Controller switching system, method, and storage medium
By monitoring the hardware operating signals of the main controller through a hardware arbitrator and combining them with heartbeat packets, the problem of misjudgment by the baseboard management controller under network congestion is solved, enabling more accurate and efficient master-slave switching and ensuring the stability of server management services and business continuity.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANDONG YUNHAI GUOCHUANG CLOUD COMPUTING EQUIP IND INNOVATION CENT CO LTD
- Filing Date
- 2026-04-21
- Publication Date
- 2026-07-24
AI Technical Summary
In servers, traditional redundancy schemes for baseboard management controllers are prone to misjudgment under network congestion, leading to inaccurate master-slave switching.
A hardware arbitrator is used to monitor the hardware operating signals of the main controller. The main controller switches over to the backup controller in coordination with the interrupt signal and the arbitration signal. The switchover is triggered by combining the hardware operating signal and the heartbeat packet, so as to avoid misjudgment caused by network congestion.
It improves the accuracy of primary/backup failover, reduces the impact of network congestion on failover, and ensures the stability and efficiency of server management services, especially reducing the impact on business continuity in scenarios such as high-frequency trading in finance and core telecommunications networks.
Smart Images
Figure CN122457461A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of server technology, and in particular to controller switching systems, methods and storage media. Background Technology
[0002] In the field of server technology, the primary base station management controller sends a heartbeat packet to the backup base station management controller every second via Ethernet or I2C bus. The heartbeat packet may include a timestamp, load status, and Cyclic Redundancy Check (CRC). The backup base station management controller can maintain a sliding window (which can be 3 to 5 heartbeat cycles) for continuity detection. If 3 consecutive heartbeat cycles are lost, a primary / backup switchover is triggered.
[0003] However, relying solely on heartbeat packets to detect the main board management controller may lead to misjudgments in situations of network congestion. Summary of the Invention
[0004] This application provides controller switching systems, methods, electronic devices, storage media, and program products to solve the problem of misjudging main controller malfunctions.
[0005] This application provides a controller switching system, including: A hardware arbitrator is used to monitor one or more hardware operating signals of the main controller; when an abnormality is detected in one or more hardware operating signals, an interrupt signal is sent to the backup controller. The main controller is used to periodically send heartbeat packets to the backup controller; The backup controller is used to perform a switchover preparation operation and send an arbitration signal to the hardware arbitrator after receiving an interrupt signal and determining that no heartbeat packet has been received from the main controller for several consecutive cycles. The hardware arbitrator is also used to send switching enable signals to the backup controller and the main controller respectively after receiving the arbitration signal; The main controller is also used to stop management operations upon receiving a switching enable signal; The backup controller is also used to initiate management operations upon receiving a switching enable signal.
[0006] This application also provides a controller switching method, including: The hardware arbitrator monitors one or more hardware operating signals of the main controller; when an abnormality is detected in one or more hardware operating signals, it sends an interrupt signal to the backup controller. The main controller periodically sends heartbeat packets to the backup controller; After receiving an interrupt signal and determining that it has not received a heartbeat packet from the master controller for several consecutive cycles, the standby controller performs a switchover preparation operation and sends an arbitration signal to the hardware arbitrator. After receiving the arbitration signal, the hardware arbitrator sends a switching enable signal to both the backup controller and the main controller. Upon receiving the switching enable signal, the main controller stops management operations; Upon receiving the switching enable signal, the backup controller initiates management operations.
[0007] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described controller switching methods when executing the computer program.
[0008] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the controller switching methods described above.
[0009] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the controller switching methods described above.
[0010] This application allows the hardware arbitrator to monitor the hardware operating signals of the primary controller, and the primary controller to periodically send heartbeat packets not monitored by the hardware arbitrator to the backup controller. Upon detecting an anomaly in the hardware operating signals, the hardware arbitrator sends an interrupt signal to the backup controller. Upon receiving the interrupt signal and confirming that no heartbeat packets have been received for several consecutive cycles, the backup controller can perform a handover preparation operation and send an arbitration signal to the hardware arbitrator. Upon receiving the arbitration signal, the hardware arbitrator can perform a primary / backup handover operation, sending handover enable signals to both the primary and backup controllers. Upon receiving the handover enable signal, the primary controller stops its management operations. Upon receiving the handover enable signal, the backup controller starts its management operations. In this architecture, the hardware arbitrator determines whether a primary / backup handover is needed based on both the hardware operating signals and the arbitration signal. Since the arbitration signal indicates a communication anomaly in the primary controller, combining these two pieces of information to determine whether a primary / backup handover should be triggered improves accuracy. Attached Figure Description
[0011] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0012] Figure 1This is a schematic diagram of the architecture of a controller switching system provided in an embodiment of this application; Figure 2 A schematic diagram of a multi-condition arbitration decision tree provided for an embodiment of this application; Figure 3 This is a schematic diagram of another controller switching system architecture provided in an embodiment of this application; Figure 4 This is a schematic diagram of the architecture of another controller switching system provided in an embodiment of this application; Figure 5 This is a schematic diagram of the architecture of another controller switching system provided in an embodiment of this application; Figure 6 A flowchart illustrating a controller switching method provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0013] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.
[0014] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.
[0015] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0016] With the rapid development of cloud computing, 5G communication, and edge computing, the requirements for server reliability and manageability are increasing. The Baseboard Management Controller (BMC), as a core component for remote server management, is responsible for monitoring hardware status, performing fault recovery, and providing remote control functions, such as for the keyboard, video monitor, and mouse (KVM). However, the traditional single-baseboard management controller architecture has a single point of failure risk. Once the baseboard management controller fails, the entire server may lose its manageability, and it may even affect the operational efficiency of the data center.
