1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* -*- mode: c; c-basic-offset: 8; -*-
3 *
4 * vim: noexpandtab sw=8 ts=8 sts=0:
5 *
6 * Copyright (C) 2005 Oracle. All rights reserved.
7 */
8
9 /* This quorum hack is only here until we transition to some more rational
10 * approach that is driven from userspace. Honest. No foolin'.
11 *
12 * Imagine two nodes lose network connectivity to each other but they're still
13 * up and operating in every other way. Presumably a network timeout indicates
14 * that a node is broken and should be recovered. They can't both recover each
15 * other and both carry on without serialising their access to the file system.
16 * They need to decide who is authoritative. Now extend that problem to
17 * arbitrary groups of nodes losing connectivity between each other.
18 *
19 * So we declare that a node which has given up on connecting to a majority
20 * of nodes who are still heartbeating will fence itself.
21 *
22 * There are huge opportunities for races here. After we give up on a node's
23 * connection we need to wait long enough to give heartbeat an opportunity
24 * to declare the node as truly dead. We also need to be careful with the
25 * race between when we see a node start heartbeating and when we connect
26 * to it.
27 *
28 * So nodes that are in this transtion put a hold on the quorum decision
29 * with a counter. As they fall out of this transition they drop the count
30 * and if they're the last, they fire off the decision.
31 */
32 #include <linux/kernel.h>
33 #include <linux/workqueue.h>
34 #include <linux/reboot.h>
35
36 #include "heartbeat.h"
37 #include "nodemanager.h"
38 #define MLOG_MASK_PREFIX ML_QUORUM
39 #include "masklog.h"
40 #include "quorum.h"
41
42 static struct o2quo_state {
43 spinlock_t qs_lock;
44 struct work_struct qs_work;
45 int qs_pending;
46 int qs_heartbeating;
47 unsigned long qs_hb_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];
48 int qs_connected;
49 unsigned long qs_conn_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];
50 int qs_holds;
51 unsigned long qs_hold_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];
52 } o2quo_state;
53
54 /* this is horribly heavy-handed. It should instead flip the file
55 * system RO and call some userspace script. */
o2quo_fence_self(void)56 static void o2quo_fence_self(void)
57 {
58 /* panic spins with interrupts enabled. with preempt
59 * threads can still schedule, etc, etc */
60 o2hb_stop_all_regions();
61
62 switch (o2nm_single_cluster->cl_fence_method) {
63 case O2NM_FENCE_PANIC:
64 panic("*** ocfs2 is very sorry to be fencing this system by "
65 "panicing ***\n");
66 break;
67 default:
68 WARN_ON(o2nm_single_cluster->cl_fence_method >=
69 O2NM_FENCE_METHODS);
70 fallthrough;
71 case O2NM_FENCE_RESET:
72 printk(KERN_ERR "*** ocfs2 is very sorry to be fencing this "
73 "system by restarting ***\n");
74 emergency_restart();
75 break;
76 }
77 }
78
79 /* Indicate that a timeout occurred on a heartbeat region write. The
80 * other nodes in the cluster may consider us dead at that time so we
81 * want to "fence" ourselves so that we don't scribble on the disk
82 * after they think they've recovered us. This can't solve all
83 * problems related to writeout after recovery but this hack can at
84 * least close some of those gaps. When we have real fencing, this can
85 * go away as our node would be fenced externally before other nodes
86 * begin recovery. */
o2quo_disk_timeout(void)87 void o2quo_disk_timeout(void)
88 {
89 o2quo_fence_self();
90 }
91
o2quo_make_decision(struct work_struct * work)92 static void o2quo_make_decision(struct work_struct *work)
93 {
94 int quorum;
