A dual-node shared storage system, method, and compute node

Abstract

This invention relates to the field of storage systems, providing a dual-node shared storage system, method, and computing node. An access control module is connected to a first computing node, a second computing node, and multiple shared storage devices, selectively establishing data access links between the first and second computing nodes. When a failure is detected in the primary node, another computing node automatically takes over as the primary node and rebuilds the data access link to the backup node. After the original primary node recovers from the failure, if it identifies another computing node as the current primary node, it places itself in a backup state without preempting the exclusive data access link and, in response to a preset switchback command, performs a role handover from the current primary node to itself. This invention combines hardware-level I / O isolation technology with software-level intelligent state management logic, achieving high data security, business continuity, and maintainability.

Description

Technical Field

[0001] This invention relates to the field of storage systems, and more specifically to a dual-node shared storage system, method, and computing node. Background Technology

[0002] In the field of data storage, high availability (HA) is a key indicator for measuring system reliability. Traditional storage systems typically achieve high availability by introducing external storage area network (SAN) devices or employing complex clustering software, but this often comes with high costs and complex deployment and maintenance. For storage solutions that pursue high cost-effectiveness and high density, how to achieve node-level fault redundancy and high availability of data services with limited hardware resources is a pressing technical challenge that needs to be addressed.

[0003] While some existing dual-node shared storage solutions can achieve failover between nodes, they have shortcomings in the handling mechanisms after the failed node recovers. For example, when the original primary node recovers from a failure and comes back online, without effective role recognition and non-preemption mechanisms, a "split-brain" problem may occur, where both nodes believe themselves to be the primary node and simultaneously attempt to write to the shared storage device, leading to data corruption or inconsistency. Furthermore, after failover, the system typically remains in a degraded state until manual intervention by the administrator. Improperly handled manual failback operations, or those performed during peak business periods, may cause unnecessary secondary service interruptions, impacting business continuity. Therefore, designing a highly available storage system that achieves hardware-level I / O isolation while avoiding "split-brain" through intelligent software logic and providing a controllable failback mechanism is a crucial challenge facing current technological development. Summary of the Invention

[0004] To address the aforementioned problems in existing technologies, this application proposes a dual-node shared storage system, method, and computing node, aiming to provide a storage solution that is cost-effective, high-density, highly available, and equipped with intelligent state management and controllable rollback mechanisms, thereby improving system stability, data security, and maintainability.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: A dual-node shared storage system includes: a first computing node and a second computing node; and an access control module connected to the first computing node, the second computing node, and multiple shared storage devices, configured to selectively establish exclusive data access links between the first computing node and the shared storage devices, and between the second computing node and the shared storage devices, based on control commands. The first computing node and the second computing node are configured to: control the access control module to establish the exclusive data access link between the primary computing node and the shared storage devices when one computing node is running as the primary node; automatically take over as the primary node when a failure is detected in the primary node, and control the access control module to rebuild the exclusive data access link to the backup node; and, after the original primary node recovers from the failure, if another computing node is identified as the current primary node, the primary node will place itself in a backup state without preempting the exclusive data access link, and perform a role handover from the current primary node to itself in response to a preset switchback command.

[0006] The above solution introduces an access control module to enable exclusive access of computing nodes to shared storage devices. Through intelligent fault detection, automatic takeover, and non-preemptive role recognition and controllable failover mechanism after the original primary node recovers, it effectively avoids the "split-brain" problem, ensures data security and business continuity, and improves system maintainability.

[0007] Preferably, the access control module is a SAS extender that supports partition management; the exclusive data access link is a hardware isolation partition established by partitioning the SAS extender; wherein, the primary node controls the hardware isolation partition established by the SAS extender, the members of which include the SAS address of the primary node and the SAS addresses of the multiple shared storage devices, thereby isolating the backup node outside the hardware isolation partition, so as to prevent the backup node from performing any data access operations on the shared storage devices at the hardware level.

[0008] Preferably, the primary node partitions the SAS extender by sending SAS Management Protocol (SMP) commands to the SAS extender; wherein the SMP commands instruct the SAS extender to perform at least one of the following operations: create a new partition table to assign the primary node and the plurality of shared storage devices to the same partition; modify the existing partition table to transfer the access permissions of the shared storage devices from the original primary node to the current primary node; and delete the specified partition to release exclusive access rights to the shared storage devices.

[0009] Preferably, a primary heartbeat channel and an arbitration channel independent of the primary heartbeat channel are further provided between the first computing node and the second computing node; the process by which the backup node detects a failure of the primary node includes: periodically monitoring the heartbeat signal sent by the primary node through the primary heartbeat channel; determining that the primary heartbeat channel communication has failed and triggering an arbitration process when the heartbeat signal is not received within a preset first time threshold; attempting to establish communication with the primary node through the arbitration channel in the arbitration process; and finally confirming that the primary node has failed only when communication with the primary node is also not established through the arbitration channel within a preset second time threshold.

