As per CASSANDRA-20045, we want to prevent full repair against
disk full scenarios. Current protection exists only for incremental
repair. This change updates the config name to not be
incremental repair specific, using the Replace annotation.
patch by Himanshu Jindal; reviewed by David Capwell, Jaydeepkumar Chovatia for CASSANDRA-20045
ninja: remove unused imports in CommandsForRanges to pass checkstyle
Patch by Dmitry Konstantinov; reviewed by Stefan Miklosovic, Caleb Rackliffe for CASSANDRA-20842
- Fix erroneous call to registerWithDelay with absolute deadline
- ExecuteSyncPoint should discount votes from unbootstrapped replicas
- Bootstrap no longer needs to first ensure durability (now ExecuteSyncPoint discounts votes from unbootstrapped replicas)
- Progress stall with home shard stopping before Stable is propagated to all shards
- Only upgrade Durability.HasPhase if we have queried all shards
- Incorrectly inferring Durability in CheckStatus.finish
- Incorrectly inferring/propagating stable from fast unstable reply; clarify to prevent further mistakes
- MaxDecidedRX should track separate hlc bounds for filtering non-RX dependencies
- minGcBefore.hlc() can move backwards across epochs, even if each shard moves forwards; must track minHlc directly
- slowTimeout init in ExecuteTxn.LocalExecute
- TxnId.parse for RV
Also improve:
- Don't query recovery state if fast path durably decided
- Support deferred partial dep deserialisation
- Support both orientations of KeyDeps/RangeDeps
- Support partialDeps as ByteBuffer
Also improve in Cassandra:
- Deps serialization and Journal skipping
- Don't inflate when reading from cache for CommandsForRanges
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20847
This also allows overriding complex settings as a JSON value and adds documentation about these overrides to conf/jvm-server.options
patch by Paulo Motta; reviewed by Stefan Miklosovic, David Capwell for CASSANDRA-20749
and more reliably avoid initialising recovery progress log state of transactions that cannot yet make progress
Also fix:
- Harden AccordExecutor state cleanup to failures
- Handle SAVING state in AccordCache.tryEvict, as now possible to save for reasons besides eviction so normal to both be in evict queue and saving
- Infer invalid in MaybeRecover and FetchData
- MaybeRecover sometimes aborts before home shard knows outcome
- Epoch sync with VisibilitySyncPoint
- Retired implies synced
- Don't interpret force repair as excluding nodes from Accord sync conditions
- TxnData.without
Also improve:
- Add Topology.removedNodes
- If Durability implies we can fetch a status, update the waiting state to fetch it
- DurableBefore debug table should have searchable txnId
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20832
The map lookup (with an implicit auto-boxing) can be replaced with a plain arithmetic operation.
A unit test is used to ensure that the assumption about serialization version incrementing for new versions is still correct.
greaterThanOrEqual method is removed as unused.
Patch by Dmitry Konstantinov; reviewed by Stefan Miklosovic for CASSANDRA-20816
A flushing range is a combination of partial and full shards, for full shards we use write time captured values for count and total size of partition keys, for partial shards we iterate over keys
When we iterate over partial shards we count key bytes only instead of reading them and also try to skip tokens full parsing
Patch by Dmitry Konstantinov; reviewed by Branimir Lambov for CASSANDRA-20760
Also fix:
- Catch exceptions thrown by Task.cleanupExclusive to ensure we do not corrupt SequentialExecutor state
- ConcurrentModificationException with CommandStore.waitingOnSync
- Exclude promisedHlc that are in the future, even if not equal to Long.MAX_VALUE
- Filter CFK on load as not expected to be up to date (for later on demand filtering validation)
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20821
patch by Romain Hardouin; reviewed by Stefan Miklosovic, Dmitry Konstantinov for CASSANDRA-20494
Co-authored-by: Stefan Miklosovic <smiklosovic@apache.org>
since later quorums may include the bootstrapping node which does not participate in the durability of preceding transactions
Also Improve:
- Apply MaxDecidedRX filtering to CommandsForKey RX dependencies
- Optimise AbstractRanges.sliceMinimal (burn test hotspot)
- Don't start shard schedulers on topology changes if not already started
- Only registerTransitive if waitingOnSync
- Reserve DurabilityRequest until ShardDurability is started
- Don't notify progress log if stopped
- Remove duplicated CFK unmanaged filtering
Also fix:
- Edge case in notification across bootstrap boundary by resubmitting Unmanaged to be recomputed
- Serialization of CommandsForKey.TxnInfo.missing() collection when non-identity flag bits are present
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20811
patch by Caleb Rackliffe; reviewed by Andres de la Peña for CASSANDRA-18112
Co-authored-by: Caleb Rackliffe <calebrackliffe@gmail.com>
Co-authored-by: Andres de la Peña <a.penya.garcia@gmail.com>
- Remove from CFK any unapplied transactions we know cannot apply
- Force notification of waiting commands in CFK on replay
Also fix:
- Don't truncateWithOutcome if pre bootstrap or stale
- Fix RangeDeps.without(RangeDeps)
- Fix InMemoryCommandStore replay bug with clearing DefaultLocalListeners
- Ensure SaveStatus and executeAt are updated together to prevent corruption via expunge
Improve:
- Inform home shard that command is decided if we cannot execute, to avoid recovery contention
- Don't recover sync points on the fast path
- Don't calculate recovery info for RX (since we don't use it anymore, so no need to do the work)
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20797
This commit only contains in-jvm dtest, logically same as in 5.0, which is ignored as it would fail.
It was identified as part of CASSANDRA-19902 review that trunk branch returns STARTING instead of JOINING operation mode.
This discrepancy between 5.x and trunk is meant to be solved under CASSANDRA-20795.
