JP5392594B2 - Virtual machine redundancy system, computer system, virtual machine redundancy method, and program - Google Patents

Description

  The present invention relates to a virtual machine redundancy system, and in particular, when a failure occurs in hardware of a virtual machine system in which a plurality of guest operating systems are operated on a host operating system in an operating system, an operating system memory dump is performed. The present invention relates to a virtual machine redundancy system having a function of collecting data in an external storage and transferring a running guest operating system to a standby guest operating system at high speed.

  A virtual machine redundancy system having a plurality of cluster-managed virtual machines is known. In this virtual machine redundancy system, virtual machine control units operating on the respective host operating systems cooperate with each other. If a failure occurs in any of the virtual machine systems, the guest operating system process running on the virtual machine controller that controls the virtual machine system is transferred to the normally running virtual machine system To reduce downtime. However, it is difficult to identify the cause of the failure depending on the hardware only by the virtual computer control unit made of software.

  As this type of technology, there is an invention described in Japanese Patent Laid-Open No. 2002-32244 (see Patent Document 1). According to the present invention, when a virtual machine control unit has some trouble when operating a virtual machine and the virtual machine cannot operate, the memory image of the guest operating system is saved in a storage medium. The memory image is converted into dump type data and output to facilitate investigation and analysis of the cause of the failure.

  The first problem of the present invention is as follows. If a hardware failure occurs during the operation of the virtual machine system, the host operating system and the virtual machine controller operating on the host operating system may become uncontrollable. If they become uncontrollable, each guest operating system operating under the control of the virtual machine control unit becomes uncontrollable, and the dump collecting means included in each guest operating system cannot be used.

  The reason is that since the virtual machine control unit operates on the host operating system, when a hardware failure occurs, the host operating system itself cannot operate normally and the virtual machine control unit cannot be controlled. Therefore, each guest operating system is also uncontrollable and the dump collecting means cannot be activated.

  The second problem is that in the method in which the guest operating system process is transferred from the active system to the standby system in cooperation with the virtual machine controller, which is software, a downtime of a certain time occurs when a hardware failure occurs. It is a problem. The reason is that since the virtual machine control units perform alive monitoring by heartbeats, it takes a certain time-out time to detect that the heartbeat is interrupted.

  Japanese Patent Laid-Open No. 7-219802 (see Patent Document 2) describes an invention of a duplex control system. In this duplex control method, when a failure is detected during processing in the main system, the contents of the storage units of both systems are kept the same in order to switch to the standby system and continue the processing. Therefore, the write data to the main storage unit is also written to the standby storage unit. The write contents generated in the main storage unit are sequentially stored in the internal buffer by the storage control unit that operates independently of the main CPU. In response to an instruction from the main CPU, the storage unit change contents of the main CPU are started to be stored in another buffer area. In parallel, the change according to the contents of the previous buffer area is made to the storage unit of the standby system.

  Japanese Patent Laid-Open No. 8-28702 (see Patent Document 3) describes an invention of a plurality of computer systems coupled to a shared memory. This is an invention in an electronic computer system that couples at least one real computer (hereinafter referred to as a real cluster) and a shared memory that is an external storage device. At least one having an operating system (hereinafter referred to as OS) for controlling individual guest clusters in a real cluster and a virtual cluster operated real cluster or an OS for controlling a virtual machine system A virtual machine system is connected to the shared memory.

  Japanese Patent Laying-Open No. 9-305424 (see Patent Document 4) describes an invention of a dual processor system. The present invention includes an MPU and a main storage device connected by a main memory bus, and a shared data matching device (hereinafter abbreviated as CME) having a transmission / reception circuit for transmitting / receiving shared information to / from a counterpart system. The main storage device has a shared area for storing shared data. The CME includes memory access information acquisition means, memory access means, shared area setting means, and shared data monitoring means. The memory access information acquisition means snoops access information including an address and data to be written from the MPU to the main storage device from the main memory bus. The memory access means writes in the shared area when the received information from the partner system is shared data. The shared area setting means designates the range of the shared area. The shared data monitoring unit determines that the information is shared data when the address in the access information or the received information is within the range of the shared area.

JP 2002-32244 A Japanese Laid-Open Patent Publication No. 7-219802 JP-A-8-287021 JP-A-9-305424

  An object of the present invention is to identify a cause of failure depending on hardware by dedicated hardware without depending on the state of a host operating system when a hardware failure occurs in an operational virtual machine system. It is in.

