JP2000305773A - Remote execution method of non-stop program change of disk controller - Google Patents

Abstract

(57) [Summary] In a disk system including a plurality of disk controllers, a conventional method of changing a non-stop program is prevented from being performed by a third party without change authority. An operator who operates a maintenance terminal is firstly guaranteed to be a person who is allowed to change a program so that the program can be changed safely even for a remote operation, and the program change is started. It is guaranteed that the instruction from the instruction means is an instruction of a person who is permitted to change the program, and further, that the stored new program is a program transmitted by a person who is permitted to change the program.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for remotely changing a non-stop program of a disk controller and a disk system, and more particularly to realizing the change of a non-stop program of a disk system from a remote maintenance terminal. It is about.

[0002]

2. Description of the Related Art (1) Storage management in a multi-storage environment and a wide-area distributed storage environment In recent years, the demand for large-scale storage by data warehouse applications and the like has led to the need for a single storage in the center, a large number of disk controllers and disks. We are moving to a multi-storage environment with drives. Further, with the spread of networks, the mutual use of data between centers scattered among each other has become active.

In order to manage a large number of storages and storages dispersed and distributed on a network,
Since the management cost increases in the conventional storage management method, a method of collectively managing a large number of storages in a distributed storage environment on a network is very important.

(2) Non-stop program change of the disk controller One of the functions required for storage management is to change the disk control program of the disk controller of the storage,
There is a function to update without stopping all input / output and command processing from the host. Hereinafter, unless otherwise specified, such a function will be referred to as "non-stop program change of the disk controller".

[0005] As a known example of the non-stop program changing method of the disk controller, there is Japanese Patent Application Laid-Open No. 7-306844. This publication discloses a technique related to a non-stop program change method of a multiprocessor system and a technique related to a multiprocessor system that can change a program executed by the processor group without stopping the entire processor group.

(3) Conventional example of non-stop program change method Next, as a conventional example, according to the non-stop program change method disclosed in the above-mentioned gazette, two disk control units A and B of a certain disk controller are used. Make program changes. For details of the method, refer to the publications of known examples.

(3.1) Configuration of Conventional Example First, a configuration of a conventional example will be described with reference to FIG.

[0008] The disk control device 10000 shown in FIG.
Is a disk control unit A00001 that performs disk control
, A disk control unit B01001, a shared memory 02000 shared between the disk control units, and a program storage unit 03000 that holds a control program, and controls the drive 04000. In addition, it is connected to a maintenance terminal 05000 for instructing a program change via the maintenance terminal interface 06000. The disk control unit A00001 includes a disk control processor 00002 for performing disk control, a local memory 00003, and a program change processing unit 000 for performing a program change process.
04, host connection means 00005 for exchanging input / output requests and the like of the host, maintenance terminal connection means 00006 for exchanging data commands with the maintenance terminal, and a disk control unit for connecting each means in the disk control unit A00001. It comprises an internal bus 00007.

The disk control unit B01001 has a control processor 0100 like the disk control unit A00001.
2. Local memory 01003, program change processing means 01004, host connection means 10005, maintenance terminal connection means 01006, disk control unit internal bus 01
007. In the shared memory 02000,
A cluster allocating unit 02001 for grouping a plurality of disk control units for performing a program change in units called “clusters”, and a distributed processing mode control unit 02 for controlling an operation state of each cluster during a program change process
002 exists. The maintenance terminal 05000 holds a program change start instruction unit 05001 for instructing the start of the program change process. The above is the configuration of the conventional example.

(3.2) Procedure of Non-Stop Program Change Processing in Conventional Example Next, with the above configuration, the program of the disk control unit A00001 is changed without stopping the disk device 10000 entirely, and then the disk control unit B010001 is changed. The procedure for changing the program will be described with reference to FIG. 9 which is a main flowchart. In showing this procedure, the clustering described in section (3.1) is based on the assumption that the disk control unit A00001 is in cluster 1 and the disk control unit B01001 is in cluster 2
And

(3.2.1) Non-stop program change processing procedure First, the maintenance terminal 05000 and the disk control unit A0000
It communicates with the first program change processing means 00004 and transmits data of a new program (hereinafter referred to as a new program) (step 11010). The program processing means 00004 stores the new program in the program storage means 03000 (step 11020). Maintenance terminal 05
000, the program change start instructing means 05001 instructs the program change processing means 00004 to start the program change (step 11030).

