[PATCH] OCFS2: The Second Oracle Cluster Filesystem

/* -*- mode: c; c-basic-offset: 8; -*-

 *

 * vim: noexpandtab sw=8 ts=8 sts=0:

 *

 * Copyright (C) 2005 Oracle.  All rights reserved.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * General Public License for more details.

 *

 * You should have received a copy of the GNU General Public

 * License along with this program; if not, write to the

 * Free Software Foundation, Inc., 59 Temple Place - Suite 330,

 * Boston, MA 021110-1307, USA.

 */

/* This quorum hack is only here until we transition to some more rational

 * approach that is driven from userspace.  Honest.  No foolin'.

 *

 * Imagine two nodes lose network connectivity to each other but they're still

 * up and operating in every other way.  Presumably a network timeout indicates

 * that a node is broken and should be recovered.  They can't both recover each

 * other and both carry on without serialising their access to the file system.

 * They need to decide who is authoritative.  Now extend that problem to

 * arbitrary groups of nodes losing connectivity between each other.

 *

 * So we declare that a node which has given up on connecting to a majority

 * of nodes who are still heartbeating will fence itself.

 *

 * There are huge opportunities for races here.  After we give up on a node's

 * connection we need to wait long enough to give heartbeat an opportunity

 * to declare the node as truly dead.  We also need to be careful with the

 * race between when we see a node start heartbeating and when we connect

 * to it.

 *

 * So nodes that are in this transtion put a hold on the quorum decision

 * with a counter.  As they fall out of this transition they drop the count

 * and if they're the last, they fire off the decision.

 */

#include <linux/kernel.h>

#include <linux/slab.h>

#include <linux/workqueue.h>

#include "heartbeat.h"

#include "nodemanager.h"

#define MLOG_MASK_PREFIX ML_QUORUM

#include "masklog.h"

#include "quorum.h"

static struct o2quo_state {

	spinlock_t		qs_lock;

	struct work_struct	qs_work;

	int			qs_pending;

	int			qs_heartbeating;

	unsigned long		qs_hb_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];

	int			qs_connected;

	unsigned long		qs_conn_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];

	int			qs_holds;

	unsigned long		qs_hold_bm[BITS_TO_LONGS(O2NM_MAX_NODES)];

} o2quo_state;

/* this is horribly heavy-handed.  It should instead flip the file

 * system RO and call some userspace script. */

static void o2quo_fence_self(void)

{

	/* panic spins with interrupts enabled.  with preempt

	 * threads can still schedule, etc, etc */

	o2hb_stop_all_regions();

	panic("ocfs2 is very sorry to be fencing this system by panicing\n");

}

/* Indicate that a timeout occured on a hearbeat region write. The

 * other nodes in the cluster may consider us dead at that time so we

 * want to "fence" ourselves so that we don't scribble on the disk

 * after they think they've recovered us. This can't solve all

 * problems related to writeout after recovery but this hack can at

 * least close some of those gaps. When we have real fencing, this can

 * go away as our node would be fenced externally before other nodes

 * begin recovery. */

void o2quo_disk_timeout(void)

{

	o2quo_fence_self();

}

static void o2quo_make_decision(void *arg)

{

	int quorum;

	int lowest_hb, lowest_reachable = 0, fence = 0;

	struct o2quo_state *qs = &o2quo_state;

	spin_lock(&qs->qs_lock);

	lowest_hb = find_first_bit(qs->qs_hb_bm, O2NM_MAX_NODES);

	if (lowest_hb != O2NM_MAX_NODES)

		lowest_reachable = test_bit(lowest_hb, qs->qs_conn_bm);

	mlog(0, "heartbeating: %d, connected: %d, "

	     "lowest: %d (%sreachable)\n", qs->qs_heartbeating,

	     qs->qs_connected, lowest_hb, lowest_reachable ? "" : "un");

	if (!test_bit(o2nm_this_node(), qs->qs_hb_bm) ||

	    qs->qs_heartbeating == 1)

		goto out;

	if (qs->qs_heartbeating & 1) {

		/* the odd numbered cluster case is straight forward --

		 * if we can't talk to the majority we're hosed */

		quorum = (qs->qs_heartbeating + 1)/2;

		if (qs->qs_connected < quorum) {

			mlog(ML_ERROR, "fencing this node because it is "