Replace io.airlift:airline dependency with info.picocli:picocli across
all nodetool command implementations. This migration includes:
- Convert 160+ nodetool command classes from airline to picocli
- Add AbstractCommand base class for commands and utility methods
- Add NodetoolCommand top-level class for the cli utility
- Update all command classes to use @Command, @Option, and @Parameters
- Add plain text files to test command help output
- Add mock test classes for improved test coverage and parse validation
- Modify test infrastructure to work with picocli-based commands
- Add new layouts for cli formatting to preserve backwards compatibility
The migration maintains backward compatibility while providing improved
command-line parsing, better help system, and more robust argument
validation through picocli enhanced features.
patch by Maxim Muzafarov; reviewed by Caleb Rackliffe, Dmitry Konstantinov, Stefan Miklosovic for CASSANDRA-17445
- DurableBefore.fullyContainedIn should compare txnId
Also fix:
- Messages with nullable state should check if they are cancelled after reading the state but before using it
- Don't snapshot during replay
- CFK.updateRedundantBefore incorrectly updating mayExecute and sharing byId in some cases
- Refine GC with global durability bound
- Fix JournalGCTest
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20786
Also fix:
- Limit truncation to TruncatedApplyWithOutcome until data is persisted durably to local store
- IntervalUpdater not invoking super.close()
- Do not invoke preRunExclusive without holding lock
- IntervalUpdater not correctly initialise BranchBuilder.inUse
- AccordExecutor should notify if more work on unlock of caches
- Relax paranoid CFK validation during restart
Also improve:
- Flush logs before System.exit
- Start/stop progress log explicitly
- Limit progress log concurrency
- Clear heavy fields in some messages once processed
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20780
patch by Yuqi Yan; reviewed by Brandon Williams, Maxwell Guo, Stefan Miklosovic for CASSANDRA-19552
Co-authored-by: Stefan Miklosovic <smiklosovic@apache.org>
- PreLoadContext descriptions
- Introduce LoadKeysFor so we can avoid loading range transactions except where necessary
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20758
Also fix:
- slowCoordinatorDelay calculation for locally truncated command throws ISE
- Bad cast of Truncated during replay
- Don't throw IllegalStateException in Invariants.expect if accord.testing == false
- Replay of empty segment throws NPE
Also improve:
- Support tracing of recovery and home progress
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20771
- Don't try to update metrics when no TxnId (e.g. GetMaxConflict)
- maybeExecuteImmediately did not guarantee mutual exclusivity
- Cancellation of a running 'plain' task could corrupt AccordExecutor state
- GetLatestDeps message serializer
- txn_blocked_by StackOverflowError
- Not updating CommandsForKey in all cases on restart
Also Improve:
- TableId.from/toString
- Route toString methods
- Tracing coverage of FetchRoute
- Replay command store parallelism
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20763
- Use AsymmetricComparator for seeking
- Reimplement AbstractTransformer for more efficienct operation when only transforming a subset (i.e. Subtraction)
- Reuse source node IntervalMaxIndex calculations for first branch level (to save iterating leaves)
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20756
- WatermarkCollector should not report same closed/retired epoch N times
- AccordSyncPropagator can merge pending requests and back-off retries
- AccordCommandLoader should notify listeners
- AccordSegmentCompactor should estimate number of keys to ensure bloom filters work
- txn_blocked_by table should report what it can, not throw IllegalStateException
- Permit uncompressed system tables
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20754
- Journal debugging vtable support
- Background task tracing support
Fix:
- HLC_BOUND only valid for strictly lower HLC
- HAS_UNIQUE_HLC can only be safely computed if READY_TO_EXECUTE
- Break recursion in CommandStore.ensureReadyToCoordinate
- Fix find intersecting shard scheduler
- Separate adhoc ShardScheduler from normal to avoid overwriting
- Should still use execution listeners to detect invalid reads for certain transactions even with dataStoreDetectsFutureReads
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20746
- Lock inversion when restarting durability for erased sync point
- Initialise durability cycle start time
Improve:
- Improve durability reporting
- Timeout durability requests
- DurabilityQueue concurrency should limit only until quorum is achieved
- Some exceptions that may be thrown when starting coordination may not be propagated
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20328
- Cannot shrink CommandsForKey if loading pruned
- NoSpamLogger to suppress AccordSyncPropagator repeats
- Minor performance improvement to BTree.Subtraction
- EphemeralReads should retry in a later epoch if replication factor changes
- Fix no local epoch for NotAccept
- Invalidate a command with no route but for which we know we own some key that has applied locally
- Don't pre-merge existing DurableBefore, to reduce duplicate/redundant persistence
- Misc purging bugs and improve testing of purging
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20739
- Fix shouldCleanup handling of erase/expunge
- Fix CommandChange handling of minUniqueHlc being cleared
- Don't clear minUniqueHlc when fast applying; instead simply validate !isWaiting
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20726
- Attempt to fix CommandsForKey StackOverflowError (presumed to be reachable via SaveStatus->InternalStatus map returning null)
- Bound recursion with SafeCommandStore.tryRecurse()
- IndexOutOfBoundsException in CINTIA checkpoint list encoding bounds logic
- Maintain MaxDecidedRX to save majority of work when deciding RX that are newer than those we have previously agreed
- Introduce IntervalBTree and use in CommandsForRanges to limit time spent in critical section when there are millions of RX
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20727
- Introduce SequentialAgentExecutor
- ExecuteEphemeralRead.LocalExecute (matching ExecuteTxn.LocalExecute)
- remove AgentExecutor (agent() only used as implementation detail)
- Skip CommandStore/CommandsForKey on read or apply, when safe to do so
- Implement maybeExecuteImmediately
- Faster maxTimestamp
Fix:
- Marking vestigial without knowing all covering keys
- Incorrect size in WaitingOn.none
- Cleanup RX that are not known but are no longer needed, due to being defunct
- Home should not abort because of local truncation; may still be incomplete on another shard
- Invalidate infinite loop due to interpreting Vestigial as a possible decision (as though it were another Truncated state)
- Known.isTruncated reporting incorrect answer in some cases, leading to infinite RecoverWithRoute loops as not slicing to correct subset and some shards are truncated and reject the deps collection
- BurnTest slowCoordinatorDelay should grow with retryCount
- NotAccept should check both ballot and saveStatus; PreCommitted or later can be propagated by Apply that has an earlier ballot
- Handle awaiting locally retired epoch
- Fix propagate low epoch of sync points
- Fix GetEphemeralReadDeps.reduce NPE
- Don't use tombstones to ERASE journal entries, as want to produce an Erased SaveStatus until EXPUNGE
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20726
* Fix typos in AccordDebugKeyspace
* Make durability service listen to topology changes
* Account for truncated epoch when computing the low bound
* Add a test to make sure GC issues do not slip past us in the future
* Fix compilation
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20718
* Further relax conditions of 'unsafe' startup
* Allow skipping unfinished allocations
* Relax assertion: allow same key accross multiple different stores
* Fix SegmentTest
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20718
* Ignore storage compat mode errors
* Fix restart test (Cannot invoke "org.slf4j.Logger.debug(String, Object, Object)" because "this.inInstancelogger" is null)
* Always speculate in accord replacement test to avoid read timeouts
* Make sure not to cleanup fields before persisting them
Background: we would clean up redundantBefore and some other fields.
