CN104111848A - Multi-thread software dynamic upgrading method based on asynchronous check points - Google Patents

Abstract

The invention discloses a method for dynamically upgrading multi-threaded software based on asynchronous checkpoints, including: the key code can be inserted into the running source program at the binary level instead of the source code level based on the dynamic insertion method, so that the upgrade does not need to rely on Specific compiler; based on the asynchronous checkpoint algorithm, it can ensure that all threads are blocked before dynamic upgrade, so that all threads can be updated at one time and avoid the overhead caused by the maintenance of the old and new versions; the binary rewriting method is used to realize the indirect function jump, Functions to be updated that are not being executed can be upgraded; functions to be updated that are being executed can be upgraded by means of stack reconstruction, so that dynamic upgrades eliminate unpredictable waiting times such as updating loop bodies and main functions. The invention can minimize the loss caused by version maintenance downtime for applications and services with high reliability requirements (such as electronic payment systems), and reduce the cost of adding redundant hardware.

Description

A method for dynamic upgrade of multithreaded software based on asynchronous checkpoint

technical field

The invention belongs to the security field in software reliability research, and more specifically relates to a multi-thread software dynamic upgrading method based on asynchronous checkpoints.

Background technique

In order to provide 7/24 hours service reliability, from the software point of view, the traditional software update method usually requires stopping the running of the software, and then restarting the software after the update is applied. Such a stop-restart approach inevitably disrupts the execution of running services and reduces software availability. From the perspective of hardware, some solutions can realize dynamic migration under the premise of adding server mirroring. After the upgrade is completed, the data will be resynchronized back to the main server to ensure the reliability of the application (service). However, this solution needs to be purchased. Additional redundant hardware greatly increases maintenance costs. To sum up, the multi-threaded software dynamic upgrade solution based on asynchronous checkpoints will be able to improve the reliability of online programs (services), reduce downtime, and increase profitability. In order to solve the above problems, Dynamic Software Update (DSU) was conceived and has become an urgently needed new technology. In dynamic software updates, multi-thread support is a new challenge, because threads execute the same function and try to modify the same data, so it is difficult to guarantee data consistency.

Generally speaking, many existing methods are based on the update point (the data to be updated and the position where the code is not currently called are called the update point). In this way, when updating a running system, it can only be applied at certain execution points, such as when the code to be updated is not executed and the data is not referenced, otherwise the system is prone to inconsistent states.

The update point based approach has several disadvantages. First of all, being able to find the security update point largely depends on the analysis ability of the compiler or programmer. For a language as flexible as C, compilers often have a hard time analyzing pointers and aliases. As a result, they have to make conservative assumptions, which can generate false positives in the analysis results. While recent proposals favor switching compilers to make programs updatable, their approach works only for single-threaded applications and fails to maintain binary compatibility. So, it cannot be used for compiled binaries and currently running software. Second, it is difficult to find update points in multi-threaded software, and some modules in a busy system may not even have a safe point. Updatable analysis is not possible for multi-threaded software when it comes to data changes. If the update point cannot be reached or detected in time, some security updates will be delayed and vulnerable systems may be exposed to external attacks. Finally, for some dynamic update systems based on the update point mechanism, the operator may not have any control over the dynamic update process, and the operator will have no idea when the system reaches the secure update point to apply the update. If the operator has no way of knowing whether the system has completed the current update, another update in progress may be applied inadvertently.

In summary, the existing dynamic software upgrade system solutions have the following deficiencies:

Some solutions (such as UpStare) need to rely on a specific compiler, and add relevant dynamic upgrade auxiliary code when recompiling the source program, which is not feasible for deployed applications; some solutions (such as Polus) cannot update the The executed function needs to wait until the function is called to take effect, which means that if the main function is changed, the application will never be dynamically upgraded to a new version until the program exits; some solutions are only valid for single-threaded applications, obviously It's also not practical in today's day when multi-threaded applications are so prevalent.

Contents of the invention

Aiming at the above defects or improvement needs of the prior art, the present invention provides a method for dynamically upgrading multi-threaded software based on asynchronous checkpoints. The above-mentioned technical problems ensure the feasibility of the upgrade, so that the update process will not be in an indefinite wait.