  Another problem of the present invention is that even when a hardware failure occurs in the active system, the downtime is greatly reduced, and the processing of the active guest operating system is taken over as the processing of the standby guest operating system. There is.

  A virtual machine redundancy system according to one aspect of the present invention includes an active computer system and a standby computer system that stands by as a backup of the active computer system. The operational computer system includes an operational host operating system and an operational guest operating system that operates on a virtual machine provided by the operational host operating system. The standby computer system includes a standby host operating system and a standby guest operating system.

  According to the present invention, when a hardware failure occurs in an active virtual machine system, the cause of failure that depends on hardware is identified by dedicated hardware without depending on the state of the host operating system. Can do.

  Further, even when a hardware failure occurs in the active system, the downtime can be greatly shortened, and the process of the active guest operating system can be taken over as the process of the standby guest operating system.

  One of the best modes for carrying out the present invention will be described in detail with reference to the drawings. Referring to FIG. 1, the virtual machine redundancy system in one embodiment includes an operational computer system SYS 1, a standby computer system SYS 2, and a shared storage 19. Each of the operational computer system SYS1 and the standby computer system SYS2 includes physical hardware HW1 and HW2 and basic input / output control systems 7 and 8. In the operational computer system SYS1, a host OS OS1 operates, and guest OSs OS1-A to OS1-C operate on the host OS OS1. In the standby computer system SYS2, the host OS OS2 and the guest OSs OS2-A to OS2-C are on standby as active backups.

  The host OS OS1 has a virtual machine control unit 1, a failure detection unit 3, and a dump unit 5. The virtual machine control unit 1 is responsible for part of the functions of the host OS OS1, provides virtual machine resources to the guest OSs OS1-A to OS1-C, and performs memory management and control. The failure detection unit 3 is started when a fatal hardware failure occurs as part of the function of the host OS OS1, and starts the dump unit 5 and automatically restarts the system SYS1. The dump unit 5 is activated by the failure detection unit 3 as part of the function of the host OS OS1 and collects a memory dump. In the host OS OS2, the virtual machine control unit 2, the failure detection unit 4, and the dump unit 6 are respectively waiting as backups for the virtual machine control unit 1, the failure detection unit 3, and the dump unit 5. .

  The basic input / output control systems 7 and 8 provide the host OS OS1 and OS2 with input / output control services between the host OS OS1 and OS2 and the physical hardware HW1 and HW2, respectively. This is firmware that provides a certain system management mode to the central processing units 9 and 10.

  The physical hardware HW1 and HW2 are respectively the central processing units 9 and 10, the physical memory control units 11 and 12, the physical memory 13 and 14, the physical hardware management units 15 and 16, and the physical I / O control. Parts 17 and 18. The active physical memory control unit 11 controls reading / writing to the physical memory 13 and transfers the memory contents to the physical hardware management unit 15 when writing to a physical address that is permitted to be written. The standby physical memory control unit 12 controls reading / writing to the physical memory 14 and writes to the physical memory 14 when a request for writing to the physical memory 14 is received from the physical hardware management unit 16. I do. The active physical hardware management unit 15 receives the memory copy from the physical memory control unit 11 and transfers it to the standby system. A fatal hardware failure is detected, the central processing unit 9 is interrupted, a control transfer notification is sent to the standby system, and the central processing unit 9 registers and context information are transmitted.

  The standby physical hardware management unit 16 passes the received memory copy to the physical memory control unit 12. When the control transfer notification is received, an interrupt is given to the central processing unit 10 to perform processing for taking over the continuation of operation from the register and context information received from the active system. The active physical I / O control unit 17 performs read / write control to the shared storage 19 and read / write control to the input / output hardware. The standby physical I / O control unit 18 performs read control from the shared storage 19 and read / write control to the input / output hardware.

  The shared storage 19 can be accessed from each of the active system and the standby system. Specifically, the shared storage 19 can be read / written from the active system and can only be read from the standby system. The shared storage 19 is the latest version of the active guest OSes OS1-A to OS1-C so that the active file systems can be referred to after the standby guest OSes OS2-A to OS2-C are switched to the active system. Stores file system information.