We are calling persistFieldUpdates, during which we "flush" field updates to command store, but then set it back to null:
fieldUpdates = null;
so when we get to persistFieldUpdatesInternal in AccordTask, we don't have any field updates.
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20718
Also Fix:
- slowCoordinatorDelay should bound its start point, and log more detail if its expectations are breached
- Erased SaveStatus can be reported for all queried owned participants on a replica (the saved participants have been erased)
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20722
SAI predicate search currently has a bug that could result in missing rows due to a
concurrent flush during a query. The new test created in this PR shows the point of failure.
The problem is that we get the SSTable index references before getting the Memtable index
references. Note that we do it in the correct order in the ANN OF query path, but not
in the WHERE query path.
This commit updates the QueryView object to hold references to the appropriate Memtable indexes.
It also removes the problematic search methods from MemtableIndexManager to prevent future misuse.
patch by Michael Marshall; reviewed by Caleb Rackliffe and Ekaterina Dimitrova for CASSANDRA-20709
- AccordJournal should not attempt to construct expunged commands
- ready/notReady logic can break if we receive a partial Route that does not cover the local store
- Invariant.require -> TopologyRetiredException
- validate min/max in TopologyManager.preciseEpochs
Improve:
- ExecuteSyncPoint should send Apply
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20713
- Do not query local topology when deciding what keys to fetch to avoid TopologyRetiredException
- Ensure we propagate information back to the requesting CommandStore by using the store id to ensure it is included
- BurnTest topology fetching was broken by earlier patch
- Topology callbacks were not being invoked as we were not calling .begin()
- Topology mismatch failure during notAccept phase was not being reported due to CoordinatePreAccept already having isDone==true
patch by Benedict; reviewed by David Capwell for CASSANDRA-20711
- Don't assume stillExecutes applies to remote request - must mark unavailable any keys we don't have the txn definition for
- Don't exit notifyManagedPreBootstrap notify loop early, as could have later transactions with lower txnId
- CoordinateEphemeralRead must retry if insufficient responses from replicas that still own the range
- Burn test terminates while non-recurring tasks pending on command store queues
- Infinite recovery due to not sending InformDurable when partially truncated
- Incorrect participants when invoking removeRedundantDependencies
- Infinite bootstrap loop on retired topology
Improve
- Do not perform linear filters of CommandStores or Topologies
- Some default implementations of forEach/iterator
- TopologyRetiredException messages
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20707
- cfk pruning+prebootstrap=invalid future dependency
- exclude retired ranges when filtering RX stillTouches
- propagate uses incorrect lowEpoch when fetch finds additional owned/touched ranges
- node.withEpoch should callback with TopologyRetiredException, not throw
- Recovery can race with durable-applied pruning; must not send durable unless latest ballot on apply
- removeRedundantDependencies was not slicing pre-bootstrap range calculation to participating ranges
- NPE in TopologyManager.atLeast caused by referencing an epoch that has been GC'd
- use journal durableBeforePersister in burn test, not NOOP_PERSISTER
- ServerUtils.cleanupDirectory use tryDeleteRecursive
- FsyncRunnable shutdown
- fix NPE in AccordJournalBurnTest
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20688
Updates SystemKeyspace.writePreparedStatement to accept a timestamp
associated with the Prepared creation time. Using this timestamp
will ensure that an INSERT into system.prepared_statements will
always precede the timestamp for the same Prepared in
SystemKeyspace.removePreparedStatement.
This is needed because Caffeine 2.9.2 may evict an entry as soon
as it is inserted if the maximum weight of the cache is exceeded
causing the DELETE to be executed before the INSERT.
Additionally, any clusters currently experiencing a leaky
system.prepared_statements table from this bug may struggle to
bounce into a version with this fix as
SystemKeyspace.loadPreparedPreparedStatements currently does
not paginate the query to system.prepared_statements, causing heap
OOMs. To fix this this patch adds pagination at 5000 rows and
aborts loading once the cache size is loaded. This should allow
nodes to come up and delete older prepared statements that may no
longer be used as the cache fills up (which should happen immediately).