In order to achieve the above object, according to one aspect of the present invention, a method for dynamically upgrading multithreaded software based on asynchronous checkpoints is provided, including the following steps:

(1) Obtain the old and new versions of the software to be upgraded, extract the project source files in the old and new versions respectively, and integrate the project source files of the old and new versions respectively;

(2) comparing the integrated new version of the project source file with the old version of the project source file to generate a primary patch;

(3) Insert the asynchronous checkpoint into the primary patch to generate a dynamic upgrade patch, wherein the asynchronous checkpoint stores the mapping relationship between the continuation points of the old and new versions of the software to be upgraded;

(4) load the dynamic upgrade patch that generates into the old version of the software to be upgraded in operation;

(5) receiving the user's initialization request, and using the function name to be updated in the dynamic upgrade patch to search for the corresponding function body in the memory according to the initialization request, and inserting the asynchronous checkpoint in step (3) into the function body;

(6) Receive the user's application request, and use the asynchronous checkpoint algorithm to make all threads in the software to be upgraded reach a blocked state according to the application request;

(7) For the functions and variables that are not used and executed in the threads of the software to be upgraded, the binary rewriting method is used to realize the indirect jump of the functions. For the functions and variables that are being used and executed in the threads of the software to be upgraded , using stack reconstruction for mapping and state transition;

(8) According to the mapping relationship of the continuation point of the old and new versions stored in the asynchronous checkpoint in the dynamic upgrade patch, all threads are resumed, and the process ends.

Preferably, step (1) is to integrate the project source files by using the merge function in the common intermediate language.

Preferably, step (5) inserts the asynchronous checkpoint into the function body by means of dynamic instrumentation, and the position of inserting the function body is at the head of the function body, the beginning of the loop body, and before the function call.

Preferably, step (6) specifically includes the following sub-steps:

(6-1) receiving the user's application request, including the process ID of the software to be updated and the path of the dynamic upgrade patch file in step (3);

(6-2) Initialize the empty first mapping table and the second mapping table, wherein the first mapping table represents the critical variable that the thread has obtained and the lock that assists in dynamic upgrade, and the second mapping table represents the critical variable that the thread wishes to obtain and the assisting Dynamically upgraded locks;

(6-3) Track shared critical variables of threads and locks that assist dynamic upgrades by wrapping and replacing system calls. When the system operates on shared critical variables and locks that assist dynamic upgrades, look for step (6-2) The first mapping table and the second mapping table, then enter step (6-4), if not then add the name of the critical variable name and the lock that assists dynamic upgrade to the first mapping table and the second mapping table, and in each After each variable or lock, add the thread ID that operates on it, and then enter step (6-4).

(6-4) Determine whether the thread occupies the lock that assists in dynamic upgrade, or occupies a shared critical variable. If it is the former, its thread ID is first added to the second mapping table. If there is no lock in the first mapping table that assists in dynamic upgrade Thread ID, then its thread ID is added to the corresponding position in the first mapping table, and this thread is marked as assisting state, if the lock that assists dynamic upgrade in the first mapping table has thread ID, this thread is marked as blocking state; If it is the latter, its thread ID is first added in the second mapping table, if the shared critical variable corresponding in the first mapping table does not have a thread ID, then its thread ID is added to the corresponding position in the first mapping table, and The thread is marked as an assist state, if the corresponding shared critical variable in the first mapping table has a thread ID, the thread is marked as a blocked state;

(6-5) Continuously check the status of all threads. When no thread is found to be in the running state, the thread marked as the assistance state will be blocked. At this time, all threads will enter the blocked state, and the notification system can perform subsequent dynamic upgrade operations.