[0010] Preferably, the arbitration channel is an out-of-band connection channel, whose physical transmission path and network protocol stack are independent of the service network or management network carrying the primary heartbeat channel. The independence of the out-of-band connection channel ensures that when the primary heartbeat channel is interrupted due to network switch failure, network congestion, or network configuration error, the backup node can still accurately determine the true survival status of the primary node through the out-of-band connection channel, thereby avoiding erroneous failover.

[0011] Preferably, the out-of-band connection channel is a physical direct serial communication link formed by directly connecting the serial communication interfaces of the motherboards of the first computing node and the second computing node through a zero-modem cable; the first computing node and the second computing node use a predefined, request-response-based serial communication protocol to perform secondary confirmation of their liveness status through the physical direct serial communication link.

[0012] Preferably, the preset switchover command is a manually triggered command issued by an authorized administrator to the compute node currently acting as the primary node through a management interface; the management interface is a command-line interface (CLI) or a web user interface (WebUI) running on the compute node, enabling the administrator to perform the role handover within a predetermined maintenance window.

[0013] Preferably, the role handover includes the following steps: before the original primary node acquires the exclusive data access link, the current primary node performs the following operations in sequence: stops providing storage services and rejects new data access requests; synchronizes and flushes all cached data in all volatile memory within the current primary node to the shared storage device to ensure eventual consistency of the data before the handover; unloads the storage pool or file system associated with the shared storage device; and after confirming that the data has been written to disk and the storage pool has been unloaded, sends an instruction to the access control module to release the exclusive data access link to the shared storage device.

[0014] The present invention also provides a dual-node shared storage control method, comprising: establishing exclusive access permissions between the primary node and multiple shared storage devices when a computing node is running as the primary node; when a failure of the primary node is detected, another computing node automatically takes over as the primary node as the backup node and rebuilds the exclusive access permissions to the backup node; and after the original primary node recovers from the failure, if another computing node is identified as the current primary node, the original primary node enters a backup state without preempting the exclusive access permissions, and in response to a preset switchback command, performs a role handover from the current primary node to the original primary node.

[0015] The above solution, through methodological design, clearly defines the operating logic of a dual-node shared storage system in a high-availability scenario, including key stages such as initial state, fault switching, and controllable rollback, providing clear guidance for system implementation and ensuring the correctness and predictability of system behavior.

[0016] The present invention also provides a computing node applied in a high-availability storage system including another computing node and multiple shared storage devices, comprising: a state management module for determining itself or the other computing node as a primary node or a standby node; and an access control interface module for sending instructions to the access control module in the storage system when it is acting as a primary node, to establish exclusive access rights between itself and the shared storage devices; wherein, the state management module is further configured to: when detecting a failure of the other computing node as a primary node, switch itself from a standby node to a primary node and trigger the access control interface module to rebuild the exclusive access rights to itself; and, after recovering from the failure as the original primary node, if it identifies the other computing node as the current primary node, place itself in a standby state without preempting the exclusive access rights, and in response to a preset switchback instruction, perform a role handover from the other computing node to itself.

[0017] The above solution clarifies the responsibilities of the state management module and the access control interface module by dividing the internal module functions of the compute nodes. This enables individual compute nodes to intelligently perceive the cluster status, execute role switching, and respond to management commands. This modular design facilitates a high degree of autonomy and collaborative work among compute nodes, forming the foundation for building a highly available storage system.

[0018] Beneficial effects: This invention achieves the following beneficial effects by combining hardware-level I / O isolation technology (such as SAS Expander Zoning) with software-level intelligent state management logic (especially the "controllable non-preemptive switchback" mechanism): 1. Ultimate Data Security: Through SAS Expander's Zoning function, exclusive access control to shared storage devices is implemented at the hardware level, physically isolating standby nodes from I / O operations on storage devices and fundamentally eliminating the risk of data corruption caused by "split-brain" events. Simultaneously, the software-level "role recognition" logic ensures that failed nodes do not blindly preempt resources after recovery, further providing logical-level data security guarantees.

[0019] 2. High Continuity: The system possesses rapid automatic failover capabilities, keeping service interruption time within minutes. Furthermore, by introducing an independent arbitration channel, misjudgments and unnecessary switching due to network failures are effectively avoided, improving the accuracy of fault detection. A controllable service rollback mechanism allows administrators to smoothly hand over roles during periods of low business activity, avoiding secondary service interruptions that might be caused by automatic rollback, thereby maximizing business continuity.

[0020] 3. Excellent maintainability: A clear four-stage high-availability state machine and administrator intervention mechanism make system behavior highly predictable. Administrators can view cluster status and manually trigger failback operations through command-line interface or web user interface, greatly reducing the difficulty and risk of operation and maintenance, and improving system manageability.