This patch does not address the issue of Caffeine immediately evicting
a prepared statement, however it will prevent the
system.prepared_statements table from growing unbounded. For most users
this should be adequate, as the cache should only be filled when there
are erroneously many unique prepared statements. In such a case we can
expect that clients will constantly prepare statements regardless
of whether or not the cache is evicting statements.
patch by Andy Tolbert; reviewed by Berenguer Blasi and Caleb Rackliffe for CASSANDRA-19703
As part of a broader effort to decouple java driver code from the
server code, this moves sstableloader to its own tools directory.
As sstableloader is also used as a library (CASSANDRA-10637), added
a new artifact 'cassandra-sstableloader' that will get deployed to
maven along with 'cassandra-all'.
While I expect this is likely a niche use case, this will allow users
to continue using BulkExport as a library.
Moves sstableloader-specific targets to its own build.xml in
tools/sstableloader/build.xml.
Also updates IDE project files and circleci to utilize new
sstableloader-specific targets.
patch by Andy Tolbert; reviewed by Stefan Miklosovic and Mick Semb Wever for CASSANDRA-20328
patch by Stefan Miklosovic; reviewed by Bernardo Botella Corbi for CASSANDRA-20563
Co-authored-by: Bernardo Botella Corbi <contacto@bernardobotella.com>
Memory-mapping is done in buffers of size less than 2GiB.
When these buffers aren't aligned to 4KiB and the trie-index file
spans many buffers then reading it results in going out of buffer
bounds.
This patch fixes it by making sure that the buffers are correctly
aligned.
patch by Szymon Miezal; reviewed by blambov and brandonwilliams for CASSANDRA-20351
Memory-mapping is done in buffers of size less than 2GiB.
When these buffers aren't aligned to 4KiB and the trie-index file
spans many buffers then reading it results in going out of buffer
bounds.
This patch fixes it by making sure that the buffers are correctly
aligned.
patch by Szymon Miezal; reviewed by blambov and brandonwilliams for CASSANDRA-20351
* cassandra-5.0:
Add LittleEndianMemoryUtil and NativeEndianMemoryUtil, switch memtable-related off-heap objects and Memory to use them and have Little Endian now. Add BE offsets detection on Summary loading. Add test SSTables in an old format with BE offsets in Summary component to LegacySSTableTest.
Add BE offsets detection on Summary loading.
Add test SSTables in an old format with BE offsets in Summary component to LegacySSTableTest.
Patch by Dmitry Konstantinov; reviewed by Branimir Lambov, Michael Semb Wever for CASSANDRA-20190
- Share TableMetadatas and PartitionKey for PartialTxn serialization
Also:
- TxnReference et al should reference uniqueId, and avoid serializing ksName/cfName
- Don't double count shared keys when estimating size on heap
patch by Benedict; reviewed by David Capwell for CASSANDRA-20578
This removes the usage of index files during compaction and simplifies
and improves the performance of compaction.
patch by Branimir Lambov; reviewed by Sylvain Lebresne for CASSANDRA-20092
Also improve:
- TxnId serialization
- StoreParticipants serialization
- compareUnsigned Node.Id for consistency with serialized TxnId
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20546
* avoid running python3-dependent tasks when running simulator tasks
* fix a problem with simulated snitch rebase
* add a distinction between short-lived daemon threads and infinite loop ones for cases when we need to simulate user-implemented infinite loops
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20542
Improve:
- InMemoryJournal compaction should simulate files to ensure we compact the same cohorts of records (so shadowing applied correctly)
- Don't update CFK deps if already known
- avoid unnecessary heapification of LogGroupTimers
- begin removal of Guava (mostly unused)
- consider medium path on fast path delayed
- add Seekables.indexOf to support faster serialization
- unboxed Invariant.requires variant
- AsyncChains.addCallback -> invoke
Fix:
- Recovery must wait for earlier transactions on shards that have not yet been accepted, even if we recover a fast Stable record on another shard
- only skip Dep calculation on PreAccept if vote is required by coordinator
- ReadTracker must slice Minimal the first unavailable collection
- If PreLoadContext cannot acquire shared caches, still consider existing contents
- CFK: make sure to insert UNSTABLE into missing array
- Fix failed task stops DelayedCommandStore task queue processing further tasks
- short circuit AbstractRanges.equals()
- Handle edge case where we can take fast/medium path but one of the Deps replies contains a future TxnId
- update executeAtEpoch when retryInFutureEpoch
- Fix incorrect validation in validateMissing (should only validate newInfo is not in missing when in witnessedBy; all other additions should be included)
patch by Benedict; reviewed by David Capwell for CASSANDRA-20522
* Fix short accord simulation test (seed 0x6bea128ae851724b), ConcurrentModificationException
* Increase wait time during closing to avoid Unterminated threads
* Increase timeouts, improve test stability
* More descriptive output from CQL test
* Shorten max CMS delay
* Improve future handling in config service
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20440
- Accord Journal purging was disabled
- remove unique_id from schema keyspace
- avoid String.format in Compactor hot path
- avoid string concatenation on hot path; improve segment compactor partition build efficiency
