Subject: Network partitions (was RE: Caching proposal, take 2 (LONG))

From: David Robinson <[email-masked]>
Date: Thu, 12 Aug 1999 17:33:27 -0700 (PDT)

> > I think I was missing the discussion in 7.5. I don't 
> > understand how a lock
> > server (in absence of a call back protocol) can detect 
> > network partition:
> > 
> > "When there is a network partition and the lease expires, the server
> >    must record on stable storage the client information relating to
> >    those leases. "
> 
> I didn't interpret that as requiring the server to detect network
> partition.  My paraphrase would be something like:
> 
>     When the lease expires (as would happen in the event of a 
>     network partition), yada yada yada

This is another poorly written section (Can't I explain anything clearly? :-)

As I said in some private e-mail on this area:

This is is directly related to the scenerio, client A grabs lock,
network partition, client B gets lock, server reboots and network repairs,
both clients attempt to reclaim during the grace period. Server must
have a mechanism to prevent client A from getting getting the lock.

There are two ways to do this, while locks are held by a client
the server maintains its identity on stable storage and only those
clients can initiate a reclaim.  Conversely the server can maintain
a list of clients/locks that were revoked and refuse those specific
reclaims.  There are tradeoffs in both approaches.  I think I wrote
up the previous description emphasising one over the other, but
I don't think we should require a particular solution, but require that
the situation be handled.

We just need to rewrite 7.5 to describe the failure scenerio so servers
can protect against it.

	-David