fs/ocfs2/cluster/quorum.c

   1 /* -*- mode: c; c-basic-offset: 8; -*-
   2  *
   3  * vim: noexpandtab sw=8 ts=8 sts=0:
   4  *
   5  * Copyright (C) 2005 Oracle.  All rights reserved.
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public
  18  * License along with this program; if not, write to the
  19  * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  20  * Boston, MA 021110-1307, USA.
  21  */
  22
  23 /* This quorum hack is only here until we transition to some more rational
  24  * approach that is driven from userspace.  Honest.  No foolin'.
  25  *
  26  * Imagine two nodes lose network connectivity to each other but they're still
  27  * up and operating in every other way.  Presumably a network timeout indicates
  28  * that a node is broken and should be recovered.  They can't both recover each
  29  * other and both carry on without serialising their access to the file system.
  30  * They need to decide who is authoritative.  Now extend that problem to
  31  * arbitrary groups of nodes losing connectivity between each other.
  32  *
  33  * So we declare that a node which has given up on connecting to a majority
  34  * of nodes who are still heartbeating will fence itself.
  35  *
  36  * There are huge opportunities for races here.  After we give up on a node's
  37  * connection we need to wait long enough to give heartbeat an opportunity
  38  * to declare the node as truly dead.  We also need to be careful with the
  39  * race between when we see a node start heartbeating and when we connect
  40  * to it.
  41  *
  42  * So nodes that are in this transtion put a hold on the quorum decision
  43  * with a counter.  As they fall out of this transition they drop the count
  44  * and if they're the last, they fire off the decision.
  45  */
  46 #include <linux/kernel.h>
  47 #include <linux/workqueue.h>
  48 #include <linux/reboot.h>
  49
  50 #include "heartbeat.h"
  51 #include "nodemanager.h"
  52 #define MLOG_MASK_PREFIX ML_QUORUM
  53 #include "masklog.h"
  54 #include "quorum.h"
  55
  56 static struct o2quo_state {
  57         spinlock_t              qs_lock;
  58         struct work_struct      qs_work;
  59         int                     qs_pending;
  60         int                     qs_heartbeating;
  61         unsigned long           qs_hb_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];
  62         int                     qs_connected;
  63         unsigned long           qs_conn_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];
  64         int                     qs_holds;
  65         unsigned long           qs_hold_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];
  66 } o2quo_state;
  67
  68 /* this is horribly heavy-handed.  It should instead flip the file
  69  * system RO and call some userspace script. */
  70 static void o2quo_fence_self(void)
  71 {
  72         /* panic spins with interrupts enabled.  with preempt
  73          * threads can still schedule, etc, etc */
  74         o2hb_stop_all_regions();
  75
  76         switch (o2nm_single_cluster->cl_fence_method) {
  77         case O2NM_FENCE_PANIC:
  78                 panic("*** ocfs2 is very sorry to be fencing this system by "
  79                       "panicing ***\n");
  80                 break;
  81         default:
  82                 WARN_ON(o2nm_single_cluster->cl_fence_method >=
  83                         O2NM_FENCE_METHODS);
  84                 /* fall through */
  85         case O2NM_FENCE_RESET:
  86                 printk(KERN_ERR "*** ocfs2 is very sorry to be fencing this "
  87                        "system by restarting ***\n");
  88                 emergency_restart();
  89                 break;
  90         };
  91 }
  92
  93 /* Indicate that a timeout occurred on a hearbeat region write. The
  94  * other nodes in the cluster may consider us dead at that time so we
  95  * want to "fence" ourselves so that we don't scribble on the disk
  96  * after they think they've recovered us. This can't solve all
  97  * problems related to writeout after recovery but this hack can at
  98  * least close some of those gaps. When we have real fencing, this can
  99  * go away as our node would be fenced externally before other nodes
 100  * begin recovery. */
 101 void o2quo_disk_timeout(void)
 102 {
 103         o2quo_fence_self();
 104 }
 105
 106 static void o2quo_make_decision(struct work_struct *work)
 107 {
 108         int quorum;
 109         int lowest_hb, lowest_reachable = 0, fence = 0;
 110         struct o2quo_state *qs = &o2quo_state;
 111
 112         spin_lock(&qs->qs_lock);