- Partial compaction should update records in place to ensure truncation of discontiguous compactions do not lead to an incorrect field version being used
- StoreParticipants.touches behaviour for RX was erroneously modified; should touch all non-redundant ranges including those no longer owned
- SetShardDurable should correctly set DurableBefore Majority/Universal based on the Durability parameter
- fix erroneous prunedBefore invariant
- Journal compaction should not rewrite fields shadowed by a newer record
- Don't save updates to ERASED commands
- Simplify CommandChange.getFlags
- fix handling of Durability for Invalidated
- Don't use ApplyAt for GC_BEFORE with partial input, as might be a saveStatus >= ApplyAtKnown but with executeAt < ApplyAtKnown
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20441
- Decouple command serialization from TableMetadata version; introduce ColumnMetadata ids; gracefully handle missing TableId
- DataInputPlus.readLeastSignificantBytes must truncate high bits
- Fix RandomPartitioner accord serialization
- Fast path stable commits must not override recovery propose/commit decisions regarding visibility of a transaction
- RejectBefore must mergeMax, not merge, to ensure we maintain epoch and hlc increasing independently
- Bad commitInvalidate decision
- consistent filtering for touches and stillTouches
- ensure TRUNCATE_BEFORE implies SHARD_APPLIED
- TopologyManager.unsyncedOnly off-by-one error
- DurabilityQueue should not retry SyncPointErased
- handle rare case of no deps but none needed
- not updating CFK synchronously on recovery, which can lead to erroneous recovery decisions for other transactions
- Don't return partial read response when one commandStore rejects the commit
- Filter touches/stillTouches consistently
- WaitingState computeLowEpoch must use hasTouched to handle historic key with no route
Improve:
- Use format parameters to defer building Invariants.requireArgument string
- streamline RedundantStatus/RedundantBefore
Also improve:
- Introduce DurabilityService
- Retire SyncPoint, replace Barrier with Write and RX
- MessageType -> enum, restore GetMaxConflict
- Standardise backoff logic with WaitStrategy
- improve TimeoutStrategy/RetryStrategy specification strings
- Forbid KX, remove directKeyDeps
- Introduce UniqueTimeService, permitting hlc reservations for sync points avoid delay when min TxnId is sufficiently in the past
- Remove ListStore custom purge logic
Also fix:
- RejectBefore should reject on both epoch and hlc
- Do not record sync success for removed nodes
- Support GlobalDurability detecting no command store to run on
- Incorrect ballot constructor
- Serializing 15-bit ballot flags incorrectly
- TopologyManager.hasEpoch deadlock
- Computing withOpenEpochs incorrectly, sometimes stopping one epoch short
- PartitionKey serializer should not depend on schema information that can be erased
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20395
- Bad ArrayBuffers recycling logic
- RX must ensure dependencies TRANSITIVE_VISIBLE
- Permit constructing "antiRange" that spans multiple prefixes
- Not computing range CommandSummary IsDep correctly
- Truncated commands that aren't shard durable could not repopulate CFK on replay, permitting recovery of another command to make an incorrect decision
- NPE on async persist of RX (i.e. supplying no callback)
- NPE in Builder.shouldCleanup when durability is null
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20370
- Only use persisted RedundantBefore for compaction
- RouteIndex should index only touches, not Route
- Flush RangesForEpoch updates to journal immediately, so we do not rely on the command we are processing succeeding
- DurableBefore updates must wait for the epochs to be known locally
- Shard.mustWitnessEpoch to support guaranteeing to witness relevant non-topology schema changes
- We must propagate RedundantBefore RX shard bounds along with epoch syncs
- Prevent a truncated transaction FetchData infinite loop
- GC_BEFORE status being overwritten by bootstrappedAt, permitting old transaction state to be resurrected
- Avoid CFK.maxUniqueHlc read race on bootstrap
- TopologyManager.awaitEpoch could wait for wrong epoch
- Journal fsync thread could miss notifications
Also improve:
- CommandStores uses SearchableRangeList for finding matching stores
- Refactor RedundantBefore to use a sorted array of TxnId/RedundantStatus pairs (to better fix GC_BEFORE issue)
- Accord debug keyspace operates on keyspace/table, and sorts correctly by token
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20361
Improve:
- Introduce pre/accept fast execution flags
- Introduce searchable Deps serialization
- Flatten AccordRoutingKey(s) into single type, using sentinel bits
- Introduce new fast byte-comparable serialization methods for Token and TableId to support above
Fix:
- Fix journal re-serialization logic
- Enable RandomPartitioner for Accord by supporting fixed-width serialization for RouteIndex
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20349
Also fix:
- Topology slicing must declare whether we share/slice node ownership (to assist above)
- CFK.visit removes transitive dependencies too eagerly across epoch change
- apply cleanup to builder consistently, and construct the same value we would produce by purge (so that replay is idempotent)
- Invoke ExecuteTxn.LocalExecute callbacks on originating CommandStore
- misc other minor issues
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20325
Use initializeTopologyUnsafe to for-load the last topology and create shards rather than replaying all topologies.