[0017] Therefore, to solve the above problems, a redundancy scheme for the baseboard management controller is proposed: The primary baseboard management controller sends a heartbeat packet to the backup baseboard management controller every second via Ethernet or I2C bus. The heartbeat packet may include a timestamp, load status, and Cyclic Redundancy Check (CRC). The backup baseboard management controller can maintain a sliding window (3 to 5 heartbeat cycles) for continuity monitoring. If 3 consecutive heartbeat cycles are lost, a primary / backup switchover is triggered.
[0018] However, relying solely on heartbeat packets to detect the main board management controller may lead to misjudgments in situations of network congestion.
[0019] To address the aforementioned technical problems, this application provides a controller switching system, such as... Figure 1 As shown, the controller switching system may include a hardware arbitrator, a main controller, and a backup controller.
[0020] The hardware arbiter can be a Complex Programmable Logic Device (CPLD). Both the main controller and the backup controller can be board management controllers.
[0021] The connection between the master controller and the backup controller can include a heartbeat signal line. The heartbeat signal line can use a Peripheral Component Interconnect Express (PCIE) bus or an optical link. The PCIE bus offers higher data transmission efficiency, while the optical link provides electromagnetic interference immunity, low latency, and high bandwidth. A hardware arbiter connects to both the master and backup controllers. The connection channel between the hardware arbiter and either controller can include an interrupt signal line, a switching enable signal line, and an arbitration request line. The heartbeat signal line, switching enable signal line, and arbitration request line can all be implemented using general purpose input / output (GPIO) pins.
[0022] The main controller and the backup controller reside in the same power domain, which supplies power only to the main and backup controllers. This allows for a rapid increase in output power after a switchover, ensuring the backup controller operates at full speed while maintaining a stable voltage output.
[0023] Under the above structure, the functions of the hardware arbiter, main controller, and backup controller are as follows: A hardware arbiter can be used to monitor one or more hardware operating signals of the main controller. When an abnormality is detected in one or more hardware operating signals, an interrupt signal is sent to the backup controller.
[0024] The master controller can be used to periodically send heartbeat packets to the backup controller.
[0025] The backup controller can be used to perform a switchover preparation operation and send an arbitration signal to the hardware arbitrator after receiving an interrupt signal and determining that no heartbeat packet has been received from the master controller for several consecutive cycles.
[0026] The hardware arbitrator can also be used to send switching enable signals to the backup controller and the main controller respectively after receiving the arbitration signal.
[0027] The main controller can also be used to stop management operations after receiving a switching enable signal.
[0028] The backup controller can also be used to initiate management operations after receiving a switching enable signal.
[0029] The main controller's operating signals may include a power signal, a clock signal, a watchdog signal, and a heartbeat signal. The power signal, clock signal, and watchdog signal are all hardware operating signals. The watchdog signal can originate from the main controller's WDT_OUT pin, and the heartbeat signal can be sent in the form of a heartbeat packet or a hardware pulse. When sending a heartbeat packet, the operating signals monitored by the hardware arbiter may include one or more of the power signal, clock signal, and watchdog signal. Changes in the power signal indicate whether the main controller's power supply is normal; changes in the clock signal indicate whether the main controller's crystal oscillator is normal; changes in the watchdog signal indicate whether the main controller's software is normal; and whether a heartbeat packet is received indicates whether the main controller's communication is normal. For example, a 25MHz crystal oscillator can be used.
[0030] Since heartbeat packets are application layer messages, they are usually contained within data packets. Monitoring heartbeat signals requires parsing their contents. Power signals, clock signals, watchdog signals, etc., are all hardware operating signals. Hardware arbitrators are more suitable for processing hardware operating signals. Therefore, this solution chooses to have hardware signals monitored by hardware arbitrators and application layer signals monitored by backup controllers.
[0031] Specifically, when the roles of the primary and backup controllers are not fixed, after the server system starts, the two controllers can negotiate their roles through a hardware handshake protocol. One controller becomes the primary controller, and the other becomes the backup controller. Each controller sends its identity information to the hardware arbitrator. Correspondingly, after receiving the identity information from both controllers, the hardware arbitrator can determine the primary controller based on the role type carried in the identity information, and then use the primary controller's communication address information to monitor its power signal, clock signal, and watchdog signal.
[0032] Therefore, the hardware arbitrator can determine the state of the main controller based on one or more hardware operating signals of the main controller. The main controller's state can be normal or abnormal. For example, if the power signal is lost in a clock cycle, or if the fluctuation amplitude of the power signal between two adjacent clock cycles exceeds a preset amplitude threshold, the main controller's power signal can be determined to be abnormal. If the clock signal disappears, or if the clock signal frequency drifts, or the waveform of the clock cycle is distorted (which may not conform to a specified waveform), the main controller's clock signal can be determined to be abnormal. If the main controller's watchdog signal fails to arrive at the hardware arbitrator's watchdog timer within a preset duration, the main controller's watchdog signal can be determined to be abnormal. After determining that one or more operating signals are abnormal, the hardware arbitrator can determine that the main controller's state is abnormal.
[0033] The master controller can periodically send heartbeat packets to the backup controller, and the backup controller can periodically receive heartbeat packets sent by the master controller. In other words, the backup controller monitors the heartbeat packets of the master controller. If it does not receive the heartbeat packets of the master controller for several consecutive cycles (e.g., 2 cycles), it can determine that the master controller is in an abnormal state and mark the master controller as an abnormal state.
[0034] After determining that the main controller is in an abnormal state, the hardware arbitrator can send an interrupt signal to the backup controller via the interrupt signal line.
