REPLICATION IN THE HARP FILE SYSTEM

1
REPLICATION IN THE HARP FILE SYSTEM

• B. Liskov, S. Ghemawat, R. Gruber,P. Johnson, L.
  Shrira, M. Williams
• MIT

2
Paper highlights

• HARP is a fault-tolerant file system using
• Uninterruptible power supplies and replication to
  support non-blocking writes
• Upgradable witnesses to handle site failures
• Focus on key ideas
• The paper was not covered in detail

3
Overall organization (I)

• A HARP system consists of three machines
• a primary server
• a secondary server
• a server holding a witness
• All three servers are on separate Uninterruptible
  Power Supplies (UPS)

4
Overall organization (II)
UPS
UPS
UPS
Primary
Secondary
Witness
5
The role of the UPS (I)

• Most file servers use non-blocking writes
• Reply to clients before the data are actually
  written to disk
• Not acceptable for a fault-tolerant file server
• Must write data in stable storage before replying
  to the client
• Major drawback is additional delay

6
The role of the UPS (II)

• The HARP system reply to clients as soon as the
  data have written in the main memories of both
  its primary and secondary server
• Replicating data on two servers protect them from
  a single software or hardware failure
• The two UPS protect them from a power failure

7
The role of the UPS (III)

• HARP uses replication and UPS to implement a
  stable storage in the main memory of its two
  servers

8
The role of the witness

• The witness does not do anything as long as both
  primary and secondary servers are operational
• When a failure occurs, the server that can
  contact the witness becomes the new primary
• Ensures the consistency of the data in the
  presence of both site failures and network
  partitions

9
After a failure (I)
UPS
UPS
UPS
Primary
Secondary
Witness
10
After a failure (II)

• Site B can communicate with the witness
• It becomes the new primary
• HARP cannot operate with a single site
• Site C becomes a temporary secondarywitness is
  said to be promoted
• In practice C does not get all replicated data
  from C
• Keeps instead a log of all updates

11
After a failure (III)
UPS
UPS
UPS
Temporary Secondary
Old Primary
New Primary
12
After a failure (IV)

• When A recovers
• A is brought up to date by B and C
• A and B act again as primary and secondary
  servers
• Temporary secondary server on C is demoted to its
  previous status of witness