 113
 114         lowest_hb = find_first_bit(qs->qs_hb_bm, O2NM_MAX_NODES);
 115         if (lowest_hb != O2NM_MAX_NODES)
 116                 lowest_reachable = test_bit(lowest_hb, qs->qs_conn_bm);
 117
 118         mlog(0, "heartbeating: %d, connected: %d, "
 119              "lowest: %d (%sreachable)\n", qs->qs_heartbeating,
 120              qs->qs_connected, lowest_hb, lowest_reachable ? "" : "un");
 121
 122         if (!test_bit(o2nm_this_node(), qs->qs_hb_bm) ||
 123             qs->qs_heartbeating == 1)
 124                 goto out;
 125
 126         if (qs->qs_heartbeating & 1) {
 127                 /* the odd numbered cluster case is straight forward --
 128                  * if we can't talk to the majority we're hosed */
 129                 quorum = (qs->qs_heartbeating + 1)/2;
 130                 if (qs->qs_connected < quorum) {
 131                         mlog(ML_ERROR, "fencing this node because it is "
 132                              "only connected to %u nodes and %u is needed "
 133                              "to make a quorum out of %u heartbeating nodes\n",
 134                              qs->qs_connected, quorum,
 135                              qs->qs_heartbeating);
 136                         fence = 1;
 137                 }
 138         } else {
 139                 /* the even numbered cluster adds the possibility of each half
 140                  * of the cluster being able to talk amongst themselves.. in
 141                  * that case we're hosed if we can't talk to the group that has
 142                  * the lowest numbered node */
 143                 quorum = qs->qs_heartbeating / 2;
 144                 if (qs->qs_connected < quorum) {
 145                         mlog(ML_ERROR, "fencing this node because it is "
 146                              "only connected to %u nodes and %u is needed "
 147                              "to make a quorum out of %u heartbeating nodes\n",
 148                              qs->qs_connected, quorum,
 149                              qs->qs_heartbeating);
 150                         fence = 1;
 151                 }
 152                 else if ((qs->qs_connected == quorum) &&
 153                          !lowest_reachable) {
 154                         mlog(ML_ERROR, "fencing this node because it is "
 155                              "connected to a half-quorum of %u out of %u "
 156                              "nodes which doesn't include the lowest active "
 157                              "node %u\n", quorum, qs->qs_heartbeating,
 158                              lowest_hb);
 159                         fence = 1;
 160                 }
 161         }
 162
 163 out:
 164         if (fence) {
 165                 spin_unlock(&qs->qs_lock);
 166                 o2quo_fence_self();
 167         } else {
 168                 mlog(ML_NOTICE, "not fencing this node, heartbeating: %d, "
 169                         "connected: %d, lowest: %d (%sreachable)\n",
 170                         qs->qs_heartbeating, qs->qs_connected, lowest_hb,
 171                         lowest_reachable ? "" : "un");
 172                 spin_unlock(&qs->qs_lock);
 173
 174         }
 175
 176 }
 177
 178 static void o2quo_set_hold(struct o2quo_state *qs, u8 node)
 179 {
 180         assert_spin_locked(&qs->qs_lock);
 181
 182         if (!test_and_set_bit(node, qs->qs_hold_bm)) {
 183                 qs->qs_holds++;
 184                 mlog_bug_on_msg(qs->qs_holds == O2NM_MAX_NODES,
 185                                 "node %u\n", node);
 186                 mlog(0, "node %u, %d total\n", node, qs->qs_holds);
 187         }
 188 }
 189
 190 static void o2quo_clear_hold(struct o2quo_state *qs, u8 node)
 191 {
 192         assert_spin_locked(&qs->qs_lock);
 193
 194         if (test_and_clear_bit(node, qs->qs_hold_bm)) {
 195                 mlog(0, "node %u, %d total\n", node, qs->qs_holds - 1);
 196                 if (--qs->qs_holds == 0) {
 197                         if (qs->qs_pending) {
 198                                 qs->qs_pending = 0;
 199                                 schedule_work(&qs->qs_work);
 200                         }
 201                 }
 202                 mlog_bug_on_msg(qs->qs_holds < 0, "node %u, holds %d\n",
 203                                 node, qs->qs_holds);
 204         }
 205 }
 206
 207 /* as a node comes up we delay the quorum decision until we know the fate of
 208  * the connection.  the hold will be droped in conn_up or hb_down.  it might be
 209  * perpetuated by con_err until hb_down.  if we already have a conn, we might