According to another aspect of the present invention, a multithreaded software dynamic upgrade system based on asynchronous checkpoints is provided, including:

The first module is used to obtain the old and new versions of the software to be upgraded, respectively extract the project source files in the old and new versions, and integrate the project source files of the old and new versions respectively;

The second module is used to compare the integrated new version of the project source file with the old version of the project source file to generate a primary patch;

The third module is used to insert the asynchronous checkpoint into the primary patch to generate a dynamic upgrade patch, wherein the asynchronous checkpoint stores the mapping relationship between the continuation points of the old and new versions of the software to be upgraded;

The fourth module is used to load the generated dynamic upgrade patch into the running old version of the software to be upgraded;

The fifth module is used to receive the user's initialization request, and according to the initialization request, use the function name to be updated in the dynamic upgrade patch to find the corresponding function body in the memory, and insert the asynchronous checkpoint in the third module into the function body ;

The sixth module is used to receive the user's application request, and use the asynchronous checkpoint algorithm to make all the threads in the software to be upgraded reach a blocked state according to the application request;

The seventh module is used to realize the indirect jump of functions in the way of binary rewriting for the functions and variables that are not used and executed in the threads of the software to be upgraded. For the functions and variables that are being used and executed in the threads of the software to be upgraded Functions and variables are mapped and state converted by means of stack reconstruction;

The eighth module is used to resume execution of all threads according to the mapping relationship between the old and new versions of the continuation point stored in the asynchronous checkpoint in the dynamic upgrade patch, and the process ends.

Generally speaking, compared with the prior art, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

(1) Binary compatibility (not dependent on a specific compiler): the method of the present invention does not use program transformation or reconstruction to make the program renewable, it utilizes the debugging API to obtain the control right of the patch process and revises the state of the running program, This is similar to the implementation principle of a debugger. Furthermore, the method of the present invention increases the flexibility of updates without relying on update points to eliminate many of the constraints on types.

(2) multi-thread support: the difficulty of processing multi-thread software is that several threads may access the data in the update simultaneously, and the present invention abandons the method based on the update point and adopts the update to apply immediately. Its tracking attempts to write access to the critical variables in the old version and adopts the method of updating all threads at one time to ensure that the software only executes and calls the functions and variables of the same version at the same time, avoiding data inconsistency.

(3) Prevent deadlock between threads: Consider that some software may already be in an abnormal state before updating, such as some software internal errors or external attacks. Therefore, not considering these situations is likely to cause the failure of these software updates. Although it is unlikely to completely solve these problems, the correct running state cannot be known at some point, but the method of the present invention can wrap and replace system calls to learn Whether each thread is in a blocked state, maintaining the WANT and HAVE lists can effectively avoid deadlock problems between threads.

(4) Usability and manageability: In order to reduce the operator's burden, the method of the present invention develops a user interface to facilitate the whole updating process. The operator only needs to tell the system a small amount of information (process ID and patch name) to apply the update. At the same time, the patching process is also visible to the operator. In order to help users build dynamic patches, the method of the present invention provides a source code-to-source code compiler, which can identify the semantic difference between the old and new versions of the code. With some simple manual adjustments, dynamic patches can be generated automatically.

(5) Low overhead: Since binary rewriting is used to indicate the function call from the old version to the new version, this will only generate a little overhead of function indirect addressing. However, the application of asynchronous checkpoint algorithm to update all threads at one time and complete the stack reconstruction is carried out when all threads are blocked. In fact, such overhead is very small, and performance tests show that it is effective for most applications. The overhead is less than 5%.

Description of drawings

Fig. 1 is a flow chart of the multi-thread software dynamic upgrading method based on asynchronous checkpoint in the present invention.

Figure 2(a) and (b) show the deadlock problem that the asynchronous checkpoint algorithm can solve.

Fig. 3 shows the realization principle of function indirect jump.

Figure 4 shows an overview of stack reconstruction.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not constitute a conflict with each other.

The overall idea of the present invention is that the user can generate the primary dynamic upgrade patch according to the new and old versions of open source software, process the primary dynamic upgrade patch and compile it under a conventional compiler to obtain the dynamic upgrade patch, and then load the dynamic upgrade patch using the asynchronous checkpoint algorithm Make all the threads of the software to be updated reach the blocking state, update the functions and variables that are not used by indirect jumps, and restructure the stacks of all threads at once for the functions and variables that are being used to update.

