2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2003 Sistina Software Limited.
|
2008-10-21 10:45:06 -06:00
|
|
|
* Copyright (C) 2005-2008 Red Hat, Inc. All rights reserved.
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
|
|
|
* This file is released under the GPL.
|
|
|
|
*/
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
#include "dm-bio-record.h"
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/mempool.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/pagemap.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/workqueue.h>
|
2008-10-21 10:45:06 -06:00
|
|
|
#include <linux/device-mapper.h>
|
2008-04-24 15:02:01 -06:00
|
|
|
#include <linux/dm-io.h>
|
|
|
|
#include <linux/dm-dirty-log.h>
|
|
|
|
#include <linux/dm-kcopyd.h>
|
2008-10-21 10:45:06 -06:00
|
|
|
#include <linux/dm-region-hash.h>
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2006-06-26 01:27:35 -06:00
|
|
|
#define DM_MSG_PREFIX "raid1"
|
2008-10-21 10:45:06 -06:00
|
|
|
|
|
|
|
#define MAX_RECOVERY 1 /* Maximum number of regions recovered in parallel. */
|
2006-06-26 01:27:35 -06:00
|
|
|
|
2007-05-09 03:32:59 -06:00
|
|
|
#define DM_RAID1_HANDLE_ERRORS 0x01
|
2007-07-12 10:29:04 -06:00
|
|
|
#define errors_handled(p) ((p)->features & DM_RAID1_HANDLE_ERRORS)
|
2007-05-09 03:32:59 -06:00
|
|
|
|
2006-11-08 18:44:44 -07:00
|
|
|
static DECLARE_WAIT_QUEUE_HEAD(_kmirrord_recovery_stopped);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2006-06-26 01:27:26 -06:00
|
|
|
/*-----------------------------------------------------------------
|
|
|
|
* Mirror set structures.
|
|
|
|
*---------------------------------------------------------------*/
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
enum dm_raid1_error {
|
|
|
|
DM_RAID1_WRITE_ERROR,
|
2009-12-10 16:52:02 -07:00
|
|
|
DM_RAID1_FLUSH_ERROR,
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
DM_RAID1_SYNC_ERROR,
|
|
|
|
DM_RAID1_READ_ERROR
|
|
|
|
};
|
|
|
|
|
2006-06-26 01:27:26 -06:00
|
|
|
struct mirror {
|
2007-10-19 15:47:58 -06:00
|
|
|
struct mirror_set *ms;
|
2006-06-26 01:27:26 -06:00
|
|
|
atomic_t error_count;
|
2008-02-12 20:53:00 -07:00
|
|
|
unsigned long error_type;
|
2006-06-26 01:27:26 -06:00
|
|
|
struct dm_dev *dev;
|
|
|
|
sector_t offset;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct mirror_set {
|
|
|
|
struct dm_target *ti;
|
|
|
|
struct list_head list;
|
2008-10-21 10:45:06 -06:00
|
|
|
|
2007-05-09 03:32:59 -06:00
|
|
|
uint64_t features;
|
2006-06-26 01:27:26 -06:00
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
spinlock_t lock; /* protects the lists */
|
2006-06-26 01:27:26 -06:00
|
|
|
struct bio_list reads;
|
|
|
|
struct bio_list writes;
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
struct bio_list failures;
|
2009-12-10 16:52:03 -07:00
|
|
|
struct bio_list holds; /* bios are waiting until suspend */
|
2006-06-26 01:27:26 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_region_hash *rh;
|
|
|
|
struct dm_kcopyd_client *kcopyd_client;
|
2007-05-09 03:33:04 -06:00
|
|
|
struct dm_io_client *io_client;
|
2008-02-07 19:11:37 -07:00
|
|
|
mempool_t *read_record_pool;
|
2007-05-09 03:33:04 -06:00
|
|
|
|
2006-06-26 01:27:26 -06:00
|
|
|
/* recovery */
|
|
|
|
region_t nr_regions;
|
|
|
|
int in_sync;
|
2007-07-12 10:29:15 -06:00
|
|
|
int log_failure;
|
2009-12-10 16:52:06 -07:00
|
|
|
int leg_failure;
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
atomic_t suspend;
|
2006-06-26 01:27:26 -06:00
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
atomic_t default_mirror; /* Default mirror */
|
2006-06-26 01:27:26 -06:00
|
|
|
|
2007-05-09 03:32:50 -06:00
|
|
|
struct workqueue_struct *kmirrord_wq;
|
|
|
|
struct work_struct kmirrord_work;
|
2008-04-24 15:10:42 -06:00
|
|
|
struct timer_list timer;
|
|
|
|
unsigned long timer_pending;
|
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
struct work_struct trigger_event;
|
2007-05-09 03:32:50 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
unsigned nr_mirrors;
|
2006-06-26 01:27:26 -06:00
|
|
|
struct mirror mirror[0];
|
|
|
|
};
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
static void wakeup_mirrord(void *context)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
struct mirror_set *ms = context;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-05-09 03:32:50 -06:00
|
|
|
