Hardware implementation of an application-level watchdog timer

An application watchdog, comprising a dedicated watchdog counter in the hardware layer of a computer system, and a watchdog driver operating in the kernel mode of the computer operating system, the watchdog driver comprising:

• a system thread configured to monitor a plurality of designated user applications operating in the user mode of the computer operating system;
• a message passing interface for receiving periodic signals from each of the user applications;
• and
• a communication interface for transmitting a timer reset command to the dedicated watchdog counter;
• wherein if the system thread receives a message from each of the designated user applications within an allotted period of time, the watchdog driver sends a timer reset command to the dedicated watchdog counter and wherein if the system thread does not receive a message from each of the designated user applications within the allotted period of time, the watchdog driver does not send a timer reset command to the dedicated watchdog counter.

An application watchdog, comprising a dedicated watchdog counter in the hardware layer of a computer system, and a watchdog driver operating in the kernel mode of the computer operating system, the watchdog driver comprising:

• a system thread configured to monitor a plurality of designated user applications operating in the user mode of the computer operating system;
• a message passing interface for receiving periodic signals from each of the user applications;
• and
• a communication interface for transmitting a timer reset command to the dedicated watchdog counter;
• wherein if the system thread receives a message from each of the designated user applications within an allotted period of time, the watchdog driver sends a timer reset command to the dedicated watchdog counter and wherein if the system thread does not receive a message from each of the designated user applications within the allotted period of time, the watchdog driver does not send a timer reset command to the dedicated watchdog counter;
• wherein, if the watchdog counter does receive a timer reset command from the watchdog driver, the counter is reset to begin counting down from the maximum allotted period of time and wherein if the watchdog counter does not receive a timer reset command from the watchdog driver, the counter is configured to restart the computer system when the counter expires
• wherein the watchdog counter further comprises, a timer value register that stores a digital representation of the maximum allotted period of time;
• and
• a control and status register that comprises:
• a bit for enabling the application watchdog:
• a bit for counter reset;
• bit fields for enabling early expiration warnings;
• and
• bit fields for early expiration warning signals;
• wherein if the watchdog counter does not receive a timer reset command from the watchdog driver and the early expiration warnings are enabled, the counter is configured to transmit early expiration warnings to the rest of the computer system before the counter expires.

A method of detecting and restarting an unresponsive computer application, comprising:

• executing the application in a first protective layer of a computer operating system;
• executing an application watchdog driver in a second, more protected, protective layer of the computer operating system;
• establishing a message passing interface between the application and the watchdog driver;
• periodically transmitting signals from the application to the message passing interface;
• executing a system thread in the watchdog driver that is configured to monitor the message passing interface for the periodic signals from said application or other designated applications;
• and
• using a dedicated watchdog timer device to count from a programmable initial value to a final system reset value;
• wherein if the system thread detects a periodic signal from the application before the watchdog timer counts to the final system reset value, the watchdog driver initiates a command to the watchdog timer to reset the watchdog timer to the initial value and wherein if the system thread fails to detect a periodic signal from the application before the watchdog timer counts to the final system reset value, the watchdog timer initiates a command to restart the computer system.

A method of detecting and restarting an unresponsive computer application, comprising:

• executing the application in a first protective layer of a computer operating system;
• executing an application watchdog driver in a second, more protected, protective layer of the computer operating system;
• establishing a message passing interface between the application and the watchdog driver;
• periodically transmitting signals from the application to the message passing interface;
• executing a system thread in the watchdog driver that is configured to monitor the message passing interface for the periodic signals from said application or other designated applications;
• using a dedicated watchdog timer device to count from a programmable initial value to a final system reset value;
• wherein if the system thread detects a periodic signal from the application before the watchdog timer counts to the final system reset value, the watchdog driver initiates a command to the watchdog timer to reset the watchdog timer to the initial value and wherein if the system thread fails to detect a periodic signal from the application before the watchdog timer counts to the final system reset value, the watchdog timer initiates a command to restart the computer system;
• sending an early warning message to notify system management software or firmware that the watchdog timer is about to expire;
• and
• the early warning messages are NMI and SMI interrupts that are sent 9 seconds before the watchdog timer device expires.

A computer server, comprising:

• a central processing unit (“CPU”) configured to execute an operating system and designated user applications;
• a system memory coupled to said CPU;
• an input/output processor (“IOP”) configured to control server management architecture;
• a system watchdog device configured to receive periodic messages from the operating system;
• and
• an application watchdog device configured to receive periodic messages from the user applications;
• wherein if either the system watchdog device or the application watchdog device does not receive a periodic message for a designated period of time, the watchdog device that does not receive the periodic messages initiates a command to the CPU to reset the server.