JP6449671B2 - Core I/O failover control system and core I/O failover control method - Google Patents

Description

The present invention relates to a core I/O (Input/Output) failover control system and a core I/O failover control method, and in particular to a core I/O failover control system and a core I/O failover control method in a computer server in which the core I/O is duplicated to improve the reliability of the core I/O.

There are computer servers (hereinafter referred to as core I/O duplex servers) that have improved the reliability of the core I/O by installing two core I/Os. Among them, when a minor failure occurs in the operational core I/O, a control method is adopted in which the standby core I/O is switched to the operational system while continuing the operation of the computer server. Most computer servers today have only one core I/O (hereinafter referred to as a core I/O single server), and there are few core I/O duplex servers. Therefore, most operating systems (OS) do not assume core I/O duplex servers. In such an OS compatibility situation, in order to realize core I/O failover in a core I/O duplex server, it was necessary to provide the server with very complex and large-scale hardware. Or, in some cases, it was necessary to realize it at the system firmware layer at the expense of application performance. In addition, "failover" as used in this specification means that when a failure occurs in a running system, the function of the part where the failure occurred is taken over by an alternative function and processing continues.

For example, Patent Document 1 discloses a technology related to core I/O duplex servers that includes a map unit that maps a space for used core I/O and a space for spare core I/O in the memory space of each processor node in order to switch the core I/O device to be used without restarting the partition. It also includes a suppression unit that suppresses the issuance of new transactions by multiple processor nodes in response to an instruction to change the used core I/O device, and a copy unit that copies data stored in a source register included in the used core I/O device to a destination register included in the spare core I/O device after the suppression. It also discloses a technology that includes a routing setting change unit that changes the routing setting so that transactions to the used core I/O device are transferred to the spare core I/O device after the copy is completed, and a release unit that releases the suppression of the issuance of new transactions after the change.

Patent Document 2 also discloses a technology in which a transaction routing controller receives, routes, and sends out transactions to achieve I/O device duplication at the hardware level and enable dynamic degeneration of the master device. The routing table has validity information indicating that I/O device duplication is valid, as well as master device identification information and slave device identification information, and a service processor controls the transaction routing controller and the routing table.

JP 2012-168650 A JP 2008-225534 A

In the technology described in Patent Document 1, the system firmware controls the core I/O device switching, so there is an issue that all processors in the computer server must be temporarily stopped. In addition, there is an issue that all applications on the computer server are temporarily stopped during the core I/O device switching period. There is also an issue that hardware called a spare core I/O access control circuit is required to copy information in the used core I/O device to the spare core I/O device.

The technology described in Patent Document 2 had the problem that in order to keep the information in the duplicated I/O devices consistent at all times, the transaction routing controller and routing table in the memory controller became very complex and large-scale.

The object of the present invention is to solve the above-mentioned problems and realize failover of core I/O functions without equipping a computer server with complex and large-scale hardware and without temporarily suspending applications that are not using the core I/O functions.

In order to solve the above-mentioned problems, the present invention provides a core I/O failover control system for a computer having a system control unit having a plurality of core I/O units and a BMC (Base Management Controller), wherein the system control unit has a core I/O switching circuit that switches the core I/O units and a memory that temporarily stores contents of the core I/O units, the BMC has a fault detection unit that collects fault information when the core I/O unit detects a fault and a core I/O control unit that controls the core I/O switching circuit based on the fault information, and the system control unit has a core I/O switching driver that temporarily saves the contents of the core I/O units to the memory when switching the core I/O units .

In order to solve the above-mentioned problems, the present invention provides a core I/O failover control method for a computer having a system control unit having a plurality of core I/O units and a BMC ( Base Management Controller ), comprising the steps of: the BMC detecting a failure detected by the core I/O unit; the system control unit temporarily saving to memory the contents of the core I/O unit in which the failure has occurred; the BMC switching from the core I/O unit in which the failure has occurred to a normal core I/O unit; and the system control unit restoring to the normal core I/O unit the contents of the core I/O unit temporarily saved to memory .

According to the present invention, it is possible to realize a failover of the core I/O function without having to equip the computer server with complex and large-scale hardware, and without suspending applications that are not using the core I/O function.