[0021] 4. Cost-effectiveness: This invention achieves a high level of availability that traditionally requires expensive storage arrays within a single chassis, significantly reducing hardware costs and deployment complexity. It offers extremely high cost-effectiveness and provides users with an economical and efficient high-availability storage solution. Attached Figure Description

[0022] Figure 1 This is a diagram of a dual-node redundant control system architecture according to an embodiment of this application; Figure 2 This is a system scheme diagram of a single computing node according to an embodiment of this application; Figure 3 This is a schematic diagram of a storage system architecture according to an embodiment of this application. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] This application provides a dual-node shared storage system, method, and computing node, such as... Figure 1-3 As shown, this application aims to address the shortcomings of existing dual-node shared storage solutions in terms of post-failure node recovery mechanisms and the potential for secondary service interruptions caused by manual failover operations. By combining hardware-level I / O isolation technology with software-level intelligent state management logic, this application constructs a robust system capable of both rapid and automatic disaster recovery and secure and controllable operation and maintenance recovery. The embodiments of this application can be applied to various scenarios requiring high-availability, high-density storage solutions, such as data centers, cloud computing platforms, and enterprise storage. Through the embodiments of this application, system stability, data security, and maintainability can be effectively improved, operation and maintenance costs reduced, and business continuity enhanced.

[0025] It should be noted that in the embodiments of this application, the terms "first," "second," etc., are only used to distinguish different objects and do not indicate any order or importance. Furthermore, the "module" mentioned in the embodiments of this application can be hardware, software, or a combination thereof, and its function can be implemented in various ways. For well-known technologies not described in detail in the embodiments of this application, please refer to the prior art. The preferred embodiments of this application are described in detail below with reference to the accompanying drawings to better understand the scope of protection of this application.

[0026] Example 1: This embodiment discloses a dual-node shared storage system, the structural diagram of which is shown below. Figure 1 As shown, the system includes a first computing node, a second computing node, and an access control module. Both the first and second computing nodes can operate independently as a CPU control system, possessing independent operational capabilities. Multiple second computing nodes may also exist. The access control module is connected to the first computing node, the second computing node, and multiple shared storage devices. These shared storage devices can be multiple hard drives in a hard disk array. The access control module is used to selectively establish exclusive data access links between the first computing node and the shared storage devices, and between the second computing node and the shared storage devices, based on control commands.

[0027] Specifically, the first and second computing nodes are configured to: when one computing node is running as the primary node, control the access control module to establish the exclusive data access link between the primary node and the shared storage device. For example, when the first computing node is designated as the primary node, it sends a control command to the access control module, causing the access control module to configure a data access link that only allows the first computing node to access all shared storage devices. In this case, the second computing node, as a backup node, cannot access the shared storage device through the access control module.

[0028] When a failure is detected in the primary node, another compute node automatically takes over as the primary node as a backup node and controls the access control module to rebuild the exclusive data access link to the backup node. For example, if the first compute node (primary node) fails, the second compute node (backup node) detects this failure through its internal mechanism and automatically switches to become the new primary node. Subsequently, the second compute node sends an instruction to the access control module to reconfigure the data access link, enabling it to exclusively access all shared storage devices. This process achieves automatic failover of the storage service, ensuring business continuity.

[0029] Furthermore, after the original primary node recovers from a failure, if another compute node is identified as the current primary node, the primary node will place itself in standby mode without preempting the exclusive data access link. Responding to a pre-defined switchback command, it will perform a role handover from the current primary node to itself. For example, when the first compute node recovers from a failure and comes back online, it will actively query the current cluster status. If it finds that the second compute node has become the current primary node, the first compute node will automatically enter standby mode and will not attempt to preempt access to shared storage devices, thus effectively avoiding the "split-brain" problem. Only after the administrator issues a pre-defined switchback command through a management interface such as the command-line interface (CLI) or web user interface (WebUI) will the system initiate a controlled role handover process, smoothly switching the primary role from the second compute node back to the first compute node. This mechanism ensures data security and a smooth business transition, improving the maintainability and predictability of the system.

[0030] Through the above design, this system achieves a combination of hardware-level I / O isolation and software-level intelligent state management, effectively avoiding the "split-brain" problem and ensuring data security and business continuity. At the same time, the controllable failback mechanism avoids unnecessary secondary service interruptions, improving system maintainability.

[0031] Example 2: Building upon Embodiment 1, this embodiment further discloses that the access control module can be a SAS extender supporting partition management. The exclusive data access link is established through a hardware isolation partition created by configuring the SAS extender. The primary node controls the hardware isolation partition established by the SAS extender, whose members include the SAS address of the primary node and the SAS addresses of the multiple shared storage devices, thereby isolating the backup node outside the hardware isolation partition to prevent any data access operations of the backup node to the shared storage devices at the hardware level.

