Upgrade of a program

[0002] The present application is a continuation of U.S. patent application Ser. No. 09/362,400 filed Jul. 28, 1999 now U.S. Pat. No. 6,324,692 which is herein incorporated by reference.

[0003] This invention relates to computer programs, and more particularly to program upgrades.

[0004] Installing an upgrade of a computer program on a personal computer generally requires a user to load a compressed version of the program onto the computer and begin an installation process. The installation process normally requires a user to execute an installation program and additionally respond to prompts for information as required by the installation program. The installation process may directly overwrite the previous version of software or the process may uninstall the current version of the software prior to installing the new version. Once the software is installed the system is typically rebooted and an attempt can be made to run the software. If the software fails to install, the user must decide whether to reinstall the upgraded program or to reinstall the previous version that was compatible with the system.

[0005] In a networked system, which is connected to a central server with attached disk arrays, an upgrade to a centrally accessed program on the server is performed in a substantially similar fashion, where the upgrade requires that the system administrator load the upgrade, install the program, and reboot the server. The system must be shut down for a period of time during installation and the rebooting of the server. This shutdown makes access to both files and programs on or connected to the server impossible during rebooting. Additionally, if the upgrade fails to install, the system administrator must decide whether to reinstall the upgrade or the current version of the program. Both operations again take the server offline and deny users access to files and programs.

[0006] In a system which has redundant servers, upgrading a program posses a further problem. In order for the redundant servers to operate properly, the program mirrored on the inactive server must be compatible with the upgraded program on the active server. Potential inconsistencies may occur when the active server is upgraded with a new version of a program and the format of data transfer between the two servers changes. In such a circumstance redundancy is lost between the servers. Also if an upgraded active server goes off line and the inactive server becomes active the inactive server may not be capable of interpreting the new message protocols that were part of the upgraded server program.

[0007] The present invention is directed to a method and processor program product for performing an upgrade of a program on a processor. An upgraded version of the program is received into the processor and a backup of the program is created in memory associated with the processor. The upgraded version of the program is then installed and the processor is rebooted. Prior to initializing other application drivers, a reboot driver checks if the state of the processor is correct. If the reboot driver determines that the state of the processor is incorrect, the system reverts to the backup of the program. In alternative embodiments, if the reboot driver determines that the state is incorrect, the system inhibits the loading of other application drivers. Additionally, the reboot driver may set a counter to indicate the number of times that the processor is rebooted. If the counter has not reached a predetermined threshold, the system attempts to reboot the processor with the upgraded version of the program. The counter may be stored in a database, such as, the registry of the processor. If the counter reaches the predetermined threshold, the system reverts to the backup of the program.

[0008] In another related embodiment, the processor is a first server in a server cluster. The first server communicates to a second server that an upgrade is to occur in the first server. The first server confirms that second server is running a program which is compatible with the upgraded program prior to beginning the installation of the upgraded program. If the second server is not running a compatible version of the program, the second server sends a signal to the first server to abort the upgrade. If the second server is running a compatible program, the second server sends a signal prior to the first server to begin installation of the upgrade indicating that the second server will receive input and output formerly associated with the first server. When installation of the upgrade is complete, the first server notifies the second server that the first server is in the process of rebooting and then confirms that the program has been upgraded. Once the first server has been upgraded, the entire process may be performed again so that the second server may be upgraded. In another embodiment, the installation of the upgrade is performed automatically without human intervention.

[0009] The foregoing features of the invention will be more readily understood by reference to the following detailed description taken with the accompanying drawings:

[0010] FIG. 1 is a preferred embodiment of the present invention for upgrading a program.

[0011] FIG. 2 is a flow chart showing the method for installing a nondisruptive upgrade.

[0012] FIG. 3 is a flow chart of the method for installing a nondisruptive upgrade in a preferred embodiment of the system as shown in FIG. 1.

[0013] FIG. 4 is a block diagram of one embodiment of the invention represented as modules.