1 is a block diagram showing a configuration of a core I/O failover control system according to an embodiment of the present invention. FIG. 2 is a block diagram showing a configuration of a system control unit in the embodiment of the present invention. FIG. 2 is a block diagram showing a configuration of a BMC according to an embodiment of the present invention. 2 is a block diagram showing a configuration of a core I/O control unit according to an embodiment of the present invention. 4 is a flowchart illustrating an operation of the core I/O failover control system in the embodiment of the present invention.

The following describes an embodiment of the present invention in detail with reference to the drawings.

(Embodiment)
1 is a block diagram showing the configuration of a core I/O failover control system according to an embodiment of the present invention, The configuration of the core I/O failover control system according to the embodiment will be described with reference to FIG.

In FIG. 1, the computer server 100 has a system control unit 101 and a BMC 102.

The system control unit 101 is a group of hardware components necessary to operate as a computer server, including a CPU, memory, I/O devices, etc.

The BMC (Base Management Controller) 102 is a controller that manages and controls the system control unit 101, and is connected to the system control unit 101 via three interfaces: BMI 150, BCI 151, and BHI 152.

OS 103 is an operating system that runs on the system control unit 101, and has the function of starting or stopping various drivers. The core I/O switching driver 104 and the core I/O driver 105 run on OS 103.

The core I/O switching driver 104 starts up on the system control unit 101 in response to an interrupt from the system control unit 101, and stops or starts the core I/O driver 105 via the OS 103. It also copies information about the active core I/O in the system control unit 101 to the standby core I/O.

Figure 2 is a block diagram showing the configuration of the system control unit 101 in an embodiment of the present invention. The configuration of the system control unit 101 will be described using Figure 2.

The host bridge 206 has the CPUs 200-202, memory 205, an I/O bridge 210 that connects I/O devices, a core I/O switching circuit 209, and interfaces 250-252, 255, 260, and 259, and is responsible for data transfer between these components. It also has a BHI 152 that is an interface with the BMC 102. This BHI 152 is, for example, a PCI Express interface defined in "PCI Express Base Specification Revision 3.0".

The core I/O unit A 207 and the core I/O unit B 208 are components having the core I/O functions of a computer server, and both provide exactly the same functions. The core I/O functions are I/O functions that are essential for operating as a computer server, and an example of a function included in the core I/O functions is CMOS/NvRAM (Non-volatile RAM).
Examples of the memory include a random access memory (Random Access Memory), a serial controller, a timer, a Universal Serial Bus (USB) controller, and an interrupt controller.

In addition, core I/O unit A207 and core I/O unit B208 have a BMI150 that is an interface with BMC102. BMC102 monitors failures in core I/O unit A207 and core I/O unit B208 via the BMI150.

The core I/O switching circuit 209 has a BCI 151 which is an interface with the BMC 102, and is a component which switches between core I/O unit A 207 and core I/O unit B 208 via the BCI 151. The core I/O switching circuit 209 is connected to core I/O unit A 207 and core I/O unit B 208 via interfaces 257 and 258. One of the core I/O units A 207 or B 208 selected by the core I/O switching circuit 209 becomes the active system, and the other core I/O unit B 208 or A 207 becomes the standby system.

Figure 3 is a block diagram showing the configuration of the BMC 102 according to this embodiment, and Figure 4 is a block diagram showing the configuration of the core I/O control unit 300 according to this embodiment. The detailed configuration of the BMC 102 will be described using Figures 3 and 4.

In FIG. 3, the BMC 102 has a core I/O control unit 300 and a failure prediction detection unit 301. The core I/O control unit 300 has a function of issuing various interrupts associated with core I/O switching. It also has a function that allows the BMC 102 and the core I/O switching driver 104 to communicate through the BHI 152 and the host bridge 206. An example of the core I/O control unit 300 is a configuration that complies with the PCI Express Endpoint defined in "PCI Express Base Specification Revision 3.0".

The failure sign detection unit 301 is a mechanism that monitors and detects failures in core I/O unit A207 and core I/O unit B208. When core I/O unit A207 or core I/O unit B208 detects a failure in itself, it notifies the failure sign detection unit 301 of BMC 102 via BMI 150. When core I/O unit A207 or core I/O unit B208 detects a failure in itself, it sets its own status flag. Therefore, the failure sign detection unit 301 of BMC 102 can detect the presence or absence of a failure by periodically reading the set status flag via BMI 150.