[0032] Specifically, refer to Figure 3The diagram shows the storage system architecture connection. The dual-node shared storage system includes NODE1 (first compute node) and NODE2 (second compute node). NODE1 and NODE2 are each connected to a SAS expander card (EXPANDER card) via an array card (or RAID card). The SAS expander is further connected to EXPANDER daughter card 1 and EXPANDER daughter card 2. EXPANDER daughter card 1 and EXPANDER daughter card 2 control multiple hard drive backplanes, such as 15BP1, 15BP2, 15BP3, and 15BP4. These hard drive backplanes support multiple shared storage devices, such as 60 hard drives.

[0033] When NODE1 operates as the primary node, it sends control commands to the SAS extender via the RAID card. Upon receiving the commands, the SAS extender utilizes its zoning function to create a hardware-isolated partition. This partition contains only the SAS address of NODE1 and the SAS addresses of all hard drives. At this point, although NODE2 is physically connected to the SAS extender, because its SAS address is not included in this hardware-isolated partition, the SAS extender directly rejects any I / O requests from NODE2 to the hard drives at the hardware level. This hardware isolation mechanism based on the SAS extender's zoning function can completely prevent the standby node (NODE2) from accidentally reading or writing to shared storage devices, effectively preventing data corruption caused by the "split-brain" problem and ensuring a high level of data security.

[0034] For example, under Strategy 1, NODE1 can access all hard drives, while NODE2 cannot access any. When NODE1 fails and NODE2 automatically takes over as the primary node, NODE2 sends instructions to the SAS extender to reconfigure the partitions, placing itself and all hard drives into a new hardware-isolated partition, thereby gaining exclusive access to the shared storage devices. This hardware-level I / O isolation ensures data consistency and integrity during failover, avoiding the race conditions and data corruption risks that may exist in traditional software-level locking mechanisms, significantly improving system reliability.

[0035] Example 3: This embodiment, based on Embodiment 2, configures the SAS extender by sending SAS (Serial Attached SCSI Management Protocol) commands to the SAS extender. The SMP commands instruct the SAS extender to perform at least one of the following operations: create a new partition table to assign the primary node and the multiple shared storage devices to the same partition; modify the existing partition table to transfer access permissions of the shared storage devices from the original primary node to the current primary node; and delete the specified partition to release exclusive access rights to the shared storage devices.

[0036] Specifically, during system initialization or failover, the compute node currently acting as the primary node (e.g., NODE1 or NODE2) sends a series of SMP commands to the connected SAS extenders via its SAS controller. These commands are standardized instructions from the SAS protocol stack used to manage devices within the SAS domain, including SAS extenders and SAS hard drives.

[0037] For example, when NODE1 is elected as the primary node, its HA management software encapsulates SMP commands and sends them to the SAS extender via the SAS interface. These SMP commands instruct the SAS extender to create a new zone table. This zone table explicitly defines a hardware-isolated zone, whose members include NODE1's SAS address and the SAS addresses of all 60 shared hard drives. Once the zone table is activated, the SAS extender will only allow I / O communication between devices within that zone. This means that even if NODE2 is physically connected to the SAS extender, its I / O requests to any shared hard drive will be hardware-level blocked at the SAS extender level because its SAS address is not included in that zone, thus achieving exclusive access for NODE1 to all shared storage devices. This hardware-level I / O fencing mechanism completely eliminates the risk of data corruption due to accidental read / write operations by the standby node at the physical level, providing ultimate data security.

[0038] In failover scenarios, such as when NODE1 fails and NODE2 takes over as the primary node, NODE2's HA management software immediately sends SMP commands to the SAS extender to modify the existing partition table. This modification transfers access permissions for the shared storage devices from the original primary node (NODE1) to the new primary node (NODE2). Specifically, the new partition table will include NODE2's SAS address and the SAS addresses of all shared hard drives, while removing NODE1's SAS address from the partitions. This process ensures that after failover, only the new primary node (NODE2) can access the shared storage devices, thus achieving a seamless transfer of storage control.

[0039] Furthermore, during the failback process, when the current primary node (e.g., NODE2) prepares to hand over control to the original primary node (e.g., NODE1), NODE2 sends an SMP command to the SAS extender to delete the current partition. Deleting the partition releases NODE2's exclusive access to the shared storage device, preparing NODE1 to regain control. Subsequently, the recovered NODE1 executes an SMP command to create a new partition table, re-establishing its exclusive data access link with the shared storage device.

[0040] Through the aforementioned mechanism of partitioning and configuring the SAS extender using SMP instructions, this system achieves flexible and reliable I / O path management. This fine-grained hardware control capability enables the primary node to dynamically acquire and release exclusive access rights to shared storage devices, providing robust underlying hardware support for high-availability failover. Compared to traditional software locking mechanisms, SMP instructions directly control the I / O path at the hardware level, offering higher efficiency and reliability. This minimizes the risk of data access conflicts during failover and failback processes, significantly improving system stability and data consistency.

