Method and system for managing storage systems containing redundancy data

[0002] 1. Field Of The Invention

[0003] The present invention relates to storage systems. More particularly, the invention relates to a method and system for managing storage systems containing multiple data storage devices.

[0004] 2. Background

[0005] Conventional data storage systems include one or more storage devices connected to a controller or manager. As used herein, the term “data storage device” refers to any device or apparatus utilizable for the storage of data, e.g., a disk drive. For explanatory purposes only and not as an intent to limit the scope of the invention, the term “disk drive” will be used throughout this document instead of the term “data storage device.”

[0006] A logical volume manager (also called a logical disk manager) can be used to manage storage systems containing multiple disk drives. The logical volume manager configures a pool of disk drives into logical volumes (also called logical disks) so that applications and users interface with logical volumes instead of directly accessing physical disk drives. One advantage of using a logical volume manager is that a logical volume may span multiple physical disks, but is accessed transparently as if it were a single disk drive. These logical volumes appear to other components of the computer system as ordinary physical disk drives, but with performance and reliability characteristics that are different from underlying disk drives.

[0007] The logical volume manager divides physical disk drive into one or more partitions (also known as extents or subdisks). Each logical volume is composed of one or more partitions and each partition is typically defined by an offset and length. Because of the overhead inherent in managing multiple partitions, conventional systems normally have severe limitations on the number of partitions that can be formed on a physical disk drive. Due to the nature of the data structures and algorithms used by conventional volume managers, the maximum number of partitions or subdisks permitted to a logical volume in conventional systems is usually much less than 5000. In the simplest case, the disk manager forms a logical volume from a single partition. In more complex cases, the disk manager may form logical volumes by concatenating multiple partitions.

[0008] To protect against the loss of information, data on the system can be “mirrored” (i.e., duplicated and stored) on two or more separate storage locations. In this way, an additional copy of data is available for retrieval if the first copy cannot be accessed. However, conventional systems typically provide mirroring at relatively coarse granularity levels. For example, many systems provide mirroring at the granularity of the disk drive, i.e., entire disk drives are mirrored, even if it is desired to mirror only a portion of the data on the disk drive. By implementing mirroring on a disk drive basis, it is not normally possible to mix data with different redundancy requirements on the same disk drive. For example, parity protection can also be used to protect data. In many system, mirroring is more useful for heavily accessed data while parity protection is more useful for less frequently accessed data. In many conventional systems, administrative overhead makes it difficult to configure and protect some of the data with mirroring while protecting other data on the same disk drive with parity protection. Thus, the conventional method of implementing redundancy could create load imbalances.

[0009] Protection from disk drive failure can also be achieved by mirroring partitions or concatenations of partitions. Parity protection can also be maintained on a partition basis. To ensure that a disk drive failure does not result in lost data, all partitions in one concatenation should be on disk drives that are not used by other concatenations used for the same logical volume. This requires knowledge about all portions of a logical volume when allocating a new one. This is not a problem for a small number of partitions, but could be present a problem for a logical volume having a large number of partitions.

[0010] Conventional redundancy methods also do not adequately address the issue of multiple disk drive failures. If a system contains many logical volumes which spread redundancy data with small allocation granularity over many disk drives, then the chance of two disk drives failing which both contain redundant copies of a particular data item increases. As the partition size decreases, the chances of multiple drive failures that result in lost data increase, since there are more combinations of disk drives protecting redundant copies of the same data.

[0011] The foregoing problems of the conventional systems are farther exasperated by systems containing many disk drives (e.g., a thousand or more disk drives). This is due in large part to the amount of manual administration required in conventional systems. In conventional systems, the functions of configuring, addressing, and administering logical volumes and disk drives are normally performed manually by an administrator who must make choices as to the proper configuration to employ. When a large number of disk drives and/or logical volumes are used, this manual administration becomes more and more difficult. Thus, existing systems are prone to human error and their structures (administrative and data) do not scale well beyond a certain number of disk drives.

[0012] Thus, there is a need for a system and method to address the above described problems of the related art.

[0013] The invention is a system and method for managing a storage system having a plurality of data storage devices.

[0014] According to an embodiment of the invention, each disk drive is associated with a failure group. Two disk drives are in different failure groups if they do not share a common failure condition that is projected to affect both disk drives at the same time, e.g., they are not dependant upon a common piece of hardware which can fail without the entire system failing. Two disk drives are in the same failure group if they can both become inaccessible due to a single failure which the system should survive. For mirroring, each disk drive is paired with one or more disk drives from other failure groups. These symmetric pairs are called “mirror partners.” Pairs are formed so that every disk drive has mirror partners in as many different failure groups as possible. When a piece of a logical volume is allocated on a disk drive, the mirror copy of that piece is allocated on one of the disk drive's mirror partners. The partner is chosen to evenly distribute the mirrored data to all partners. Two independent failures would be required to destroy both copies of the data.

[0015] Further details of aspects, objects, and advantages of the invention are described below in the detailed description, drawings, and claims.

[0016] The accompanying drawings are included to provide a further understanding of the invention and, together with the Detailed Description, serve to explain the principles of the invention.

[0017] FIG. 1 illustrates a storage system according to an embodiment of the present invention.

[0018] FIGS. 2A, 2B, and 2C are diagrams illustrating extent striping in an embodiment of the invention.

[0019] FIG. 3 is a diagram showing a logical volume directory according to an embodiment of the present invention.

[0020] FIG. 4 is a diagram of an allocation table according to an embodiment of the invention.

[0021] FIG. 5 is a diagram showing extent mirroring according to the present invention.

[0022] FIG. 6 illustrates disk drives divided into failure groups.

[0023] FIG. 7 is a table describing mirror partners for disk drives shown in FIG. 6.

[0024] FIG. 8 is a flow diagram showing a process for creating a logical volume.

[0025] FIG. 9 is a flow diagram showing a process for expanding a logical volume.

[0026] FIGS. 10A and 10B are flow diagrams showing processes for allocating mirrored extent sets.

[0027] FIG. 11 is a flow diagram showing a process for allocating parity extent sets.

[0028] FIG. 12 is a flow diagram showing a process for deleting logical volumes.

[0029] FIG. 13 is a flow diagram showing a process for reducing logical volumes.

[0030] FIG. 14 is a flow diagram showing a process for deleting extent sets.

[0031] FIG. 15 is a flow diagram showing a process for relocating extent sets.

[0032] FIG. 16 is a flow diagram showing a process for adding a disk drive to a disk group.

[0033] FIG. 17 is a flow diagram showing a process for clearing a disk drive.

[0034] FIG. 18 is a flow diagram showing a process for deploying a hot standby drive.

[0035] FIG. 19 is a diagram of a computer hardware system with which the present invention can be implemented

[0036] System Overview

[0037] The invention is a method of managing and allocating logical disks or logical volumes on an array of disk drives. In the present embodiment, each disk drive is divided into many small fixed size pieces, where the size of the piece is small compared to the size of the disk drive. Allocations and deallocations of storage space are normally performed in units of the size of the piece. Each logical volume is made of pieces from many disk drives. The logical volume can be composed of pieces from every disk drive, but this may not be possible if there are too many devices or if some devices are full. The pieces of a logical volume are spread out as evenly as practical such that two pieces on the same disk drive are far apart in the address space of a logical volume. Thus, I/O load is spread evenly over multiple disk drives. The address space of the logical volume can be striped across small groups of pieces to improve throughput for large I/O operations. Further details regarding a logical volume manager to manage these disk structures is disclosed in copending U.S. Application Ser. No. 09/177,916, filed concurrently herewith, which is hereby incorporated by reference in its entirety.

[0038] An aspect of the invention relates to a method of allocating redundant data on disk drives. Redundancy methods may include, for example, data mirroring and the use of parity protection. Redundant data is normally placed so that failure of a single disk drive will not result in the loss of data. However, multiple disk drive failures may cause loss of data if the disk drive failures affect the exact disk drives that contain the redundant sets of data. In the present invention, failure of multiple disk drives is unlikely to lose any data even when logical volumes are allocated from a large number of disk drives with small allocation granularity. Moreover, choice of disk drive for redundant data is independent of any other allocations for the same logical volume. Thus the algorithm scales for large logical volumes and many disk drives even with small allocation granularity.

[0039] In the present embodiment, each disk drive is associated with a failure group. Two w disk drives are in different failure groups if they do not share a common failure condition that is projected to affect both disk drives at the same time, e.g., they are not dependant upon a common piece of hardware which can fail without the entire system failing. Two disk drives are in the same failure group if they can both become inaccessible due to a single failure, which the system should survive. There should be at least two failure groups for the system to survive a failure.