[0014] The term “driver” as used within the following descriptions and claims shall mean a program that runs in the operating system context/space. FIG. 1 shows the system for nondisruptive upgrade of a headless system in accordance with a preferred embodiment of the invention. In this system a remote host is in communication with a server cluster which is coupled to a disk array. A server cluster is a group of two or more processors coupled to share data and to provide a redundant backup in case one server fails. In this system storage processor 1 and storage processor 2 provide parallel processing. The host is connected to each of the processors and both processor 1 and processor 2 may access any of the attached disks within the disk array. The host sends requests such as read commands or write commands to a particular disk through a preferred processor. A preferred processor is associated with specified LUNs (logical unit numbers) for a group of disks. The second processor provides an alternative path of access to the LUNs associated with the preferred processor in case of failure of the preferred processor or if the system is being upgraded. In this configuration all of the data stored on the disks is associated with a preferred path through the preferred processor and a failover path through the second processor.

[0015] In the system of FIG. 1, storage processor 2 is connected to storage processor 1 by means of a fiber channel. Each of the processors mirrors the cache of the other processor so that the caches are identical. In the event of storage processor 1 failing, the cache of storage processor 1 is dumped to a reserved section of one of the disks in the disk array and then the data is redistributed to the appropriate memory address associated with the data. Once the host stops receiving data communication signals from processor 1, the host assumes that there has been an error and begins automatic failover procedures. The host switches to the failover path and begins routing all requests through storage processor 2. The host will occasionally poll the failed server to determine if the server was shut down temporarily as in the case of a system upgrade or a power failure. A failover switching system is described in U.S. Pat. No. 5,922,077 entitled FAIL-OVER SWITCHING SYSTEM filed on Nov. 14, 1996 assigned to the same assignee and which is incorporated by reference herein in its entirety.

[0016] Upgrading one of the processors in the server cluster without interruption of service is possible, if the host has automatic transaction failover software installed and the host is connected to each processor as described above. If the automatic transaction failover software is not installed then the processor which fails is inaccessible while it is being upgraded. In a server cluster downtime is reduced by turning control over to another server during the upgrade process through automatic transaction failover.

[0017] FIG. 2 is a flow chart of the sequence of steps taken in automatically upgrading a software program on a processor so that the processor is controlled as state machine. Although the term processor is used, the method may be performed on a computer. Further, the method may be performed on any processor including a headless processor as the method provides for automatic upgrading. A headless processor lacks a user input device and is normally devoid of a keyboard and monitor. In step 100 an upgrade of a program already on the processor is input into the processor. The upgraded program may be transmitted from a remote location through a network connection such as the host computer shown in FIG. 1 or may be placed on the processor through some other transportable medium such as a floppy disk or a CD-ROM. If the upgrade is transmitted remotely either via a network or Internet connection, a graphical user interface (GUI) may be present on the remote machine for establishing a connection to the processor, transmitting the upgraded software, and overseeing the installation process. On the processor, a procedure may be running which is triggered every time that new data is received by the processor and checks to see if an executable file is present. The processor then unpacks the upgrade materials which may involve decompression of the files and the processor performs consistency checks on the files. Consistency checks are performed to establish the compatibility of the revision and also to verify that the files are authorized upgrades.

[0018] The processor recognizes that a new program is available for installation and confirms with the registry of the system that a previous version is currently running on the processor. Once the upgrade has been recognized the current version of the program is copied into another directory on the processor (step 110). This step may occur prior to the initiation of the installation of the upgraded program. Additionally the upgraded version is also copied into it's own directory. The program is then installed by executing the installation program which is either part of the upgrade or a standard program which is resident in the operating system or other software present on the processor (step 120). The program may be saved in compressed form and a monitor program will initiate the installation process. Additionally, the monitor program will have saved the configuration data that is required by the installation program in nonvolatile memory. The configuration data may be entered by the monitor program into the blank parameters as the program is being installed or the installation may be controlled remotely through the GUI on the host computer/terminal in which the administrator may enter the configuration data manually. After the program is installed, a script or monitor program running in the application space of the processor causes the processor to be rebooted and a counter to be initialized (step 130). Once the processor is rebooted a reboot driver is triggered (step 140). The reboot driver starts prior to any other application driver on the processor. The reboot driver is an external application driver which is part of the operating system which functions in the operating system space. If the state of the processor as read from the registry of the processor is configured as expected by the reboot driver, a flag is set and the program may be run (step 150). If the registry is not set correctly the reboot driver recognizes the failure and sets the flag to indicate the failure. The counter is then advanced (step 160). In one embodiment the counter is found within the registry. If the flag indicates a failure, the monitor program will inhibit the loading of the remaining application drivers (step 170). The monitor program then checks the counter to see if it has reached a predefined maximum value (step 180). If the counter has reached the maximum the monitor program reverts back to the backup copy of the program which is saved in memory associated with the processor (step 190). The counter is also provided to allow the program to stay at its current revision if a destabilizing power surge causes a reboot before the prior reboot is complete.