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20294
- Even if we can decide autonomously that we took the fast path, we must still wait for earlier transactions to decide themselves
- We must update a command that is in CFK.loadingPruned whether or not it is outOfRange
- We must visit pruned commands that are transitive dependencies of RX to ensure dependencies are propagated
- flagsWithoutDomainAndKind() -> flagsWithoutDomainOrKindOrCardinality() [to fix integration regression]
- Don't invoke uniqueNow() twice when allocate nextTxnId
- BTreeReducingRangeMap edge case that corrupts map when merge function does not return one of its inputs
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20292
Also fix:
- Truncate command on first access, without participants
- Use Ballot.ZERO when invoking CFK.insertOutOfRange where appropriate
- Don't supply a command's own route to ProgressLog.waiting to ensure new keys are incorporated
- Ensure progress in CommandsForKey by setting vestigial commands to ERASED
- Add any missing owned keys to StoreParticipants.route to ensure fetch can make progress
- Recovery must wait for earlier not-accepted transactions if either has the privileged coordinator optimisation
- Inclusive SyncPoint used incorrect topologies for propose phase
- Barrier must not register local listener without up-to-date topology information
- Stop home shard truncating a TxnId to vestigial rather than Invalidated so other shards can make progress
Also improve:
- Validate commands are constructed with non-empty participants
- Remove some unnecessary synchronized keywords
- Clear ok messages on PreAccept and Accept to free up memory
- Introduce TxnId.Cardinality flag so we can optimise single key queries
- Update CommandsForKey serialization to better handle larger flag space
- Configurable which Txn.Kind can result in a CommandStore being marked stale
- Process DefaultProgressLog queue synchronously when relevant state is resident in memory
- Remove defunct CollectMaxApplied version of ListStore bootstrap
- Standardise linearizability violation reporting
- Improve CommandStore.execute method naming to reduce chance of misuse
- Prune and address some comments
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20282
- preclude TCM of being behind Accord if newer epoch is reported via withEpoch/fetchTopologyInternal
- improve topology discovery during first boot and replay
- fix races between config service TCM listener reporting topologies, and fetched topologies during
Patch by Alex Petrov, reviewed by Ariel Weisberg and David Capwell for CASSANDRA-20245
- Implement missing parts of protocol optimisations, refine some particulars and remove MEDIUM_PATH_WAIT_ON_RECOVERY
Also fix:
- Deps.txnIds -> Deps.txnIdsWithFlags to make clear unsafety, and validate Command isn't created with flags
- Save a lossy low/high epoch we're waiting on in WaitingState so that we can reconstruct the same Route on callback
- Load any potentially invalidated commands we had in ProgressLog to ensure they are marked invalidated locally and notify any waiters
- Refine Invariant to accept case where a truncated dependency should apply first but both transactions are redundant and only the waiter could not be cleaned up
- only update CFK.maxUniqueHlc using commands we execute
- Don't update uniqueHlc when zero to avoid incompatible transaction invariant check
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20222
With paging it's possible for the range Accord needs to read from to have the start and end token be the same in which case the LHS token needs to be converted to a MinTokenKey
Patch by Ariel Weisberg; Reviewed by David Capwell for CASSANDRA-20262
- Fix waiting state callback computes different route to initiator
- Invariants.checkX -> Invariants.requireX (to allow complementary Invariants.expectX as appropriate)
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20228
Follow-up to CASSANDRA-20228:
- Fix AccordUpdateParameters to correctly supply List cell paths derived from applyAt
- Fix ExecuteAtSerialize.serialiseNullable
- Fix topologies flush regression caused by markRetired forcing a flush on every call
patch by Benedict; reviewed by Ariel Weisberg for CASSANDRA-20228
- detect and save whether RX can be used as a GC bound for HLCs
- have RX durably record if they witnessed any superseding epoch and use this for HLC GC
- rework GC to retain applyAt for writes
Also improve:
- PreCommitted overwrites fast path vote, then loses tie-break with NotAccept, so we don't recover
- track executeAtLeast and uniqueHlc separately from WaitingOn in CommandChange
- Always propose executeAt.hlc() >= txnId.hlc()
- Short-circuit recovery if ApplyAt already known
Also fix:
- Dangling recovery when Commit rejected
- Failed epoch fetch handling in DefaultProgressLog
- CommandsForKey must track Accept executeAt for computing earlierWait collection on recovery
- Report DefaultProgressLog exceptions before retrying
- Fix inverted condition in RecoverWithRoute
- Remove laterNoWait from laterWait collection in recovery
- Invalidate incorrectly selected maxNotTruncated if max had a not truncated component
- WaitingState.fetch not request/propagating prior epochs
- CFK visit active pruning was comparing txn against maxCommittedWriteBefore rather than maxCommittedWriteForEpoch
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20228
- Privileged coordinator. If the coordinator is a replica we can reduce our quorum sizes by including the coordinator's vote.
- with deps: if we include coordinator's preaccept deps we can reliably reduce quorum size by 1, at the expense of recovery sometimes requiring additional phases and waiting for future txns
- with only vote: if we only include the vote we can avoid any additional recovery phases or waiting for future txns, but can reduce our quorum size for only some configurations
- Medium path. If t=t0 at a simple majority we can take just two rounds.
- with additional phase: on recovery, earlier txns must wait for medium path to be disabled (or committed) so we do not accidentally recover a transaction that won't be witnessed
- with unstable deps: on slow path commit, deps not found in accept as committed as unstable and do not affect recovery decisions for earlier transactions
Also improve:
- Recovery of await conditions simply recalculates the rejects flag rather than restarting to ensure faster forward progress
- refactor Command hierarchy
- tweak: don't save Writes for non-write transactions
Also fix:
- isOutOfRange when invoked from callback for some txn < Committed
- handle loadingPruned that is pre-bootstrap on update to bootstrappedAt
- journal replay can overwrite in memory state loaded for a command not yet replayed
- subtle ordering bug in LatestDeps.mergeProposal
- fix occasional class initialisation order bug
- handle race condition on learning of topology
patch by Benedict; reviewed by Aleksey Yeschenko for CASSANDRA-20222
Improve:
- Remove GetMaxConflict; use local MaxConflict collection
Fix:
- Invalidated should retain StoreParticipants so we can update CFK on journal replay
- loading pruned uninitialised commands via CFK: make sure hasTouched contains key so that if invalidated we are notified
- updateExecuteAtLeast should always be higher than TxnId
- Async CFK callbacks treated pruned transactions incorrectly
- node.withEpoch when ExecuteEphemeralRead in futureEpoch
- Deps.without should be key/range aware
- Durably mark bootstrapBeganAt and safeToReadAt in MaxConflicts
- Don't attempt to calculate local deps when DepsErased in GetLatestDeps (command has durably applied to this shard)
- filter StoreParticipants before invoking shouldCleanup
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20183
Includes multiple changes, primary ones:
* Make HarrySimulatorTest work with Accord
* Removed nodes now live in TCM, no need to discover historic epochs in order to find removed nodes
* CommandStore <-> RangesForEpochs mappings required for startup are now stored in journal, and CS can be set up _without_ topology replay
* Topology replay is fully done via journal (where we store topologies themselves), and topology metadata table (where we store redundant/closed information)
* Fixed various bugs related to propagation and staleness
* TCM was previously relied on for "fetching" epoch: we can not rely on it as there's no guarantee we will see a consecutive epoch when grabbing Metadata#current
* Redundant / closed during replay was set with incorrect ranges in 1 of the code paths
* TCM was contacted multiple times for historical epochs, which made startup much longer under some circumstances
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20142
- Fix notifying unmanaged after update redundant before/bootstrap
- Do not infer invalid if we have a single round of replies with minKnown not decided and maxKnown erased - in this case store the knowledge for next request.