[0040] For mirroring, each disk drive is paired with one or more disk drives from other failure groups. These symmetric pairs are called “mirror partners.” In the present embodiment, partnerships are formed so that every disk drive has mirror partners in as many different failure groups as possible. When a piece of a logical volume is allocated on a disk drive, the mirror copy of that piece is allocated on one of the disk drive's mirror partners. The partner is chosen to evenly distribute the mirrored data to all partners of a particular disk drive. Two independent failures would be required to destroy both copies of the data. The chance of losing data because of double drive failure depends primarily on the number of mirror partners per disk drive rather than the number of disk drives containing pieces of the same logical volume. In the present invention, if a double failure occurs that results in the loss of data, then the amount of data that is lost is significantly reduced since it is only the portion shared by the two failed disk drives that is lost. This is in contrast to conventional systems that mirror entire disk drives, where a double failure of mirrored disk drives results in the loss of data from an entire disk drive.

[0041] Mirroring pieces of logical volumes rather than entire disk drives or logical volumes allow better load distribution after a failure, and allow mirrored and non-mirrored data to reside on the same disk drive. When there are multiple mirror partners, then there are multiple disk drives to take over the load of a failed disk drive. The I/O necessary to rebuild the replacement disk drive comes from multiple surviving disk drives. This improves I/O load balancing and the mean time to repair using a hot standby. In the present embodiment, the choice to mirror or not is independent of the particular disk drive chosen to store the data. There is no requirement to choose a fixed partitioning of storage into mirrored and non-mirrored storage areas. As system requirements change, the amount of mirrored data can be dynamically adjusted without administrative commands.

[0042] The method can be generalized to other redundancy algorithms such as parity protection. When parity protection is employed, the contents of a lost data piece can be recalculated from the parity piece and the remaining data pieces. In an embodiment, the parity piece contains the exclusive OR of all of the data pieces corresponding to a particular parity set. In the present invention, the parity piece is allocated on a disk drive chosen to spread the data evenly across all system disk drives. The data pieces are then allocated from disk drives in different failure groups which are mirror partners of the disk drive containing the parity piece. Thus, both the number of failure groups in a system and the number of mirror partners sets an upper bound on the number of data pieces that can be protected by one parity piece.

[0043] Disk Structures

[0044] Referring to FIG. 1, shown is a storage system 100 having a disk system 102 according to an embodiment of the present invention. Disk system 102 comprises one or more “disk groups.” A disk group is a set of disk drives that have similar characteristics. In the illustrated example of FIG. 1, disk group 104 is comprised of physical disk drives 106, 108, 110, and 112 while disk group 114 is comprised of disk drives 116 and 118. Multiple disk groups can exist for assigning space for different purposes and for providing different performance characteristics. Most disk drives within a disk group are used for allocating data storage space, while some are designated as “hot standby drives.” A hot standby drive is a disk drive that is defined and recognized by the system, but is not immediately made available for data storage. Such a disk drive is normally associated with a specific disk group and is used to replace failed disk drives in the disk group.

[0045] A “root disk group” can be used to store information describing the entire disk system. The root disk group information identifies all directories that are used to maintain the disk system. In addition, it contains information about logical volumes, disk groups, and physical disk drives in disk system 102. Disk headers in the root disk group contain addresses of logical volume directories.

[0046] Each disk drive in disk system 102 is a named disk drive. A named disk drive is a single physical disk drive from the point of view of the operating system, although the named disk drive may actually be a group of disk drives in a storage subsystem that appear as a single disk drive on the I/O bus. When a disk drive is added to the disk system 102, it is given a name (in an embodiment, the disk name is assigned by the system administrator). This name is stored on the disk drive itself and is used to identify the disk drive when the system is booted. Operationally, the name is also used in interactions with the systems administrator. Statistics can also be maintained by disk drive names. Failures can be reported by disk drive names, while disk drives are dropped by name. A disk group should contain multiple named disk drives. The beginning of a disk drive contains a map of the space on the disk drive. This map defines which portions of the disk drive are free and which logical volumes the allocated portions belong to.

[0047] Each named disk drive has a physical block size, which is preferably a power of two. This is the block size that was used to format the disk drive. I/O requests to a named disk drive should be a multiple of the physical block size. In a present embodiment, all disk drives in a disk group have the same physical block size.

[0048] A logical volume is the basis of the storage interface presented to a client application 130 of storage system 100. FIG. 1 shows two logical volumes 120 and 122. Each logical volume appears to client application 130 as a contiguous section of storage, although the logical volume may actually span non-continuous space across a very large number of physical disk drives. Logical volumes may be created, destroyed, resized, read, and written. In an embodiment, a logical volume is allocated within a single disk group. Thus, logical volume 120 is allocated within disk group 104 while logical volume 122 is allocated within disk group 114. A logical volume can be spread over many or all of the disk drives in a disk group. According to the present invention, the system can move parts of a logical volume while it is in active use. A logical volume id consists of a logical volume number and an incarnation for that logical volume number. The logical volume id is unique within the entire disk system. A directory system can be used to associate ASCII names with a logical volume id.

[0049] Once created, the logical volume can be directly accessed as a single large logical file, e.g., as a database file used by database management systems such as Oracle 8 from Oracle Corporation. In addition, the logical volume can be utilized much like a Unix partition, in which the logical volume is formed into a file system. If used as a file system, multiple OS based files can be formed and allocated from the logical volume.

[0050] The data in a logical volume is composed of multiple data extents. Each data extent is a contiguous section of storage on a named drive. As shown in FIG. 1, the first three extents of logical volume 120 correspond to data extents 124, 126, and 128 on disk drives 106, 108, and 110 respectively. Extents for a logical volume may be located on a single named drive, or may be spread across multiple disk drives. Spreading logical volumes over multiple disk drives provides load balancing advantages, as will be explained in more detail below.

[0051] The size of data extents is selected for desired performance characteristics. Extents should be large enough to support efficient sequential I/O. When moving data, larger data extents result in more data being locked for a longer time, whereas smaller extents result in more overhead spent to perform the locking. Larger extent sizes reduce the number of pointers that must be maintained to track all the extents of a logical volume. Smaller extent sizes allow a logical volume to be spread more evenly over more disk drives. In a present embodiment, each data extent for a particular logical volume is preferably of a fixed size. The present invention contemplates that a logical volume in an embodiment is large enough to comprise over 5000 data extents, and may well exceed several tens/hundreds of thousands or millions of data extents.

[0052] One advantage of the present invention is that unlike the prior solutions, each logical volume is composed of a large number of data extents and each data extent is formed of a relatively small size. The present system can move data from one disk drive to another by locking an extent for I/O and then copying it. Because of the relatively small size of the data extents in the present invention, smaller sections of data are locked to perform data movements from one disk drive to another, thereby preserving greater concurrency and data access for system clients. If a new disk drive is added, extents from all logical volumes can be migrated to the new device. Since each extent is small, it can be locked briefly while being copied with little impact on availability. Since each extent can normally be moved independently of any other extent, there is no need to restripe entire logical volumes. The migration can be done gradually at low priority to limit the impact on the overall system performance. As the migration proceeds the new device gradually increases its contribution to the overall I/O load of the system. If a disk drive needs to be removed, its pieces can be gradually migrated to other disk drives.

[0053] In a present embodiment, each logical volume is made of extents from as many disk drives as possible. The logical volume may contain extents from every drive, but this may not be possible if there are too many drives or if some are full. The extents of a logical volume are spread out as evenly as is practical so that two extents on the same disk drive are far apart in the address space of the logical volume. Thus, the I/O load is spread evenly over many or all disk drives. The address space of the logical volume can be striped across small groups of extents to improve throughput for large I/O operations.

[0054] Each physical disk drive is divided into many fixed sized storage pieces. In the present embodiment, each of these pieces is referred to as an “allocation unit,” which has a size that is preferably a power of 2 multiple of the disk drive block size. Disk space within a disk group is normally allocated and freed in pieces of the allocation unit size. Thus, the size of a data extent for a logical volume is preferably a power of two multiple of the allocation unit for the disk group. Consistent with the invention, the usable space in a disk drive is a multiple of this size.

[0055] The size of allocation units is selected for desired performance characteristics. One factor to consider in this selection is the I/O performance of the disk drive(s) containing the allocation units. In one embodiment, the allocation unit size is selected so that it is large enough such that an I/O of the entire allocation unit is near the maximum efficiency of the disk drive, but is small enough so that it can be transferred in an I/O which does not significantly impact the availability of the disk drive. Random I/O operations of the preferred allocation unit size will result in a transfer rate of at least 50%, and more preferably at least 75% of the maximum transfer rate of the disk drive. The allocation unit size can be selected such that it is small compared to the amount of memory available for caching disk drive blocks so that caching will average I/O loads over areas of logical volumes much larger than an allocation unit. An allocation unit should be large enough such that the data to keep track of its status is insignificant compared to the data in the allocation unit. Since each logical volume is an integral number of allocation units, each allocation unit should be small compared to the size of a logical volume to avoid wasting space in a partially used allocation unit. In an embodiment, the allocation unit comprises at least two or more disk blocks in size.