  1. A data synchronization process in the memory areas of the active guest OSes OS1-A to OS1-C and the standby guest OSes OS2-A to OS2-C will be described with reference to FIG.

[Active / Standby]
The physical memory control units 11 and 12 of the active system and the standby system each have an address management table (see FIG. 5 described later). The virtual machine control units 1 and 2 copy the physical memory information to the address management tables of the physical memory control units 11 and 12 when the physical memory address information managed by the virtual machine control unit 1 or 2 changes (see FIG. 1 [1]).

[Operational system]
When there is a write request from the central processing unit 9 ([2] in FIG. 1), the physical memory control unit 11 collates the physical address information in the address management table with the physical address for which the write request has been made. . If the corresponding physical address exists, at the same time as writing to the physical memory 13 ([3] in FIG. 1), the physical address and the memory data to be written are also passed to the physical hardware management unit 15 (FIG. 1). [4]). The physical hardware management unit 15 transmits the received physical address and memory data to the standby physical hardware management unit 16 ([5] in FIG. 1).

[Standby]
The standby physical hardware management unit 16 requests the physical memory control unit 12 to write to the physical memory 14 in order to write to the physical memory 14 based on the received physical address and memory data ( [6] in FIG. The physical memory control unit 12 that has received the request collates the physical address information in its own address management table with the physical address for which the write request has been made. Only when the corresponding physical address exists, the central processing unit 10 is requested to release the physical memory bus ([7] in FIG. 1). The central processing unit 10 that has received the physical memory bus release request notifies the physical memory control unit 12 of the release of the physical memory bus ([8] in FIG. 1). The physical memory control unit 12 notifies the physical hardware management unit 16 of write permission to the designated physical address, and completes preparation for accepting data transfer ([9] in FIG. 1). The physical hardware management unit 16 that has received the notification transfers memory data to the physical memory control unit 12 ([10] in FIG. 1). The physical memory control unit 12 that has received the memory data transferred from the physical hardware management unit 16 writes to the designated address of the physical memory 14 ([11] in FIG. 1). When the writing is completed, the central processing unit 10 is notified of the completion of exclusive use of the physical memory bus ([12] in FIG. 1).

  2. Migration processing of the guest OSes OS1-A to OS1-C when a hardware failure occurs will be described with reference to FIG.

[Operational system]
When the active physical hardware management unit 15 detects a fatal hardware failure, it raises an interrupt to the central processing unit 9 ([1] in FIG. 2). The central processing unit 9 that has received an interrupt from the physical hardware management unit 15 transfers control to the system management mode of the basic input / output control system 7 developed in the physical memory 13 ([2] in FIG. 2). When an instruction to save the current state of the central processing unit 9 is issued by the shift to the system management mode ([3] in FIG. 2), the current state (register information, Context information) is passed to the physical memory control unit 11 ([4] in FIG. 2). These are stored in the registers and the context information storage area in the system management area of the basic input / output control system 7 expanded in the physical memory 13 ([5] in FIG. 2), and simultaneously through the physical memory control unit 11. Then, it is also passed to the physical hardware management unit 15 ([6] in FIG. 2). The physical hardware management unit 15 notifies the standby physical hardware management unit 16 of the control transfer notification of the guest OSs OS1-A to OS1-C and the received registers and context information of the central processing unit 9. Transmit ([7], [8] in FIG. 2).

  On the other hand, the central processing unit 9 in the system management mode instructs the physical hardware management unit 15 to raise an interrupt for starting the failure detection unit 3 of the host OS OS1 to the central processing unit 9 itself. An instruction is issued ([9] in FIG. 2), and then a restore instruction is executed to exit the system management mode. Subsequently, when receiving an interrupt from the physical hardware management unit 15 ([10] in FIG. 2), the central processing unit 9 transfers control to the failure detection unit 3 ([11] in FIG. 2). The failure detection unit 3 activates the dump unit 5, and the dump unit 5 performs a memory dump to the shared storage 19 via the central processing unit 9, the physical memory control unit 11, and the physical I / O control unit 17. Write. When the memory dump is completed and an end notification is received from the dump unit 5, the failure detection unit 3 automatically restarts the operational computer system SYS1.