Next, program change processing means 00004
Sets the shared memory 02000 so that each cluster independently performs input / output processing (step 11040). After the setting, the program change processing means 00004
(Step 11)
050). Details of the intra-cluster program change processing will be described later. After the completion of the intra-cluster program change processing, the program change processing means 00004 instructs the program change processing means 01004 to execute the intra-cluster program change processing of the cluster 2 (step 11060).

[0013] The program change processing means 01004 performs an intra-cluster program change processing of the cluster 2 (step 11070).
The program change processing means 01004 confirms the end of the program change processing in the cluster 2 (step 11080).

The program change processing means 00004 makes settings in the shared memory 02000 to release the limitation that each cluster independently performs input / output processing (step 1109).
0) Then, the program change start instructing means 05001 is notified of the completion of the program change processing (step 1).
1100). The above is the non-stop program change processing procedure.

(3.2.2) Intra-cluster program change processing procedure Here, the procedure of the above-described intra-cluster program change processing will be described with reference to FIG. 9 of a flowchart. In FIG. 9, reference numerals are not specified, but in the following description,
The intra-cluster program change processing of the cluster 1 to which the disk control unit A00001 of the conventional example configuration belongs is used as a specific example.

First, the disk control processor 00002
Checks whether there are any outstanding I / O requests (step 11
210). Thereafter, the disk control processor 00002 instructs the host connecting means 00005 to inhibit the host from accepting a new input / output request (step 11220). The disk control processor 00002 is a program change processing unit 0
0004 is notified that the program change preparation is completed (step 11230). Program change processing means 0
0004 instructs the disk control processor 00002 to perform a program change maintenance operation (step 11240).
The disk control processor 00002 stores the new program in the local memory 00003 (step 112).
50). After operating with the new program stored in the local memory, the disk control processor 00002 instructs the host connection means 00005 to resume accepting host input / output requests (step 11260). The above is the procedure of the intra-cluster program change processing.

[0017]

According to the above-described conventional non-stop program changing method, the disk control program can be changed without stopping the operation of the disk control device entirely. However, there are the following problems in applying the known technology to collective management in a distributed storage environment.

(Problem 1) There is no means for guaranteeing the safety of the operation of changing the program. Here, safety is considered from the following viewpoints. To guarantee that the operator operating the maintenance terminal is a person who is permitted to change the program, to guarantee that the instruction from the program change start instructing means is the instruction of the person who is permitted to change the program, and to store the information. This is to ensure that the new program is a program sent by a person who is allowed to change the program.

There is no consideration for the following problems.

(Problem 2) Since there is no means in both the program change start instructing means and the program change means for setting whether or not to execute the program change of each cluster, the operation of changing the program only in a specific cluster is performed. Can not do it.

(Problem 3) A processor different from the disk control processor of the disk control unit is assumed as the program change processing means. However, adding a separate processor other than the control processor increases the cost of the entire disk controller.

Therefore, an object of the present invention is to firstly assure the safety of a program change operation by a disk control device and a program change start instructing means, so that a non-stop program change of a safe disk device from a maintenance terminal can be performed. It is to realize the processing.

A second object is to increase the availability of the non-stop program change method by making it possible to select a cluster for executing the non-stop program change processing.

A third object of the present invention is to reduce the cost of the control device and, consequently, the cost of the disk system by making the disk control processor of the disk control unit usable as the program change processing means.

[0025]

Means for Solving the Problems To solve the above-mentioned problems and objects, the present invention adds the following means.