[0056] In an embodiment, a small hot spot will not result in excessive disk drive I/O operations to that location because a cache will retain hot blocks to avoid excessive disk drive I/O. However, entire logical volumes may be too large to fit in the cache. In conventional systems, this may cause load imbalances in the system. However, in the present invention, a logical volume that is hot will have disk drive I/O distributed to all areas of the logical volume rather than to a single disk drive. Larger allocation units save directory space and make for more efficient space maintenance operations. Smaller allocation units waste less space due to partially filled units, and allow more logical volumes to share a disk drive for better load balancing. In an embodiment, a disk drive comprises at least 10,000 allocation units. Thus for a 4 gigabyte disk drive in an embodiment of the invention, an allocation unit could be somewhere between 128 K and one megabyte in size.

[0057] The use of allocation units in the present invention allows for the reduction or elimination of fragmentation in the system. In the present invention, many relatively small extents comprised of one or more allocation units are allocated on each disk drive. Extents can be allocated along boundaries that correspond to the number of allocation units within an allocated extent. For example, extents that are a power of two allocation units in size can be allocated at corresponding power of two boundaries of the disk drive. Allocating to these boundaries facilitates the re-allocation of particular areas of the disk drive once sets of allocation units have been de-allocated, since sections of the disk drive that have been deallocated are inherently of the proper size for reallocation. By allocating many relatively small extents, and allocating along boundaries based upon the number of allocation units being allocated, fragmentation can be minimized or eliminated in the system.

[0058] Breaking a logical volume into many extents on many different disk drives provides load balancing, but does not necessarily improve throughput. In an embodiment, it is expected that most I/O operations are no more than one extent long. For situations where performance demands require more throughput than one disk drive can provide, extent striping can be used. A common case for this is a database log file.

[0059] Extent striping remaps the address space of a logical volume so that it is no longer a straight concatenation of all data extents in the logical volume. A stripe factor and stripe unit is chosen to perform extent striping. Stripe factor refers to the number of disk drives employed for striping, while stripe unit refers to the size of the data piece written to each disk drive during each pass of the striping operation. In a present embodiment, the stripe unit is a power of two times the physical block size and is less than the data extent size. A logical volume should be an integral multiple of stripe factor extents. Picking too large a stripe factor may waste space and makes allocation difficult since each extent should be on a different disk drive. A too small stripe unit may reduce the efficiency of I/O operations. A too large stripe unit may not improve throughput for all but the largest I/O operations.

[0060] Referring to FIG. 2A, shown is a logical volume 202 comprised of data extents, A, B, C, and D. Data extents A, B, C, and D are located on disk drives 212, 214, 216, and 218 respectively. If striping is employed, then extent A can be divided into a plurality of stripe units, such as stripe units AØ, A1, A2, and A3. Extent B could be divided into stripe units BØ, B1, B2 and B3. Similarly, extents C and D could be divided into stripe units CØ, C1, C2, C3, and DØ, D1, D2, D3 respectively.

[0061] FIG. 2B illustrates the address space of logical volume 202 when striping is not used. When data striping is not used the logical address space sequentially proceeds in order through the data extents comprising logical volume 202. Thus, a sequential read of the contents of logical volumes 202 will result in the access of extent A on disk drive 212, then proceed to an access of extent B on disk drive 214, and thereafter proceed in order through extents C and D on disk drives 216 and 218. Note that during an extent-sized access of disk drive 212 (i.e., disk access that is one extent in length), disk drives 214, 216, and 218 remain idle. In fact, this scheme causes I/O to occur at each disk drive in sequence, while leaving other disk drives idle during the I/O operation.

[0062] FIG. 2C shows a striped logical volume address space for logical volume 202 when striping is used. The address space of logical volume 202 is divided such that the addresses for the striped units of data are interlaced up to the stripe factor value. FIG. 2C shows a system having a stripe factor of four and a strip unit size such that each extent is divided into four stripe units. When an extent-sized sequential read of logical volume 202 is performed according to the striped system of FIG. 2C, parallel I/O operations are performed against each of disk drives 212, 214, 216, and 218. Specifically, a first set of I/O operations will access stripe units AØ, BØ, CØ, and DØ in parallel. Then, stripe units A1, B1, C1, and D1 are accessed in parallel. Thereafter, stripe units A2, B2, C2, and D2 and A3, B3, C3, and D3 are also accessed in parallel. Thus, parallel I/O is performed against multiple disk drives, rather than I/O against a single disk drive at a time as is the case with the example of FIG. 2B. Thus, data striping can be used to increase I/O throughput.

[0063] In an embodiment, each logical volume is defined by a list or directory that identifies each logical volume's parameters and extents. FIG. 3 shows one embodiment of such a directory, which is termed a “logical volume directory” 302. The directory itself can be a logical volume that is stored in one or more extents from one or more disk drives. This directory is used to translate logical I/O requests into disk drive I/O requests.

[0064] Referring to FIG. 3, logical volume directory 302 contains one entry for every logical volume in the disk system. Each entry contains information about the logical volume such as, for example, its size, striping factor, stripe unit, allocation, disk group, extent size, and redundancy algorithm. The logical volume directory entry also contains one or more extent pointers.

[0065] If the logical volume is small enough, extent pointers within the directory entry point directly to the data extents of the logical volume. For example, directory entry 304 for logical volume 1 contains a number of extent pointers 306a,306b,and 306c.Extent pointer 306apoints to data extent 308 on disk 1, extent pointer 306bpoints to data extent 310 on disk 2, and extent pointer 306cpoints to data extent 312 on disk 3.

[0066] If a logical volume is large enough such that the logical volume directory entry does not have enough pointers to directly point to all the corresponding data extents, then the pointers in the directory entry point to pointer extents, which in turn point to the data extents for that logical volume. Pointer extents are analogous to data extents, but contain pointers to data extents instead of data. In the example of FIG. 3, directory entry 314 for logical volume 12 contains an extent pointer 316 which points to a pointer extent 318. Pointer extent 318 points to data extents 320, 322, and 324 on disks 1, 2, and 3 respectively. Depending upon the size of the logical volume, most logical volumes will need only one pointer extent to point to all the data extents of a logical volume. Large logical volumes might need multiple pointer extents. An additional level of pointer extents pointing to pointer extents should not be necessary in most cases since one level of pointers in a present embodiment can support logical volumes that are over 100 terabytes in size; however, it is expressly contemplated that the present invention can be applied to systems having multiple levels of pointer extents.

[0067] Pointer extents can be in a different disk group from data extents. This is useful for cases where one disk group has different performance characteristics than another. A disk group with poor performance for small updates would not normally be chosen for pointer extents, which may need to be updated when relocating an extent. However it would be suitable for read only data extents. As with data extents, pointer extents are preferably a power of two multiple of the allocation unit for the disk group where they reside. The size of a pointer extent can be different than the size of data extents for a logical volume. Since pointer extents are a small portion of the overall system data and are important for maintaining space, pointer extents should be mirrored.

[0068] In an embodiment, the logical volume directory is itself a logical volume. The first entry 330 in the logical volume directory 302 is the logical volume directory itself. A logical volume's number, is an index into the logical volume directory to the entry for that logical volume. Thus the logical volume directory is logical volume zero. To detect stale logical volume numbers a logical volume can also be identified by a 32-bit timestamp from the time of its creation or modification. The logical volume number and timestamp together can be used to form the logical volume id.

[0069] The logical volume directory contains information for interpreting the contents of logical volumes. Thus the logical volume directory should be mirrored, and possibly even triple mirrored on some systems. The address of each copy of the first data extent of the logical volume directory is recorded in the header of every disk drive in the root disk group. Since the first data extent starts with the directory entry for the logical volume directory, this makes it possible to find all logical volumes.

[0070] In an embodiment, a separate list is maintained for each disk drive with entries that describe each allocation unit on that disk drive. The example of FIG. 4 illustrates one embodiment of this list, which is referred to as an “allocation table” 402. If an allocation unit is not part of any logical volume, its entry will indicate that the allocation unit is available. If an allocation unit contains data for a logical volume, then the table entry describes the logical volume and the address within the logical volume. If an allocation unit contains pointers for a logical volume, then the table entry identifies the logical volume and the corresponding pointer extent for that logical volume.

[0071] Referring to FIG. 4, the beginning of a disk drive 400 is preferably an allocation table 402 that describes the contents of the disk drive. Allocation table 402 has one entry for every allocation unit 404 on the disk drive. If allocation unit 404 is allocated to a logical volume, then the entry in allocation table 402 identifies the corresponding logical volume and extent within the logical volume. If an extent spans multiple allocation units then there will be multiple entries that are the same. An entry of zero indicates available storage. In an embodiment, the position of an entry in the allocation table corresponds to the allocation unit position on disk drive. Thus, the allocation table 402 does not need to maintain pointers to the allocation units on disk drive. Alternately, the allocation table may maintain pointers 406 to the allocation units 404 on the disk drive.