queue_work(ms->kmirrord_wq, &ms->kmirrord_work);
|
|
|
|
}
|
|
|
|
|
2008-04-24 15:10:42 -06:00
|
|
|
static void delayed_wake_fn(unsigned long data)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms = (struct mirror_set *) data;
|
|
|
|
|
|
|
|
clear_bit(0, &ms->timer_pending);
|
2008-10-21 10:45:06 -06:00
|
|
|
wakeup_mirrord(ms);
|
2008-04-24 15:10:42 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static void delayed_wake(struct mirror_set *ms)
|
|
|
|
{
|
|
|
|
if (test_and_set_bit(0, &ms->timer_pending))
|
|
|
|
return;
|
|
|
|
|
|
|
|
ms->timer.expires = jiffies + HZ / 5;
|
|
|
|
ms->timer.data = (unsigned long) ms;
|
|
|
|
ms->timer.function = delayed_wake_fn;
|
|
|
|
add_timer(&ms->timer);
|
|
|
|
}
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
static void wakeup_all_recovery_waiters(void *context)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
wake_up_all(&_kmirrord_recovery_stopped);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
static void queue_bio(struct mirror_set *ms, struct bio *bio, int rw)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
unsigned long flags;
|
|
|
|
int should_wake = 0;
|
2008-10-21 10:45:06 -06:00
|
|
|
struct bio_list *bl;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
bl = (rw == WRITE) ? &ms->writes : &ms->reads;
|
|
|
|
spin_lock_irqsave(&ms->lock, flags);
|
|
|
|
should_wake = !(bl->head);
|
|
|
|
bio_list_add(bl, bio);
|
|
|
|
spin_unlock_irqrestore(&ms->lock, flags);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
if (should_wake)
|
2008-10-21 10:45:06 -06:00
|
|
|
wakeup_mirrord(ms);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
static void dispatch_bios(void *context, struct bio_list *bio_list)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
struct mirror_set *ms = context;
|
|
|
|
struct bio *bio;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
while ((bio = bio_list_pop(bio_list)))
|
|
|
|
queue_bio(ms, bio, WRITE);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
#define MIN_READ_RECORDS 20
|
|
|
|
struct dm_raid1_read_record {
|
|
|
|
struct mirror *m;
|
|
|
|
struct dm_bio_details details;
|
|
|
|
};
|
|
|
|
|
2009-04-02 12:55:24 -06:00
|
|
|
static struct kmem_cache *_dm_raid1_read_record_cache;
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Every mirror should look like this one.
|
|
|
|
*/
|
|
|
|
#define DEFAULT_MIRROR 0
|
|
|
|
|
|
|
|
/*
|
2008-02-07 19:11:37 -07:00
|
|
|
* This is yucky. We squirrel the mirror struct away inside
|
|
|
|
* bi_next for read/write buffers. This is safe since the bh
|
2005-04-16 16:20:36 -06:00
|
|
|
* doesn't get submitted to the lower levels of block layer.
|
|
|
|
*/
|
2008-02-07 19:11:37 -07:00
|
|
|
static struct mirror *bio_get_m(struct bio *bio)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-02-07 19:11:37 -07:00
|
|
|
return (struct mirror *) bio->bi_next;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
static void bio_set_m(struct bio *bio, struct mirror *m)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-02-07 19:11:37 -07:00
|
|
|
bio->bi_next = (struct bio *) m;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
static struct mirror *get_default_mirror(struct mirror_set *ms)
|
|
|
|
{
|
|
|
|
return &ms->mirror[atomic_read(&ms->default_mirror)];
|
|
|
|
}
|
|
|
|
|
|
|
|
static void set_default_mirror(struct mirror *m)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms = m->ms;
|
|
|
|
struct mirror *m0 = &(ms->mirror[0]);
|
|
|
|
|
|
|
|
atomic_set(&ms->default_mirror, m - m0);
|
|
|
|
}
|
|
|
|
|
2009-12-10 16:52:04 -07:00
|
|
|
static struct mirror *get_valid_mirror(struct mirror_set *ms)
|
|
|
|
{
|
|
|
|
struct mirror *m;
|
|
|
|
|
|
|
|
for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
|
|
|
|
if (!atomic_read(&m->error_count))
|
|
|
|
return m;
|
|
|
|
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
/* fail_mirror
|
|
|
|
* @m: mirror device to fail
|
|
|
|
* @error_type: one of the enum's, DM_RAID1_*_ERROR
|
|
|
|
*
|
|
|
|
* If errors are being handled, record the type of
|
|
|
|
* error encountered for this device. If this type
|
|
|
|
* of error has already been recorded, we can return;
|
|
|
|
* otherwise, we must signal userspace by triggering
|
|
|
|
* an event. Additionally, if the device is the
|
|
|
|
* primary device, we must choose a new primary, but
|
|
|
|
* only if the mirror is in-sync.
