Secure migratable architecture having high availability

• US 9,760,291 B2
• Filed: 02/19/2016
• Issued: 09/12/2017
• Est. Priority Date: 06/30/2014
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Beale, Andrew Ward, Strong, David
• Primary Examiner(s): Abbaszadeh, Jaweed A
• Assistant Examiner(s): Derose, Volvick
• Application Number:
  US15/048,154
• Publication Number:
  US 20160371101A1
• Time in Patent Office: 571 Days
• Field of Search: 713 1
• CPC Class Codes: G06F 12/0223 User address space allocation, e.g. contiguous or non contiguous base addressing
• CPC Class Codes: G06F 12/08 in hierarchically structured memory systems, e.g. virtual memory systems
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 2212/1004 Compatibility, e.g. with legacy hardware
• CPC Class Codes: G06F 2212/1016 Performance improvement
• CPC Class Codes: G06F 2212/1032 Reliability improvement, data loss prevention, degraded operation etc
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/151 Emulated environment, e.g. virtual machine
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0617 in relation to availability
• CPC Class Codes: G06F 3/062 Securing storage systems
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0656 Data buffering arrangements
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0664 : at device level, e.g. emulation of a storage device or system
• CPC Class Codes: G06F 3/067 : Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 3/0673 : Single storage device
• CPC Class Codes: G06F 8/65 : Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4401 : Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/455 : Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 : Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5016 : the resource being the memory
• CPC Class Codes: H04L 41/0843 : based on generic templates
• CPC Class Codes: H04L 41/28 : Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods are disclosed that ensure high availability of such an architecture hosted on commodity platforms. One method includes initializing, by an operating system, execution of a process by the programmable circuit, the process including a firmware environment representing a virtual computing system, the process further including one or more workloads to be executed within the process. The method also includes allocating a portion of the memory for use by the process, the portion of memory including a plurality of memory segments, and generating a plurality of area descriptors associated with the plurality of memory segments, each of the area descriptors defining a location and length of a corresponding memory segment. The method includes quiescing execution of the process and capturing contents of the portion of memory and the plurality of area descriptors associated with the process.

Claims

1. A system comprising:

a computing system including;

a programmable circuit configured to execute instructions according to a first computing architecture;

a memory communicatively connected to the programmable circuit, the memory storing software executable by the programmable circuit, the software including;

a first process including a firmware environment representing a virtual computing system having a second computing architecture different from the first computing architecture and one or more workloads to be executed within the process,

the software executable to perform a method including;

initializing, by an operating system executing natively on the computing system, execution of the first process by the programmable circuit;

allocating a portion of the memory for use by the first process, the portion of memory including a plurality of memory segments;

generating a plurality of area descriptors associated with the plurality of memory segments, each of the area descriptors defining a location and length of a corresponding memory segment and used by the virtual computing system to access the portion of the memory for execution of the one or more workloads;

quiescing execution of the first process;

capturing contents of the portion of memory and the plurality of area descriptors associated with the quiesced first process; and

transferring a binary including the quiesced first process and the state of the portion of memory associated with the quiesced first process to a second location.

2. The system of claim 1, wherein the method performed by the software further includes:

at the second location, unpacking the portion of memory into a second portion of memory and updating the area descriptors to reference the second portion of memory;

installing the first process at the second location from the binary; and

continuing operation of the first process at the second location.

3. The system of claim 2, wherein the second location comprises a second computing system communicatively connected to the first computing system.

4. The system of claim 1, wherein the second location comprises a second memory location within the computing system.

5. The system of claim 1, wherein the software is further executable to perform releasing the portion of the memory allocated to the first process.

6. The system of claim 1, wherein, during execution of the first process on the computing system, the portion of memory is replicated on the second computing system.

7. The system of claim 6, wherein quiescing execution of the first process and initializing execution of the second process occur without restarting the computing system.

8. The system of claim 1 wherein the first process includes one or more call-outs useable by the one or more workloads to directly execute instructions within the first computing architecture.

9. The system of claim 1, wherein the software is configured to, prior to initializing execution of the process by the programmable circuit, enumerate a specific version level of the firmware environment operating within the process.

10. The system of claim 1, wherein the software is further configured to replace the firmware with updated firmware while the first process is queisced.

11. A computer-implemented method comprising:

initializing, by an operating system executing natively on a computing system, execution of a process by a programmable circuit of the computing system, the process including a firmware environment representing a virtual computing system having a second computing architecture different from a first computing architecture of the computing system on which the operating system and process reside, the process further including one or more workloads to be executed within the process;

allocating a portion of the memory for use by the process, the portion of memory including a plurality of memory segments;

generating a plurality of area descriptors associated with the plurality of memory segments, each of the area descriptors defining a location and length of a corresponding memory segment and used by the virtual computing system to access the portion of the memory for execution of the one or more workloads;

quiescing execution of the process; and

capturing contents of the portion of memory and the plurality of area descriptors associated with the quiesced process.

12. The method of claim 11, further comprising replacing the firmware with updated firmware while the process is queisced.

13. The method of claim 11, further comprising transferring a binary including the process and the state of the portion of memory associated with the process to a second location.

14. The method of claim 13, further comprising:

at the second location, unpacking the portion of memory into a second portion of memory and updating the area descriptors to reference the second portion of memory;

installing the process at the second location from the binary; and

continuing operation of the process at the second location.

15. The method of claim 13, further comprising deallocating the portion of memory.

16. The method of claim 13, wherein the portion of memory is located on a first computing system and the second portion of memory is located on a second computing system, and wherein deallocating the portion of memory frees memory resources of the first computing system.

17. The method of claim 11, further comprising, during operation of the process, requesting allocation by the operating system of one or more processing cores available on the computing system.

18. The method of claim 11, further comprising, during operation of the process, requesting allocation by the operating system of one or more additional memory segments available on the computing system.

19. The method of claim 11, further comprising enumerating a specific version level of the firmware environment operating within the process.

20. A non-transitory computer-readable storage medium comprising computer-executable instructions stored thereon which, when executed by a computing system, cause the computing system to perform a method comprising:

initializing, by an operating system executing natively on the computing system, execution of a process by the programmable circuit, the process including a firmware environment representing a virtual computing system having a second computing architecture different from a first computing architecture of a computing system on which the operating system and process reside, the process further including one or more workloads to be executed within the process;

allocating a portion of the memory for use by the process, the portion of memory including a plurality of memory segments;

generating a plurality of area descriptors associated with the plurality of memory segments, each of the area descriptors defining a location and length of a corresponding memory segment and used by the virtual computing system to access the portion of the memory for execution of the one or more workloads;

quiescing execution of the process;

capturing contents of the portion of memory and the plurality of area descriptors associated with the quiesced process; and

transferring a binary including the process and the state of the portion of memory associated with the quiesced process to a second location.