[0072] The logical volume directory 302 and allocation tables 402 contain the same information in different forms. If a disk drive fails, the surviving allocation tables can be used to reconstruct any pointer extent on the failed device containing entries for allocation units on surviving devices. To accomplish this, the allocation tables for the surviving disk drives can be scanned to identify and rebuild any pointer extents that were on the lost disk drive. If a failure corrupts one of the data structures, the other can be used to repair the corruption. Thus, allocation table 402 contains enough information to rebuild all the pointers to data extents on disk drive 400. If another disk drive failed and that disk drive contained pointer extents that pointed to disk drive 400, then lost pointer extents could be rebuilt from the allocation tables.

[0073] Allocation table 402 does not ordinarily have to be mirrored since it only describes the disk drive it is stored on. If an allocation table becomes corrupted it is possible to reconstruct the lost entries by scanning pointer extents for all logical volumes in the disk group.

[0074] An embodiment of the present invention includes a named disk directory, which contains information about every named disk drive known to the disk system. Most of this information is replicated in the header of the disk drive. However, the named disk directory also contains status information that may not be on the disk drive. For example, if a disk drive failure has occurred, then this information is recorded in the named disk directory (but may not be recorded to the disk drive itself). In addition, the named disk directory also identifies mirror partners for each disk drive (mirror partnerships will be described in more detail below).

[0075] If a named disk directory is utilized, then it is assigned to logical volume number one, and can be found from the first extent of the logical volume directory. The block number within the directory is the disk number. A version number can be used to recognize old named disks that had the same number. As with the logical volume directory, the named disk directory should be mirrored for protection from disk drive failure. If the named disk directory becomes corrupt, it can be rebuilt from information replicated in the disk drive headers.

[0076] A particular embodiment of this invention also includes a disk group directory. The disk group directory contains one entry for each disk group. The disk group directory describes characteristics that are common to each disk drive in the disk group. This can include, for example, the allocation unit size, the limit on mirror partners, and the physical block size. As with the logical volume directory the disk group directory should be mirrored to protect it from disk drive failure. If the disk group directory becomes corrupt, it can be rebuilt from the disk drive headers.

[0077] A present embodiment includes an “active change directory” to preserve data consistency for operations that modify the system. When it is necessary to make a structural change to the storage system, an entry is allocated in the active change directory to track the operation and ensure that the operation either completes or is undone. If a process dies without marking the change entry as complete, then a recovery process will look at the entry, and complete or undo the operation. Thus, the active change directly is somewhat analogous to the “undo log” employed in database systems. As with the logical volume directory the active change directory is preferably mirrored to protect it from disk drive failure.

[0078] For example, deleting a logical volume may require updating many disk drives to indicate that allocation units of the logical volume are free, as well as marking the entry in the logical volume directory. The first step in deleting a logical volume is to write an active change directory entry indicating that a logical volume is being deleted. After updating all the allocation tables and the logical volume directory, the entry in the active change directory is marked as complete. Similarly, creating a logical volume makes an identical entry so that a failure during creation will result in the partially created logical volume being deleted.

[0079] Redundancy Methods

[0080] To protect against the loss of information in the event of a disk drive failure, redundancy methods can be employed to ensure continued access to data. Two methods that are particularly applicable in the present invention are mirroring and the use of parity protection. Mirroring involves the replication of data at two or more separate and distinct disk drives. Parity protection can be used to recalculate lost information from existing data.

[0081] Referring to FIG. 5, extent mirroring can be used to maintain two copies of each extent for a logical volume. Update operations to the extent are written to both copies, and read operations can be performed against either extent. In a preferred embodiment, mirroring of pointer extents can be independent of mirroring for data extents. Extent mirroring can be used to protect against the loss of a disk drive. Striping can be done on top of mirroring to increase throughput.

[0082] In the example of FIG. 5, logical volume 502 employs extent mirroring to maintain two copies of every data extent. The group of extents that contain mirror or redundant copies of a particular data item is referred to an “extent set.” In FIG. 5, logical volume 502 includes extent sets 504 and 506. Extent set 504 points to two mirrored copies of a data extent that is two allocation units in size. One mirrored copy is stored as extent 508 on disk drive 510, while the other mirrored copy is stored as extent 512 on disk drive 514. Similarly, extent set 506 comprises two mirrored data extents 516 and 518 which are located on disk drives 520 and 522 respectively.

[0083] A dual-mirrored extent requires two pointers be maintained for every mirrored extent. For very critical data it is also possible to maintain more than 2 mirrored copies of a data extent—this additional mirroring can be achieved by expanding the extent set to include pointers to other mirrored copies of the data extent.

[0084] Extent mirroring is more flexible than mirroring entire disk drives since it allows the redundancy to be specified on a per logical volume basis. It allows dynamic determination of how much data is to be mirrored on a disk drive. Thus, multiple logical volumes can share the same disk drive, with some logical volumes being mirrored while the others are not. Extent mirroring also allows multiple disk drives to share in the increased I/O load that is incurred when a disk drive fails. Mirroring can also be performed at granularities smaller than the logical volume level. In an embodiment, the logical volume directory entry is configured to indicate whether mirroring is used for a particular extent, and if so, the amount of mirroring that is applied. To accomplish this, variable sized extent sets are employed. Each extent set within a logical volume can have different mirroring characteristics from other extent sets in the same logical volume. Extents which are mirrored contain multiple extent pointers within the extent set. Extents that are not mirrored have only a single extent pointer per extent. Thus, it is possible to designate only certain selected extents within a logical volume to be mirrored.

[0085] An alternative to mirroring is to utilize parity protection by keeping a parity extent for every few data extents. A group of data extents protected by a parity extent is called a parity set. The parity extent preferably contains the exclusive OR of all the corresponding data extents. If one of the extents within a parity set is lost due to a disk drive failure, its contents can be recalculated from other extents in its parity set.

[0086] In an embodiment, a parity set size is selected for a logical volume. Each logical volume can have a different parity set size. The data in the logical volume is sized to be a multiple of the parity set size. The parity set size is selected for desired performance characteristics. Large parity sets could make updates more expensive, since the blocks forming extents of the parity sets need to be locked and recalculated under some circumstances. Small parity sets could consume more disk drive space for parity extents. In an alternate embodiment, different extent sets within a logical volume may have different parity set sizes. As with mirroring, this approach is more flexible than traditional systems since parity protected data can be dynamically mixed on the same disk drive with mirrored and unprotected data.

[0087] Unlike RAID 5 systems, it is not required in the present invention to spread the parity over all the extents in the parity set. This is necessary in RAID 5 systems to evenly distribute the extra I/O load for parity updates. In the present invention, I/O operations are distributed by having numerous extents per logical volume. However striping across data extents is useful to improve sequential I/O performance to the logical volume and to reduce the size of write operations that update all blocks protected by the same parity blocks. This is more efficient because there is no need to read data to calculate the new parity. To simplify allocation, the striping factor can equal the parity set size.

[0088] Extent mirroring and extent parity protection are used to protect against the loss of data when there is a disk drive failure. It is also important to render it unlikely that data will be lost if multiple-drive failures occur. With traditional mirroring no data will be lost unless both disk drives in the mirror are simultaneously down. With a traditional 5 column RAID 5 set of disk drives, data loss would require 2 out of 5 disk drives to fail at the same time. If a traditional system contains many disk drives, the chances of any two of the disk drives that contain redundant data failing at the same time are fairly small. However, if extent mirroring is performed by randomly picking any other disk drive out of 1000 (for example) for the mirrored copy of the extent, and extents are mirrored on many of the 1000 disk drives, then the chance of any two disk drives failing which contain mirrored data greatly increases. If such a two disk failure occurs, then some extent is likely to be lost because it is mirrored on those 2 disk drives. The multiple-disk failure scenario could also result in increased risks of lost data if parity extent sets are spread over increased numbers of disk drives. In fact, the risks of lost data is even greater for parity protection than for mirroring since a greater percentage of disk drives contain redundancy information for any particular piece of data.

[0089] The solution to the multiple-disk failure problem is to limit the number of disk drives that are used to store redundant data. Thus if disk drive X fails, a second failure will not lose data unless the failure occurs to one of N other disk drives where N is a relatively small number. To accomplish this in an embodiment of the present invention, each named disk drive can be associated with a “failure group.” All named drives in a failure group share some common disk drive failure criteria, which is any failure mode or condition which is projected to cause the related disk drives to fail at the same time period. The projected failure may cause either permanent loss of data or may result in temporary loss of access. For example, disk drives in a failure group may share a common hardware component or may be located in a common geographic location. The present invention will avoid allocating redundancy data to disk drives that are in the same failure group. In the example of FIG. 6, two disk drives (602 and 604) that share the same controller 608 are designated to the same failure group 606. If two disk drives (612 and 614) are on the same power supply 610 but different controllers (616 and 618), they would be in the same failure group 620 if power supply failure is a practical concern. Disk drives 624, 626, 628, and 630 share a common projected failure condition which results in these disk drives being assigned to the same failure group 622. Thus, disk drives are in the same failure group if there is a failure mode that could affect each of the disk drives and redundant data is maintained to protect against that failure. There should be at least two failure-groups to implement the proper redundancy.

