Abstract: Upgrading a network appliance to a second firmware is dynamically specified and implemented to minimize network disruption. The installed firmware runs in a first execution domain and the second firmware runs in safe mode in a second execution domain. Upgrade planning data is produced by monitoring service executables in the second execution domain for stage failures at various execution states. The upgrade planning data is used to produce an upgrade specification for upgrading from the installed firmware to the second firmware. The upgrade planning data can indicate that there are execution state dependencies between the service executables. The upgrade specification can be adapted for the execution state dependencies and used by a finite state machine to implement the upgrade.

Abstract: A networking device can include a packet processing pipeline circuit and a processor. The packet processing pipeline circuit can be configured to implement a data plane and the processor can be configured to implement a control plane. The packet processing pipeline circuit and the processor can also be configured to send a plurality of heartbeat packets on multiple paths to a second networking device. The data plane can produce and send the heartbeat packets to the second networking device within a heartbeat period. The data plane may send a second plurality of heartbeat packets on multiple paths to the second networking device with a second heartbeat period. The heartbeat packets can have unique packet five tuples that include an IP address of the second networking device.

Abstract: A networking device can include a packet processing pipeline circuit and a processor. The packet processing pipeline circuit can be configured to implement a data plane and the processor can be configured to implement a control plane. The packet processing pipeline circuit and the processor can also be configured to send a plurality of heartbeat packets on multiple paths to a second networking device. The data plane can produce and send the heartbeat packets to the second networking device within a heartbeat period. The data plane may send a second plurality of heartbeat packets on multiple paths to the second networking device with a second heartbeat period. The heartbeat packets can have unique packet five tuples that include an IP address of the second networking device.

Abstract: Upgrading a network appliance to a second firmware is dynamically specified and implemented to minimize network disruption. The installed firmware runs in a first execution domain and the second firmware runs in safe mode in a second execution domain. Upgrade planning data is produced by monitoring service executables in the second execution domain for stage failures at various execution states. The upgrade planning data is used to produce an upgrade specification for upgrading from the installed firmware to the second firmware. The upgrade planning data can indicate that there are execution state dependencies between the service executables. The upgrade specification can be adapted for the execution state dependencies and used by a finite state machine to implement the upgrade.

Abstract: Before upgrading a node, a critical state policy can determine whether the node is currently in a critical state. Nodes in critical states should not be upgraded whereas nodes in noncritical states can be. Critical state policies can determine if a node is currently in a critical state and different types of nodes can have different critical state policies. A critical state policy can be stored and used when needed. A critical state policy can use current values for nonconstant node attributes to determine a criticality state of a node. A directive to perform an upgrade that transitions the node to a new version can be received. The criticality state of the node can be determined after receiving the directive and before performing the upgrade. The upgrade may be performed only when the criticality state of the node indicates that the node is in a noncritical state.

Abstract: A network appliance running a first firmware may roll back to that first firmware in a hitless manner during an unsuccessful upgrade to a second firmware. Before the attempted upgrade, a first process in the first firmware is providing a service. The upgrade process is initiated to upgrade the network appliance from the first firmware to a second firmware. The upgrade process can include stopping communication via a data plane of the network appliance to the first process, and detecting an upgrade failure. The upgrade process is hitless because rolling back the upgrade process occurs without halting the first firmware. Rolling back the upgrade includes restoring communications via the data plane to the first process.

Abstract: Described are platforms, systems, and methods for upgrading firmware on a programmable input output (IO) device. In one aspect, a method executed by the programmable IO device comprises: receiving, from a north-bound entity, a request to upgrade firmware installed on at least one CPU core; disabling flow-miss traffic to the at least one CPU core; redirecting the flow-miss traffic to an off-box service; providing a configuration for the programmable IO device to the off-box service; redirecting traffic to the off-box service; upgrading the firmware installed on the at least one CPU core; upgrading at least one program running in the data plane; reprograming a forwarding state provided by the off-box service; disabling the redirection of the traffic to the off-box service; and providing, to the north-bound entity, a notification indicating a completion of the upgrade.

Abstract: Described are platforms, systems, and methods for upgrading firmware on a programmable input output (IO) device. In one aspect, a method executed by the programmable IO device comprises: receiving, from a north-bound entity, a request to upgrade firmware installed on at least one CPU core; disabling flow-miss traffic to the at least one CPU core; redirecting the flow-miss traffic to an off-box service; providing a configuration for the programmable IO device to the off-box service; redirecting traffic to the off-box service; upgrading the firmware installed on the at least one CPU core; upgrading at least one program running in the data plane; reprograming a forwarding state provided by the off-box service; disabling the redirection of the traffic to the off-box service; and providing, to the north-bound entity, a notification indicating a completion of the upgrade.