[Standby]
When the standby physical hardware management unit 16 receives the control transfer notification and the register and context information from the active physical hardware management unit 15, the standby physical hardware management unit 16 stores the status register of the physical hardware management unit 16 itself in the active system. The value is changed to a value indicating that it is present, and an interrupt is given to the central processing unit 10 ([12] in FIG. 2). The central processing unit 10 receiving the interrupt from the physical hardware management unit 16 jumps to a predetermined entry address in the instruction code group of the basic input / output control system 8 developed in the physical memory 14 and is executed in the system management mode. Control is transferred to the program ([13] in FIG. 2). When an instruction to save the current state of the central processing unit 10 is issued by the shift to the system management mode ([14] in FIG. 2), the current state (register information, Context information) is transferred to the physical memory control unit 12 ([15] in FIG. 2). This current state is stored in the context information storage area in the system management area of the basic input / output control system 8 developed in the physical memory 14 ([16] in FIG. 2).

  Next, in the system management mode, it is confirmed whether or not the physical hardware management unit 16 has received control transfer notifications of the active guest OSs OS1-A to OS1-C from the active system. Here, it is checked whether or not the status register of the physical hardware management unit 16 has a value indicating the active system ([17] in FIG. 2). If the value indicates the active system, the register and the context information of the active central processing unit 9 held by the physical hardware management unit 16 are acquired ([18] in FIG. 2), and physical memory control is performed. It is stored in a spare context storage area in the system management area via the section 12 ([19] in FIG. 2).

  In the system management mode, finally, a restore command is issued to the central processing unit 10 to restore the registers and context information stored in the spare context storage area to each register of the central processing unit 10. Then, the operational guest OSes OS1-A to OS1-C resume system operation from the phase processed immediately before the failure ([20] and [21] in FIG. 2). After the system operation is resumed, the failure detection unit 4 cooperates with the virtual machine control unit 2 to perform a polling check in order to diagnose whether the backed up guest OSes OS2-A to OS2-C are operating normally. . If it is not operating normally, the guest OSes OS2-A to OS2-C are restarted.

  3. A configuration example of the physical hardware management unit 15 will be described with reference to FIG. Referring to FIG. 3, the physical hardware management unit 15 includes an interrupt processing unit 20, a log collection unit 21, a status register 22, a data reception unit 23, a data transmission unit 24, an error register 25, and an input buffer. 35 and an output buffer 36. In FIG. 3, the interrupt processing unit 20 detects a fatal hardware failure and causes the central processing unit 9 to generate an interrupt. The log collection unit 21 collects detailed log information when a hardware failure occurs. The status register 22 holds information indicating whether the system is an active system or a standby system. The data receiving unit 23 receives the memory information and the control transfer notification. The data transmission unit 24 transmits the memory information and the control transfer notification. The error register 25 holds information (failure level) indicating whether the detected hardware failure is fatal. The input buffer 35 functions as a buffer for memory information to be received and a control transfer notification. The output buffer 36 functions as a buffer for memory information to be transmitted and a control transfer notification.

  An operation example of the physical hardware management unit 15 will be described. When the physical memory control unit 11 or the physical I / O control unit 17 detects a hardware failure, the physical memory control unit 11 or the physical I / O control unit 17 notifies the physical hardware management unit 15 and registers information indicating whether the failure is fatal in the error register 25. The interrupt processing unit 20 checks the value of the error register 25 and determines whether the notified hardware failure is fatal. In the case of a fatal case, the central processing unit 9 is interrupted and the log collection unit 21 records the failure information. In response to an interrupt request, an interrupt is sent to the central processing unit 9 as it is.

  The physical address and memory data input from the physical memory control unit 11 are temporarily stored in the output buffer 36 and then transmitted from the data transmission unit 24 to the opposing physical hardware management unit 16. The physical address and memory data received by the data receiving unit 23 are temporarily stored in the input buffer 35 and then output to the physical memory control unit 11. Here, when the control transfer notification is received, the value of the status register 22 is changed from the value indicating the standby system to the value indicating the active system.

  4). A configuration example of the virtual machine control unit 1 will be described with reference to FIG. Referring to FIG. 4, the virtual machine control unit 1 includes a virtual hardware providing unit 26, a memory management unit 27, and a memory management table 28. The virtual hardware providing unit 26 virtually generates and provides system resources (central processing unit, physical memory, basic input / output system, input / output device, etc.) used by the guest OSes OS1-A to OS1-C. Take a role. The memory management unit 27 holds the segment and page information and performs memory management of the host OS OS1 and the guest OSs OS1-A to OS1-C. The memory management table 28 stores correspondence information between logical addresses and physical addresses of areas writable by the system. The memory management table 28 stores all the memory information of each process of the guest OS OS1-A to OS1-C and the host OS OS1 itself.