[0035] Upon receiving an interrupt signal, the standby controller can determine whether the primary controller has been marked as abnormal. If so, it can determine that the primary controller has not detected a preset number of heartbeat packets from the primary controller, indicating a communication anomaly. Furthermore, the interrupt signal can be detected by the hardware operating signals monitored by the hardware arbitrator, which also indicate a problem. In this case, the standby controller can determine that the primary controller is abnormal and unable to operate. To improve the efficiency of the primary / standby switchover, the standby controller can perform switchover preparation operations, such as preloading relevant software and data. Since the hardware arbitrator is primarily used to control the primary / standby switchover operation, the standby controller can also send an arbitration signal to the hardware arbitrator via the arbitration signal line in this situation.
[0036] After receiving the arbitration signal, the hardware arbitrator can send switching enable signals to both the primary and backup controllers via the switching enable signal line. For example, it can raise the switching enable signal on the switching enable signal line between itself and the primary controller, and lower the switching enable signal on the switching enable signal line between itself and the backup controller. Upon detecting that the switching enable signal is raised, the primary controller can stop management services; upon detecting that the switching enable signal is lowered, the backup controller can perform relevant management operations.
[0037] It should be noted that when the standby controller receives the handover enable signal, the relevant handover preparation operations may not have been completed yet. The standby controller will wait for the handover preparation operations to be completed before performing management operations.
[0038] In the above process, the multi-condition arbitration decision tree for primary / standby switching can be used as follows: Figure 2 As shown, the backup controller determines whether multiple consecutive heartbeat cycles have been lost. If so, and no interrupt signal is received, it can be determined that the hardware operating signals are normal. In this case, the communication of the primary controller can be considered abnormal. Upon receiving an interrupt signal, it can be determined that the hardware operating signals are abnormal. At this point, an arbitration signal can be sent to the hardware arbitrator, which will then perform the primary / backup switchover operation. This avoids dual-primary conflict.
[0039] In the primary / standby switchover system of this application, the hardware arbitrator can monitor the hardware operating signals of the primary controller, and the primary controller can periodically send heartbeat packets not monitored by the hardware arbitrator to the standby controller. After detecting an abnormality in the hardware operating signals, the hardware arbitrator sends an interrupt signal to the standby controller. Upon receiving the interrupt signal and determining that no heartbeat packets have been received for several consecutive cycles, the standby controller can perform a switchover preparation operation and send an arbitration signal to the hardware arbitrator. Upon receiving the arbitration signal, the hardware arbitrator can perform a primary / standby switchover operation, sending switchover enable signals to both the standby and primary controllers. Upon receiving the switchover enable signal, the primary controller stops its management operations. Upon receiving the switchover enable signal, the standby controller starts its management operations.
[0040] In this architecture, the hardware arbitrator determines whether a primary / standby switchover is needed based on hardware operating signals and arbitration signals. The arbitration signal indicates a communication anomaly in the primary controller. Therefore, combining these two pieces of information to determine whether to trigger a primary / standby switchover improves accuracy. Furthermore, in this solution, the standby controller does not directly notify the hardware arbitrator upon detecting a heartbeat packet anomaly. Instead, it notifies the hardware arbitrator only when an interrupt signal is received and the heartbeat packet is abnormal. This is because if the standby controller notifies the hardware arbitrator immediately upon detecting a heartbeat packet anomaly, it would consume more resources under network congestion. Additionally, this solution uses the hardware arbitrator to perform the switchover operation, which offers higher security and avoids the problem of management service interruption due to the standby controller failing to trigger a timely primary / standby switchover. The standby controller's advance switchover preparation improves the efficiency of starting management services; for example, in scenarios such as high-frequency trading in finance and core telecommunications networks, it can reduce the impact on business continuity.
[0041] In some alternative implementations, the controller switching system may also include shared memory, such as... Figure 3 As shown, the shared memory can be a high-speed memory to reduce master-slave switchover time. For example, it can be Static Random-Access Memory (SRAM) with a capacity of 8MB. Both the master controller and the backup controller are connected to the shared memory via a bus. The number of bus bits between the master controller and the shared memory can be greater than or equal to the number of bus bits between the backup controller and the shared memory. For example, the number of bus bits between the master controller and the shared memory can be 32 bits, and the number of bus bits between the backup controller and the shared memory can be 16 bits. The master controller can access the shared memory via a 32-bit bus, and the backup controller can access the shared memory via a 16-bit bus.
[0042] Correspondingly, the main controller can also be used to update its own operating status information to the shared memory.
[0043] The operational status information includes physical environment information, management service session information, and one or more of the following: firmware information and configuration parameters. Physical environment information may include values from various sensors (e.g., temperature sensor values, voltage sensor values) and fan speed. Session information may include network configuration information from the transport layer and service information from the application layer. For example, network configuration information from the transport layer may include network parameters such as communication address, port, serial number, and window number; service information from the application layer may include user identity, user permissions, session identifier, and command progress. Firmware information may include the firmware and its corresponding version number. Configuration parameters may include various types of configuration parameters, such as network configuration parameters, user management parameters, management service and interface parameters, hardware monitoring thresholds (temperature threshold, speed threshold), heartbeat packet period, security settings, and event and log parameters.
[0044] Specifically, the main controller can periodically write its own operating status information and the corresponding periodic timestamp to the shared memory, or it can write the changed operating status information to the shared memory after its own operating status information changes.
[0045] In this way, the recorded operating status information makes it easier to analyze the cause of the main controller's abnormality. Furthermore, after the switchover operation is completed, the standby controller can also perform relevant management operations based on the operating status information recorded in the shared memory.
[0046] In some optional implementations, during the standby controller's switchover preparation operation, the standby controller is specifically used to read operating status information from the shared memory and perform the switchover preparation operation based on the operating status information.