[0019] By providing a method for backing out to the backup program which is known to work on the processor, the processor will not have lingering downtime. Additionally, if a currently running version of the program becomes corrupted the method allows the backup copy to be reinstalled.

[0020] FIG. 3 is a flow chart of the method for installing a nondisruptive upgrade in a preferred embodiment of the system as shown in FIG. 1. In step 300 the upgrade is received in the first processor of the server cluster. The program is recognized as an upgrade of a program already running on the first processor. In step 310, the second processor of the server cluster which is running a version of the currently running program on the first processor is informed that an upgrade is about to occur on the first processor. The first processor sends information relating to the upgrade so that the second processor can confirm that it is running a compatible version of the upgraded software. A compatible revision contains modifications that can be run on one processor while the partner processor is running a prior revision. If the upgrade contains new messages in the protocol, the upgrade may be run in compatibility mode. In compatibility mode, the upgraded program sends only messages which are recognized by the previous version of the software. If there are minor additions to the program the system and method of U.S. patent application entitled Revision Compatibility Between Programs Ser. No. 09/213,073, filed Dec. 16, 1998 to the same assignee may be applied. The full disclosure of said patent application is hereby incorporated by reference herein. To test for compatibility, the manufacturer of the upgrade would need to have a system in place, such that, various revision numbers would be compatible. For example, the first processor may send the revision number of the upgraded program to the second processor. Based on the revision number, processor 2 could compare that number with the revision number of the currently running program on processor 2 to determine if the upgrade is incompatible, compatible, or should be run in compatibility mode.

[0021] Once the second processor has confirmed that the first processor is to be upgraded, the data present in the mirrored caches is sent to the reserved section of one of the disks of the disk array and both processors dump their respective caches. After the caches are dumped, the system operates in a non-cached mode to prevent any loss of information in the event that the second processor fails. The data from the caches is then redistributed from the reserved section to the memory address that is associated with the data.

[0022] After the cache data is redistributed, the first processor is signaled that it may begin the upgrade process (step 320). The upgrade process begins as described with reference to FIG. 2. After the installation is complete processor 1 will signal to processor 2 that a reboot is about to occur on processor 1 (step 330). Processor 2 then signals the host that any requests for data will be directed through processor 2 (step 340). Once confirmation from the host occurs, processor 2 will signal processor 1 that the reboot may proceed. The first processor then reboots (step 350). The state of the registry is compared to an expected state by the reboot driver (step 360) If the state is as expected, a reboot flag is set and the upgrade is complete (step 370). At this point control of the disk array and receipt of request for information may be restored to processor 1. Additionally, processor 2 is signaled that it may begin the upgrade procedure (step 380). Processor 2 may be set to immediately begin the upgrade procedure upon receipt of this message or processor 2 may be set on a timer and upgraded at a more preferable time. If the state is incorrect, the reboot flag is set, to indicate a failure initiation of all other drivers is prohibited and the processor begins the reboot sequence of step 130 in FIG. 2.

[0023] If processor 2 determines that the upgrade is incompatible with the currently operating version of the program on processor 2 it will signal processor 1 and halt the upgrade process (step 322). When processor 1 receives the message it will abort the upgrade process and continue to run the version of the program that is present on the processor. Processor 2 will then be set into an upgrade mode (step 324). Processor 2 will then attempt to upgrade to a version of the program that will be compatible with the upgrade of the program. The method will then return to step 300 wherein each step with reference to processor 2 will now be with respect to processor 1 and vice versa.