  An operation example of the virtual machine control unit 1 will be described. When there is a change in the memory contents due to the writing, the virtual machine control unit 1 stores the address information of the changed memory and its contents, and updates the memory management table 28. Further, the memory information (physical address and memory contents) is passed to the physical memory control unit 11. The physical memory control unit 11 updates the address management table (see FIG. 5 described later), and stores the memory address information whose memory contents are changed. At the same time, the memory information is also transferred from the physical memory control unit 11 to the standby virtual computer control unit 2 via the physical hardware management unit 15. Based on this memory information, the standby memory management table is also updated.

  5. A configuration example of the physical memory control unit 11 will be described with reference to FIG. Referring to FIG. 5, the physical memory control unit 11 includes a physical memory, an I / O input / output switching circuit 29, an address management table 30, and an output buffer 37. The physical memory / I / O input / output switching circuit 29 controls memory input / output from the central processing unit 9, the physical I / O control unit 17, and the like, and performs overall access control to the physical memory 13. In the address management table 30, the address information of the memory management table 28 managed by the virtual machine control unit 1 is copied. When a write to a physical address in the physical memory 13 occurs, the physical memory / I / O input / output switching circuit 29 refers to the address management table 30 and checks whether the physical address is a write-permitted area. To do. If the corresponding physical address exists, a copy of the memory content to be written is transferred to the physical hardware management unit 15.

  6). The shared storage 19 will be described in detail. In the present embodiment, the shared storage 19 is installed in the virtual machine redundancy system. Assume that the file system used by the active guest OSes OS1-A to OS1-C is a disk image stored on a physical disk that exists locally in the active system. In this case, after the standby system shifts to the active system, the standby system guest OS OS2-A to OS2-C cannot access the disk image. For this reason, the virtual machine redundancy system cannot operate after the standby system has shifted to the active system.

  Therefore, in the present embodiment, a shared storage 19 that is equally accessible from both the active computer system SYS1 and the standby computer system SYS2 is prepared. Here, file system information updated from the active guest OSes OS1-A to OS1-C is stored.

  The effect by this Embodiment is demonstrated. The first effect is that the cause of a hardware failure that cannot be detected by the host operating system can be identified. The reason is that a physical hardware management unit, which is dedicated hardware, is prepared, and this physical hardware management unit notifies failure notifications from various hardware control units such as a physical memory control unit and a physical I / O control unit. This is because it provides a mechanism for detecting and saving log information.

  The second effect is that the redundant operation of the guest operating system can be provided with greatly reduced downtime. The reason for this is that the physical hardware management units related to the virtual machine systems of the active system and the standby system work together to detect a failure when a hardware failure occurs and provide a mechanism to immediately migrate the guest operating system processing. Because it is.

FIG. 1 is a diagram showing a configuration of a virtual machine redundancy system, and a control flow and a data flow during normal operation. FIG. 2 is a diagram showing the flow of control and data when a fatal hardware failure occurs. FIG. 3 is a diagram illustrating a configuration example of the physical hardware management unit. FIG. 4 is a diagram illustrating a configuration example of the virtual machine control unit. FIG. 5 is a diagram illustrating a configuration example of the physical memory control unit.

Explanation of symbols

1, 2 Virtual computer control unit 3, 4 Fault detection unit 5, 6 Dump unit 7, 8 Basic input / output control system 9, 10 Central processing unit 11, 12 Physical memory control unit 13, 14 Physical memory 15, 16 Physical hardware Hardware management unit 17, 18 Physical I / O control unit 19 Shared storage 20 Interrupt processing unit 21 Log collection unit 22 Status register 23 Data reception unit 24 Data transmission unit 25 Error register 26 Virtual hardware provision unit 27 Memory management unit 28 Memory management Table 29 Physical memory, I / O input / output switching circuit 30 Address management table 35 Input buffer 36, 37 Output buffer

Claims (14)