|
|
|
|
*
|
|
|
|
* This function must not block.
|
|
|
|
*/
|
|
|
|
static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms = m->ms;
|
|
|
|
struct mirror *new;
|
|
|
|
|
2009-12-10 16:52:06 -07:00
|
|
|
ms->leg_failure = 1;
|
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
/*
|
|
|
|
* error_count is used for nothing more than a
|
|
|
|
* simple way to tell if a device has encountered
|
|
|
|
* errors.
|
|
|
|
*/
|
|
|
|
atomic_inc(&m->error_count);
|
|
|
|
|
|
|
|
if (test_and_set_bit(error_type, &m->error_type))
|
|
|
|
return;
|
|
|
|
|
2009-01-05 20:04:57 -07:00
|
|
|
if (!errors_handled(ms))
|
|
|
|
return;
|
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
if (m != get_default_mirror(ms))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (!ms->in_sync) {
|
|
|
|
/*
|
|
|
|
* Better to issue requests to same failing device
|
|
|
|
* than to risk returning corrupt data.
|
|
|
|
*/
|
|
|
|
DMERR("Primary mirror (%s) failed while out-of-sync: "
|
|
|
|
"Reads may fail.", m->dev->name);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
2009-12-10 16:52:04 -07:00
|
|
|
new = get_valid_mirror(ms);
|
|
|
|
if (new)
|
|
|
|
set_default_mirror(new);
|
|
|
|
else
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
DMWARN("All sides of mirror have failed.");
|
|
|
|
|
|
|
|
out:
|
|
|
|
schedule_work(&ms->trigger_event);
|
|
|
|
}
|
|
|
|
|
2009-12-10 16:52:02 -07:00
|
|
|
static int mirror_flush(struct dm_target *ti)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms = ti->private;
|
|
|
|
unsigned long error_bits;
|
|
|
|
|
|
|
|
unsigned int i;
|
|
|
|
struct dm_io_region io[ms->nr_mirrors];
|
|
|
|
struct mirror *m;
|
|
|
|
struct dm_io_request io_req = {
|
2010-09-03 03:56:19 -06:00
|
|
|
.bi_rw = WRITE_FLUSH,
|
2009-12-10 16:52:02 -07:00
|
|
|
.mem.type = DM_IO_KMEM,
|
2011-01-13 12:59:48 -07:00
|
|
|
.mem.ptr.addr = NULL,
|
2009-12-10 16:52:02 -07:00
|
|
|
.client = ms->io_client,
|
|
|
|
};
|
|
|
|
|
|
|
|
for (i = 0, m = ms->mirror; i < ms->nr_mirrors; i++, m++) {
|
|
|
|
io[i].bdev = m->dev->bdev;
|
|
|
|
io[i].sector = 0;
|
|
|
|
io[i].count = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
error_bits = -1;
|
|
|
|
dm_io(&io_req, ms->nr_mirrors, io, &error_bits);
|
|
|
|
if (unlikely(error_bits != 0)) {
|
|
|
|
for (i = 0; i < ms->nr_mirrors; i++)
|
|
|
|
if (test_bit(i, &error_bits))
|
|
|
|
fail_mirror(ms->mirror + i,
|
2009-12-10 16:52:02 -07:00
|
|
|
DM_RAID1_FLUSH_ERROR);
|
2009-12-10 16:52:02 -07:00
|
|
|
return -EIO;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*-----------------------------------------------------------------
|
|
|
|
* Recovery.
|
|
|
|
*
|
|
|
|
* When a mirror is first activated we may find that some regions
|
|
|
|
* are in the no-sync state. We have to recover these by
|
|
|
|
* recopying from the default mirror to all the others.