- Fix SyncPoint topology selection
- Fix CheckStatusOkFull.with(InvalidIf)
- Fix NotifyWaitingOn
- ExecuteTxn should only contact latest topology for follow-up requests
- DurableBefore.min should not go backwards on new epoch topology, journal replay was not correctly handling PreApplied, partialTxn can be null if not owned
- Fix notify pre-bootstrap that arrives post-bootstrap
- Avoid GC race condition on Propagate where we can incorrectly infer a shard is stale
- Ensure redundantBefore on previously-owned range does not imply redundant before for overlapping queries on still-owned range
- Ensure we don't mark stale unless all of the quorum we contacted had erased, else we may have raced with the agreement and erase
- Fix Invalidate when no route found for FetchData does not report to all requested local epochs
- Fix WAS_OWNED_RETIRED without durableBefore at Universal can lead to assertions with RX that we permit to execute but that have not yet
- Fix initialiseWaitingOn can in some cases transitively notify the command we're updating via maybeCleanup of dependencies, but the command isn't yet updated so isn't ready
- Fix encountering a command that is pre-bootstrap, and for which we have locally 'applied' a supserseding RX, so that we do not know its outcome locally (so we do not cleanup the command), but also it must have been decided - and we should not respond with future dependencies.
- Epoch failures on CoordinatePreAccept should trigger the CoordinatePreAccept failure handler
- Use the shard bound rather than GC bound for fallback dependency
- LatestDeps should be sliced to actual route, so as not to use both PreAccepted AND Stable deps as though Stable
- Fix various callback issues with node.withEpoch and Recover/Propose.isDone
- RecoverWithRoute can encounter a partially truncated transaction where the Deps for one shard are not committed. Must fetch LatestDeps.
- Tighten LatestDeps semantics for Recover
- CommandsForKey: do not restore pruned as APPLIED
- Ensure prune points execute in the epoch in which they are declared
- must merge all fast path votes including those from earlier epochs that may have witnessed a later transaction
- Recoveries that know the transaction is committed a priori should skip the Accept phase
- Maintain GC behaviour for redundant commands that are pre-bootstrap
- don't apply ERASE to CommandsForKey to avoid breaking pruning
- Introduce clearBefore to ProgressLog to more consistently handle cleaning up redundant transactions (and avoid triggering burn test invariants)
- don't replay journal of a bootstrapping node in burn test
- Recover, Accept or Commit reply from epoch that has been retired should be treated as Success rather than Redundant
- Distinguish completely REDUNDANT+PRE_BOOTSTRAP from partially GC_BEFORE and REDUNDANT+PRE_BOOTSTRAP - latter can make stronger inferences based on the GC_BEFORE intersection (could perhaps be treated as simply GC_BEFORE)
- RX must register historical transactions with CFK
- CommandStore.bootstrapper must wait for coordinate sync via same mechanism as sync()
- Don't start topology change for shard where all replicas are already bootstrapping
- Reify executes et al in StoreParticipants
- LocalListeners txn listener reentry may erase the entry entirely
- use registerAt in AbstractRequest for expirations, use correct time for expiresAt in ListAgent
- use txnId.epoch() for pruning, as must be before both txnId and executeAt of prune point for coordinating dependencies
- compute accurate KnownMap when affected by bootstrap or staleness
- upgradeTruncated should calculate Definition and Deps separately
- Invalidate should not sort before Erased when calculating max reply or max knowledge reply
- avoid another infinite loop at end of burn test
- avoid another epoch loading edge case
- pass through low/high epochs to ensure we propagate information to all waiting command stores
- RX must adopt a non-pruned dependency that has a higher TxnId (if is itself behind prune point)
- rejects should also be calculated on COMMITTED started before
- remove Apply Factory wrapper for RX, redundant now we have CoordinationAdapters (and has faulty epoch logic)
- for RX ensure we return maximum writes for each epoch we intersect (same effectively as pruning logic)
- rework updateUnmanaged to improve clarity
- BeginRecovery constructor of LatestDeps should use touches() not owns() for compute localDeps
- BeginRecovery superseding calculation was incorrectly treating startedBefore Committed and Accepted the same, when the point at which a dep should be known differs
- Refactor Command visiting, porting C* integration to accord-core
- RelationMultiMap Builder should resize keys and keyLimits independently
- CommandsForKey Serialization moved to accord-core
- losing ownership of range should trigger re-registration of unmanaged waiting on commit of a no-longer owned txn
patch by Benedict; reviewed by Alex Petrov for CASSANDRA-20172
* Move serializers that previously were in static field into corresponding swappable accessors
* Add a (no-op in Cassandra impl) Result serializer
* Allow more than one Accord Journal table
* Move some previously-Cassandra implementation details (such as FieldUpdates) to Accord
* Fix a bug with sorting of Journal Key (incorrect non-identity flags)
* Accord side: Make sure not to re-sort collection of events scheduled for application
* Implement serializers for Accord/BurnTest List* items
Patch by Alex Petrov; reviewed by Benedict Elliott Smith for CASSANDRA-20112.
* SELECT is now a regular Harry operation, not a separate "validate" step
* Flushes (or any custom operation) are now a part of a model, Harry will run them for you
* Simplified validation of subset/wildcard queries
* All Operations and are now SchemaSpec-agnostic, and can use any generators (like QT or whatever)
* You read it right, Harry now can use any generator and still be able to not to keep generated values in memory
* There are no concepts of “descriptor selectors”, or “bijection” exposed anymore. You just provide a Generator, Harry figures out the rest.