The core I/O control unit 300 and the failure prediction detection unit 301 are both installed inside the BMC 102 because they are controlled by a controller (not shown) within the BMC 102, but may be located elsewhere as long as they are controllable.

Figure 4 shows the configuration of the core I/O control unit 300 in this embodiment. The driver stop instruction flag register 401, the driver start instruction flag register 402, the driver stop completion flag register 403, and the driver start completion flag register 404 are accessible from both the BMC 102 and the BHI 152.

When the flag of the driver stop instruction flag register 401 is set, the interrupt control unit 400 transmits a driver stop interrupt to the BHI 152. When the flag of the driver start instruction flag register 402 is set, the interrupt control unit 400 transmits a driver start interrupt to the BHI 152.
MSI as defined in "MSI Specification Revision 3.0"
and a configuration conforming to MSI-X Capability Structures is possible.

The operation of the core I/O failover control system in this embodiment will be explained using Figures 1, 2, 3, 4, and 5.

Figure 5 is a flowchart explaining the operation of the core I/O failover control system in this embodiment.

In FIG. 5, first, the BMC 102 detects a minor fault in the operational core I/O function (S101). That is, in the computer server 100 in which the core I/O unit A207 is operating as the operational system, the fault sign detection unit 301 in the BMC 102 detects a minor fault in the operational core I/O unit A207 via the BMI 150. In this embodiment, a fault that allows the system to continue operating and can be recovered from is considered a minor fault. An example of a minor fault is the frequent occurrence of correctable faults.

Next, the BMC 102 issues a core I/O driver stop instruction (S102). When the BMC 102 recognizes a minor failure of the active core I/O unit A207 via the failure sign detection unit 301, it sets a flag in the driver stop instruction flag register 401 in the core I/O control unit 300. When the flag in the driver stop instruction flag register 401 is set in the core I/O control unit 300, it is notified to the interrupt control unit 400, and the interrupt control unit 400 transmits a driver stop interrupt to the BHI 152. The driver stop interrupt transmitted to the BHI 152 is transmitted to the CPUx 200, CPUy 201, or CPUz 202 via the host bridge 206 in the system control unit 101. Here, it is assumed that the driver stop interrupt is transmitted to the CPUx 200. On the CPUx 200 that receives the driver stop interrupt, the OS 103 recognizes the driver stop interrupt and starts the core I/O switching driver 104 associated with the interrupt.

Next, the core I/O switching driver 104 stops the core I/O driver 105 (S103). In order to recognize the interrupt cause, the core I/O switching driver 104, started by the OS 103, reads the driver stop instruction flag register 401 and the driver start instruction flag register 402 in the core I/O control unit 300 in the BMC 102 via the host bridge 206 in the system control unit 101. At this timing, the flag in the driver stop instruction flag register 401 is set, so the core I/O switching driver 104 first clears the flag in the driver stop instruction flag register 401. Then, the core I/O driver 105 is stopped via the OS 103. This stops access to the active core I/O unit A 207.

Then, the core I/O switching driver 104 saves the information in the core I/O function (S104). That is, the core I/O switching driver 104 temporarily saves the information in the active core I/O unit A 207 to the memory 205 via the host bridge 206 in the system control unit 101. After that, the core I/O switching driver 104 sets the flag in the driver stop completion flag register 403.

Next, the BMC switches the active core I/O function (S105). When the BMC 102 detects that the flag in the driver stop completion flag register 403 in the core I/O control unit 300 has been set, it first clears the flag in the driver stop completion flag register 403. Then, it instructs the core I/O switching circuit 209 via the BCI 151 to select core I/O unit B 208. This switches core I/O unit B 208 to the active system.

Then, the BMC 102 instructs the core I/O driver 105 to restart (S106). That is, after switching the core I/O unit B208 to the active system, the BMC 102 sets the flag of the driver start instruction flag register 402 in the core I/O control unit 300. When the flag of the driver start instruction flag register 402 is set in the core I/O control unit 300, it is notified to the interrupt control unit 400, and the interrupt control unit 400 transmits a driver start interrupt to the BHI 152. The driver start interrupt transmitted to the BHI 152 is transmitted to the CPUx 200, CPUy 201, or CPUz 202 via the host bridge 206 in the system control unit 101. Here, it is assumed that the driver start interrupt is transmitted to the CPUx 200. On the CPUx 200 that receives the driver start interrupt, the OS 103 recognizes the driver start interrupt and activates the core I/O switching driver 104 associated with the interrupt.