As shown in Figure 1, the multithreaded software dynamic upgrading method based on the asynchronous checkpoint of the present invention comprises the following steps:

(1) Obtain the old and new versions of the software to be upgraded, extract the project source files in the old and new versions respectively, and integrate the project source files of the new and old versions respectively; specifically, use Common Intermediate Language (CIL for short) Merge (Merge) function in the integration of project source files;

(2) Compare the integrated new version of the project source file with the old version of the project source file to generate a primary patch; specifically, use a powerful online upgrade system (Powerful LiveUpdating System, referred to as Polus) for comparison , the primary patch generated is a program file of type .c;

(3) Insert the asynchronous checkpoint into the primary patch to generate a dynamic upgrade patch; specifically, insert the code of the asynchronous checkpoint into a .c type program file, and compile it with a conventional compiler (such as GCC) , and finally generate a program file of the .so type; in addition, the asynchronous checkpoint saves the mapping relationship between the old and new versions of the software to be upgraded;

(4) load the dynamic upgrade patch that generates into the old version of the software to be upgraded in operation;

(5) Receive the user's initialization request, and use the function name to be updated in the dynamic upgrade patch to find the corresponding function body in the memory according to the initialization request, and insert the asynchronous checkpoint in step (3) into the function body; specifically For example, the asynchronous checkpoint is inserted into the function body using dynamic instrumentation. The position of inserting the function body is at the head of the function body, the beginning of the loop body, and before the function call.

(6) Receive the user's application request, and use the asynchronous checkpoint algorithm to make all threads in the software to be upgraded reach a blocked state according to the application request; this step specifically includes the following sub-steps:

(6-1) receiving the user's application request, including the process ID of the software to be updated and the path of the dynamic upgrade patch file in step (3);

(6-2) Initialize the empty first mapping table (HAVE list) and the second mapping table (WANT list), wherein the first mapping table represents the critical variable that the thread has obtained and the lock (Lock) that assists dynamic upgrade, and the second The mapping table represents the critical variables that the thread wants to obtain and the locks that assist dynamic upgrades;

(6-3) Track the thread's shared critical variables and locks that assist dynamic upgrades by replacing with wrapper calls system calls. When the system operates on shared critical variables and locks that assist dynamic upgrades, the search steps The first mapping table and the second mapping table in (6-2), enter step (6-4) then, if not then add the name of critical variable name and the lock that assists dynamic upgrade to the first mapping table and the second mapping Table, and add the thread ID of its operation behind each variable or lock, and then enter step (6-4).

(6-4) Determine whether the thread is occupying a lock that assists in dynamic upgrades or a shared critical variable. If it is the former, first add its thread ID to the WANT list. If the lock in the HAVE list that assists in dynamic upgrades does not have a thread ID, then Add its thread ID to the corresponding position in the HAVE list, and mark the thread as an assist (cooperate) state, if the lock in the HAVE list assists dynamic upgrades with a thread ID, mark the thread as a blocking (block) state; if it is The latter first adds its thread ID to the WANT list, if the corresponding shared critical variable in the HAVE list does not have a thread ID, then adds its thread ID to the corresponding position in the HAVE list, and marks the thread as assisting (run ) state, if the corresponding shared critical variable in the HAVE list has a thread ID, the thread is marked as blocked (block) state.

(6-5) Continuously check the status of all threads. When no thread is found to be in the running state, the thread marked as the assistance state will be blocked. At this time, all threads will enter the blocked state, and the notification system can perform subsequent dynamic upgrade operations.

(7) For the unused and executed functions and variables in the threads of the software to be upgraded, the binary rewriting method is used to realize the indirect jump of the function. Specifically, the binary code at the beginning of the function body is replaced with the jmp instruction, Jump to the new version of the function, and the variables are mapped to the memory address of the new version by redirection; for the functions and variables being used and executed in the threads in the software to be upgraded, the stack reconstruction method is used for mapping and state conversion , specifically, first save the scene, record the data in the current function stack and the value of the register, then expand the stack, and rewrite the function parameters, Return address, previous stack frame pointer and local variables, modify and replace new function instructions.

(8) According to the mapping relationship of the continuation point of the old and new versions preserved in the asynchronous checkpoint in the dynamic upgrade patch, all threads are resumed and executed, and the process ends. At this moment, the functions and variables that are now executed and used by the running software are all new versions.