[0090] Mirror partners are defined in the present invention to limit the number of disk drives that protect data for redundancy purposes. Each disk drive is associated with a corresponding list of its mirror partners. Each disk drive should be in a different failure group from its mirror partners. In an embodiment, the list of mirror partners for a disk drive is listed in the header for that disk drive.

[0091] Referring to FIG. 7, shown is a table of a possible mirror partnership configuration for the disk drives depicted in FIG. 6. A partnership is preferably symmetric—if disk drive 602 lists disk drive 612 as its partner then disk drive 612 will also list disk drive 602 as a partner. Mirror partners are in different failure groups from each other, but a disk drive may have multiple mirror partners that are in the same failure group. For example, disk drive 602 may have both disk drives 624 and 628 as mirror partners, even though both disk drive 624 and disk drive 628 are in the same failure group.

[0092] Mirror partners should be chosen to be in as many different failure groups as possible. When allocating extents with either mirroring or parity protection, set of extents are preferably allocated using mirror partners. The allocation begins by picking any disk drive in the disk group and allocating one extent on that disk drive. This extent is the primary extent in the extent set. The secondary extents are allocated on mirror partners of the primary extent's disk drive. When allocating an extent set for a logical volume, any disk drive may be chosen, but if the logical volume is mirrored, the mirror extent should be allocated from a mirror partner of the primary drive. Thus mirrored data can only be lost if both a disk drive and one of its mirror partners fail.

[0093] As shown in FIG. 7, the number of mirror partners for any particular disk drive should be limited. For example, disk drive 602 from failure group 606 only lists disk drives 612, 624, and 628 as its mirror partners, even though the pool of disk drives from failure groups 620 and 622 also include disk drives 614, 626, and 630. Limiting the number of mirror partners for a disk drive reduces the number of disk drives that contain redundant copies of a particular data item, thereby reducing the probability of losing data if a multiple disk drive failure occurs. The number of mirror partners for any particular disk drive can be different from that of other disk drives. Thus, disk drive 602 has three mirror partners while disk drive 604 has four mirror partners.

[0094] Using mirror partners also limit the chances of multiple-drive failures damaging a parity protected extent. A parity set is allocated by picking any disk drive as the primary disk to hold the parity extent and then allocating the data extents on its mirror partners. Each data extent should be located on a mirror partner that is in a different failure group from other extents in the parity set. To limit the risk of lost data, the mirror partnerships can be more particularly specified for the kind of redundancy algorithm the mirror partnership is used for. For example, in an embodiment, only some of the mirror partners of a disk drive are used for both mirrored and parity protected data extents. These are called “full mirror partners.” Partnerships that are used only for mirroring and not for parity protected data are called “mirror only partners.” Partnerships that are used only for parity protection and not for mirroring data are called “parity only partners.” The type of the mirror partner is a symmetric property of the partnership—if A is a mirror only partner of B then B is a mirror only partner of A.

[0095] If a disk drive fails, protected extents can be rebuilt from that disk drive's mirror partners. By having multiple mirror partners, the extra I/O load for the rebuild is spread over multiple disk drives. This reduces the mean time to repair the failure with a hot standby, since a higher I/O rate can be used to reconstruct lost data. It also means that the reconstruction can be accomplished by looking at the mirror partner's allocation tables. Thus no other disk drives need to be examined. A lower mean time to repair reduces the probability of having two simultaneous failures.

[0096] An embodiment comprises different failure group criteria based upon the redundancy algorithm employed. Particular disk drives may be considered part of the same failure group for a redundancy algorithm having higher demand levels of availability, but considered in different failure groups for redundancy algorithms having lower demands for reliability. For example, two disk drives on a common controller could be considered part of the same failure group for a high-reliability mirrored data system, but may be considered in two separate failure groups for a system having lower demand-levels for reliability.

[0097] Disk drives that are listed as a mirror partner of another disk drive may not always be available to be used for mirroring extents. This may occur, for example, if the disk drive selected to mirror a primary extent does not contain sufficient space to allocate storage for the secondary extent. If this occurs, then another mirror partner of the disk drive containing the primary extent must be selected to allocate the secondary extent. In an embodiment, if there is insufficient space on the mirror partners of a primary disk to allocate all of the required secondary extents (e.g., an extent is triple mirrored but the primary disk does not have at least two available mirror partners to allocate the secondary extents), then the primary extent is deallocated and a new disk drive is selected to allocate the primary extent.

[0098] Operational Processes

[0099] This section described some of the operational methods, processes, and algorithms employed in a present embodiment of the invention.

[0100] A. Create Disk System

[0101] Initially the disk system should be configured to contain at least one disk group with at least one named disk drive (or at least two disk drives in two different failure groups if redundancy methods are employed). The disk drives are formatted as empty named disk drives and the directory logical volumes are created with a single mirrored data extent. The parameters for creating the root disk group and each named drive are specified.

[0102] B. Create Disk Group

[0103] Creating a disk group involves creating an entry in the disk group directory. This new entry creates a disk group that is initially without any disk drives. The lowest unused entry in the disk group directory is normally selected when a new disk group is created (this means that disk group numbers may be reused). Examples of parameters specified for each disk group are:

[0104] Group name

[0105] Physical block size

[0106] Allocation unit size

[0107] Maximum number of mirror partners per disk drive (both full and mirror-only partners)

[0108] C. Delete Disk Group

[0109] Deletion of a disk group is procedurally implemented by clearing a specified entry from the disk group directory. In an embodiment, a disk group can only be deleted only if it contains no disk drives. The root disk group cannot normally be deleted.

[0110] D. Create Logical Volume

[0111] Examples of logical volume parameters that may be specified when creating a logical volume are:

[0112] Initial logical volume size

[0113] Redundancy—number of mirror copies or parity extent size set

[0114] Pointer disk group

[0115] Pointer extent size

[0116] Data disk group

[0117] Data extent size

[0118] Stripe factor and unit size

[0119] Referring to the process flowchart on FIG. 8, the following actions are performed to create a logical volume:

[0120] 1. Find an unused logical volume directory entry (802). Normally, the lowest unused logical volume entry is selected when creating a new logical volume. This means that logical volume numbers may be reused.

[0121] 2. Find an unused active change directory entry (804). Record in active change directory that a logical volume is being created. If the create process does not successfully complete, the active change directory entry will allow identification of the aborted or failed operation, and allow a recovery process to delete the partially created logical volume.

[0122] 3. Store logical volume parameters in the newly created logical volume directory entry (806).

[0123] 4. Determine if the logical volume is large enough to require pointer extents (808). If so, then allocate enough mirrored extent sets and store pointers in the directory entry (810 and 811). Note that pointer extents are usually not striped. Allocate data extents (813a) and store pointers in the pointer extents (812).

[0124] 5. If the logical volume is small enough in size, then allocate data extents (813b) and store pointers directly in logical volume directory entry (814). The allocations of 813aand 813bare performed at as many different disk drives as practical. The action of allocating a data extent (813aand 813b) also updates the allocation table. Either the mirrored extent or parity extent algorithm can be used to allocate extents (See section below on allocating extents for more details).

[0125] 6. Clear the active change directory entry (816). This commits the creation of the logical volume.

[0126] E. Expand Logical Volume

[0127] The process for expanding a logical volume is very similar to the process for allocating space when creating a new logical volume. The arguments needed in a present embodiment to implement this process are the logical volume number and the new logical volume size. Other information required for the allocations is already in the directory entry. As illustrated in FIG. 9, the following actions perform the process of expanding a logical volume:

[0128] 1. Allocate and update an active change directory entry with a resize entry (902). The original size of the logical volume is recorded in the entry. If there is a failure the logical volume will be shrunk back to the original size.

[0129] 2. Determine whether new pointer extents are needed (904). There are two principle reasons for requiring new pointer extents. First, the logical volume may have existing pointer extents (905), but the existing extents may be insufficient for the new logical volume size. If this is the case, then new pointer extent(s) are allocated to point to the new data extents (909). Second, if the logical volume does not presently have pointer extents but they will required at the new logical volume size, then pointer extent(s) are allocated and the pointers from the logical volume directory entry are moved to the first block of the new extent (906 and 908). In either case, if additional pointer extents are required the logical volume directory entry is updated to point to the new pointer extents.

[0130] 3. Allocate new data extents and store pointers in logical volume directory entry (if the logical volume is small enough) or in pointer extents (if logical volume is large enough to require pointer extents) (910 and 912). The allocations are performed on as many different disk drives as practical. Either mirroring or parity protection can be used to allocate the extents. See section below on allocating extents.