[0024] The preferred embodiment of the system operates in the Windows NT, operating environment designed by the Microsoft Corporation of Redmond, Wash. The system takes advantage of Windows NT's setup API to install and uninstall drivers, copy, delete and rename files, including compressing and decompressing and adding deleting and changing registry entries. A backup version of Windows NT is maintained in a separate directory structure from the version being upgraded so that at boot time the backup version of the operating system may be selected if the upgraded version fails to load properly.

[0025] In the preferred version of the system, a copy of the current version of the program and a previous version of the program are kept in memory associated with each processor and the current version and the previous version of the program are identical on both processors. When an upgrade occurs, the current revision replaces the previous version and the upgraded version becomes the current version. If the current version is not suitable to become the previous version, for example, if the current version is corrupted, the updated version replaces the current version and the previous version is left alone. In the preferred embodiment, the current version of the program and the previous version are copied from memory associated with the processor to the coupled data storage array to provide additional redundancy. Also, the upgrade material are distributed to both processors and the materials are unpacked and checked in a staging directory before upgrading occurs on either processor.

[0026] The host may cancel an upgrade request prior to installation which causes the upgrade materials to be removed from the processor and the host may select the version of the program to run, such that the prior revision may be selected as the current version. Any version of the program may be restored by the host from the data storage array. This function is required when a corrupted version of the revision is on the processor.

[0027] The method as described above may be implemented in various modules as shown in FIG. 4. A receiving module 410 receives the upgrade 405 into the first computer 400 and recognizing that the program is an upgrade of a current program which is resident on the first computer 400 in the processor 420 of the computer. A copy module 430 copies the current program from the processor 420 and stores a backup copy of the current program in memory 440. An installation module 450 installs the upgrade and reboots the first computer 400. A reboot driver 460 reads the processor state of the first computer 400 prior to the initialization of all other application drivers. A reversion module 470 reverts to the backup copy of the current program if the installation of the upgrade fails by recalling the backup copy from memory 440. The backup copy may be a fully executable copy of the program or the backup copy may be compressed. If the backup copy is compressed, the backup copy would be sent to the installation module 450 prior to being executed. In other embodiments in which the upgrade process happens in a server cluster, a transceiver module 480 is included. The transceiver module 480 communicates with a second computer 500 signaling that an upgrade is to occur in the first computer 400 of the server cluster and confirming that the second computer 500 is running a program which is compatible with the upgraded program prior to beginning the installation.

[0028] In an alternative embodiment, the disclosed apparatus and method for nondisruptive upgrades may be implemented as a processor program product for use with a computer system. Such implementation may include a series of computer instructions fixed either on a tangible medium, such as a computer readable medium (e.g., a diskette, CD-ROM, ROM, or fixed disk) or transmittable to a computer system, via a modem or other interface device, such as a communications adapter connected to a network over a medium. The medium may be either a tangible medium (e.g., optical or analog communications lines) or a medium implemented with wireless techniques (e.g., microwave, infrared or other transmission techniques). The series of computer instructions embodies all or part of the functionality previously described herein with respect to the system. Those skilled in the art should appreciate that such computer instructions can be written in a number of programming languages for use with many computer architectures or operating systems. Furthermore, such instructions may be stored in any memory device, such as semiconductor, magnetic, optical or other memory devices, and may be transmitted using any communications technology, such as optical, infrared, microwave, or other transmission technologies. It is expected that such a processor program product may be distributed as a removable medium with accompanying printed or electronic documentation (e.g., shrink wrapped software), preloaded with a computer system (e.g., on system ROM or fixed disk), or distributed from a server or electronic bulletin board over the network (e.g., the Internet or World Wide Web). Of course, some embodiments of the invention may be implemented as a combination of both software (e.g., a processor program product) and hardware. Still other embodiments of the invention are implemented as entirely hardware, or entirely software (e.g., a processor program product).

[0029] Although various exemplary embodiments of the invention have been disclosed, it should be apparent to those skilled in the art that various changes and modifications can be made which will achieve some of the advantages of the invention without departing from the true scope of the invention. These and other obvious modifications are intended to be covered by the appended claims.