 210  * be dropping a hold that conn_up got. */
 211 void o2quo_hb_up(u8 node)
 212 {
 213         struct o2quo_state *qs = &o2quo_state;
 214
 215         spin_lock(&qs->qs_lock);
 216
 217         qs->qs_heartbeating++;
 218         mlog_bug_on_msg(qs->qs_heartbeating == O2NM_MAX_NODES,
 219                         "node %u\n", node);
 220         mlog_bug_on_msg(test_bit(node, qs->qs_hb_bm), "node %u\n", node);
 221         set_bit(node, qs->qs_hb_bm);
 222
 223         mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating);
 224
 225         if (!test_bit(node, qs->qs_conn_bm))
 226                 o2quo_set_hold(qs, node);
 227         else
 228                 o2quo_clear_hold(qs, node);
 229
 230         spin_unlock(&qs->qs_lock);
 231 }
 232
 233 /* hb going down releases any holds we might have had due to this node from
 234  * conn_up, conn_err, or hb_up */
 235 void o2quo_hb_down(u8 node)
 236 {
 237         struct o2quo_state *qs = &o2quo_state;
 238
 239         spin_lock(&qs->qs_lock);
 240
 241         qs->qs_heartbeating--;
 242         mlog_bug_on_msg(qs->qs_heartbeating < 0,
 243                         "node %u, %d heartbeating\n",
 244                         node, qs->qs_heartbeating);
 245         mlog_bug_on_msg(!test_bit(node, qs->qs_hb_bm), "node %u\n", node);
 246         clear_bit(node, qs->qs_hb_bm);
 247
 248         mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating);
 249
 250         o2quo_clear_hold(qs, node);
 251
 252         spin_unlock(&qs->qs_lock);
 253 }
 254
 255 /* this tells us that we've decided that the node is still heartbeating
 256  * even though we've lost it's conn.  it must only be called after conn_err
 257  * and indicates that we must now make a quorum decision in the future,
 258  * though we might be doing so after waiting for holds to drain.  Here
 259  * we'll be dropping the hold from conn_err. */
 260 void o2quo_hb_still_up(u8 node)
 261 {
 262         struct o2quo_state *qs = &o2quo_state;
 263
 264         spin_lock(&qs->qs_lock);
 265
 266         mlog(0, "node %u\n", node);
 267
 268         qs->qs_pending = 1;
 269         o2quo_clear_hold(qs, node);
 270
 271         spin_unlock(&qs->qs_lock);
 272 }
 273
 274 /* This is analogous to hb_up.  as a node's connection comes up we delay the
 275  * quorum decision until we see it heartbeating.  the hold will be droped in
 276  * hb_up or hb_down.  it might be perpetuated by con_err until hb_down.  if
 277  * it's already heartbeating we might be dropping a hold that conn_up got.
 278  * */
 279 void o2quo_conn_up(u8 node)
 280 {
 281         struct o2quo_state *qs = &o2quo_state;
 282
 283         spin_lock(&qs->qs_lock);
 284
 285         qs->qs_connected++;
 286         mlog_bug_on_msg(qs->qs_connected == O2NM_MAX_NODES,
 287                         "node %u\n", node);
 288         mlog_bug_on_msg(test_bit(node, qs->qs_conn_bm), "node %u\n", node);
 289         set_bit(node, qs->qs_conn_bm);
 290
 291         mlog(0, "node %u, %d total\n", node, qs->qs_connected);
 292
 293         if (!test_bit(node, qs->qs_hb_bm))
 294                 o2quo_set_hold(qs, node);
 295         else
 296                 o2quo_clear_hold(qs, node);
 297
 298         spin_unlock(&qs->qs_lock);
 299 }
 300
 301 /* we've decided that we won't ever be connecting to the node again.  if it's
 302  * still heartbeating we grab a hold that will delay decisions until either the
 303  * node stops heartbeating from hb_down or the caller decides that the node is
 304  * still up and calls still_up */
 305 void o2quo_conn_err(u8 node)
 306 {
 307         struct o2quo_state *qs = &o2quo_state;
 308
 309         spin_lock(&qs->qs_lock);
 310
 311         if (test_bit(node, qs->qs_conn_bm)) {
 312                 qs->qs_connected--;
 313                 mlog_bug_on_msg(qs->qs_connected < 0,
 314                                 "node %u, connected %d\n",
 315                                 node, qs->qs_connected);
 316
 317                 clear_bit(node, qs->qs_conn_bm);
 318
 319                 if (test_bit(node, qs->qs_hb_bm))
 320                         o2quo_set_hold(qs, node);
 321         }
 322
 323         mlog(0, "node %u, %d total\n", node, qs->qs_connected);
 324
 325
 326         spin_unlock(&qs->qs_lock);
 327 }
 328
 329 void o2quo_init(void)
 330 {
 331         struct o2quo_state *qs = &o2quo_state;
 332
 333         spin_lock_init(&qs->qs_lock);
 334         INIT_WORK(&qs->qs_work, o2quo_make_decision);
 335 }
 336
 337 void o2quo_exit(void)
 338 {
 339         struct o2quo_state *qs = &o2quo_state;
 340
 341         flush_work(&qs->qs_work);
 342 }