95 int lowest_hb, lowest_reachable = 0, fence = 0;
96 struct o2quo_state *qs = &o2quo_state;
97
98 spin_lock(&qs->qs_lock);
99
100 lowest_hb = find_first_bit(qs->qs_hb_bm, O2NM_MAX_NODES);
101 if (lowest_hb != O2NM_MAX_NODES)
102 lowest_reachable = test_bit(lowest_hb, qs->qs_conn_bm);
103
104 mlog(0, "heartbeating: %d, connected: %d, "
105 "lowest: %d (%sreachable)\n", qs->qs_heartbeating,
106 qs->qs_connected, lowest_hb, lowest_reachable ? "" : "un");
107
108 if (!test_bit(o2nm_this_node(), qs->qs_hb_bm) ||
109 qs->qs_heartbeating == 1)
110 goto out;
111
112 if (qs->qs_heartbeating & 1) {
113 /* the odd numbered cluster case is straight forward --
114 * if we can't talk to the majority we're hosed */
115 quorum = (qs->qs_heartbeating + 1)/2;
116 if (qs->qs_connected < quorum) {
117 mlog(ML_ERROR, "fencing this node because it is "
118 "only connected to %u nodes and %u is needed "
119 "to make a quorum out of %u heartbeating nodes\n",
120 qs->qs_connected, quorum,
121 qs->qs_heartbeating);
122 fence = 1;
123 }
124 } else {
125 /* the even numbered cluster adds the possibility of each half
126 * of the cluster being able to talk amongst themselves.. in
127 * that case we're hosed if we can't talk to the group that has
128 * the lowest numbered node */
129 quorum = qs->qs_heartbeating / 2;
130 if (qs->qs_connected < quorum) {
131 mlog(ML_ERROR, "fencing this node because it is "
132 "only connected to %u nodes and %u is needed "
133 "to make a quorum out of %u heartbeating nodes\n",
134 qs->qs_connected, quorum,
135 qs->qs_heartbeating);
136 fence = 1;
137 }
138 else if ((qs->qs_connected == quorum) &&
139 !lowest_reachable) {
140 mlog(ML_ERROR, "fencing this node because it is "
141 "connected to a half-quorum of %u out of %u "
142 "nodes which doesn't include the lowest active "
143 "node %u\n", quorum, qs->qs_heartbeating,
144 lowest_hb);
145 fence = 1;
146 }
147 }
148
149 out:
150 if (fence) {
151 spin_unlock(&qs->qs_lock);
152 o2quo_fence_self();
153 } else {
154 mlog(ML_NOTICE, "not fencing this node, heartbeating: %d, "
155 "connected: %d, lowest: %d (%sreachable)\n",
156 qs->qs_heartbeating, qs->qs_connected, lowest_hb,
157 lowest_reachable ? "" : "un");
158 spin_unlock(&qs->qs_lock);
159
160 }
161
162 }
163
o2quo_set_hold(struct o2quo_state * qs,u8 node)164 static void o2quo_set_hold(struct o2quo_state *qs, u8 node)
165 {
166 assert_spin_locked(&qs->qs_lock);
167
168 if (!test_and_set_bit(node, qs->qs_hold_bm)) {
169 qs->qs_holds++;
170 mlog_bug_on_msg(qs->qs_holds == O2NM_MAX_NODES,
171 "node %u\n", node);
172 mlog(0, "node %u, %d total\n", node, qs->qs_holds);
173 }
174 }
175
o2quo_clear_hold(struct o2quo_state * qs,u8 node)176 static void o2quo_clear_hold(struct o2quo_state *qs, u8 node)
177 {
178 assert_spin_locked(&qs->qs_lock);
179
180 if (test_and_clear_bit(node, qs->qs_hold_bm)) {
181 mlog(0, "node %u, %d total\n", node, qs->qs_holds - 1);
182 if (--qs->qs_holds == 0) {
183 if (qs->qs_pending) {
184 qs->qs_pending = 0;
185 schedule_work(&qs->qs_work);
186 }
187 }
188 mlog_bug_on_msg(qs->qs_holds < 0, "node %u, holds %d\n",
189 node, qs->qs_holds);
190 }
191 }
192
193 /* as a node comes up we delay the quorum decision until we know the fate of
194 * the connection. the hold will be droped in conn_up or hb_down. it might be
195 * perpetuated by con_err until hb_down. if we already have a conn, we might
196 * be dropping a hold that conn_up got. */
o2quo_hb_up(u8 node)197 void o2quo_hb_up(u8 node)
198 {
199 struct o2quo_state *qs = &o2quo_state;
200
201 spin_lock(&qs->qs_lock);
202
203 qs->qs_heartbeating++;
204 mlog_bug_on_msg(qs->qs_heartbeating == O2NM_MAX_NODES,
205 "node %u\n", node);
