claim 1 wherein:

the watchdog timer device resides in a hardware layer separate from the operating system protection layers and wherein the application watchdog driver communicates with the watchdog timer device via a hardware abstraction layer.

5. The computer system of claim 1 further comprising a system watchdog timer device;

wherein the computer system also executes a system watchdog driver that monitors the operating

system for periodic messages; and

wherein if the system watchdog driver receives a periodic message from the operating system in a predetermined period of time, the system watchdog driver delivers a command to clear the system watchdog timer device.

6. The computer system of claim 5 wherein:

the watchdog timer devices issue a reset command if either of the watchdog timer devices do not receive a clear timer command from the watchdog drivers in a predetermined period of time.

7. An application watchdog, comprising a dedicated watchdog counter in the hardware layer of a computer system, and a watchdog driver operating in the kernel mode of the computer operating system, the watchdog driver comprising:

a system thread configured to monitor a plurality of designated user applications operating in the user mode of the computer operating system;

a message passing interface for receiving periodic signals from each of the user applications; and

a communication interface for transmitting a timer reset command to the dedicated watchdog counter;

wherein if the system thread receives a message from each of the designated user applications within an allotted period of time, the watchdog driver sends a timer reset command to the dedicated watchdog counter and wherein if the system thread does not receive a message from each of the designated user applications within the allotted period of time, the watchdog driver does not send a timer reset command to the dedicated watchdog counter.

8. The application watchdog of claim 7 wherein:

if the watchdog counter does receive a timer reset command from the watchdog driver, the counter is reset to begin counting down from the maximum allotted period of time and wherein if the watchdog counter does not receive a timer reset command from the watchdog driver, the counter is configured to restart the computer system when the counter expires.

9. The application watchdog of claim 8 wherein the watchdog counter further comprises:

a timer value register that stores a digital representation of the maximum allotted period of time; and

a control and status register that comprises;

a bit for enabling the application watchdog;

a bit for counter reset;

bit fields for enabling early expiration warnings; and

bit fields for early expiration warning signals;

wherein if the watchdog counter does not receive a timer reset command from the watchdog driver and the early expiration warnings are enabled, the counter is configured to transmit early expiration warnings to the rest of the computer system before the counter expires.

10. The application watchdog of claim 9 wherein:

the early warning messages are non-mask interrupts.

11. The application watchdog of claim 9 wherein:

the early warning messages are maskable interrupts.

12. The application watchdog of claim 9 wherein:

the early warning messages are system management interrupts.

13. The application watchdog of claim 7 wherein:

the messages from the designated user applications are sent periodically by the applications and directed specifically to the watchdog driver.

14. The application watchdog of claim 7 wherein:

the plurality of the user applications are prioritized by a computer user to permit varying levels of watchdog protection.

15. The application watchdog of claim 7 wherein:

the application watchdog operates in conjunction with a system watchdog that is configured to monitor the computer operating system for periodic activity; and

wherein both the application watchdog and the system watchdog are sufficiently configured to restart the computer system if either watchdog does not receive a timer reset command within an allotted period of time.

16. A method of detecting and restarting an unresponsive computer application, comprising:

executing the application in a first protective layer of a computer operating system;

executing an application watchdog driver in a second, more protected, protective layer of the computer operating system;

establishing a message passing interface between the application and the watchdog driver;

periodically transmitting signals from the application to the message passing interface;

executing a system thread in the watchdog driver that is configured to monitor the message passing interface for the periodic signals from said application or other designated applications; and

using a dedicated watchdog timer device to count from a programmable initial value to a final system reset value;

wherein if the system thread detects a periodic signal from the application before the watchdog timer counts to the final system reset value, the watchdog driver initiates a command to the watchdog timer to reset the watchdog timer to the initial value and wherein if the system thread fails to detect a periodic signal from the application before the watchdog timer counts to the final system reset value, the watchdog timer initiates a command to restart the computer system.

17. The method of claim 16 further comprising:

sending an early warning message to notify system management software or firmware that the watchdog timer is about to expire.

18. The method of claim 16 wherein the initialization of the watchdog driver comprises:

loading the watchdog driver as the operating system loads following a computer system boot; and

loading and creating an initial input/output control signal interface that establishes the message passing interface.

19. The method of claim 18 wherein the initialization of the computer application comprises:

linking the application with a dynamic link library;

calling the watchdog driver via the dynamic link library and through the initial input/output control signal interface to validate the message passing interface; and

sending application location and identification information to the watchdog driver.

20. The method of claim 19 wherein the initialization of the watchdog timer device comprises:

setting the timer initialization value in a timer value register in the watchdog timer device; and

setting the counter enable bit and early warning enable bits in a control/status register in the watchdog timer device.

21. The method of claim 17 wherein:

the early warning messages are NMI and SMI interrupts that are sent 9 seconds before the watchdog timer device expires.

22. The method of claim 16 wherein:

the system thread must detect a periodic signal from all designated applications before initiating the command to the watchdog timer to reset the watchdog timer to the initial value.

23. A computer system, comprising:

an operating system with at least two protection layers;

one or more computer applications; and

at least two watchdog drivers;

wherein a first of the plurality of watchdog drivers is configured to monitor the operating system for periodic messages and a second of the plurality of watchdog drivers is configured to monitor the computer applications for periodic messages; and

wherein if the second watchdog driver receives a periodic message from the computer applications in a predetermined period of time, the second watchdog driver delivers a command to clear the second of the plurality of watchdog timer devices.

24. The computer system of claim 23 wherein:

if the first watchdog driver receives a periodic message from the operating system in a predetermined period of time, the first watchdog driver delivers a command to clear the first of the plurality of watchdog timer devices.

25. The computer system of claim 24 wherein:

the watchdog timer devices are configured to restart the computer system if either of the watchdog timer devices do not receive a clear timer command from the watchdog drivers in a predetermined period of time.

26. The computer system of claim 23 wherein:

the watchdog driver creates timer events in the operating system scheduler that alert the watchdog driver when the predetermined period of time has expired.

27. A computer server, comprising:

a central processing unit (“

CPU”

) configured to execute an operating system and key, designated user applications;

a system memory coupled to said CPU;

an input/output processor (“

IOP”

) configured to control server management architecture;

a system watchdog device configured to receive periodic messages from the operating system; and

an application watchdog device configured to receive periodic messages from the user applications;

wherein if either the system watchdog device or the application watchdog device does not receive a periodic message for a designated period of time, the watchdog device that does not receive the periodic messages initiates a command to the CPU to reset the server.

28. The computer server of claim 27 wherein:

the system watchdog and application watchdog may be selectably enabled or disabled independent of one another.

29. The computer server of claim 28 wherein:

the watchdog devices are selectably configured to transmit an early warning interrupt to the CPU before the watchdog device initiates the server reset command.

30. The computer server of claim 28 wherein:

the watchdog devices are selectably configured to transmit an early warning notification to the IOP before the watchdog device initiates the server reset command.

31. The computer server of claim 28 wherein:

the watchdog devices are selectably configured to transmit an event notification to the IOP when the watchdog device initiates the server reset command.