			     "only connected to %u nodes and %u is needed "

			     "to make a quorum out of %u heartbeating nodes\n",

			     qs->qs_connected, quorum,

			     qs->qs_heartbeating);

			fence = 1;

		}

	} else {

		/* the even numbered cluster adds the possibility of each half

		 * of the cluster being able to talk amongst themselves.. in

		 * that case we're hosed if we can't talk to the group that has

		 * the lowest numbered node */

		quorum = qs->qs_heartbeating / 2;

		if (qs->qs_connected < quorum) {

			mlog(ML_ERROR, "fencing this node because it is "

			     "only connected to %u nodes and %u is needed "

			     "to make a quorum out of %u heartbeating nodes\n",

			     qs->qs_connected, quorum,

			     qs->qs_heartbeating);

			fence = 1;

		}

		else if ((qs->qs_connected == quorum) &&

			 !lowest_reachable) {

			mlog(ML_ERROR, "fencing this node because it is "

			     "connected to a half-quorum of %u out of %u "

			     "nodes which doesn't include the lowest active "

			     "node %u\n", quorum, qs->qs_heartbeating,

			     lowest_hb);

			fence = 1;

		}

	}

out:

	spin_unlock(&qs->qs_lock);

	if (fence)

		o2quo_fence_self();

}

static void o2quo_set_hold(struct o2quo_state *qs, u8 node)

{

	assert_spin_locked(&qs->qs_lock);

	if (!test_and_set_bit(node, qs->qs_hold_bm)) {

		qs->qs_holds++;

		mlog_bug_on_msg(qs->qs_holds == O2NM_MAX_NODES,

			        "node %u\n", node);

		mlog(0, "node %u, %d total\n", node, qs->qs_holds);

	}

}

static void o2quo_clear_hold(struct o2quo_state *qs, u8 node)

{

	assert_spin_locked(&qs->qs_lock);

	if (test_and_clear_bit(node, qs->qs_hold_bm)) {

		mlog(0, "node %u, %d total\n", node, qs->qs_holds - 1);

		if (--qs->qs_holds == 0) {

			if (qs->qs_pending) {

				qs->qs_pending = 0;

				schedule_work(&qs->qs_work);

			}

		}

		mlog_bug_on_msg(qs->qs_holds < 0, "node %u, holds %d\n",

				node, qs->qs_holds);

	}

}

/* as a node comes up we delay the quorum decision until we know the fate of

 * the connection.  the hold will be droped in conn_up or hb_down.  it might be

 * perpetuated by con_err until hb_down.  if we already have a conn, we might

 * be dropping a hold that conn_up got. */

void o2quo_hb_up(u8 node)

{

	struct o2quo_state *qs = &o2quo_state;

	spin_lock(&qs->qs_lock);

	qs->qs_heartbeating++;

	mlog_bug_on_msg(qs->qs_heartbeating == O2NM_MAX_NODES,

		        "node %u\n", node);

	mlog_bug_on_msg(test_bit(node, qs->qs_hb_bm), "node %u\n", node);

	set_bit(node, qs->qs_hb_bm);

	mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating);

	if (!test_bit(node, qs->qs_conn_bm))

		o2quo_set_hold(qs, node);

	else

		o2quo_clear_hold(qs, node);

	spin_unlock(&qs->qs_lock);

}

/* hb going down releases any holds we might have had due to this node from

 * conn_up, conn_err, or hb_up */

void o2quo_hb_down(u8 node)

{

	struct o2quo_state *qs = &o2quo_state;

	spin_lock(&qs->qs_lock);

	qs->qs_heartbeating--;

	mlog_bug_on_msg(qs->qs_heartbeating < 0,

			"node %u, %d heartbeating\n",

			node, qs->qs_heartbeating);

	mlog_bug_on_msg(!test_bit(node, qs->qs_hb_bm), "node %u\n", node);

	clear_bit(node, qs->qs_hb_bm);

	mlog(0, "node %u, %d total\n", node, qs->qs_heartbeating);

	o2quo_clear_hold(qs, node);

	spin_unlock(&qs->qs_lock);