206 mlog_bug_on_msg(test_bit(node, qs->qs_hb_bm), "node %u\n", node);
207 set_bit(node, qs->qs_hb_bm);
208
209 mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating);
210
211 if (!test_bit(node, qs->qs_conn_bm))
212 o2quo_set_hold(qs, node);
213 else
214 o2quo_clear_hold(qs, node);
215
216 spin_unlock(&qs->qs_lock);
217 }
218
219 /* hb going down releases any holds we might have had due to this node from
220 * conn_up, conn_err, or hb_up */
o2quo_hb_down(u8 node)221 void o2quo_hb_down(u8 node)
222 {
223 struct o2quo_state *qs = &o2quo_state;
224
225 spin_lock(&qs->qs_lock);
226
227 qs->qs_heartbeating--;
228 mlog_bug_on_msg(qs->qs_heartbeating < 0,
229 "node %u, %d heartbeating\n",
230 node, qs->qs_heartbeating);
231 mlog_bug_on_msg(!test_bit(node, qs->qs_hb_bm), "node %u\n", node);
232 clear_bit(node, qs->qs_hb_bm);
233
234 mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating);
235
236 o2quo_clear_hold(qs, node);
237
238 spin_unlock(&qs->qs_lock);
239 }
240
241 /* this tells us that we've decided that the node is still heartbeating
242 * even though we've lost it's conn. it must only be called after conn_err
243 * and indicates that we must now make a quorum decision in the future,
244 * though we might be doing so after waiting for holds to drain. Here
245 * we'll be dropping the hold from conn_err. */
o2quo_hb_still_up(u8 node)246 void o2quo_hb_still_up(u8 node)
247 {
248 struct o2quo_state *qs = &o2quo_state;
249
250 spin_lock(&qs->qs_lock);
251
252 mlog(0, "node %u\n", node);
253
254 qs->qs_pending = 1;
255 o2quo_clear_hold(qs, node);
256
257 spin_unlock(&qs->qs_lock);
258 }
259
260 /* This is analogous to hb_up. as a node's connection comes up we delay the
261 * quorum decision until we see it heartbeating. the hold will be droped in
262 * hb_up or hb_down. it might be perpetuated by con_err until hb_down. if
263 * it's already heartbeating we might be dropping a hold that conn_up got.
264 * */
o2quo_conn_up(u8 node)265 void o2quo_conn_up(u8 node)
266 {
267 struct o2quo_state *qs = &o2quo_state;
268
269 spin_lock(&qs->qs_lock);
270
271 qs->qs_connected++;
272 mlog_bug_on_msg(qs->qs_connected == O2NM_MAX_NODES,
273 "node %u\n", node);
274 mlog_bug_on_msg(test_bit(node, qs->qs_conn_bm), "node %u\n", node);
275 set_bit(node, qs->qs_conn_bm);
276
277 mlog(0, "node %u, %d total\n", node, qs->qs_connected);
278
279 if (!test_bit(node, qs->qs_hb_bm))
280 o2quo_set_hold(qs, node);
281 else
282 o2quo_clear_hold(qs, node);
283
284 spin_unlock(&qs->qs_lock);
285 }
286
287 /* we've decided that we won't ever be connecting to the node again. if it's
288 * still heartbeating we grab a hold that will delay decisions until either the
289 * node stops heartbeating from hb_down or the caller decides that the node is
290 * still up and calls still_up */
o2quo_conn_err(u8 node)291 void o2quo_conn_err(u8 node)
292 {
293 struct o2quo_state *qs = &o2quo_state;
294
295 spin_lock(&qs->qs_lock);
296
297 if (test_bit(node, qs->qs_conn_bm)) {
298 qs->qs_connected--;
299 mlog_bug_on_msg(qs->qs_connected < 0,
300 "node %u, connected %d\n",
301 node, qs->qs_connected);
302
303 clear_bit(node, qs->qs_conn_bm);
304
305 if (test_bit(node, qs->qs_hb_bm))
306 o2quo_set_hold(qs, node);
307 }
308
309 mlog(0, "node %u, %d total\n", node, qs->qs_connected);
310
311
312 spin_unlock(&qs->qs_lock);
313 }
314
o2quo_init(void)315 void o2quo_init(void)
316 {
317 struct o2quo_state *qs = &o2quo_state;
318
319 spin_lock_init(&qs->qs_lock);
320 INIT_WORK(&qs->qs_work, o2quo_make_decision);
321 }
322
o2quo_exit(void)323 void o2quo_exit(void)
324 {
325 struct o2quo_state *qs = &o2quo_state;
326
327 flush_work(&qs->qs_work);
328 }
329