[0047] Specifically, after receiving an interrupt signal and determining that no heartbeat packet has been received from the backup controller for several consecutive cycles, the backup controller can read the operating status information from the shared memory and configure the backup controller based on the operating status information to complete the switchover preparation operation.
[0048] By preparing in advance, we can reduce the time spent waiting for management services, improve the efficiency of switching operations, and further ensure server security.
[0049] In some alternative implementations, the shared memory includes a first storage area, a second storage area, and a third storage area. The first storage area can be used to store physical environment information, the second storage area can be used to store session information for management services, the third storage area can be used to store firmware information, and the fourth storage area can be used to store configuration parameters.
[0050] For the different types of operating status information mentioned above, the update method adopted by the main controller can also be different. Accordingly, the main controller can specifically be used to perform one or more of the following operations: First, the physical environment information in the first storage area is updated periodically.
[0051] Second, after determining that the session state of the management service has changed, obtain the changed session information and update the changed session information to the second storage area.
[0052] Third, after receiving the firmware update command, extract the firmware information from the firmware update command and update the firmware information to the third storage area.
[0053] Fourth, after receiving the configuration modification instruction, update the configuration parameters of the fourth storage area according to the configuration modification instruction.
[0054] Specifically, because physical environment information changes frequently and involves a large amount of data, but has high fault tolerance, it can be periodically updated to the first storage area. For each period's physical environment information, a corresponding timestamp can be recorded. Session information changes less frequently but is of high importance; therefore, the latest session information can be written to the second storage area after a change in session state. The same applies to configuration parameters; modifying any configuration parameter can modify the corresponding configuration parameter in the fourth storage area. Firmware updates are infrequent, but data integrity and security requirements are high. Therefore, upon receiving a firmware update command, firmware information can be extracted and updated to the third storage area. This firmware can include an Error-Correcting Code (ECC). The above data update process can be performed using either overwrite or incremental writes.
[0055] For example, the data storage methods for shared memory can be found in Table 1.
[0056] Table 1
[0057] In Table 1, 0x0000-0x3FFF is the first storage area, 0x4000-0x7FFF is the second storage area, and 0x8000-0xFFFF is the third storage area.
[0058] This approach of updating data in different ways offers greater flexibility, reducing resource waste while ensuring data accuracy and integrity.
[0059] In some alternative implementations, during the handover preparation operation described above, the backup controller may specifically perform one or more of the following operations: First, read the physical environment information from the first storage area.
[0060] Second, read session information from the second storage area.
[0061] Third, read the latest first version number from the third storage area. Also, check if the first version number matches the second version number of the firmware installed. If the first and second version numbers do not match, determine not to read the firmware from the shared storage. Alternatively, if the first and second version numbers do not match, load the firmware corresponding to the first version number from the shared storage. Perform a firmware update operation based on the firmware corresponding to the first version number.
[0062] Fourth, read the configuration parameters from the fourth storage area and perform configuration operations based on the configuration parameters.
[0063] Specifically, after receiving an interrupt signal, the standby controller can read the latest physical environment information from the first storage area, such as the physical environment information with the timestamp closest to the current moment. Then, based on the latest physical environment information, it can perform relevant handover preparation operations. For example, performing relevant handover preparation operations based on the latest physical environment information could be: Based on the latest sampled temperature sensor data, determine the heat dissipation strategy and prepare instructions to adjust the heat dissipation strategy in advance. Alternatively, based on the latest sampled voltage sensor data, determine whether the power supply is abnormal, and if so, preload the protection program.
[0064] After the backup controller receives the switching enable signal, it can directly control the fan speed based on the pre-prepared instructions to adjust the heat dissipation strategy, and perform protection operations based on the pre-loaded protection program. Both the fan speed control operation and the protection operation are management operations.
[0065] The backup controller can also read session information from the second storage area so that after receiving the switchover enable signal, it can re-establish the management session based on the session information. Then, after receiving the switchover enable signal, the backup controller can perform management operations based on the re-established management session.
[0066] Furthermore, the backup controller can first read the latest first version number (e.g., the largest version number) from the third storage area and compare the first version number with the second version number of its own installed firmware. If the two match, it can determine that its current firmware is the latest firmware and there is no need to read the firmware. If the two do not match, it can determine that its current firmware is not the latest firmware, and it can read the firmware corresponding to the first version number from the third storage area and use the firmware to perform a firmware update operation (this operation is an operation after the switch preparation operation). For example, the firmware can be overwritten into its own firmware memory, or the original firmware can be incrementally updated.
[0067] The backup controller can also read various configuration parameters from the fourth storage area and execute corresponding configuration operations based on these parameters. For example, it can configure the heartbeat period, network, management services, and sensor data sampling period. Furthermore, after receiving the switchover enable signal and completing the relevant switchover preparation operations, the backup controller performs management operations according to its configured operating parameters. For instance, it samples the temperature sensor values according to the configured sampling period, and increases the fan speed after determining that the temperature sensor value is greater than a preset temperature threshold.
[0068] In this way, the backup controller can perform firmware updates in advance, allowing it to use the latest firmware for relevant management operations. Furthermore, preparing for the switchover in advance reduces the time required to restore management services and improves controller switchover efficiency.
[0069] In some alternative implementations, the primary controller may encounter an anomaly during firmware updates. To improve the efficiency of the server restoring normal management services, the primary controller can synchronize the update progress with the backup controller during the firmware update process. Accordingly, the backup controller can specifically be used to perform firmware update operations based on the update progress and the firmware corresponding to the first version number.
[0070] Specifically, the primary controller and the backup controller can be equipped with a dedicated transaction coordinator (software). During the firmware update process of the primary controller, the transaction coordinator can synchronize its update progress to the backup controller in real time. After receiving an interrupt signal sent by the hardware arbitrator, the backup controller can perform a firmware update operation based on the update progress recorded by the transaction coordinator and the latest firmware stored in the third storage area (i.e., the firmware corresponding to the first version number).