As shown in Figure 2 (a) and (b), threads a, b, c, d, e, f are running normally, at this time the update monitoring process sends a signal to the application program that it will be updated. Thread a arrives at the checkpoint first, so it acquires the lock to assist dynamic upgrade, and threads b, c, and d also arrive at the checkpoint, but at this time the lock to assist dynamic upgrade has been acquired by thread a, so they are in a blocked state , the update monitoring process can easily know this situation by assisting in the exception capture of dynamically upgraded locks. However, thread d occupies the critical variable temp1 before blocking. At this time, thread e happens to access the critical variable temp1 and is blocked. The process normally cannot capture the state of thread e directly, because no exception is thrown. However, through the WANT and HAVE lists, it can be easily found that thread e is blocked, and thread f is in the state of continuing execution. That is to say, without the support of the WANT and HAVE lists, when the thread f also reaches the blocked state, the update monitoring process does not know that all threads are blocked, and it will still wait forever, resulting in a deadlock of the application. The WANT and HAVE lists can successfully avoid the deadlock problem between threads during the update process.

Method of the invention The method of the invention inserts a jmp instruction by rewriting the 5 bytes of the instruction at the beginning of the function, but the rewriting operation destroys one or more instructions. In addition to the instruction rewrite operation, the method of the present invention inserts two nop instructions of two bytes before the immediately executed instruction, because the kernel subtracts two bytes from EIP to restart the system call, if ptrace has interrupted a system The execution of the call. In order to make the application program continue to execute without the help of the system after the code update, the method of the present invention should preserve the original instructions that have been rewritten as jmp and nop instructions. However, when the original instruction that should be rewritten as a nop is on another branch, the modified instruction may be executed directly, which may cause an illegal instruction error. Then, the other 4 or 7 bytes of the method rewriting instruction of the present invention (two nop instructions need 2 bytes, a short jump jmp instruction needs 2 bytes or a long jump jmp instruction needs 5 bytes ). Short jump jmp instructions are used to jump control flow to another branch and instructions that cannot be directly rewritten as nop instructions. As shown in Figure 3, through this binary rewriting method, a jump instruction is inserted at the beginning of the function body at the virtual memory address. When the program calls the function again, it will execute sequentially along each instruction in the function body. The first instruction has been rewritten as a jmp jump instruction, and the program will jump to the code of the new version of the function to continue executing, which is equivalent to executing the instructions of the new version of the function every time the program calls the old version of the function.

Stack reconstruction consists of two main steps, preservation of stack information and restoration of all function stack frames. It saves the state of the existing stack before restoring the updated state in stack reconstruction. To reduce the size of the stack reconstruction helper code in upgrade patches, the wrapper functions that efficiently save and restore stack frames are only generated in text segments in a separate memory area that runs when rebuilding. As shown in Figure 4, functions A and B are executing and all need to be updated. At this time, if all threads are suspended and blocked, the method of the present invention starts to save the scene, records the value of data and registers, and then unrolls the stack, according to the dynamic upgrade. For the information of the function to be updated in the patch, re-assign the variables in the function stack frame, modify and replace the new function instructions, and the part of the function that does not need to be updated in the stack has not changed much, and the functions that need to be updated, such as A, B, etc. The data of the new version is obtained from the data mapping of the old version, and values such as registers and relative virtual addresses must also be recalculated.

It is easy for those skilled in the art to understand that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, All should be included within the protection scope of the present invention.

Claims (5)

1. the multi-thread software dynamic update method based on asynchronous checkpointing, is characterized in that, comprises the following steps:

(1) obtain the new and old edition of software to be upgraded, extract respectively the project source file in new and old edition, and respectively the project source file of this new and old edition is integrated;

(2) the project source file of redaction and the project source file of legacy version after integrating are contrasted, to generate elementary patch;

(3) asynchronous checkpointing is inserted in elementary patch, to generate dynamic update patch, the mapping relations of wherein having preserved the continuity point of the new and old edition of software to be upgraded in asynchronous checkpointing;

(4) the dynamic update patch of generation is loaded in the legacy version of operating software to be upgraded;

(5) receive user's initialization requests, and use function name to be updated in dynamic update patch to search function body corresponding in internal memory according to this initialization requests, and the asynchronous checkpointing in step (3) is inserted in this function body;

(6) receive user's application request, and utilize asynchronous checkpointing algorithm to make all threads in software to be upgraded reach blocked state according to this application request;

(7) for the function and the variable that are not used in the thread in software to be upgraded and carry out, the mode that adopts scale-of-two to rewrite realizes the indirect redirect of function, for the function and the variable that are using in the thread in software to be upgraded and carrying out, adopt the mode of storehouse reconstruct to shine upon and state conversion;

(8) recover to carry out all threads according to the mapping relations of the continuity point of the new and old edition of preserving in asynchronous checkpointing in dynamic update patch, process finishes.