* All Cassandra data types are now supported
* No upper limit on the number of columns (also, clustering columns)
* Basic (for now) support for Transactions
* It is now possible to visit multiple partition in the same Visit (essentially, for transactions)
* Much much simpler to generate synthetic workloads now (basically, you just write a Generator
* Add support for all single-cell types.
Most of it was just a refactoring of Harry, to allow the following (still pending):
* Easier to add subset SELECTION (important for SAI testing)
* Easier add support for functions
* Easier to add support for collections and UDTs
* Easier to add support for LET bindings
Patch by Alex Petrov; reviewed by David Capwell, Caleb Rackliffe, and Abe Ratnofsky for CASSANDRA-20080.
For correctness, the dependencies we adopt on joining a new topology must exclude the possibility of respondents accepting additional transactions with a lower TxnId, so proxying on the existing `ExclusiveSyncPoint` mechanisms is logical for the time-being. This patch removes the `FetchMajorityDeps` logic in favour of simply waiting for a suitable `ExclusiveSyncPoint` to be proposed.
patch by Benedict, reviewed by Alex Petrov for CASSANDRA-20056
Patch by Alex Petrov; reviewed by Ariel Weisberg for CASSANDRA-20032
Accord Deps tests have incorrect range semantics
patch by David Capwell; reviewed by Ariel Weisberg for CASSANDRA-20029
Fix NPE in MockJournal on null onFlush
Fix SavedCommandTest.
After the serialization change that serializes "changed" before "is null", null flag can no be written.
Patch by Ariel Weisberg; Reviewed by David Capwell for CASSANDRA-19955
Non-serial single partition reads on Accord
Patch by Ariel Weisberg; Reviewed by Benedict Elliott Smith for CASSANDRA-19951
update durability scheduling and majority deps fetching
do not deserialize deps in CommandsForRangesLoader unless required
AccordJournalPurger should use shouldCleanupPartial
load historical transactions when loading topology
split JournalKey in journal table so we can index it
reorder journal fields so we can easily index on route (when present)
use Message.expiresAtNanos for callback expiration
do not notify slow for range barriers
Accord: Do not contact faulty replicas, and promptly report slow replies for preaccept/read. Do not wait for stale or left nodes for durability.
* reconstruct CFK, TFK, progressLog
* migrate CommandStore collection state from Accord table to the log
* make memtable writes non-durable; reconstruct memtable state from Writes
Patch by Alex Petrov and Benedict Elliott Smith; reviewed by Benedict Elliott Smith and Alex Petrov for CASSANDRA-19869
(Accord): C* stores table in Range which will cause ranges to be removed from Accord when DROP TABLE is performed
patch by David Capwell, Sam Tunnicliffe; reviewed by Sam Tunnicliffe for CASSANDRA-18675
CEP-15: (Accord) sequence EpochReady.coordinating to allow syncComplete to be learned from newer epochs
patch by David Capwell; reviewed by Alex Petrov, Blake Eggleston for CASSANDRA-19769
Patch by Blake Eggleston; Reviewed by David Capwell for CASSANDRA-19940
Changes:
Increase accord repair range splitting
Streamline table metadata fetching - removes some unnecessary abstraction from the table metadata lookup path
Remote unnecessary set building when building lists of overlapping keys
Add separate recover delay for repair and increase default recover delay
Rebase fixup: when a local keyspace is being open but it isnt present return null so error msg can be provided
Rebase fixup: improved metrics error msg when the exception doesnt match what is expected
Rebase improvement: when we see a timeout or preempt use the new vtable to show the status cross the cluster
Rebase improvement: Cluster.checkForThreadLeaks now groups similar stack traces to make the output less dense
The SimpleProgressLog had a number of problems:
1. It polled for progress with no attempt to determine whether progress could realistically be made, so:
- as the number of pending transactions grew, the proportion of useful work dropped (as many would be unable to make progress without earlier transactions completing)
- each transaction in the chain could recover only on average 1/2 poll interval behind the last transaction to complete
2. It requested full transaction state from every replica on each attempt
3. It maintained a lot of in-memory state
4. Polling happened en-masse, allowing for little per-transaction control
We also separately maintained fairly expensive per-command listener state that negatively affected our command loading and caching.
The new DefaultProgressLog makes use of several new features: LocalListeners, RemoteListeners, Timers and Await messages.
- LocalListeners provide a memory-efficient collection for managing each CommandStore<E2><80><99>s transaction listeners, with dedicated record keeping for inter-transaction relationships.
- RemoteListeners provide a mechanism for request/response pairs that may be separated by longer than the normal Cassandra message timeout, and require minimal state on sender and recipient. This permits replicas to cheaply update their local state machine as soon as distributed information becomes available.
The DefaultProgressLog tracks each transaction with separate timers to handle per-transaction scheduling, backoff etc, and a succinct state machine. To reduce overhead correspondence is preferentially limited to a handful of replicas, and limited to the home shard where appropriate.
patch by Benedict; reviewed by Ariel Weisberg for CASSANDRA-19870
- Remove concept of non-participating home keys; home keys are required to be a participant in the transaction
- Remove covering/covers concept
- Various invalidation/truncation/erase behaviours
patch by Benedict; reviewed by Blake for CASSANDRA-19825
CommandsForKey periodically self-prunes, so as to continue functioning well in-between garbage collections. Once we prune we are left with potentially incomplete information, and have to sometimes load per-command information from disk. But the payoff is ensuring CommandsForKey objects - which drive the majority of the state machine - are kept to a reasonable size.
patch by Benedict; reviewed by Blake Eggleston and David Capwell
Stefan Miklosovic