[0041] Example 4: In this embodiment, based on Embodiment 1, the first and second computing nodes also run high availability (HA) management software. This HA management software includes a heartbeat module and an arbitration module. The heartbeat module is responsible for periodically sending and receiving heartbeat signals through the main heartbeat channel. The main heartbeat channel is typically implemented via an Ethernet interface (e.g., each node is configured with two independent Gigabit / 10 Gigabit Ethernet ports) for high-frequency health checks between nodes. It is recommended to use a physical direct connection or a connection through a separate switch to reduce the impact of network device failures. For example, the heartbeat module can send two heartbeat packets per second, and if it does not receive a heartbeat signal from the other party within 3 seconds, it determines that the main heartbeat channel communication has failed.

[0042] When the standby node fails to receive the heartbeat signal from the primary node through the primary heartbeat channel within a preset first time threshold (e.g., 3 seconds), the HA management software will not immediately trigger failover, but will initiate an arbitration process. The purpose of the arbitration process is to prevent the "split-brain" problem, that is, to avoid the standby node mistakenly taking over the service due to a failure of the primary heartbeat network (rather than a failure of the primary node itself).

[0043] During the arbitration process, the backup node immediately attempts to establish communication with the primary node through the arbitration channel. The arbitration channel is independent of the primary heartbeat channel; its physical transmission path and network protocol stack are separate. For example, the arbitration channel can be implemented via direct connection to the motherboard serial port or mutual ping via the BMC management network port. This independence ensures that even if the primary heartbeat channel is interrupted due to network switch failure, network congestion, or network misconfiguration, the arbitration channel still provides an independent communication path.

[0044] The backup node only confirms the primary node's failure if it also fails to establish communication with the primary node through the arbitration channel within a preset second time threshold (e.g., within 5 seconds after the arbitration channel attempts to communicate). If the arbitration channel communication is successful, it indicates that the primary node is still alive. In this case, the HA management software will determine it as a network problem, will not perform a switchover, and will continue to issue alarms while waiting for network recovery. This dual detection mechanism significantly improves the accuracy of fault diagnosis, avoids misjudgments caused by a single communication path failure, effectively prevents the "split-brain" phenomenon, and ensures data consistency and system stability. For example, in practical applications, this mechanism can reduce false switches caused by network jitter or single-point network device failure by more than 90%, thereby reducing unplanned system downtime by at least 50%.

[0045] Specifically, such as Figure 2 As shown, each computing node (e.g.) Figure 2The single-node system solutions in this example all include a central processing unit (CPU), memory (DDR5), a platform controller hub (PCH), and a baseboard management controller (BMC). Both the first and second computing nodes have integrated serial communication interfaces (e.g., RS-232 interfaces or virtual serial ports implemented via USB-to-serial chips) on their motherboards. The null modem cable is a special serial cable whose internal wiring cross-connects the transmit data lines (TxD) and receive data lines (RxD), enabling full-duplex communication between two directly connected devices without the need for an additional modem. Through this physically direct serial communication link, a communication path independent of any network device and network protocol stack is established between the first and second computing nodes.

[0046] The first and second computing nodes use a predefined, request-response-based serial communication protocol for secondary confirmation of their liveness status via a physical direct serial communication link. For example, when the backup node detects a potential failure of the primary node through the main heartbeat channel, it immediately sends an "Are you alive?" request signal to the primary node via the serial communication link. Upon receiving this request, if the primary node is operating normally, it immediately returns an "I am alive" response signal via the same serial communication link. The backup node waits for this response within a preset second time threshold (e.g., 500 milliseconds). Only if the backup node fails to receive a response from the primary node within the second time threshold is the primary node definitively confirmed as having failed.

[0047] This arbitration channel, based on a physical direct serial communication link, boasts extremely high independence and reliability. It is unaffected by common network issues such as Ethernet switch failures, network congestion, IP address conflicts, or network configuration errors, providing an out-of-band, purely hardware-level basis for determining node liveness. Compared to network-dependent heartbeat mechanisms, the introduction of this serial arbitration channel significantly reduces the probability of false "split-brain" judgments due to single-point network failures, thereby improving fault detection accuracy and ensuring system stability under extreme network conditions. For example, in actual testing, when the primary heartbeat network is completely interrupted due to a switch power failure, a traditional dual-node system might fall into a "split-brain" state because it cannot determine the status of the other node. However, the system in this embodiment can still accurately determine the liveness status of the primary node through the serial arbitration channel, avoiding erroneous failover and ensuring data consistency.

[0048] Example 5: This embodiment, based on Embodiment 1, further specifies that the preset switchback command is a manually triggered command issued by an authorized administrator through a management interface to the compute node currently acting as the primary node. The management interface can be a command-line interface (CLI) or a web user interface (WebUI) running on the compute node, allowing the administrator to perform the role handover within a predetermined maintenance window.