  An operational computer system in a redundant virtual machine system;
  A standby computer system in the redundant virtual machine system;
  A shared storage accessible from each of the active computer system and the standby computer system;
Including
  Each of the operational computer system and the standby computer system is
  Physical hardware with a central processing unit and physical memory;
  A host operating system running on the physical hardware;
  Virtual machine control means running on the host operating system;
  A guest operating system running on the virtual machine control means;
  Physical memory control means for controlling reading and writing to the physical memory;
  In the case of the operational system, which is dedicated hardware, the memory information of the guest operating system is acquired in cooperation with the virtual machine control unit and the physical memory control unit, and the standby system and the memory information of the guest operating system are synchronized. When a fatal hardware failure is detected, an interrupt is sent to the central processing unit, and a control transfer notification and register information and context information of the central processing unit are transmitted to the standby system. A physical hardware management means for raising an interrupt to the central processing unit upon receiving a control transfer notification from the active system, and taking over the operation based on the register information and context information received from the active system;
  When a fatal hardware failure is detected, dump means for collecting a memory dump of the physical memory on the host operating system;
  Physical I / O control means for acquiring the memory dump and performing read / write control to the shared storage and read / write control to the input / output hardware;
With
  Virtual machine redundancy system.   The virtual machine redundancy system according to claim 1,
  The physical hardware management means includes
  Interrupt processing means for detecting a fatal hardware failure and generating an interrupt in the central processing unit;
  Log collection means for collecting detailed log information when a fatal hardware failure occurs,
  A status register holding information indicating whether the local computer system is an active system or a standby system;
  Data receiving means for receiving and processing memory information and control transfer notification;
  Data transmitting means for transmitting memory information and control transfer notification;
  An error register that holds information about the failure level of whether the detected hardware failure is fatal,
  An input buffer that functions as a buffer for memory information to be received and a control transfer notification;
  An output buffer that functions as a buffer for memory information to be transmitted and a control transfer notification;
With
  Virtual machine redundancy system.   The virtual machine redundancy system according to claim 2,
  When the physical memory control unit or the physical I / O control unit detects a hardware failure, the physical memory control unit or the physical I / O control unit notifies the physical hardware management unit and registers information indicating whether the failure is fatal in the error register.
  The interrupt processing means checks the value of the error register, determines whether the notified hardware failure is fatal, and if fatal, raises an interrupt to the central processing unit,
  The log collecting means collects detailed log information when a fatal hardware failure occurs,
  The physical memory control means temporarily stores a physical address and input of memory data in the output buffer,
  The data transmission means transmits information stored in the output buffer to another physical hardware management means,
  When the data receiving means receives a physical address and memory data from another system data transmitting means, temporarily stores it in the input buffer, and then outputs it to the physical memory control means and receives a control transfer notification To change the value of the status register from the value indicating the standby system to the value indicating the active system
  Virtual machine redundancy system.   The virtual machine redundancy system according to any one of claims 1 to 3,
  The virtual computer control means includes
  Virtual hardware providing means for virtually generating and providing system resources used by the guest operating system;
  Memory management means for holding segment information and page information, and performing memory management of the host operating system and the guest operating system;
  A memory management table for storing correspondence information between a logical address and a physical address of an area writable by a local computer system, and memory information of each process of the host operating system and the guest operating system;
With
  Virtual machine redundancy system.   The virtual machine redundancy system according to claim 4,
  When there is a change in the memory contents due to writing, the virtual machine control means stores the physical address and memory contents of the changed memory, updates the memory management table, and Passing the address and the memory contents to the physical memory control means;
  The physical memory control means passes the physical address and the memory contents to the standby virtual machine control means via the physical hardware management means, and updates the standby memory management table.
  Virtual machine redundancy system.   The virtual machine redundancy system according to claim 5,
  The physical memory control means includes
  An input / output switching circuit that controls memory input / output from the central processing unit and the physical I / O control means, and performs overall access control to the physical memory;
  An address management table obtained by copying address information of the memory management table managed by the virtual machine control means;
Comprising
  The input / output switching circuit refers to the address management table when writing to a predetermined physical address in the physical memory occurs, and checks whether or not the physical address is a write-permitted area. Is a write-permitted area, a copy of the memory contents to be written is transferred to the physical hardware management means