The core I/O switching driver 104 restores the core I/O function information (S107). In order to recognize the interrupt cause, the core I/O switching driver 104, started by the OS 103, reads the flags of the driver stop instruction flag register 401 and the driver start instruction flag register 402 in the core I/O control unit 300 in the BMC 102 via the host bridge 206 in the system control unit 101. At this timing, the flag of the driver start instruction flag register 402 is set, so the core I/O switching driver 104 first clears the flag of the driver start instruction flag register 402. Then, via the host bridge 206 in the system control unit 101, the core I/O function information temporarily saved in the memory 205 in the above (S104) is written to the new active core I/O unit B208. As a result, the I/O function information before and after the I/O function failover becomes the same.

Then, the core I/O switching driver 104 restarts the core I/O driver 105 (S108). The core I/O switching driver 104 restarts the core I/O driver 105 via the OS 103. This starts access to the new active core I/O unit B208. After that, the core I/O switching driver 104 sets a flag in the driver start completion flag register 404.

Finally, the BMC 102 checks whether the core I/O driver 105 has been restarted (S109). When the BMC 102 detects that the flag in the driver start completion flag register 404 in the core I/O control unit 300 has been set, it clears the flag in the driver start completion flag register 404 and ends the series of core I/O function failover processes.

According to an embodiment of the present invention, the BMC 102 plays a central role in controlling the core I/O switching driver 104 to stop and restart the core I/O driver 105 when a predictive failure occurs. When the core I/O driver 105 stops, there is no access to the core I/O function, so applications that do not use the core I/O function are not affected by the failover. In addition, when hardware such as a CPU temporarily suspends access to the core I/O function to perform a failover of the core I/O function, other software using the CPU also stops. However, according to this embodiment, there is no impact on other software using the CPU.

As described above, according to this embodiment, it is possible to realize a failover of the core I/O function without suspending applications that do not use the core I/O function by simply adding a core I/O switching circuit to the system control unit and a core I/O control unit to the BMC, without having to equip the computer server with complex and large-scale hardware. Since these are simple circuits and small in scale, it is possible to realize a failover of the core I/O function without suspending applications that do not use the core I/O function.

The present invention is not limited to the above-described embodiment, and can be modified and altered in various ways without departing from the spirit and scope of the present invention.

The present invention can be used in information devices that have duplicated core I/O to improve the reliability of the core I/O.

100 Computer server 101 System control unit 102 BMC
103 OS
104 Core I/O switching driver 105 Core I/O driver 150 BMI
151 BCI
152 B.H.I.
200 CPUx
201 CPUy
202 CPUz
205 Memory 206 Host bridge 207 Core I/O unit A
208 Core I/O section B
209 Core I/O switching circuit 210 I/O bridge 250 Interface 251 Interface 252 Interface 255 Interface 257 to 260 Interface 300 Core I/O control unit 301 Failure sign detection unit 400 Interrupt control unit 401 Driver stop instruction flag register 402 Driver start instruction flag register 403 Driver stop completion flag register 404 Driver start completion flag register

Claims (2)

In a core I/O failover control system for a computer having a system control unit having a plurality of core I/O units and a BMC (Base Management Controller),
the system control unit includes a core I/O switching circuit that switches the core I/O unit;
A memory for temporarily storing the contents of the core I/O unit,
The BMC includes a failure detection unit that collects failure information when the core I/O unit detects a failure, and a core I/O control unit that controls the core I/O switching circuit based on the failure information,
A core I/O failover control system characterized in that the system control unit has a core I/O switching driver that temporarily saves the contents of the core I/O unit to the memory when switching the core I/O unit. A core I/O failover control method for a computer having a system control unit having a plurality of core I/O units and a BMC (Base Management Controller) , comprising:
the BMC detecting a failure detected by the core I/O unit;
the system control unit temporarily saves contents of the core I/O unit in which a failure has occurred in a memory ;
a step of switching the BMC from the failed core I/O unit to a normal core I/O unit;
a step of the system control unit restoring the contents of the core I/O unit temporarily saved in the memory to the normal core I/O unit that has been switched over;
13. A core I/O failover control method comprising:

Images