[0071] In this way, the backup controller performs firmware update operations based on the update progress, rather than updating from scratch, which is more efficient.
[0072] In some optional implementations, the backup controller performs a firmware update operation based on the update progress and the firmware corresponding to the first version number. This may specifically include: Based on the update progress, determine whether the firmware update operation of the main controller is complete. If the firmware update operation of the main controller is not complete, according to the update progress, the firmware corresponding to the first version number is divided into a first firmware file and a second firmware file. The first firmware file is directly written to its own firmware storage. After performing a verification operation on the second firmware file, the verification result is obtained. After the verification result indicates that the second firmware file is correct, the second firmware file is then written to its own firmware storage.
[0073] The first firmware file can be a firmware file that has been verified by the main controller, and the second firmware file can be a firmware file that has not been verified by the main controller.
[0074] Specifically, the update progress can include the update percentage, the firmware update location, etc. For example, the firmware update location is the filename of the target sub-file in the firmware (the first sub-file that has not yet been updated), or it can include the names of the updated and unupdated sub-files. When the update percentage is determined to be 100%, it can be determined that the firmware update operation of the main controller has been completed. At this time, the backup controller directly reads the latest firmware from the third storage area and updates its own firmware.
[0075] If the update ratio is not 100%, it can be determined that the main controller has not completed the firmware update operation. In this case, the backup controller can divide the firmware corresponding to the first version number into a first firmware file and a second firmware file based on the update progress. For example, the target sub-file and all subsequent sub-files can be designated as the second firmware file, and all other sub-files can be designated as the first firmware file. Alternatively, based on the names of the updated sub-files, the sub-files corresponding to the updated sub-file names in the firmware corresponding to the first version number can be identified and directly designated as the first firmware file. Similarly, based on the names of the unupdated sub-files, the sub-files corresponding to the unupdated sub-file names in the firmware corresponding to the first version number can be identified and directly designated as the second firmware file.
[0076] Since the primary controller has already verified the first firmware file, the backup controller does not need to perform further verification and can directly write it into its own firmware storage. For the second firmware file, the backup controller can perform a verification operation to obtain the verification result. If the verification result is successful, the backup controller will then write the second firmware file into its own firmware storage to complete the firmware update operation.
[0077] This reduces the resources and time spent on repeated firmware verification by the backup controller, thereby reducing the recovery time of the management service and improving the startup efficiency of the management service.
[0078] In some alternative implementations, the shared memory can be connected to a supercapacitor, for example, a supercapacitor with a rated operating voltage of 5V and a capacitance of 2F. This allows data to be retained for a period of time (e.g., greater than or equal to 300ms) after a power outage, during which time it can be moved to non-volatile memory, preventing data loss.
[0079] In some alternative implementations, when the heartbeat signal is implemented in the form of a hardware pulse (e.g., the main controller generates it by shaping it with a Schmitt trigger), the backup controller does not need to monitor the heartbeat signal of the main controller. Instead, the main controller monitors it. That is, the operating signals of the main controller monitored by the hardware arbitrator include the power signal, clock signal, watchdog signal, and heartbeat signal. Accordingly, the hardware arbitrator can also be used to directly send switching enable signals to the backup controller and the main controller respectively when one or more hardware operating signals are detected to be abnormal.
[0080] This reduces the resource consumption of the backup controller.
[0081] In some alternative implementations, the controller switching operation can be triggered in different ways, such as being passively triggered by detecting an anomaly in the aforementioned example, or being actively triggered. Accordingly, the controller switching system may also include an operation panel, which can be connected to a hardware arbitrator.
[0082] The hardware arbitrator can also be used to send switching enable signals to the backup controller and the main controller respectively in response to the click operation of the target button on the operation panel.
[0083] Specifically, technicians can click the switch button on the operation panel, and the generated signal can be transmitted to the hardware arbiter. After detecting this signal, the hardware arbiter can send a switch enable signal to the backup controller and the main controller respectively.
[0084] In some alternative implementations, during the handover preparation process described above, when performing configuration operations based on configuration parameters, the backup controller can be specifically used to configure network bandwidth and network speed.
[0085] Specifically, the standby controller can configure its network parameters using preset network bandwidth and speed. This eliminates the need for configuration operations after receiving a handover enable signal, reducing management service waiting time and improving handover efficiency. Configuring network parameters is one operation within the handover preparation process.
[0086] In some alternative implementations, the controller switching system also includes network cables and network components, such as... Figure 4As shown, network cables are connected to the network components, the main controller, and the backup controller, respectively. The network components can be Ethernet physical layer transceivers.
[0087] The backup controller can also be used to obtain the physical communication address of the master controller after receiving a switching enable signal. It writes the physical communication address into its own address register so that the backup controller can perform management operations via the physical communication address.
[0088] Specifically, after receiving the switchover enable signal, the standby controller can read the physical communication address pre-written by the primary controller from the shared memory, and then write the physical communication address into its own address register. In this way, the standby controller can perform relevant management operations through the physical communication address recorded in the address register.
[0089] In some optional implementations, both the primary and backup controllers may include a management engine, various communication interfaces, a security subsystem, a hot standby circuit, a fast wake-up circuit, etc., such as Figure 5 As shown, the main controller is labeled with the management engine, various communication interfaces, and security subsystem, while the backup controller is labeled with the hot standby circuit and the fast wake-up circuit.
[0090] The management engine can be used to run different types of management interfaces, such as the Intelligent Platform Management Interface (IPMI) protocol stack and the Redfish interface, to perform management operations on the server, such as remote power on / off and monitoring hardware health status.