For the first problem, in order to ensure that the operator operating the maintenance terminal is a person who is permitted to change the program, the operator sets a password to instruct the program change process. User authentication is performed by providing a program change authentication unit in the disk system when necessary. Also, in order to ensure that the instruction from the program change start instructing means is an instruction of a person who is permitted to change the program, the disk system transmits the program change remote operation program to the maintenance terminal, and the program is transmitted to the maintenance terminal. The communication between the maintenance terminal and the disk control unit is guaranteed by executing the program on the remote program execution means.
Further, in order to ensure that the new program to be stored is a program transmitted by a person who is permitted to change the program, the maintenance program transmits new program transmission confirmation information from the maintenance terminal to the disk system in the remote program described above. This is guaranteed by comparing the new program received by the change authentication means with the information and confirming that they match.

For the second problem, a program change management means for setting whether or not to execute the program change of each cluster is newly provided, and information relating to the execution of the program change is set from the maintenance terminal to the means. By that
The operation of changing the program only for a specific cluster can be performed.

In order to solve the third problem, for example, the disk control processor of the disk control unit A serves as a program change processing unit of the other disk control unit B.
However, during the non-stop program change processing of the disk control unit B, the disk control unit A needs to respond to an input / output request or the like from a normal host. However, in order to solve this problem, in order to prevent the inability to respond to the input / output request from the normal host at all, a new means for executing another system program change processing is newly provided, and the input / output request is processed by the means. By determining whether to perform the program change processing of another system, the performance of the input / output request of the host is prevented from being reduced as much as possible.

[0029]

DESCRIPTION OF THE PREFERRED EMBODIMENTS (1) Embodiment 1 In this embodiment, in order to solve the first problem, a program change authentication means and a program change remote operation program are newly provided in a disk control unit of a disk control device. .
The present invention shows that the program can be changed without stopping the disk control device as in the conventional example, and that the program can be safely changed from a remote place.

(1.1) Configuration of Embodiment 1 The configuration of this embodiment will be described below with reference to FIG. The differences from the conventional example are as follows. First, the disk control unit A0
0001, a program change authenticating means 00008 for performing an authentication operation for assuring that the operator operating the maintenance terminal is a person who is permitted to change the program, and an instruction from the program change start instructing means permits the program change. In order to ensure that the instruction is issued by the user, the disk system adds a program change processing remote execution program communication means 00009 for transmitting the program change remote operation program to the maintenance terminal.

Similarly, the disk control unit B10001 additionally includes a program change authentication unit 10008 and a program change processing remote execution program communication unit 00009. Program change processing remote execution program holding means for holding a program change processing remote execution program to be transmitted to the maintenance terminal on the shared memory 02003
And a program change authentication information holding unit 02004 for holding the authentication information of the operator of the maintenance terminal 05000. The maintenance terminal 05000 has a disk controller 100
Remote program executing means 05002 for executing the program for executing the remote program change processing received from 00.
Add. The above is the configuration of the first embodiment.

(1.2) Description of Procedure for Changing Nonstop Program in First Embodiment Next, the procedure of changing a nonstop program in the present embodiment will be described with reference to the main flowchart of FIG. Hereinafter, only the steps newly added to the conventional non-stop program change processing will be described.

First, the maintenance terminal 05000 requests the program change processing remote execution program communication means 00009 of the disk control unit A00001 to transmit the program change processing remote execution program to be executed on the remote program execution means 05002 (step 1100
5). The disk control device 10000 has a maintenance terminal 050
A program change processing remote execution program is transmitted to the program 00 (step 11006). Maintenance terminal 05000
Indicates the received program change processing remote execution program 0
The authentication information of the operator of the program change process is transmitted to the program change authentication means 00008 of the disk control unit A00001 via the 5003 (step 110).
07).

Here, as the authentication information, for example, FIG.
It is conceivable to use a set of a predetermined user name and password such as described above. Disk control unit A00
The program change authentication means 00008 of step 001 stores the authentication information transmitted in step 11007 in the shared memory 02
000 of the program change authentication information holding means 02004, and a list of user names and passwords permitted to operate as shown in FIG. 11 is checked. If operation is possible, the process proceeds to the next step (step 11008). If the operation is not possible, the maintenance terminal is notified, and the process ends without performing the subsequent steps of the non-stop program processing.