[0131] 4. Update the logical volume size in the logical volume directory entry and clear entry in the active change directory (914 and 916). This allows I/O operations to be performed to the new area of the logical volume.

[0132] F. Allocate Mirrored Extent Set

[0133] This process is directed towards allocation of extents when not using a parity extent for redundancy protection. This includes singleton extent allocation as a mirroring factor of one (singleton extents are extents which are not mirrored). A set of extents is allocated such that each extent is on a different disk drive. The following are examples of information that may be utilized to perform an allocation.

[0134] Disk group

[0135] Extent size

[0136] Mirroring factor

[0137] Striping factor

[0138] Logical volume number

[0139] Extent type (data or pointer) and offset

[0140] Turning to FIG. 10a,the following actions are performed to accomplish the allocation when striping is not used:

[0141] 1. Select a disk drive to allocate the primary extent of an extent set (1002) and allocate extent on the selected disk drive. In an embodiment, a round robin algorithm is used to evenly spread extents across disk drives. The primary disk should have sufficient space to store the data extent.

[0142] 2. Determine whether the mirroring factor is greater than one (i.e., whether the data to be written is mirrored) (1003). If so, then select a disk drive to allocate a secondary extent (1004) and allocate extent on the selected disk drive. The selected disk drive should be a mirror partner of the disk drive containing the primary extent and not already used for an extent in the extent set. The selected disk drive should have sufficient free space to allocate the secondary extent. If sufficient space is not available, then another mirror partner of the primary disk must be selected to allocate the secondary extent. If no mirror partners are available to allocate the secondary extent, then the process returns back to process action 1002 where a new disk drive is selected for the primary extent and the previously allocated primary extent is deallocated.

[0143] 3. Determine whether additional mirroring is needed (i.e., if the mirroring factor is three or greater) (1006). If so, then return to 1004.

[0144] 4. Once all primary and secondary extents have been allocated, update pointers in either the logical volume directory or in pointer extents to point to the new extents (1008). The appropriate allocation tables should also be updated to reflect the allocations.

[0145] FIG. 10billustrates the actions to be performed when disk striping is employed during the allocation.

[0146] 1. The total number of extents to be allocated is the mirroring factor times the striping factor. Thus, the present process for allocating the primary and secondary extents is repeated stripe factor times. The number of times to proceed through this loop is initialized (1012).

[0147] 2. Select a disk drive to allocate the primary extent of an extent set (1014) and allocate extent on the selected disk drive. In an embodiment, a round robin algorithm is used to evenly spread extents across disk drives. The primary disk should have sufficient space to store the data extent. Because striping is employed, the identity of the disk drive selected for the primary extent is recorded (1016). When additional primary or secondary extents are allocated according to the striping factor, this recorded information will be used to ensure that additional allocations occur on other disk drives.

[0148] 3. Determine whether the mirroring factor is greater than one (1017). If so, then select a disk drive to allocate a secondary extent (1018) and allocate appropriate extent on the selected disk drive. The selected disk drive should be a mirror partner of the disk drive containing the primary extent. The selected disk drive should have sufficient free space to allocate the secondary extent. If sufficient space is not available, then another mirror partner of the primary disk must be selected to allocate the secondary extent. If no mirror partners are available to allocate the secondary extent, then the process returns back to process action 1014 where a new disk drive is selected for the primary extent and the previously allocated primary extent is deallocated. The identity of the disk drive selected for the secondary extent is recorded (1019) so that further allocation of primary or secondary extents according to the striping factor do not occur on this disk drive.

[0149] 4. Determine whether additional mirroring is needed (i.e., if the mirroring factor is three or greater) (1020). If so, then return to 1018.

[0150] 5. Once all primary and secondary extents have been allocated, update pointers in either the logical volume directory or in pointer extents to point to the new extents (1022). The appropriate allocation tables should be updated to reflect the allocations.

[0151] 6. 1012-1022 are repeated striping factor times. The number of times left to go through this loop is updated each time the loop completes (1024). If the number of times through the loop is less than the stripe factor, then return to 1014 (1026). The recorded information for the primary extent allocation is used to ensure that further allocation according to the stripe factor results in allocations to differing disk drives.

[0152] In an embodiment of the invention, the primary and secondary extents of an extent set are configured to point to each other. One implementation of this comprises each primary extent pointing to each of its associated secondary extents. Each secondary extent points to the primary extent. In the event of a disk drive failure that results in a lost extent, the pointers could be followed to identify and recover the lost extent. In another implementation, the allocation table entry for an allocation unit for a primary extent identifies the mirror partner disks that contain members of the extent set that includes the primary extent. The allocation unit table entry for allocation units for each of the members of the extent set identifies the disk drive containing the primary extent. If a failure occurs, the allocation tables of the remaining disk drives can be scanned to identify members of the extent set and to recover allocation units on the failed disk drive.

[0153] G. Allocate Parity Extent Set

[0154] This process describes how extents are allocated when using a parity extent for redundancy protection. A group of extents should be allocated such that each extent is on a different disk drive. The following list identifies examples of information used to perform an allocation. Note that a striping factor may not be needed since it depends on the size of the parity set, and the extent type is always data in a present embodiment.

[0155] Disk group

[0156] Extent size

[0157] Parity set size

[0158] Logical volume number

[0159] Extent offset

[0160] Referring now to FIG. 11, the following actions are performed to accomplish the allocation:

[0161] 1. Find a disk drive for the primary extent of the parity extent set (1102) and allocate parity extent on selected disk drive (1104). In an embodiment, a round robin algorithm is used to evenly spread extents across disk drives.

[0162] 2. Allocate data extents on full mirror partners of the disk drive containing the parity extent (1106 and 1108). Each data extent should be in a different failure group. To limit exposure to multiple disk failures, mirror only partners should not be used for parity protected data. The selected full mirror partners should have available free space to allocate the data extents. If sufficient full mirror partners cannot be found (1106), then deallocate the primary extent (1107) and go back to 1102 to select a different disk drive for the primary parity extent.

[0163] 3. Store information relating to mirror partners, logical volume number, extent type, and logical volume offset in allocation tables of the extents that were allocated (1110). Different logical volume offsets may be stored for each extent in the parity set. Also, update pointers in either the logical volume directory or in pointer extent to point to the newly allocated extents.

[0164] In an embodiment of the invention, the primary and secondary extents of a parity extent set are configured to point to each other. One implementation of this comprises each parity extent pointing to each of its associated data extents. Each data extent points to the parity extent. In the event of a disk drive failure that results in a lost extent, the pointers could be followed to identify and recover the lost extent. In another implementation, the allocation table entry for an allocation unit for a primary extent identifies the mirror partner disks that contain members of the parity set that includes the primary extent. The allocation unit table entry for allocation units for each of the members of the parity set identifies the disk drive containing the primary extent. If a failure occurs, the allocation tables of the remaining disk drives can be scanned to identify members of the parity set and to recover allocation units on the failed disk drive.

[0165] H. Delete Logical Volume

[0166] The present process is used to delete a logical volume. To ensure consistency, the logical volume should not be open for any other purpose during the delete operation. In an embodiment, the only argument required is the logical volume number. The following process actions correspond to the flowchart of FIG. 12:

[0167] 1. Ensure the logical volume is not open (1202).

[0168] 2. Create an active change directory entry to indicate the logical volume is being deleted (1204). Further opens will not be allowed on the logical volume. If a recovery process encounters the active change entry, then the recovery process will complete the deletion.

[0169] 3. Starting at the last allocated data extent set, deallocate each data extent set (1206).

[0170] 4. Starting at the last allocated pointer extent, deallocate each pointer extent (1208).

[0171] 5. Mark the logical volume as deleted in the logical volume directory (1210) and remove the entry from the active change directory (1212).

[0172] I. Shrink Logical Volume

[0173] The present process shrinks (or contracts) a logical volume. In an embodiment, shrinking a logical volume involves the deletion of extent sets from the end of the logical volume. Arguments to the process are the logical volume number and the new size. FIG. 13 illustrates the actions used to perform this process:

[0174] 1. Verify there are no I/O operations in progress to the area that will be deleted (1302). Update the size in the logical volume directory entry (1306) and create an active change directory entry to indicate the shrink is in progress (1304). In the present embodiment, this will prevent any I/O operations to the area of the logical volume that is being deleted. If the shrinking process fails or aborts, a recovery process will find the active directory entry and complete the shrink of the logical volume.

[0175] 2. Starting at the last allocated data extent set, deallocate each data extent set until the logical volume has shrunk to the correct size (1308).

[0176] 3. Test whether fewer pointer extents are now required (1310). If fewer pointer extents are now required then delete the extraneous extents (1312). Otherwise, proceed to step 1314.

[0177] 4. Configure pointers in the logical volume directory entry to reflect the deletion of pointer extents (1313). If the logical volume is now small enough to not need pointer extents, then process action 1313 comprises the movement of pointers from the first pointer extent block into the logical volume directory entry.