[0091] The communication interface is used to connect various hardware components in the server, such as temperature sensors, voltage sensors, fans, etc., so that the management engine can sample relevant status data through the communication interface (the sampling frequency can be greater than or equal to 100Hz) and perform management operations.
[0092] The security subsystem may include a Trusted Platform Module 2.0 (TPM2.0) and an Advanced Encryption Standard (AES) acceleration engine. TPM2.0 can be used to generate encryption keys, digital certificates and passwords, and verify whether the firmware has been tampered with when the server starts up. The AES acceleration engine can be used to perform symmetric encryption and decryption operations.
[0093] The standby circuit is used to receive heartbeat signals from the main controller, interrupt signals from the hardware arbitrator, determine whether to perform a handover preparation operation, receive the handover enable signal from the hardware arbitrator and transmit the handover enable signal to the fast wake-up circuit, and send an arbitration signal to the hardware arbitrator. The fast wake-up circuit is used to start or stop management services after receiving the handover enable signal.
[0094] In some optional implementations, prior to management operations, the backup controller can also be used to rebuild the network connection between the backup controller and the client based on network configuration information. The management session between the backup controller and the client is then rebuilt based on service information and the network connection.
[0095] Specifically, the standby controller does not use its own network configuration information. Instead, it can directly use the network configuration information read from the second storage area to rebuild Transmission Control Protocol (TCP), User Datagram Protocol (UDP) sockets, etc., in its own network protocol stack. Based on the read network configuration information, it sets the sequence number, window number, etc. After the connection is restored, the standby controller's management service can create a new management session and then fill the relevant parameters recorded in the business information into the corresponding positions of the management session. For example, it marks that user A is logged in with administrator privileges. Finally, it continues to execute the corresponding operations based on the command progress, such as continuing to view the server through KVM and continuing to mount image files.
[0096] In this way, when subsequent data packets arrive from the client, the backup controller's protocol stack will respond normally because the communication address, port, and sequence number all match those before the failure. The client sees only a normal session, which may have a slight delay or retransmission, rather than a connection interruption.
[0097] In some alternative implementations, the backup controller is further configured to: The management sub-services are started in descending order of priority.
[0098] Specifically, the management sub-services of the standby controller, ranked from highest to lowest priority, can include core management services (e.g., basic IPMI functions), user interaction services such as the web interface, and log collection services. During service startup, these management sub-services can be started sequentially in this order, allowing more critical services to be restored first.
[0099] In some optional implementations, during the switching process, the hardware arbitrator can also be used to record logs, which can record the time points of each operation during the switching process, such as the time point when the main controller malfunctions, and calculate the time taken for the primary-to-standby switchover, that is, the time from when the standby controller starts executing the preparation operation to when the management service is fully started. In this way, complete time chain evidence can be provided for subsequent fault analysis.
[0100] In some alternative implementations, during the aforementioned handover preparation process, firmware-related operations can be performed first, and then, after restoring the core management services, the management session can be rebuilt before proceeding with subsequent management operations.
[0101] Embodiments of this application provide a controller switching method, which can be applied to the aforementioned controller switching system, such as... Figure 6 As shown, the specific processing steps of the controller switching method may include: Step 601: The hardware arbitrator monitors one or more hardware operating signals of the main controller.
[0102] Step 602: When the hardware arbitrator detects one or more abnormal hardware operating signals, it sends an interrupt signal to the backup controller.
[0103] Step 603: The main controller periodically sends heartbeat packets to the backup controller.
[0104] Step 604: After receiving an interrupt signal and determining that no heartbeat packet has been received from the master controller for several consecutive cycles, the standby controller performs a handover preparation operation and sends an arbitration signal to the hardware arbitrator.
[0105] Step 605: After receiving the arbitration signal, the hardware arbitrator sends a switching enable signal to the backup controller and the main controller respectively.
[0106] Step 606: After receiving the switching enable signal, the main controller stops the management operation.
[0107] Step 607: After receiving the switching enable signal, the standby controller starts the management operation.
[0108] The specific processing of steps 601 to 607 can be referred to the specific description in the foregoing embodiments, and will not be repeated here.
[0109] In the controller switching method of this application, a hardware arbitrator can monitor the hardware operating signals of the primary controller, and the primary controller can periodically send heartbeat packets not monitored by the hardware arbitrator to the backup controller. After detecting an abnormality in the hardware operating signals, the hardware arbitrator sends an interrupt signal to the backup controller. Upon receiving the interrupt signal and determining that no heartbeat packets have been received for several consecutive cycles, the backup controller can perform a switchover preparation operation and send an arbitration signal to the hardware arbitrator. Upon receiving the arbitration signal, the hardware arbitrator can perform a primary / backup switchover operation, sending switchover enable signals to both the backup and primary controllers. Upon receiving the switchover enable signal, the primary controller stops its management operations. Upon receiving the switchover enable signal, the backup controller starts its management operations.
[0110] In this architecture, the hardware arbitrator determines whether a primary / standby switchover is needed based on hardware operating signals and arbitration signals. The arbitration signal indicates a communication anomaly in the primary controller. Therefore, combining these two pieces of information to determine whether to trigger a primary / standby switchover improves accuracy. Furthermore, in this solution, the standby controller does not directly notify the hardware arbitrator upon detecting a heartbeat packet anomaly. Instead, it notifies the hardware arbitrator only when an interrupt signal is received and the heartbeat packet is abnormal. This is because if the standby controller notifies the hardware arbitrator immediately upon detecting a heartbeat packet anomaly, it would consume more resources under network congestion. Additionally, this solution uses the hardware arbitrator to perform the switchover operation, which offers higher security and avoids the problem of management service interruption due to the standby controller failing to trigger a timely primary / standby switchover. The standby controller's advance switchover preparation improves the efficiency of starting management services; for example, in scenarios such as high-frequency trading in finance and core telecommunications networks, it can reduce the impact on business continuity.