  Virtual machine redundancy system.   A computer system used as an active system or a standby system in the virtual machine redundancy system according to any one of claims 1 to 6.   In each of the active computer system in the redundant virtual computer system and the standby computer system in the redundant virtual computer system,
  A host operating system running on physical hardware with a central processing unit and physical memory;
  Virtual computer control means running on the host operating system;
  A guest operating system runs on the virtual machine control means;
  The physical memory control means controls reading and writing to the physical memory;
  In the case of the active system, physical hardware management means, which is dedicated hardware, obtains memory information of the guest operating system in cooperation with the virtual machine control means and the physical memory control means, and the standby system and the guest operating system Synchronizes the memory information of the system, raises an interrupt to the central processing unit when a fatal hardware failure is detected, and transmits a control transfer notification to the standby system and register information and context information of the central processing unit And
  In the case of a standby system, when the physical hardware management means receives a control transfer notification from the active system, it raises an interrupt to the central processing unit and takes over the operation based on the register information and context information received from the active system; ,
  If a fatal hardware failure is detected, the dump means performs a memory dump collection of the physical memory on the host operating system;
  The physical I / O control means acquires the memory dump, and performs read / write control to the shared storage accessible from each of the active computer system and the standby computer system and read / write control to the input / output hardware. To do and
including
  Virtual machine redundancy method.   The virtual machine redundancy method according to claim 8,
  As the physical hardware management means,
  An interrupt processing means detects a fatal hardware failure and generates an interrupt in the central processing unit;
  The log collection means collects detailed log information when a fatal hardware failure occurs,
  The status register holds information indicating whether the local computer system is an active system or a standby system;
  The data receiving means receives the memory information and the control transfer notification;
  The data transmission means transmits the memory information and the control transfer notification;
  An error register holds information about the failure level of whether the detected hardware failure is fatal;
  The input buffer functions as a buffer for memory information to be received and a control transfer notification;
  The output buffer functions as a buffer for memory information to be transmitted and a control transition notification.
Further includes
  Virtual machine redundancy method.   The virtual machine redundancy method according to claim 9,
  When the physical memory control unit or the physical I / O control unit detects a hardware failure, it notifies the physical hardware management unit and registers information indicating whether the failure is fatal in the error register. When,
  The interrupt processing means checks the value of the error register, determines whether the notified hardware failure is fatal, and if it is fatal, raises an interrupt to the central processing unit; ,
  The log collection means collects detailed log information when a fatal hardware failure occurs;
  The physical memory control means temporarily stores a physical address and input of memory data in the output buffer;
  The data transmission means transmits the information stored in the output buffer to another physical hardware management means;
  When the data receiving means receives a physical address and memory data from another data sending means, temporarily stores it in the input buffer, and then outputs it to the physical memory control means and receives a control transfer notification The status register value is changed from a value indicating the standby system to a value indicating the active system.
Further includes
  Virtual machine redundancy method.   The virtual machine redundancy method according to any one of claims 8 to 10,
  As the virtual computer control means,
  Virtual hardware providing means virtually generates and provides system resources used by the guest operating system;
  Memory management means holds segment information and page information, and performs memory management of the host operating system and the guest operating system;
  A memory management table storing correspondence information between a logical address and a physical address of an area writable by a local computer system, and memory information of each process of the host operating system and the guest operating system;
Further includes
  Virtual machine redundancy method.   The virtual machine redundancy method according to claim 11,
  When the memory contents are changed by writing, the virtual machine control means saves the physical address and memory contents of the changed memory, updates the memory management table, and Passing the address and the memory contents to the physical memory control means;
  The physical memory control means passes the physical address and the memory contents to the standby virtual machine control means via the physical hardware management means, and updates the standby memory management table;
Further includes
  Virtual machine redundancy method.   The virtual machine redundancy method according to claim 12,
  As the physical memory control means,
  An input / output switching circuit controls memory input / output from the central processing unit and the physical I / O control means to perform overall access control to the physical memory;
  Holding an address management table obtained by copying address information of the memory management table managed by the virtual machine control means;
  When the input / output switching circuit writes to a predetermined physical address in the physical memory, the input / output switching circuit refers to the address management table to check whether the physical address is a write-permitted area. Is a write-permitted area, a copy of the memory contents to be written is transferred to the physical hardware management means;
Further includes
  Virtual machine redundancy method.   A program for causing a computer system used as an active system or a standby system to execute the virtual machine redundancy method according to any one of claims 8 to 13.

Images