2. multi-thread software dynamic update method according to claim 1, is characterized in that, step (1) is to adopt the pooling function in common intermediate language to carry out the integration of project source file.

3. multi-thread software dynamic update method according to claim 1, it is characterized in that, it is to utilize dynamic pitching pile mode that step (5) is inserted asynchronous checkpointing in function body, before inserting the position of function body and be the beginning, function call of the head that is positioned at this function body, loop body.

4. multi-thread software dynamic update method according to claim 1, is characterized in that, step (6) specifically comprises following sub-step:

(6-1) reception user's application request, this application request comprises the path of process ID and the middle dynamic update patch file of step (3) of software to be updated;

(6-2) the first mapping table of initialization sky and the second mapping table, wherein the first mapping table represents critical variable that thread has obtained and assists the lock of dynamic update, and the second mapping table represents that thread wishes the critical variable obtaining and the lock of assisting dynamic update;

(6-3) lock that calls to follow the trail of the shared critical variable of thread and assist dynamic update by packaging replacement system, in the time that system has operation to the lock of shared critical variable and assistance dynamic update at every turn, the first mapping table in finding step (6-2) and the second mapping table, then enter step (6-4), the title of the lock of critical variable name and assistance dynamic update is added in the first mapping table and the second mapping table if do not have, and after each variable or lock, add the Thread Id to its operation, then enter step (6-4).

(6-4) judge that thread is to take the lock of assisting dynamic update, still take shared critical variable, if the former first adds its Thread Id in the second mapping table to, if assist the lock of dynamic update there is no Thread Id in the first mapping table, its Thread Id is added to position corresponding in the first mapping table, and be assistance state by this thread marks, be blocked state if assist the lock of dynamic update to have Thread Id in the first mapping table by this thread marks; If latter first adds its Thread Id in the second mapping table to, if shared critical variable corresponding in the first mapping table does not have Thread Id, its Thread Id is added to position corresponding in the first mapping table, and be assistance state by this thread marks, if in the first mapping table corresponding shared critical variable to have Thread Id be blocked state by this thread marks;

(6-5) the lasting state that checks all threads, in the time finding there is no thread in run state, will be labeled as the thread block of assistance state, and now all threads all enter blocked state, and reporting system can carry out follow-up dynamic update operation.

5. the multi-thread software dynamic update system based on asynchronous checkpointing, is characterized in that, comprising:

The first module, for obtaining the new and old edition of software to be upgraded, extracts respectively the project source file in new and old edition, and respectively the project source file of this new and old edition is integrated;

The second module, for the project source file of redaction and the project source file of legacy version after integrating are contrasted, to generate elementary patch;

The 3rd module, for inserting asynchronous checkpointing on elementary patch, to generate dynamic update patch, the mapping relations of wherein having preserved the continuity point of the new and old edition of software to be upgraded in asynchronous checkpointing;

Four module, for being loaded into the dynamic update patch of generation the legacy version of operating software to be upgraded;

The 5th module, for receiving user's initialization requests, and is used function name to be updated in dynamic update patch to search function body corresponding in internal memory according to this initialization requests, and the asynchronous checkpointing in the 3rd module is inserted in this function body;

The 6th module, for receiving user's application request, and utilizes asynchronous checkpointing algorithm to make all threads in software to be upgraded reach blocked state according to this application request;

The 7th module, be used for for the function and the variable that are not used in the thread of software to be upgraded and carry out, the mode that adopts scale-of-two to rewrite realizes the indirect redirect of function, for the function and the variable that are using in the thread in software to be upgraded and carrying out, adopt the mode of storehouse reconstruct to shine upon and state conversion;

The 8th module, for recovering to carry out all threads according to the mapping relations of the continuity point of the new and old edition of preserving in dynamic update patch asynchronous checkpointing, process finishes.