[0111] In some optional implementations, the controller switching system further includes shared memory; correspondingly, the controller switching method further includes: The main controller updates its own operating status information to the shared memory.
[0112] In some alternative implementations, the standby controller performs a switchover preparation operation, including: The backup controller reads the operating status information from the shared memory; based on the operating status information, it performs the switchover preparation operation.
[0113] In some optional implementations, the shared memory includes a first storage area, a second storage area, and a third storage area. The running status information includes physical environment information, session information of the management service, and firmware information, which includes firmware and version number. The main controller updates its own operating status information to the shared memory, including: The physical environment information in the first storage area is updated periodically; After determining that the session state of the management service has changed, obtain the changed session information; Update the changed session information to the second storage area; After receiving the firmware update command, extract the firmware information from the firmware update command. Update the firmware information to the third storage area.
[0114] In some alternative implementations, the backup controller reads operational status information from shared memory, including: Read physical environment information from the first storage area; Read session information from the second storage area; Read the latest version number from the third storage area; In addition, it checks whether the first version number matches the second version number of the firmware it has installed; If the first version number and the second version number are inconsistent, it is determined that the firmware will not be read from the shared storage.
[0115] In some alternative implementations, the controller switching method further includes: If the backup controller determines that the first version number and the second version number are inconsistent, it loads the firmware corresponding to the first version number from the shared memory.
[0116] In some optional implementations, the standby controller performs a switchover preparation operation based on the operating status information, including: Based on the firmware corresponding to the first version number, a firmware update operation is performed, which is one of the operations in the switch preparation operation.
[0117] In some alternative implementations, the controller switching method further includes: During the firmware update process, the main controller synchronizes the update progress with the backup controller. Based on the firmware corresponding to the first version number, perform a firmware update operation, including: Therefore, the backup controller performs a firmware update operation based on the firmware corresponding to the first version number and the update progress.
[0118] In some optional implementations, the backup controller performs a firmware update operation based on the firmware corresponding to the first version number and the update progress, including: Based on the update progress, determine whether the firmware update operation of the main controller has been completed; If it is determined that the firmware update operation of the main controller is not completed, the firmware corresponding to the first version number is divided into a first firmware file and a second firmware file according to the update progress. The first firmware file is the firmware file that the main controller has completed verification, and the second firmware file is the firmware file that the main controller has not completed verification. The first firmware file is written directly to its own firmware storage; After performing a verification operation on the second firmware file, the verification result is obtained; After the verification result indicates that the second firmware file is correct, the second firmware file is written to its own firmware storage to complete the firmware update operation.
[0119] In some alternative implementations, the controller switching system also includes network cables and network components, with the network cables connected to the network components, the main controller, and the backup controller, respectively. Controller switching methods also include: After receiving the switching enable signal, the standby controller obtains the physical communication address of the master controller and writes the physical communication address into its own address register so that the standby controller can perform management operations through the physical communication address.
[0120] In some optional implementations, session information includes network configuration information at the transport layer and service information at the application layer; the controller switching method further includes: Based on the network configuration information, the backup controller rebuilds the network connection between the backup controller and the client; based on the service information and the network connection, it rebuilds the management session between the backup controller and the client.
[0121] In some alternative implementations, the controller switching method further includes: The backup controller starts each management sub-service in descending order of priority.
[0122] In some alternative implementations, the hardware arbitrator monitors the main controller's operating signals, including power signals, clock signals, and watchdog signals.
[0123] In some alternative implementations, the operating signals of the main controller monitored by the hardware arbitrator include power signals, clock signals, watchdog signals, and heartbeat signals; Controller switching methods also include: When the hardware arbitrator detects one or more abnormal hardware operating signals, it directly sends a switching enable signal to the backup controller and the main controller respectively.
[0124] In some optional implementations, the controller switching system further includes an operation panel; the controller switching method further includes: The hardware arbitrator responds to the click operation of the target button on the operation panel by sending a switching enable signal to the backup controller and the main controller respectively.
[0125] In some alternative implementations, the shared memory is connected to a supercapacitor.
[0126] In some alternative implementations, both the main controller and the backup controller are connected to the shared memory via a bus, and the number of bus bits between the main controller and the shared memory is greater than or equal to the number of bus bits between the backup controller and the shared memory.
[0127] In some alternative implementations, the main controller and the backup controller are located in the same power domain, and the power domain supplies power only to the main controller and the backup controller.
[0128] For a detailed description of the controller switching method implementation, please refer to the aforementioned description of the controller switching system, which will not be repeated here.
[0129] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.
[0130] Embodiments of this application also provide an electronic device, such as... Figure 7 As shown, the device includes a memory 10 and a processor 20. The memory 10 stores a computer program, and the processor 20 is configured to run the computer program to perform the steps in any of the controller switching method embodiments described above. The electronic device can be any of the aforementioned hardware arbitrator, main controller, and backup controller, or it can be a server containing a controller switching system, etc.
[0131] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the controller switching method embodiments described above when running.
[0132] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.
[0133] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the controller switching method embodiments described above.
[0134] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the controller switching method embodiments described above.
[0135] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0136] The controller switching system, method, electronic device, storage medium, and program product provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.
Claims
1. A controller switching system, characterized in that, include: A hardware arbitrator is used to monitor one or more hardware operating signals of the main controller. When an abnormality is detected in one or more of the aforementioned hardware operating signals, an interrupt signal is sent to the backup controller; The main controller is used to periodically send heartbeat packets to the backup controller; The backup controller is configured to perform a switchover preparation operation and send an arbitration signal to the hardware arbitrator after receiving the interrupt signal and determining that it has not received the heartbeat packet sent by the main controller for several consecutive cycles. The hardware arbitrator is also used to send a switching enable signal to the backup controller and the main controller respectively after receiving the arbitration signal; The main controller is also configured to stop management operations upon receiving the switching enable signal; The backup controller is also used to initiate management operations after receiving the switching enable signal.