|
|
|
|
*---------------------------------------------------------------*/
|
2008-03-28 15:16:10 -06:00
|
|
|
static void recovery_complete(int read_err, unsigned long write_err,
|
2005-04-16 16:20:36 -06:00
|
|
|
void *context)
|
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_region *reg = context;
|
|
|
|
struct mirror_set *ms = dm_rh_region_context(reg);
|
2008-02-07 19:11:32 -07:00
|
|
|
int m, bit = 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-02-07 19:11:32 -07:00
|
|
|
if (read_err) {
|
2007-07-12 10:29:04 -06:00
|
|
|
/* Read error means the failure of default mirror. */
|
|
|
|
DMERR_LIMIT("Unable to read primary mirror during recovery");
|
2008-02-07 19:11:32 -07:00
|
|
|
fail_mirror(get_default_mirror(ms), DM_RAID1_SYNC_ERROR);
|
|
|
|
}
|
2007-07-12 10:29:04 -06:00
|
|
|
|
2008-02-07 19:11:32 -07:00
|
|
|
if (write_err) {
|
2008-03-28 15:16:10 -06:00
|
|
|
DMERR_LIMIT("Write error during recovery (error = 0x%lx)",
|
2007-07-12 10:29:04 -06:00
|
|
|
write_err);
|
2008-02-07 19:11:32 -07:00
|
|
|
/*
|
|
|
|
* Bits correspond to devices (excluding default mirror).
|
|
|
|
* The default mirror cannot change during recovery.
|
|
|
|
*/
|
|
|
|
for (m = 0; m < ms->nr_mirrors; m++) {
|
|
|
|
if (&ms->mirror[m] == get_default_mirror(ms))
|
|
|
|
continue;
|
|
|
|
if (test_bit(bit, &write_err))
|
|
|
|
fail_mirror(ms->mirror + m,
|
|
|
|
DM_RAID1_SYNC_ERROR);
|
|
|
|
bit++;
|
|
|
|
}
|
|
|
|
}
|
2007-07-12 10:29:04 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_recovery_end(reg, !(read_err || write_err));
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
static int recover(struct mirror_set *ms, struct dm_region *reg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
int r;
|
2008-10-21 10:45:06 -06:00
|
|
|
unsigned i;
|
2008-04-24 14:43:19 -06:00
|
|
|
struct dm_io_region from, to[DM_KCOPYD_MAX_REGIONS], *dest;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct mirror *m;
|
|
|
|
unsigned long flags = 0;
|
2008-10-21 10:45:06 -06:00
|
|
|
region_t key = dm_rh_get_region_key(reg);
|
|
|
|
sector_t region_size = dm_rh_get_region_size(ms->rh);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/* fill in the source */
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
m = get_default_mirror(ms);
|
2005-04-16 16:20:36 -06:00
|
|
|
from.bdev = m->dev->bdev;
|
2008-10-21 10:45:06 -06:00
|
|
|
from.sector = m->offset + dm_rh_region_to_sector(ms->rh, key);
|
|
|
|
if (key == (ms->nr_regions - 1)) {
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* The final region may be smaller than
|
|
|
|
* region_size.
|
|
|
|
*/
|
2008-10-21 10:45:06 -06:00
|
|
|
from.count = ms->ti->len & (region_size - 1);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (!from.count)
|
2008-10-21 10:45:06 -06:00
|
|
|
from.count = region_size;
|
2005-04-16 16:20:36 -06:00
|
|
|
} else
|
2008-10-21 10:45:06 -06:00
|
|
|
from.count = region_size;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/* fill in the destinations */
|
|
|
|
for (i = 0, dest = to; i < ms->nr_mirrors; i++) {
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
if (&ms->mirror[i] == get_default_mirror(ms))
|
2005-04-16 16:20:36 -06:00
|
|
|
continue;
|
|
|
|
|
|
|
|
m = ms->mirror + i;
|
|
|
|
dest->bdev = m->dev->bdev;
|
2008-10-21 10:45:06 -06:00
|
|
|
dest->sector = m->offset + dm_rh_region_to_sector(ms->rh, key);
|
2005-04-16 16:20:36 -06:00
|
|
|
dest->count = from.count;
|
|
|
|
dest++;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* hand to kcopyd */
|
2008-10-10 06:36:59 -06:00
|
|
|
if (!errors_handled(ms))
|
|
|
|
set_bit(DM_KCOPYD_IGNORE_ERROR, &flags);
|
|
|
|
|
2008-04-24 14:43:19 -06:00
|
|
|
r = dm_kcopyd_copy(ms->kcopyd_client, &from, ms->nr_mirrors - 1, to,
|
|
|
|
flags, recovery_complete, reg);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
return r;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void do_recovery(struct mirror_set *ms)
|
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_region *reg;
|
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
2005-04-16 16:20:36 -06:00
|
|
|
int r;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Start quiescing some regions.
