Failure Fencing (Solstice DiskSuite)

In Sun Cluster configurations using Solstice DiskSuite as the volume manager, it is Solstice DiskSuite itself that determines cluster quorum and provides failure fencing. There is no distinction between different cluster topologies for failure fencing. That is, two-node and greater than two-node clusters are treated identically. This is possible for two reasons:

• No concept of shared disks exists in the HA environment. At most, only one node can master a diskset at any given time. This precludes a situation in which more than one node needs to access the diskset after a node fails.

• The split-brain situation in which the cluster interconnect failure is viewed as a double failure (both private links have failed). In the event of a split-brain situation, Sun Cluster guarantees that data integrity will be maintained. However, there is no guarantee that cluster operation can continue without user intervention.

Disk fencing is accomplished in the following manner.

1. After a node is removed from the cluster, a remaining node does a SCSI reservation of the disk. After this, other nodes (including the node no longer in the cluster) are prevented by the disk itself to read or write to the disk. The disk will return a Reservation_Conflict error to the read or write command. In Solstice DiskSuite configurations, the SCSI reservation is accomplished by issuing the Sun multihost ioctl MHIOCTKOWN.

2. Nodes that are in the cluster continuously enable the MHIOCENFAILFAST ioctl for the disks they are accessing. This ioctl is a directive to the disk driver, and gives the node the capability to panic itself if it cannot access the disk due to the disk being reserved by some other node. The MHIOCENFAILFAST ioctl causes the driver to check the error return from every read and write that this node issues to the disk for the Reservation_Conflict error code, and it also--periodically, in the background--issues a test operation to the disk to check for Reservation_Conflict. Both the foreground and background control flow paths panic if Reservation_Conflict is returned.

3. The MHIOCENFAILFAST ioctl is not specific to dual-hosted disks. If the node that has enabled the MHIOCENFAILFAST for a disk loses access to that disk due to another node reserving the disk (by SCSI-2 exclusive reservation), the node panics.

This solution to disk fencing relies on the SCSI-2 concept of disk reservation, which requires that a disk be reserved by exactly one node.

For Solstice DiskSuite configurations, the installation program scinstall(1M) does not prompt you to specify a quorum device or node preference, or to select a failure fencing policy, as is done in VxVM configurations.