1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Copyright (C) 2005 Oracle. All rights reserved. 5 */ 6 7 /* This quorum hack is only here until we transition to some more rational 8 * approach that is driven from userspace. Honest. No foolin'. 9 * 10 * Imagine two nodes lose network connectivity to each other but they're still 11 * up and operating in every other way. Presumably a network timeout indicates 12 * that a node is broken and should be recovered. They can't both recover each 13 * other and both carry on without serialising their access to the file system. 14 * They need to decide who is authoritative. Now extend that problem to 15 * arbitrary groups of nodes losing connectivity between each other. 16 * 17 * So we declare that a node which has given up on connecting to a majority 18 * of nodes who are still heartbeating will fence itself. 19 * 20 * There are huge opportunities for races here. After we give up on a node's 21 * connection we need to wait long enough to give heartbeat an opportunity 22 * to declare the node as truly dead. We also need to be careful with the 23 * race between when we see a node start heartbeating and when we connect 24 * to it. 25 * 26 * So nodes that are in this transtion put a hold on the quorum decision 27 * with a counter. As they fall out of this transition they drop the count 28 * and if they're the last, they fire off the decision. 29 */ 30 #include <linux/kernel.h> 31 #include <linux/workqueue.h> 32 #include <linux/reboot.h> 33 34 #include "heartbeat.h" 35 #include "nodemanager.h" 36 #define MLOG_MASK_PREFIX ML_QUORUM 37 #include "masklog.h" 38 #include "quorum.h" 39 40 static struct o2quo_state { 41 spinlock_t qs_lock; 42 struct work_struct qs_work; 43 int qs_pending; 44 int qs_heartbeating; 45 unsigned long qs_hb_bm[BITS_TO_LONGS(O2NM_MAX_NODES)]; 46 int qs_connected; 47 unsigned long qs_conn_bm[BITS_TO_LONGS(O2NM_MAX_NODES)]; 48 int qs_holds; 49 unsigned long qs_hold_bm[BITS_TO_LONGS(O2NM_MAX_NODES)]; 50 } o2quo_state; 51 52 /* this is horribly heavy-handed. It should instead flip the file 53 * system RO and call some userspace script. */ 54 static void o2quo_fence_self(void) 55 { 56 /* panic spins with interrupts enabled. with preempt 57 * threads can still schedule, etc, etc */ 58 o2hb_stop_all_regions(); 59 60 switch (o2nm_single_cluster->cl_fence_method) { 61 case O2NM_FENCE_PANIC: 62 panic("*** ocfs2 is very sorry to be fencing this system by " 63 "panicing ***\n"); 64 break; 65 default: 66 WARN_ON(o2nm_single_cluster->cl_fence_method >= 67 O2NM_FENCE_METHODS); 68 fallthrough; 69 case O2NM_FENCE_RESET: 70 printk(KERN_ERR "*** ocfs2 is very sorry to be fencing this " 71 "system by restarting ***\n"); 72 emergency_restart(); 73 break; 74 } 75 } 76 77 /* Indicate that a timeout occurred on a heartbeat region write. The 78 * other nodes in the cluster may consider us dead at that time so we 79 * want to "fence" ourselves so that we don't scribble on the disk 80 * after they think they've recovered us. This can't solve all 81 * problems related to writeout after recovery but this hack can at 82 * least close some of those gaps. When we have real fencing, this can 83 * go away as our node would be fenced externally before other nodes 84 * begin recovery. */ 85 void o2quo_disk_timeout(void) 86 { 87 o2quo_fence_self(); 88 } 89 90 static void o2quo_make_decision(struct work_struct *work) 91 { 92 int quorum; 93 int lowest_hb, lowest_reachable = 0, fence = 0; 94 struct o2quo_state *qs = &o2quo_state; 95 96 spin_lock(&qs->qs_lock); 97 98 lowest_hb = find_first_bit(qs->qs_hb_bm, O2NM_MAX_NODES); 99 if (lowest_hb != O2NM_MAX_NODES) 100 lowest_reachable = test_bit(lowest_hb, qs->qs_conn_bm); 101 102 mlog(0, "heartbeating: %d, connected: %d, " 103 "lowest: %d (%sreachable)\n", qs->qs_heartbeating, 104 qs->qs_connected, lowest_hb, lowest_reachable ? "" : "un"); 105 106 if (!test_bit(o2nm_this_node(), qs->qs_hb_bm) || 107 qs->qs_heartbeating == 1) 108 goto out; 109 110 if (qs->qs_heartbeating & 1) { 111 /* the odd numbered cluster case is straight forward -- 112 * if we can't talk to the majority we're hosed */ 113 quorum = (qs->qs_heartbeating + 1)/2; 114 if (qs->qs_connected < quorum) { 115 mlog(ML_ERROR, "fencing this node because it is " 116 "only connected to %u nodes and %u is needed " 117 "to make a quorum out of %u heartbeating nodes\n", 118 qs->qs_connected, quorum, 119 qs->qs_heartbeating); 120 fence = 1; 121 } 122 } else { 123 /* the even numbered cluster adds the possibility of each half 124 * of the cluster being able to talk amongst themselves.. in 125 * that case we're hosed if we can't talk to the group that has 126 * the lowest numbered node */ 127 quorum = qs->qs_heartbeating / 2; 128 if (qs->qs_connected < quorum) { 129 mlog(ML_ERROR, "fencing this node because it is " 130 "only connected to %u nodes and %u is needed " 131 "to make a quorum out of %u heartbeating nodes\n", 132 qs->qs_connected, quorum, 133 qs->qs_heartbeating); 134 fence = 1; 135 } 136 else if ((qs->qs_connected == quorum) && 137 !lowest_reachable) { 138 mlog(ML_ERROR, "fencing this node because it is " 139 "connected to a half-quorum of %u out of %u " 140 "nodes which doesn't include the lowest active " 141 "node %u\n", quorum, qs->qs_heartbeating, 142 lowest_hb); 143 fence = 1; 144 } 145 } 146 147 out: 148 if (fence) { 149 spin_unlock(&qs->qs_lock); 150 o2quo_fence_self(); 151 } else { 152 mlog(ML_NOTICE, "not fencing this node, heartbeating: %d, " 153 "connected: %d, lowest: %d (%sreachable)\n", 154 qs->qs_heartbeating, qs->qs_connected, lowest_hb, 155 lowest_reachable ? "" : "un"); 156 spin_unlock(&qs->qs_lock); 157 158 } 159 160 } 161 162 static void o2quo_set_hold(struct o2quo_state *qs, u8 node) 163 { 164 assert_spin_locked(&qs->qs_lock); 165 166 if (!test_and_set_bit(node, qs->qs_hold_bm)) { 167 qs->qs_holds++; 168 mlog_bug_on_msg(qs->qs_holds == O2NM_MAX_NODES, 169 "node %u\n", node); 170 mlog(0, "node %u, %d total\n", node, qs->qs_holds); 171 } 172 } 173 174 static void o2quo_clear_hold(struct o2quo_state *qs, u8 node) 175 { 176 assert_spin_locked(&qs->qs_lock); 177 178 if (test_and_clear_bit(node, qs->qs_hold_bm)) { 179 mlog(0, "node %u, %d total\n", node, qs->qs_holds - 1); 180 if (--qs->qs_holds == 0) { 181 if (qs->qs_pending) { 182 qs->qs_pending = 0; 183 schedule_work(&qs->qs_work); 184 } 185 } 186 mlog_bug_on_msg(qs->qs_holds < 0, "node %u, holds %d\n", 187 node, qs->qs_holds); 188 } 189 } 190 191 /* as a node comes up we delay the quorum decision until we know the fate of 192 * the connection. the hold will be droped in conn_up or hb_down. it might be 193 * perpetuated by con_err until hb_down. if we already have a conn, we might 194 * be dropping a hold that conn_up got. */ 195 void o2quo_hb_up(u8 node) 196 { 197 struct o2quo_state *qs = &o2quo_state; 198 199 spin_lock(&qs->qs_lock); 200 201 qs->qs_heartbeating++; 202 mlog_bug_on_msg(qs->qs_heartbeating == O2NM_MAX_NODES, 203 "node %u\n", node); 204 mlog_bug_on_msg(test_bit(node, qs->qs_hb_bm), "node %u\n", node); 205 set_bit(node, qs->qs_hb_bm); 206 207 mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating); 208 209 if (!test_bit(node, qs->qs_conn_bm)) 210 o2quo_set_hold(qs, node); 211 else 212 o2quo_clear_hold(qs, node); 213 214 spin_unlock(&qs->qs_lock); 215 } 216 217 /* hb going down releases any holds we might have had due to this node from 218 * conn_up, conn_err, or hb_up */ 219 void o2quo_hb_down(u8 node) 220 { 221 struct o2quo_state *qs = &o2quo_state; 222 223 spin_lock(&qs->qs_lock); 224 225 qs->qs_heartbeating--; 226 mlog_bug_on_msg(qs->qs_heartbeating < 0, 227 "node %u, %d heartbeating\n", 228 node, qs->qs_heartbeating); 229 mlog_bug_on_msg(!test_bit(node, qs->qs_hb_bm), "node %u\n", node); 230 clear_bit(node, qs->qs_hb_bm); 231 232 mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating); 233 234 o2quo_clear_hold(qs, node); 235 236 spin_unlock(&qs->qs_lock); 237 } 238 239 /* this tells us that we've decided that the node is still heartbeating 240 * even though we've lost it's conn. it must only be called after conn_err 241 * and indicates that we must now make a quorum decision in the future, 242 * though we might be doing so after waiting for holds to drain. Here 243 * we'll be dropping the hold from conn_err. */ 244 void o2quo_hb_still_up(u8 node) 245 { 246 struct o2quo_state *qs = &o2quo_state; 247 248 spin_lock(&qs->qs_lock); 249 250 mlog(0, "node %u\n", node); 251 252 qs->qs_pending = 1; 253 o2quo_clear_hold(qs, node); 254 255 spin_unlock(&qs->qs_lock); 256 } 257 258 /* This is analogous to hb_up. as a node's connection comes up we delay the 259 * quorum decision until we see it heartbeating. the hold will be droped in 260 * hb_up or hb_down. it might be perpetuated by con_err until hb_down. if 261 * it's already heartbeating we might be dropping a hold that conn_up got. 262 * */ 263 void o2quo_conn_up(u8 node) 264 { 265 struct o2quo_state *qs = &o2quo_state; 266 267 spin_lock(&qs->qs_lock); 268 269 qs->qs_connected++; 270 mlog_bug_on_msg(qs->qs_connected == O2NM_MAX_NODES, 271 "node %u\n", node); 272 mlog_bug_on_msg(test_bit(node, qs->qs_conn_bm), "node %u\n", node); 273 set_bit(node, qs->qs_conn_bm); 274 275 mlog(0, "node %u, %d total\n", node, qs->qs_connected); 276 277 if (!test_bit(node, qs->qs_hb_bm)) 278 o2quo_set_hold(qs, node); 279 else 280 o2quo_clear_hold(qs, node); 281 282 spin_unlock(&qs->qs_lock); 283 } 284 285 /* we've decided that we won't ever be connecting to the node again. if it's 286 * still heartbeating we grab a hold that will delay decisions until either the 287 * node stops heartbeating from hb_down or the caller decides that the node is 288 * still up and calls still_up */ 289 void o2quo_conn_err(u8 node) 290 { 291 struct o2quo_state *qs = &o2quo_state; 292 293 spin_lock(&qs->qs_lock); 294 295 if (test_bit(node, qs->qs_conn_bm)) { 296 qs->qs_connected--; 297 mlog_bug_on_msg(qs->qs_connected < 0, 298 "node %u, connected %d\n", 299 node, qs->qs_connected); 300 301 clear_bit(node, qs->qs_conn_bm); 302 303 if (test_bit(node, qs->qs_hb_bm)) 304 o2quo_set_hold(qs, node); 305 } 306 307 mlog(0, "node %u, %d total\n", node, qs->qs_connected); 308 309 310 spin_unlock(&qs->qs_lock); 311 } 312 313 void o2quo_init(void) 314 { 315 struct o2quo_state *qs = &o2quo_state; 316 317 spin_lock_init(&qs->qs_lock); 318 INIT_WORK(&qs->qs_work, o2quo_make_decision); 319 } 320 321 void o2quo_exit(void) 322 { 323 struct o2quo_state *qs = &o2quo_state; 324 325 flush_work(&qs->qs_work); 326 } 327