}

/* this tells us that we've decided that the node is still heartbeating

 * even though we've lost it's conn.  it must only be called after conn_err

 * and indicates that we must now make a quorum decision in the future,

 * though we might be doing so after waiting for holds to drain.  Here

 * we'll be dropping the hold from conn_err. */

void o2quo_hb_still_up(u8 node)

{

	struct o2quo_state *qs = &o2quo_state;

	spin_lock(&qs->qs_lock);

	mlog(0, "node %u\n", node);

	qs->qs_pending = 1;

	o2quo_clear_hold(qs, node);

	spin_unlock(&qs->qs_lock);

}

/* This is analagous to hb_up.  as a node's connection comes up we delay the

 * quorum decision until we see it heartbeating.  the hold will be droped in

 * hb_up or hb_down.  it might be perpetuated by con_err until hb_down.  if

 * it's already heartbeating we we might be dropping a hold that conn_up got.

 * */

void o2quo_conn_up(u8 node)

{

	struct o2quo_state *qs = &o2quo_state;

	spin_lock(&qs->qs_lock);

	qs->qs_connected++;

	mlog_bug_on_msg(qs->qs_connected == O2NM_MAX_NODES,

		        "node %u\n", node);

	mlog_bug_on_msg(test_bit(node, qs->qs_conn_bm), "node %u\n", node);

	set_bit(node, qs->qs_conn_bm);

	mlog(0, "node %u, %d total\n", node, qs->qs_connected);

	if (!test_bit(node, qs->qs_hb_bm))

		o2quo_set_hold(qs, node);

	else

		o2quo_clear_hold(qs, node);

	spin_unlock(&qs->qs_lock);

}

/* we've decided that we won't ever be connecting to the node again.  if it's

 * still heartbeating we grab a hold that will delay decisions until either the

 * node stops heartbeating from hb_down or the caller decides that the node is

 * still up and calls still_up */

void o2quo_conn_err(u8 node)

{

	struct o2quo_state *qs = &o2quo_state;

	spin_lock(&qs->qs_lock);

	if (test_bit(node, qs->qs_conn_bm)) {

		qs->qs_connected--;

		mlog_bug_on_msg(qs->qs_connected < 0,

				"node %u, connected %d\n",

				node, qs->qs_connected);

		clear_bit(node, qs->qs_conn_bm);

	}

	mlog(0, "node %u, %d total\n", node, qs->qs_connected);

	if (test_bit(node, qs->qs_hb_bm))

		o2quo_set_hold(qs, node);

	spin_unlock(&qs->qs_lock);

}

void o2quo_init(void)

{

	struct o2quo_state *qs = &o2quo_state;

	spin_lock_init(&qs->qs_lock);

	INIT_WORK(&qs->qs_work, o2quo_make_decision, NULL);

}

void o2quo_exit(void)

{

	flush_scheduled_work();

}

/* -*- mode: c; c-basic-offset: 8; -*-

 * vim: noexpandtab sw=8 ts=8 sts=0:

 *

 * Copyright (C) 2005 Oracle.  All rights reserved.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * General Public License for more details.

 *

 * You should have received a copy of the GNU General Public

 * License along with this program; if not, write to the

 * Free Software Foundation, Inc., 59 Temple Place - Suite 330,

 * Boston, MA 021110-1307, USA.

 *

 */

#ifndef O2CLUSTER_QUORUM_H

#define O2CLUSTER_QUORUM_H

void o2quo_init(void);

void o2quo_exit(void);

void o2quo_hb_up(u8 node);

void o2quo_hb_down(u8 node);

void o2quo_hb_still_up(u8 node);

void o2quo_conn_up(u8 node);

void o2quo_conn_err(u8 node);

void o2quo_disk_timeout(void);

#endif /* O2CLUSTER_QUORUM_H */

/* -*- mode: c; c-basic-offset: 8; -*-

 * vim: noexpandtab sw=8 ts=8 sts=0:

 *

 * sys.c

 *

 * OCFS2 cluster sysfs interface

 *

 * Copyright (C) 2005 Oracle.  All rights reserved.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public

 * License as published by the Free Software Foundation,

 * version 2 of the License.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * General Public License for more details.