[0178] 5. Clear active change entry and the shrinking status in the logical volume directory entry (1314).

[0179] J. Delete Extent Set

[0180] The present process is performed to delete an extent set. In the present embodiment, an extent set is deleted from a logical volume. The following are examples of arguments that are utilized to perform the deletion:

[0181] Logical volume number, extent type, and offset into logical volume for verification purposes

[0182] Extent size.

[0183] Number of extents in the set.

[0184] Pointers containing addresses of extents to delete.

[0185] Pointer to where extent set begins.

[0186] As shown in FIG. 14, the following actions comprise the process for deleting extent sets:

[0187] 1. Lock allocation table entries for the extents to be deleted (1402). Verify the entries contain the correct extent descriptors.

[0188] 2. Clear pointers to extent set from logical volume directory entry or from pointer extents (1406).

[0189] 3. Clear the allocation table entries (1408).

[0190] K. Read/Write

[0191] I/O operations should coordinate with extent relocation to ensure that read operations access current data and that write operations do not become lost. It is assumed here that the I/O is entirely within one extent. If necessary, a larger request will be broken into multiple smaller requests.

[0192] A memory cache is maintained to hold pointer data for logical volumes that are open (e.g., logical volume directory, allocation table entries, and pointer extents). Normally, only pointer data for open logical volumes are maintained in memory, although circumstances may arise in which pointer data for unopen logical volumes are also in memory. Maintaining only a subset of the pointer information for the disk system provides a significant advantage over conventional systems that must maintain all of the pointer information for all logical volumes on the system in memory, since those conventional systems are therefore severely limited both in quantity as well as ability to administer that pointer information.

[0193] An I/O operation according to this embodiment utilizes the following parameters:

[0194] Logical volume number

[0195] Logical volume offset

[0196] I/O type—data read or data write. Note that a logical volume directory entry I/O is actually a data IO for logical volume zero.

[0197] The following process actions are performed to execute an I/O operation:

[0198] 1. Find the pointer extent that points to the extent to be read or written. For a small logical volume or a pointer extent access this is the logical volume directory entry. For a larger logical volume this may be a block from a pointer extent.

[0199] 2. Find the pointer for the data extent of this I/O. If it is marked as invalid due to an extent relocation then wait for the relocation to complete.

[0200] 3. Add an entry to the I/O request list to prevent extent relocation before this I/O completes. This entry preferably includes the I/O type.

[0201] 4. Issue the disk I/O

[0202] 5. Remove the I/O request entry. If there is a process waiting to relocate the extent then wake it up.

[0203] L. Relocate Extent Set

[0204] At times, it is necessary to move an extent or a set of extents from one disk drive (or a set of disk drives) to another disk drive (or to another set of disk drives). When this is done, the copy operation should be coordinated with other access operations. The following procedure presumes that the new extents have already been allocated. In the present embodiment, the following arguments should be specified:

[0205] The location of the current pointers to extents.

[0206] The number of extents to be relocated.

[0207] A list of new extents

[0208] Referring to FIG. 15, the following actions are performed to atomically relocate extents:

[0209] 1. Lock the extent set to be moved (1502). In an embodiment, this is accomplished by making an entry in a locked extent list and modifying pointers to be invalid.

[0210] 2. Scan the active I/O request list and wait until any writes to the extent set are complete (1506).

[0211] 3. Read data from the old extents (1508) and write data to the new extents (1510).

[0212] 4. Scan the active I/O request list and wait until any reads of the extent sets are complete (1512).

[0213] 5. Update the allocation table entries for both the old and new extents (1514).

[0214] 6. Update pointers in either the logical volume directory entry or in pointer extent(s) (1515).

[0215] 7. Unlock the locked extents (1516). Wake up any P/O operations that had been blocked during the relocation (1518).

[0216] M. Add Disk Drive

[0217] This section describes a process for adding a new disk drive to a disk group. In a present embodiment, adding to a disk group requires the following information describing the disk drive and how to access it:

[0218] The disk group

[0219] A name for the disk drive

[0220] The address of the disk drive for doing I/O to it

[0221] The physical sector size.

[0222] The size of the disk drive in sectors

[0223] The failure group for the disk drive

[0224] As disclosed in FIG. 16, the following actions are performed to add a disk drive:

[0225] 1. Scan disk drive table to find an unused disk drive number (1602).

[0226] 2. Make an entry in the active change directory to indicate the disk drive is in the process of being added to a disk group (1604). If a failure occurs during this procedure, then the disk drive will be dropped from the disk group.

[0227] 3. Write disk header and an empty allocation table on the disk drive (1606).

[0228] 4. Form partnerships with disk drives that are in other failure groups which need additional mirror partners (1608). To accomplish this, scan through all failure groups picking at most one disk drive from a failure group. Do this repeatedly until there is a scan where some usable failure group cannot contribute a disk drive, or this disk drive has all the full and mirror only partners it can handle. Full partnerships are formed prior to mirror only partnerships. This should result in an almost equal number of partners from every usable failure group.

[0229] 5. Determine the maximum number of full and mirror only partners that the disk drive may have from any failure group and still retain an even distribution of partners per failure group. In a present embodiment, this is basically the maximum number of partners divided by the number of usable failure groups rounded up. Small failure groups that are less than half the size of the average group are not considered usable when doing the divide. In addition, the new disk drive's own failure group is not usable.

[0230] 6. Break existing partnerships and form new partnerships between the new disk drive and existing disk drives in the broken partnership. Thus the new disk drive will gain two partners for every broken partnership and the old disk drives will keep the same number of partners. The new partnerships will be the same type as the broken partnership—full or mirror only.

[0231] The disk drives in each usable failure group are scanned for partnerships to break. Small failure groups will not be scanned, but they may be involved in broken partnerships. Scanning the failure groups continue until all usable failure groups have been scanned without forming any partners. A partnership is breakable if both disk drives are not in the new disk drive's failure group, they are not already a partner of the new disk drive, the new disk drive is not within one of its maximum number of this type of partner, and/or their failure group does not already have the maximum number of partners of this type with the new drive. The list of partnerships to break is recorded in the active change directory so that they can be reestablished if recovery needs to drop the disk drive.

[0232] 7. When breaking a partnership to form two new partnerships, it may be necessary to relocate secondary extents that were allocated as a result of the broken partnership (1610). Primary extents are not affected by this relocation. If a partnership between disk drive A and B is broken, then secondary extents allocated on B for an extent set with its primary extent on A will be relocated to the new disk drive. Similarly, secondary extents on A for primary extents on B will be relocated to the new drive. This allows the new disk drive to start sharing in the I/O load for existing data, but does not truly balance the load with existing disk drives. The new disk drive has less than half the space allocated compared to other disk drives, and all of it is for secondary extents. Secondary extents for parity extent sets have different access patterns than primary extents so the lack of primary extents represents an imbalance. The partners of the new disk drive also have an imbalance since they have fewer secondary extents than the average.

[0233] 8. Now that all partnerships are established, the entry in the active change directory can be cleared to commit the disk drive to be part of the disk group (1612).

[0234] 9. Rebalance primary extent allocations (1614). Ensure there is at least one rebalance running. If numerous disk drives have been added, it may be necessary to start more than one rebalance. Rebalancing will move primary extents from other disk drives to the newly added disk drive. This will also increase the number of secondary extents on the partners of the new disk drive.

[0235] N. Clear Disk Drive

[0236] This section is directed to a process from clearing data from a disk drive. If a disk drive is to be removed from a disk group or the disk drive is to be converted to a hot standby drive, then data stored on the disk drive needs to be reallocated to other disk drives. However, this may not be possible if there is not enough free space in the disk group. When this happens the disk drive is left in a clearing state so that the clearing can be retried when space becomes available.

[0237] Turning to FIG. 17, the following are actions are performed to clear a disk drive:

[0238] 1. Mark the entry in the disk directory to indicate that the disk drive is being cleared (1702). This prevents any further allocation on the disk drive. Note that this state will persist until the disk drive is deleted or used as a hot standby.

[0239] 2. Scan the allocation table to relocate every allocated extent (1704). If a primary extent is encountered, then relocate the entire extent set. If a secondary extent is encountered, then attempt to find a different mirror partner of the primary extent and relocate extent to alternate mirror partner. If there is no partner of the correct type and failure group with available space, then relocate entire extent set. If it is not possible to relocate an extent, then report an error and leave disk drive in the clearing state.

[0240] 3. Delete all the partnerships for the disk drive (1706). After partnerships have been deleted, the process for finding partners when adding a new disk drive is used to find new partners for the disk drives that have lost a partner and are not being cleared themselves (1707). This procedure is performed after breaking all partnerships so that new partnerships can more easily be formed between disk drives with less than the maximum number of partners.

[0241] 4. Disk drives with newly established partnerships will need to have the secondary allocations rebalanced (1708). Extent sets where the primary extent is on a disk drive in the new partnership may need to have some secondary extents moved to the new partners to keep the load on the partners even.