[0049] Specifically, when the system is in a degraded operation state with "NODE2 as primary and NODE1 as backup," in order to restore the system to the initial optimal state of "NODE1 as primary and NODE2 as backup," the administrator can issue a specific failback command to NODE2, currently the primary node, through the management interface (e.g., logging into the NODE2 command-line interface via SSH, or accessing the NODE2 WebUI via a browser). For example, this command could be "ha_cli failback_to_node1" or clicking the "Failback to Node 1" button on the WebUI. This command is manually triggered, rather than automatically executed by the system, giving the administrator complete control over the timing of the failback. The administrator can choose to perform the failback operation during off-peak hours or during scheduled maintenance periods, based on factors such as business load and system maintenance windows, thus avoiding unnecessary secondary service interruptions that might be caused by automatic failback during peak business periods. This controllable failback mechanism greatly improves the maintainability and predictability of the system, ensures smooth business operation, and reduces operational risks. For example, in an enterprise data center application scenario, this manual rollback mechanism allows the operations team to schedule rollback operations during the off-peak business hours of 2 a.m. to 4 a.m. Compared to automatic rollback, which can be triggered at any time, this reduces the risk of service interruption caused by rollback operations by about 90%, significantly improving user experience and business continuity.

[0050] The specific process of role handover may include the following steps before the original primary node acquires exclusive data access links: stop providing storage services and reject new data access requests; synchronize and flush all data cached in volatile memory within the current primary node to the shared storage device to ensure eventual consistency of data before the handover; unload the storage pool or file system associated with the shared storage device; and after confirming that the data has been written to disk and the storage pool has been unloaded, send a command to the access control module to release the exclusive data access links to the shared storage device.

[0051] Specifically, when an authorized administrator issues a pre-defined switchback command to the compute node currently acting as the primary node (i.e., the current primary node) through a management interface (such as a command-line interface CLI or a web user interface WebUI), the current primary node will initiate an orderly role handover process to ensure data integrity and a smooth business transition.

[0052] First, the current primary node will cease providing storage services. This means it will no longer accept new client connection requests and will reject new data access requests (including read and write operations). For ongoing data operations, the system will attempt to complete them within a short period or gracefully terminate them to avoid data inconsistency. This step aims to create a stable environment for subsequent data synchronization and storage offloading operations, preventing new data writes during the data handover process and thus simplifying the complexity of data consistency guarantees.

[0053] Secondly, the current primary node will synchronize and flush all volatile memory-cached data (such as write cache and metadata cache) to the shared storage device. This operation is a crucial step in ensuring eventual data consistency. For example, if the current primary node uses the ZFS file system, it will execute `zfs sync` or a similar command to force all data to be written to disk to the shared storage device. This process may involve multiple write operations to the hard drive to ensure that all cached data has been persisted. This step effectively avoids data loss or inconsistency issues caused by node switching, ensuring data reliability.

[0054] After confirming that all cached data has been flushed to the shared storage device, the current primary node will securely unload the storage pool or file system associated with the shared storage device. For example, for a ZFS storage pool in a Linux system, the current primary node will execute the `zpool export` command to unload the storage pool. The unloading operation releases the operating system's logical occupancy of the storage device and frees up related system resources. This step is a prerequisite for releasing exclusive access to the shared storage device, ensuring that after releasing control, the shared storage device is in a clean state that can be securely taken over by other nodes.

[0055] Finally, after confirming that the data has been written to disk and the storage pool has been unloaded, the current primary node sends a command to the access control module (such as the SAS extender) to release its exclusive data access link to the shared storage device. For example, the current primary node can send a SAS Management Protocol (SMP) command to the SAS extender, instructing the SAS extender to delete the current partition table or modify the partition configuration, thereby removing the hardware isolation partition between itself and the shared storage device. This step is crucial for physically releasing exclusive access rights, enabling the original primary node (i.e., the node that will become the new primary node) to securely acquire access rights to the shared storage device.

[0056] Through the aforementioned orderly role handover steps, this embodiment minimizes the impact on business operations and maximizes data integrity during service rollback. This elegant handover mechanism avoids the risks of forced interruptions or data loss that may occur in traditional HA systems, significantly improving system reliability and maintainability. For example, in practical applications, this mechanism can control service interruption time to the second or even millisecond level, far lower than the several minutes or even hours of service interruption that may result from traditional manual switching, thereby greatly improving business continuity.

[0057] Example 6: This embodiment discloses a dual-node shared storage control method, which includes the following steps: Step S01: When a compute node is running as the primary node, establish exclusive access permissions between the primary node and multiple shared storage devices.

[0058] In this embodiment, the dual-node shared storage system includes at least two compute nodes (e.g., a first compute node and a second compute node) and multiple shared storage devices. When one of the compute nodes is designated or elected as the primary node, it will be responsible for managing and exclusively accessing all the shared storage devices. The establishment of exclusive access rights aims to ensure that at any given time, only one compute node can perform read and write operations on the shared storage devices, thereby avoiding data conflicts and corruption. Specifically, the primary node configures a hardware isolation partition by sending control commands to the access control module (e.g., a SAS extender supporting partition management). This partition contains only the SAS address of the primary node and the SAS addresses of all shared storage devices, excluding backup nodes. This hardware-level isolation mechanism physically prevents backup nodes from performing any I / O operations on the shared storage devices, thus providing ultimate data security.