After the end of step 11010, the maintenance terminal 05
000 transmits the new program authentication information transmitted to the program change authentication means 00008 of the disk control unit A00001 (step 11011). The authentication information of the new program includes, for example, a program checksum code. The program change authentication means 00008 includes: the authentication information of the received new program;
The information obtained from the received new program is compared and confirmed (step 11012). If it is confirmed that the new program has been transmitted from the maintenance terminal 05000, steps 11020 and subsequent steps are performed as in the conventional example. The above is the non-stop program change processing procedure of the first embodiment.

As described above, according to the present embodiment, the present invention shows that the program can be changed without stopping the disk controller as in the conventional example, and furthermore, the program can be safely executed from a remote place. There is an effect that the change can be realized.

(2) Embodiment 2 This embodiment solves the first problem similarly to the first embodiment. The difference from the first embodiment is that a program change authentication unit and a program change remote operation program are not provided in the disk control unit of the disk control unit, but a program change management device including these units is newly added. It is.

This shows that the same processing as in the first embodiment can be realized without holding the program change authentication means and the program change remote control program in the disk device.

(2.1) Configuration of Embodiment 2 FIG. 3 shows the configuration of this embodiment. The difference from the first embodiment is that a new program change management device 20000 is provided. The program change management device 20000 includes a control processor 20002 and a program change authentication unit 20008 for performing an authentication operation for ensuring that an operator operating the maintenance terminal is a person who is permitted to change the program.
And a program change processing remote execution for the disk system to transmit a program change remote operation program to the maintenance terminal in order to ensure that the instruction from the program change start instructing means is an instruction of a person permitted to change the program. Program communication means 200009, program change processing remote execution program holding means 22003 for holding a program change processing remote execution program to be transmitted to the maintenance terminal, and program change authentication information holding for holding the authentication information of the operator of the maintenance terminal 05000 Means 2200
4 and a maintenance terminal connection means 20006, and is connected to the maintenance terminal interface 06000 via the maintenance terminal connection means 20006. The above is the configuration of the second embodiment.

(2.2) Description of Procedure for Changing Nonstop Program in Second Embodiment Next, the process of changing the nonstop program in the present embodiment will be described. In the present embodiment, in the main flow diagram of the first embodiment, steps 11005 to 11
The processing up to 012 can be realized by executing between the maintenance terminal 05000 and the program change management device 20000, and the subsequent steps between the program change management device 20000 and the disk control device 10000.

As described above, according to this embodiment, the present invention has the same effects as those of the first embodiment. Further, the maintenance terminal does not need to communicate with all the disk control devices, and there is an effect that the non-stop program change processing of all the disk control devices can be realized only by communicating with the program change management device.

(3) Embodiment 3 In this embodiment, in order to solve the second problem, a program change management means for setting whether or not to execute the program change of each cluster in the disk control unit of the disk control device is newly added. This means that an operation of changing a program only in a specific cluster can be realized by setting information relating to the execution of the program change from the maintenance terminal to the means.

(3.1) Configuration of the Third Embodiment The configuration of the third embodiment will be described below with reference to FIG. The differences from the conventional example are as follows. Disk control device 1000
0, a new program change management unit 02010 for setting whether or not to execute the program change of each cluster is newly provided in the shared memory 02000. The above is the configuration of the third embodiment.

(3.2) Description of Procedure for Changing Nonstop Program in Third Embodiment Next, the procedure of changing a nonstop program in the present embodiment will be described with reference to a main flowchart of FIG. Hereinafter, only the steps newly added to the conventional non-stop program change processing will be described.

First, the maintenance terminal 05000 instructs the program change management means of all the disk controllers to change the state shown in FIG.
The program change management information as shown in FIG. 2 is transmitted (step 11003). The disk controller 10000
Referring to the program change management means, it is confirmed whether or not the own disk controller is a program change target (Step 1)
1004). If it is a change target, the process from step 11010 is processed; otherwise, the non-stop program change process ends. The non-stop program changing method according to the third embodiment has been described above.