 *

 * You should have received a copy of the GNU General Public

 * License along with this program; if not, write to the

 * Free Software Foundation, Inc., 59 Temple Place - Suite 330,

 * Boston, MA 021110-1307, USA.

 *

 */

#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/kobject.h>

#include <linux/sysfs.h>

#include "ocfs2_nodemanager.h"

#include "masklog.h"

#include "sys.h"

struct o2cb_attribute {

	struct attribute	attr;

	ssize_t (*show)(char *buf);

	ssize_t (*store)(const char *buf, size_t count);

};

#define O2CB_ATTR(_name, _mode, _show, _store)	\

struct o2cb_attribute o2cb_attr_##_name = __ATTR(_name, _mode, _show, _store)

#define to_o2cb_subsys(k) container_of(to_kset(k), struct subsystem, kset)

#define to_o2cb_attr(_attr) container_of(_attr, struct o2cb_attribute, attr)

static ssize_t o2cb_interface_revision_show(char *buf)

{

	return snprintf(buf, PAGE_SIZE, "%u\n", O2NM_API_VERSION);

}

O2CB_ATTR(interface_revision, S_IFREG | S_IRUGO, o2cb_interface_revision_show, NULL);

static struct attribute *o2cb_attrs[] = {

	&o2cb_attr_interface_revision.attr,

	NULL,

};

static ssize_t

o2cb_show(struct kobject * kobj, struct attribute * attr, char * buffer);

static ssize_t

o2cb_store(struct kobject * kobj, struct attribute * attr,

	   const char * buffer, size_t count);

static struct sysfs_ops o2cb_sysfs_ops = {

	.show	= o2cb_show,

	.store	= o2cb_store,

};

static struct kobj_type o2cb_subsys_type = {

	.default_attrs	= o2cb_attrs,

	.sysfs_ops	= &o2cb_sysfs_ops,

};

/* gives us o2cb_subsys */

decl_subsys(o2cb, NULL, NULL);

static ssize_t

o2cb_show(struct kobject * kobj, struct attribute * attr, char * buffer)

{

	struct o2cb_attribute *o2cb_attr = to_o2cb_attr(attr);

	struct subsystem *sbs = to_o2cb_subsys(kobj);

	BUG_ON(sbs != &o2cb_subsys);

	if (o2cb_attr->show)

		return o2cb_attr->show(buffer);

	return -EIO;

}

static ssize_t

o2cb_store(struct kobject * kobj, struct attribute * attr,

	     const char * buffer, size_t count)

{

	struct o2cb_attribute *o2cb_attr = to_o2cb_attr(attr);

	struct subsystem *sbs = to_o2cb_subsys(kobj);

	BUG_ON(sbs != &o2cb_subsys);

	if (o2cb_attr->store)

		return o2cb_attr->store(buffer, count);

	return -EIO;

}

void o2cb_sys_shutdown(void)

{

	mlog_sys_shutdown();

	subsystem_unregister(&o2cb_subsys);

}

int o2cb_sys_init(void)

{

	int ret;

	o2cb_subsys.kset.kobj.ktype = &o2cb_subsys_type;

	ret = subsystem_register(&o2cb_subsys);

	if (ret)

		return ret;

	ret = mlog_sys_init(&o2cb_subsys);

	if (ret)

		subsystem_unregister(&o2cb_subsys);

	return ret;

}

/* -*- mode: c; c-basic-offset: 8; -*-

 * vim: noexpandtab sw=8 ts=8 sts=0:

 *

 * sys.h

 *

 * Function prototypes for o2cb sysfs interface

 *

 * Copyright (C) 2005 Oracle.  All rights reserved.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public

 * License as published by the Free Software Foundation,

 * version 2 of the License.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * General Public License for more details.

 *

 * You should have received a copy of the GNU General Public

 * License along with this program; if not, write to the

 * Free Software Foundation, Inc., 59 Temple Place - Suite 330,

 * Boston, MA 021110-1307, USA.

 *

 */

#ifndef O2CLUSTER_SYS_H

#define O2CLUSTER_SYS_H

void o2cb_sys_shutdown(void);

int o2cb_sys_init(void);

#endif /* O2CLUSTER_SYS_H */