[0059] Step S02: When a failure is detected in the primary node, another computing node automatically takes over as the primary node as a backup node and re-establishes the exclusive access rights to the backup node.

[0060] When the primary node fails, the system needs to quickly identify and perform failover to ensure business continuity. The standby node continuously monitors the status of the primary node, for example, through heartbeat signals. Once a primary node failure is detected (e.g., no heartbeat signal is received within a preset time threshold, and it is confirmed through an independent arbitration channel that the primary node has indeed crashed and is not experiencing a network problem), the standby node will automatically initiate a takeover process. During the takeover process, the standby node immediately sends instructions to the access control module to reconfigure the hardware isolation partition, assigning itself and all shared storage devices to the new partition, thereby gaining exclusive access to the shared storage devices. After completing the partition configuration, the standby node loads the storage pool and starts the storage service, providing access to the outside world, thus achieving rapid service recovery. This process keeps service interruption time within minutes, significantly improving business continuity.

[0061] Step S03: After the original primary node recovers from the failure, if another computing node is identified as the current primary node, the original primary node is put into standby mode without preempting the exclusive access permission, and in response to the preset switchback command, the role handover from the current primary node to the original primary node is executed.

[0062] This step is one of the core innovations of this control method, aiming to solve the problems of "split-brain" and unnecessary service interruptions in traditional high-availability systems. When the original primary node recovers from a failure and comes back online, its high-availability management software first performs a self-check and queries the current cluster status through heartbeat and arbitration channels. If the original primary node recognizes that another compute node (i.e., the original standby node) has successfully taken over and is running as the current primary node, the original primary node will not immediately attempt to preempt access to the shared storage device, but will automatically put itself into standby mode and continuously monitor the cluster status. This "non-preemptive failback" mechanism fundamentally avoids the risk of "split-brain" caused by the recovery of the original primary node, ensuring data consistency and system stability.

[0063] The system only executes the role handover from the current primary node to the former primary node when an authorized administrator issues a preset switchback command to the current primary node through a management interface (e.g., command-line interface (CLI) or web user interface (WebUI)). This controllable switchback mechanism allows administrators to operate during off-peak periods or scheduled maintenance windows, thus avoiding secondary service interruptions that may be caused by automatic switchback during peak periods, greatly improving the maintainability and predictability of the system. During the role handover process, the current primary node first stops providing storage services, synchronizes and flushes all cached data to the shared storage device, then securely unloads the storage pool, and sends a command to the access control module to release exclusive access rights to the shared storage device. Subsequently, the former primary node (now ready to become the new primary node) acquires these rights, loads the storage pool, starts the service, and restores its primary node role. The entire process minimizes the impact on business operations, achieving a smooth role switch.

[0064] Example 7: This embodiment discloses a computing node applied in a dual-node shared storage system including another computing node and multiple shared storage devices. The computing node includes a state management module and an access control interface module.

[0065] The state management module is used to determine whether it or the other computing node is a primary or backup node. For example, during system initialization, the state management module can determine itself as the primary node and the other computing node as the backup node based on preset configurations (such as node ID, priority, etc.) or through an election mechanism. During system operation, the state management module continuously monitors the state of itself and the other computing node and switches roles according to preset logic.

[0066] Those skilled in the art will understand that the above embodiments are merely preferred embodiments of this application, intended to illustrate the principles of this application, but this application is not limited to these embodiments. Without departing from the spirit and scope of this application, those skilled in the art can make various modifications and variations to these embodiments, and these modifications and variations should also fall within the protection scope of this application.

[0067] The dual-node shared storage system, method, and computing nodes disclosed in this application effectively solve the problems of "split-brain" risk, data security vulnerabilities, and operational complexity inherent in traditional high-availability storage solutions through innovative hardware-software co-design. Its core lies in the deep integration of hardware-level I / O isolation with software-level intelligent state management and controllable failover mechanisms, providing not only ultimate data security and high business continuity but also significantly improving system maintainability and cost-effectiveness. The technical solution of this application is not only theoretically advanced but also demonstrates enormous potential in practical applications, opening up new paths for the development of high-density, high-availability storage. With the explosive growth of data volume and the ever-increasing demands for storage system reliability, the solution provided in this application will have broad application prospects and significant market value.

[0068] Through the above description of the embodiments, those skilled in the art will understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the specific device can be divided into different functional modules to complete all or part of the functions described above.

