REPLICATION IN THE HARP FILE SYSTEM B. Liskov, S. Ghemawat, R. Gruber, P. Johnson, L. Shrira, M. Williams MIT

Paper highlights HARP is a fault-tolerant file system using –Uninterruptible power supplies and replication to support non-blocking writes – Upgradable witnesses to handle site failures Focus on key ideas –The paper was not covered in detail

Overall organization (I) A HARP system consists of three machines –a primary server –a secondary server –a server holding a witness All three servers are on separate Uninterruptible Power Supplies (UPS)

Overall organization (II) Primary UPS SecondaryWitness A UPS B C

The role of the UPS (I) Most file servers use non-blocking writes –Reply to clients before the data are actually written to disk Not acceptable for a fault-tolerant file server –Must write data in stable storage before replying to the client Major drawback is additional delay

The role of the UPS (II) The HARP system reply to clients as soon as the data have written in the main memories of both its primary and secondary server –Replicating data on two servers protect them from a single software or hardware failure –The two UPS protect them from a power failure

The role of the UPS (III) HARP uses replication and UPS to implement a stable storage in the main memory of its two servers

The role of the witness The witness does not do anything as long as both primary and secondary servers are operational When a failure occurs, the server that can contact the witness becomes the new primary –Ensures the consistency of the data in the presence of both site failures and network partitions

After a failure (I) Primary UPS SecondaryWitness A UPS B C

After a failure (II) Site B can communicate with the witness –It becomes the new primary HARP cannot operate with a single site –Site C becomes a temporary secondary: witness is said to be promoted In practice C does not get all replicated data from C – Keeps instead a log of all updates

After a failure (III) Old Primary UPS New Primary Temporary Secondary A UPS B C

After a failure (IV) When A recovers –A is brought up to date by B and C –A and B act again as primary and secondary servers –Temporary secondary server on C is demoted to its previous status of witness