[0242] 5. The cleared disk drive can be changed to a hot standby or removed from the disk group (1710).

[0243] O. Use Hot Standby

[0244] This section pertains to a process for utilizing a hot standby disk. A hot standby disk is a disk drive that is defined and recognized by the system, but is not immediately made available for data storage. Such a disk drive is normally associated with a specific disk group and is used to replace failed disk drives in the disk group. When the hot standby disk is added to a disk group, it is assigned a drive number and its header is written, but no partners are found and no allocation is done. Ideally each failure group should have at least one hot standby available. For systems with many small failure groups it would be possible to have a few failure groups that contain nothing but hot standbys.

[0245] As shown in FIG. 18, the following action are performed to replace a failed disk drive with a hot standby:

[0246] 1. Choose a hot standby to replace the failed disk drive (1802). If there is a standby in the same failure group as the failed disk drive then it should be used. If a hot standby from a different failure group is used, then the disk drive must be chosen such that none of the redundant copies of any data appear in the same failure group. To ensure this, verify that none of the mirror partners of the failed disk drive and none of the full partners of full partners is in the hot standby disk's failure group. This also ensures that no failure group becomes over represented in the mirror partners of any particular disk drive.

[0247] 2. Create an active change directory entry to indicate that a hot standby is being deployed (1804). If there is a system failure then the standby will return to being a standby and the failed disk drive will remain failed.

[0248] 3. Reconstruct the allocation table of the failed disk drive for extents that were protected by mirroring or parity protection (1806). Use the drive directory to find mirror partners of the failed disk drive. Scan allocation tables of the mirror partners. Entries that are for extent sets involving the failed disk drive will identify the logical volume number and offset of the damaged extent set. Use this information to find pointers to extents on the failed disk drive. Use the pointers to reconstruct the allocation table entries. Mark the unreferenced allocation units as available, and write out the new allocation table.

[0249] 4. Use the redundant data to reconstruct the extents on the standby disk (1808). This will involve locking the extents. The disk drive will have to be marked to indicate that it is in rebuild mode so that it is not used for reads, but will be updated by writes. Note that writes which need to update aparity extent on the failed disk drive will have to reconstruct the parity data from all extents in the extent set rather than reading it from the hot standby.

[0250] 5. The new disk drive can now be used for accessing and allocating mirrored or parity protected data. However there may be logical volumes damaged when the disk drive was lost because they had no redundancy. These logical volumes must be marked as damaged before singleton extents (i.e., unmirrored extents) can be allocated and accessed on the disk drive (1810). This is accomplished by scanning the logical volume directory for logical volumes that could have singleton extents on the failed disk drive. The pointers for those logical volumes are scanned for extents on the failed disk drive. If any are found they are marked as lost.

[0251] 6. The standby drive is now a completely functional replacement for the failed disk drive. The entry in the active change directory is cleared (1812).

[0252] 7. A rebalance should be started if a significant number of singleton extents were marked as lost (1814).

[0253] P. Delete Failed Disk Drive

[0254] If a disk drive has failed and no hot standby is available to replace it, then the disk drive's mirrored and parity protected data can be relocated. The process for deleting a failed disk drive is similar to the process for clearing a disk drive, except the allocation table is constructed from the mirror partners and logical volume directory as is performed for hot standby replacement. The data to be relocated should be reconstructed from the mirror partners rather than read from the failed disk drive. Lost singleton extents are flagged as missing by scanning the logical volume directory and pointer extents as is done when a disk drive is replaced with a hot standby.

[0255] Q. Rebalance Allocation

[0256] Over time, statistical fluctuations and the addition/deletion of disk drives may cause some disk drives in a disk group to have more data than other disk drives. In addition, a logical volume may become unevenly distributed across disk drives in a disk group. These imbalances can be gradually removed by running one or more rebalancing processes. Rebalancing processes relocate entire extent sets to even out the allocation of primary extents across disk drives in a disk group. Secondary allocations do not need rebalancing since they are tied to a primary allocation and the secondary allocations are maintained evenly across the mirror partners of a disk drive. There are two rebalancing algorithms—by disk drive and by logical volume. Both algorithms can be run at the same time by different processes.

[0257] Rebalancing by disk drive repeatedly moves primary extents from a disk drive with too many primary extents to one with too few. The disk drives with the most and least primary extents are chosen for this procedure. Another disk drive will be chosen if one of the chosen disk drives is in the middle of another rebalancing relocation. The first choice for a primary extent to relocate is from a logical volume that has multiple primary extents on a first disk drive and no primary or secondary extents on a second disk drive. Second choice would be from a logical volume that has the greatest imbalance in allocation between the two disk drives. If there are multiple primary extents from the same logical volume to choose from, the one that is going to give the best logical volume distribution across disk drives will be chosen.

[0258] Rebalancing by logical volume looks at each logical volume in the logical volume directory and moves primary extents to evenly distribute the logical volume across disk drives in the disk group. The first choice for a primary extent to relocate is from a disk drive that has multiple primary extents to a disk drive with no extents of any type on it for this logical volume. Second choice would be from a disk drive that has the most extents from this logical volume to the disk drive with the least. The relocated extent should be chosen to ensure that two extents that are close to each other within the logical volume are not on the same disk drive.

[0259] Hardware Overview

[0260] FIG. 19 is a block diagram that illustrates a computer system 1900 upon which an embodiment of the invention may be implemented. Computer system 1900 includes a bus 1902 or other communication mechanism for communicating information, and a processor 1904 coupled with bus 1902 for processing information. Computer system 1900 also includes a main memory 1906, such as a random access memory (RAM) or other dynamic storage device, coupled to bus 1902 for storing information and instructions to be executed by processor 1904. Main memory 1906 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 1904. Computer system 1900 further includes a read only memory (ROM) 1908 or other static storage device coupled to bus 1902 for storing static information and instructions for processor 1904. A data storage device 1910, such as a magnetic disk or optical disk, is provided and coupled to bus 1902 for storing information and instructions.

[0261] Computer system 1900 may be coupled via bus 1902 to a display 1912, such as a cathode ray tube (CRT), for displaying information to a computer user. An input device 1914, including alphanumeric and other keys, is coupled to bus 1902 for communicating information and command selections to processor 1904. Another type of user input device is cursor control 1916, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor 1904 and for controlling cursor movement on display 1912. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.

[0262] The invention is related to the use of computer system 1900 for managing and allocating storage within a system comprising multiple disk drives. According to one embodiment of the invention, such use is provided by computer system 1900 in response to processor 1904 executing one or more sequences of one or more instructions contained in main memory 1906. Such instructions may be read into main memory 1906 from another computer-readable medium, such as storage device 1910. Execution of the sequences of instructions contained in main memory 1906 causes processor 1904 to perform the process steps described herein. One or more processors in a multi-processing arrangement may also be employed to execute the sequences of instructions contained in main memory 1906. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to implement the invention. Thus, embodiments of the invention are not limited to any specific combination of hardware circuitry and software.

[0263] The term “computer-readable medium” as used herein refers to any medium that participates in providing instructions to processor 1904 for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as storage device 1910. Volatile media includes dynamic memory, such as main memory 1906. Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus 1902. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0264] Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.

[0265] Various forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to processor 1904 for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 1900 can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector coupled to bus 1902 can receive the data carried in the infrared signal and place the data on bus 1902. Bus 1902 carries the data to main memory 1906, from which processor 1904 retrieves and executes the instructions. The instructions received by main memory 1906 may optionally be stored on storage device 1910 either before or after execution by processor 1904.

[0266] Computer system 1900 also includes a communication interface 1918 coupled to bus 1902. Communication interface 1918 provides a two-way data communication coupling to a network link 1920 that is connected to a local network 1922. For example, communication interface 1918 may be an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface 1918 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, communication interface 1918 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

[0267] Network link 1920 typically provides data communication through one or more networks to other data devices. For example, network link 1920 may provide a connection through local network 1922 to a host computer 1924 or to data equipment operated by an Internet Service Provider (ISP) 1926. ISP 1926 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet” 1928. Local network 1922 and Internet 1928 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 1920 and through communication interface 1918, which carry the digital data to and from computer system 1900, are exemplary forms of carrier waves transporting the information.

[0268] Computer system 1900 can send messages and receive data, including program code, through the network(s), network link 1920 and communication interface 1918. In the Internet example, a server 1930 might transmit a requested code for an application program through Internet 1928, ISP 1926, local network 1922 and communication interface 1918. In accordance with the invention, one such downloaded application manages storage systems that contain multiple data storage devices, as described herein.

[0269] The received code may be executed by processor 1904 as it is received, and/or stored in storage device 1910, or other non-volatile storage for later execution. In this manner, computer system 1900 may obtain application code in the form of a carrier wave.

[0270] In the foregoing specification, the invention has been described with reference to specific embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention. The specification and drawings are, accordingly, to be regarded in an illustrative rather than restrictive sense.