As described above, according to the present embodiment, in the present invention, it is possible to set whether or not to execute the program change of each cluster, and it is possible to realize an operation of changing the program only for a specific cluster. There are coins.

(4) Embodiment 4 This embodiment solves the second problem as in the case of the third embodiment. The difference from the third embodiment is that a program change management device having this means is newly added instead of providing a program change management device in the disk control unit of the disk control device.

It is shown that by adding a program change management device, the same processing as in the third embodiment can be realized without providing a program change management means in the disk device.

(4.1) Configuration of Embodiment 4 FIG. 6 shows the configuration of this embodiment. The difference from the third embodiment is that a new program change management device 20000 is provided. The program change management device 20000 includes a control processor 20002, a program change management unit 22010 for setting whether or not to execute a program change of each cluster, and a maintenance terminal connection unit 20006. Connect to interface 06000. The above is the configuration of the fourth embodiment.

(4.2) Description of Procedure for Changing Nonstop Program in Fourth Embodiment Next, a process of changing a nonstop program in the present embodiment will be described. In the present embodiment, a description will be given of changes of the third embodiment in the main flow chart 5.

In step 11003, the maintenance terminal 0
5000 transmits to the program change management device 20000. In step 11004, the program change management device 20000 performs a confirmation operation on all disk array control devices.

As described above, according to this embodiment, the present invention has the same effects as the third embodiment. Further, there is an effect that the maintenance terminal does not need to communicate with all the disk control devices, but only needs to communicate with the program change management device.

(5) Embodiment 5 In this embodiment, in order to solve the third problem, the disk control processor of the disk control unit A controls the other disk (hereinafter referred to as "other system"). The part B serves as a program change processing means. However, in order to prevent the performance of the disk I / O from deteriorating due to the management of the program change of the other system, a new system program change processing execution judgment means is newly provided, and the I / O request is processed by the means. By determining whether or not to execute the system program change processing, the performance of the input / output request of the host is prevented from being reduced as much as possible.

(5.1) Configuration of Embodiment 5 FIG. 7 shows the configuration of this embodiment. The difference from the conventional example is
It is as follows. First, the disk control unit A00001
At the time of another system program change processing, by judging whether to process the I / O request or to execute the other system program change processing, the performance of the I / O request from the host is not reduced as much as possible. Another system program change processing execution determination means 00010 is added. Then, the program change processing means 00004 is deleted. Disk control unit B1000
Similarly, the other system program change processing execution determining means 10010 is added to
04 is deleted. The above is the configuration of the present embodiment.

(5.2) Description of Procedure for Changing Nonstop Program in Embodiment 5 The procedure for changing a nonstop program in the present embodiment is a flow chart of a main flow diagram in FIG. This will be described with reference to the drawings.

The points of this embodiment different from FIGS. 9 and 10 are as follows.
The disk control unit B, in which the program change processing unit 00004 for performing the non-stop program change processing of the disk control unit A00001 is assigned to a different cluster,
10001 disk control processor 10002. Therefore, in the flow of FIG. 9 and FIG.
Disk change unit B
It may be read by the disk control processor 10002 of 10001.

However, in the configuration of the conventional example, as described above, when an input / output request is received from the host during the execution of the program change processing of another system, or when the input / output request is processed, the program change of the other system is performed. There is no means for making a determination when returning to the process. Therefore, for example, based on the number of unprocessed input / output processes, a threshold value is set in advance in the other system program change process execution determination unit. By providing this means, the present invention based on this embodiment can be implemented by, for example, the disk control unit B100.
01 has the effect that it is possible to process both the program change process of the other system and the input / output request from the host of the own system based on the preset threshold value.