2. The controller switching system according to claim 1, characterized in that, The controller switching system also includes a shared memory; The main controller is also used for: It updates its own operating status information to the shared memory.
3. The controller switching system according to claim 2, characterized in that, The backup controller is specifically used for: Read the running status information from the shared memory; Based on the operating status information, perform the switching preparation operation.
4. The controller switching system according to claim 2 or 3, characterized in that, The shared memory includes a first storage area, a second storage area, and a third storage area. The running status information includes physical environment information, session information of the management service, and firmware information, wherein the firmware information includes firmware and version number. The main controller is specifically used for: The physical environment information in the first storage area is periodically updated; After determining that the session state of the management service has changed, obtain the changed session information; Update the changed session information to the second storage area; After receiving the firmware update instruction, the firmware information is extracted from the firmware update instruction. Update the firmware information to the third storage area.
5. The controller switching system according to claim 4, characterized in that, The backup controller is specifically used for: Read the physical environment information from the first storage area; Read the session information from the second storage area; Read the latest first version number from the third storage area; In addition, it identifies whether the first version number and the second version number of the firmware it has installed are consistent; If the first version number and the second version number are determined to be inconsistent, it is determined not to read the firmware from the shared memory.
6. The controller switching system according to claim 5, characterized in that, The backup controller is further configured to: If it is determined that the first version number and the second version number are inconsistent, the firmware corresponding to the first version number is loaded from the shared memory.
7. The controller switching system according to claim 6, characterized in that, The backup controller is specifically used for: Based on the firmware corresponding to the first version number, a firmware update operation is performed, wherein the firmware update operation is one of the operations in the switch preparation operation.
8. The controller switching system according to claim 5, characterized in that, The main controller is also used for: During the firmware update process, the update progress is synchronized with the backup controller; Therefore, the backup controller is specifically used for: Based on the firmware corresponding to the first version number and the update progress, a firmware update operation is performed.
9. The controller switching system according to claim 8, characterized in that, The backup controller is specifically used for: Based on the update progress, determine whether the firmware update operation of the main controller is complete; If it is determined that the firmware update operation of the main controller is not completed, the firmware corresponding to the first version number is divided into a first firmware file and a second firmware file according to the update progress. The first firmware file is the firmware file that the main controller has completed verification, and the second firmware file is the firmware file that the main controller has not completed verification. The first firmware file is written directly to its own firmware storage; After performing a verification operation on the second firmware file, the verification result is obtained; After the verification result indicates that the second firmware file is correct, the second firmware file is written to its own firmware storage to complete the firmware update operation.
10. The controller switching system according to claim 4, characterized in that, The controller switching system also includes a network cable and a network component, the network cable being connected to the network component, the main controller, and the backup controller respectively; The backup controller is further configured to: Upon receiving the switching enable signal, the physical communication address of the main controller is obtained; The physical communication address is written into its own address register so that the backup controller can perform the management operation through the physical communication address.
11. The controller switching system according to claim 10, characterized in that, The session information includes network configuration information at the transport layer and service information at the application layer; the backup controller is further configured to: Based on the network configuration information, the network connection between the backup controller and the client is rebuilt; Based on the business information and the network connection, rebuild the management session between the backup controller and the client.
12. The controller switching system according to any one of claims 1 to 3, characterized in that, The backup controller is further configured to: The management sub-services are started in descending order of priority.
13. The controller switching system according to any one of claims 1 to 3, characterized in that, The operating signals of the main controller monitored by the hardware arbitrator include power signals, clock signals, and watchdog signals.
14. The controller switching system according to claim 1, characterized in that, The operating signals of the main controller monitored by the hardware arbitrator include power signal, clock signal, watchdog signal, and heartbeat signal; The hardware arbitrator is also used for: When one or more of the hardware operating signals are detected to be abnormal, a switching enable signal is sent directly to the backup controller and the main controller respectively.
15. The controller switching system according to any one of claims 1 to 3, characterized in that, The controller switching system also includes an operation panel; the hardware arbitrator is further used for: In response to the click operation of the target button on the operation panel, the switching enable signal is sent to the backup controller and the main controller respectively.
16. The controller switching system according to claim 2 or 3, characterized in that, The shared memory is connected to the supercapacitor.
17. The controller switching system according to claim 2 or 3, characterized in that, Both the main controller and the backup controller are connected to the shared memory via a bus, and the number of bus bits between the main controller and the shared memory is greater than or equal to the number of bus bits between the backup controller and the shared memory.
18. The controller switching system according to any one of claims 1 to 3, characterized in that, The main controller and the backup controller are located in the same power domain, and the power domain only supplies power to the main controller and the backup controller.
19. A controller switching method, characterized in that, include: The hardware arbitrator monitors one or more hardware operating signals of the main controller. When an abnormality is detected in one or more of the aforementioned hardware operating signals, an interrupt signal is sent to the backup controller; The main controller periodically sends heartbeat packets to the backup controller; Upon receiving the interrupt signal and determining that it has not received the heartbeat packet sent by the main controller for several consecutive cycles, the backup controller performs a switchover preparation operation and sends an arbitration signal to the hardware arbitrator. After receiving the arbitration signal, the hardware arbitrator sends a switching enable signal to the backup controller and the main controller respectively. Upon receiving the switching enable signal, the main controller stops its management operations. Upon receiving the switching enable signal, the backup controller initiates management operations.
20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the controller switching method as described in claim 19.