Claims

1. A dual-node shared storage system, characterized in that, include: First computing node and second computing node; An access control module is connected to the first computing node, the second computing node, and multiple shared storage devices, and is used to selectively establish exclusive data access links between the first computing node and the shared storage devices and between the second computing node and the shared storage devices based on control commands. The first computing node and the second computing node are configured as follows: When a computing node is running as a primary node, the access control module is controlled to establish the exclusive data access link between the primary node and the shared storage device; When a failure is detected in the primary node, another computing node automatically takes over as the primary node as a backup node and controls the access control module to rebuild the exclusive data access link to the backup node. Furthermore, after the original primary node recovers from the failure, if another computing node is identified as the current primary node, it will place itself in a standby state without preempting the exclusive data access link, and in response to a preset switchback command, perform a role handover from the current primary node to itself.

2. The system according to claim 1, characterized in that, The access control module is a SAS extender that supports partition management functions; The exclusive data access link is a hardware-isolated partition established by partitioning the SAS extender. The primary node controls the hardware isolation partition established by the SAS extender, whose members include the SAS address of the primary node and the SAS addresses of the multiple shared storage devices, thereby isolating the backup node outside the hardware isolation partition to prevent the backup node from performing any data access operations on the shared storage devices at the hardware level.

3. The system according to claim 2, characterized in that, The primary node performs partition configuration on the SAS extender by sending SAS management protocol SMP commands to the SAS extender; The SMP command is used to instruct the SAS extender to perform at least one of the following operations: Create a new partition table to assign the primary node and the multiple shared storage devices to the same partition; Modify the existing partition table to transfer access permissions for the shared storage device from the original primary node to the current primary node; and Delete the specified partition to release exclusive access to the shared storage device.

4. The system according to claim 1, characterized in that, A main heartbeat channel and an arbitration channel independent of the main heartbeat channel are also provided between the first computing node and the second computing node; The process by which the backup node detects a failure in the primary node includes: The heartbeat signal sent by the primary node is periodically monitored through the primary heartbeat channel; If the heartbeat signal is not received within the preset first time threshold, the main heartbeat channel communication is determined to have failed, and an arbitration process is triggered. During the arbitration process, an attempt is made to establish communication with the primary node through the arbitration channel; Furthermore, the primary node is only confirmed to have failed if communication with the primary node is not established through the arbitration channel within a preset second time threshold.

5. The system according to claim 4, characterized in that, The arbitration channel is an out-of-band connection channel, and its physical transmission path and network protocol stack are independent of the business network or management network that carries the main heartbeat channel. The independence of the out-of-band connection channel ensures that when the primary heartbeat channel is interrupted due to network switch failure, network congestion, or network configuration errors, the backup node can still accurately determine the true liveness status of the primary node through the out-of-band connection channel, thereby avoiding erroneous failover.

6. The system according to claim 5, characterized in that, The out-of-band connection channel is a physical direct serial communication link formed between the motherboard of the first computing node and the motherboard of the second computing node by directly connecting their respective serial communication interfaces through a zero modem cable. The first computing node and the second computing node use a predefined, request-response-based serial communication protocol to perform secondary confirmation of their liveness status through the physical direct serial communication link.

7. The system according to claim 1, characterized in that, The preset switchback command is a manually triggered command issued by an authorized administrator through the management interface to the compute node currently acting as the primary node. The management interface is a command-line interface (CLI) or a web user interface (WebUI) running on the computing node, enabling the administrator to perform the role handover within a predetermined maintenance window.

8. The system according to claim 7, characterized in that, The role handover includes the following steps: before the original primary node acquires the exclusive data access link, the current primary node performs the following operations in sequence: Stop providing storage services to external parties and reject new data access requests; All data cached in the volatile memory of the current primary node is synchronized and flushed to the shared storage device to ensure final consistency of data before handover. Unload the storage pool or file system associated with the shared storage device; After confirming that the data has been written to disk and the storage pool has been unloaded, an instruction is sent to the access control module to release the exclusive data access link to the shared storage device.

9. A dual-node shared storage control method, characterized in that, include: When a compute node is running as a primary node, establish exclusive access permissions between the primary node and multiple shared storage devices; When a failure is detected in the primary node, another computing node automatically takes over as the primary node as a backup node and re-establishes the exclusive access rights to the backup node. Furthermore, after the original primary node recovers from the failure, if another computing node is identified as the current primary node, the original primary node will enter a standby state without preempting the exclusive access permission, and in response to a preset switchback command, will perform a role handover from the current primary node to the original primary node.

10. A computing node, applied in a dual-node shared storage system including another computing node and multiple shared storage devices, characterized in that, include: The status management module is used to determine itself or the other computing node as a primary node or a backup node; The access control interface module is used to send instructions to the access control module in the storage system when it is acting as the primary node, so as to establish exclusive access rights between itself and the shared storage device. The status management module is further used for: When the failure of the other computing node as the primary node is detected, the node switches itself from the backup node to the primary node and triggers the access control interface module to rebuild the exclusive access rights to itself. Furthermore, after recovering from a failure as the original primary node, if the other computing node is identified as the current primary node, the node will be placed in standby mode without preempting the exclusive access rights, and in response to a preset switchback command, it will perform a role handover from the other computing node to itself.

Images