[0058]

According to the remote control method and the disk system of the non-stop program change of the disk control device of the present invention, it is possible to prevent a third party without a change authority from executing the conventional non-stop program change method, The program can be changed safely even if the operation is performed from a remote place. Further, the non-stop program change method can be applied to a specific disk control device from among a large number of disk control devices, and the availability of the non-stop program change method can be increased. Further, the third object is that the control processor of the disk control unit serves as a program change unit, and the third object is to enable use of the disk control processor of the disk control unit as a program change processing unit, thereby reducing the cost of the control device and the disk system. Can be reduced.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a disk system according to a first embodiment of the present invention.

FIG. 2 is a main flowchart of a non-stop program changing method according to the first embodiment;

FIG. 3 is a configuration diagram of a disk system according to a second embodiment of the present invention.

FIG. 4 is a configuration diagram of a disk system according to a third embodiment of the present invention.

FIG. 5 is a main flowchart of a non-stop program changing method according to a third embodiment.

FIG. 6 is a configuration diagram of a disk system according to a fourth embodiment of the present invention.

FIG. 7 is a configuration diagram of a disk system according to a fifth embodiment of the present invention.

FIG. 8 is a configuration diagram of a conventional disk system.

FIG. 9 is a main flow chart of a conventional non-stop program changing method.

FIG. 10 is a main flow diagram of a conventional example of a method for changing a program in a cluster.

FIG. 11 is a diagram illustrating an example of program change authentication information according to the first and second embodiments.

FIG. 12 is a diagram illustrating an example of program change management information according to the third and fourth embodiments.

[Explanation of symbols]

10,000, 30000, 40000: disk controller, 0000, 01001: disk controller, 000
02,010002: Disk control processor, 0000
3,01003: Local memory, 00004,010
04: program changing means, 00005, 10005 ...
Host connection means, 00006, 01006, 20006
... Maintenance terminal connection means, 00007, 01007 ... Disk control unit internal bus, 00008, 01008, 2000
8. Program authentication means, 00009,01009,2
0009: Program change processing remote execution program communication means, 00010,01010: Other system program change processing execution determination means, 02000: Shared memory, 02001
... cluster allocation means, 02002 ... distributed processing mode control means, 02003, 22003 ... program change processing remote execution program holding means, 02004, 2200
4: Program change authentication information holding means, 02010, 2
2010: Program change management means, 03000: Program storage means, 04000: Disk drive, 05
000: maintenance terminal, 05001: program change start instruction means, 05002: remote program execution means, 050
03: received program change processing remote execution program, 06000: maintenance terminal interface, 20000
... Program change management device 20002 ... Control processor.

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Takashi Oeda 1099 Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture Inside Hitachi, Ltd.System Development Laboratory (72) Inventor Ikuya Yagisawa 1099, Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture (72) Inventor Jun Matsumoto 1099 Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture, Japan Incorporated Hitachi System Development Laboratories (72) Yasuyuki Ajimatsu 1099, Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture (72) Inventor Kenichi Moto 2880 Kozu, Odawara-shi, Kanagawa Prefecture F-term (reference) 5B014 EB04 FA11 FB03 5B076 FB02 FB05 5B089 JA34 JB07 KA17

Claims (1)

[Claims] 1. A non-stop program change of a disk control device for updating a disk control program of a disk control device in a disk system without completely stopping input / output and command processing from a host from a remote maintenance terminal. In the remote control method of the non-stop program change of the disk control device to be realized, the maintenance terminal requests the disk control device to transmit a program for executing the program change process on the maintenance terminal, and the disk control device transmits the program. By using the program change processing remote execution program, the operator who operates the maintenance terminal is assured that the operator is permitted to change the program, and the maintenance terminal can control the disk via the received program change processing remote execution program. The program change authentication means of the device The authentication information of the maintenance terminal by authenticating the operator on the maintenance terminal by comparing the transmitted authentication information with the program change authentication information held in the program change authentication information holding means, In order to authenticate the new control program sent from the maintenance terminal, the authentication information of the new program sent to the program change authentication means is sent, so that the stored new program is the program sent by the person permitted to change the program. A method for remotely executing a non-stop program change of a disk control device, wherein the safety of a program change operation from a maintenance terminal at a remote place is ensured by assuring the above.