|
|
|
|
*/
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_recovery_prepare(ms->rh);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Copy any already quiesced regions.
|
|
|
|
*/
|
2008-10-21 10:45:06 -06:00
|
|
|
while ((reg = dm_rh_recovery_start(ms->rh))) {
|
2005-04-16 16:20:36 -06:00
|
|
|
r = recover(ms, reg);
|
|
|
|
if (r)
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_recovery_end(reg, 0);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Update the in sync flag.
|
|
|
|
*/
|
|
|
|
if (!ms->in_sync &&
|
|
|
|
(log->type->get_sync_count(log) == ms->nr_regions)) {
|
|
|
|
/* the sync is complete */
|
|
|
|
dm_table_event(ms->ti->table);
|
|
|
|
ms->in_sync = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*-----------------------------------------------------------------
|
|
|
|
* Reads
|
|
|
|
*---------------------------------------------------------------*/
|
|
|
|
static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
|
|
|
|
{
|
2008-02-07 19:11:37 -07:00
|
|
|
struct mirror *m = get_default_mirror(ms);
|
|
|
|
|
|
|
|
do {
|
|
|
|
if (likely(!atomic_read(&m->error_count)))
|
|
|
|
return m;
|
|
|
|
|
|
|
|
if (m-- == ms->mirror)
|
|
|
|
m += ms->nr_mirrors;
|
|
|
|
} while (m != get_default_mirror(ms));
|
|
|
|
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int default_ok(struct mirror *m)
|
|
|
|
{
|
|
|
|
struct mirror *default_mirror = get_default_mirror(m->ms);
|
|
|
|
|
|
|
|
return !atomic_read(&default_mirror->error_count);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int mirror_available(struct mirror_set *ms, struct bio *bio)
|
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
|
|
|
region_t region = dm_rh_bio_to_region(ms->rh, bio);
|
2008-02-07 19:11:37 -07:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
if (log->type->in_sync(log, region, 0))
|
2008-02-07 19:11:37 -07:00
|
|
|
return choose_mirror(ms, bio->bi_sector) ? 1 : 0;
|
|
|
|
|
|
|
|
return 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* remap a buffer to a particular mirror.
|
|
|
|
*/
|
2008-02-07 19:11:37 -07:00
|
|
|
static sector_t map_sector(struct mirror *m, struct bio *bio)
|
|
|
|
{
|
2009-12-10 16:51:59 -07:00
|
|
|
if (unlikely(!bio->bi_size))
|
|
|
|
return 0;
|
2010-08-11 21:14:11 -06:00
|
|
|
return m->offset + dm_target_offset(m->ms->ti, bio->bi_sector);
|
2008-02-07 19:11:37 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void map_bio(struct mirror *m, struct bio *bio)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
bio->bi_bdev = m->dev->bdev;
|
2008-02-07 19:11:37 -07:00
|
|
|
bio->bi_sector = map_sector(m, bio);
|
|
|
|
}
|
|
|
|
|
2008-04-24 14:43:17 -06:00
|
|
|
static void map_region(struct dm_io_region *io, struct mirror *m,
|
2008-02-07 19:11:37 -07:00
|
|
|
struct bio *bio)
|
|
|
|
{
|
|
|
|
io->bdev = m->dev->bdev;
|
|
|
|
io->sector = map_sector(m, bio);
|
|
|
|
io->count = bio->bi_size >> 9;
|
|
|
|
}
|
|
|
|
|
2009-12-10 16:52:03 -07:00
|
|
|
static void hold_bio(struct mirror_set *ms, struct bio *bio)
|
|
|
|
{
|
|
|
|
/*
|
2010-03-05 19:32:35 -07:00
|
|
|
* Lock is required to avoid race condition during suspend
|
|
|
|
* process.
|
2009-12-10 16:52:03 -07:00
|
|
|
*/
|
2010-03-05 19:32:35 -07:00
|
|
|
spin_lock_irq(&ms->lock);
|
|
|
|
|
2009-12-10 16:52:03 -07:00
|
|
|
if (atomic_read(&ms->suspend)) {
|
2010-03-05 19:32:35 -07:00
|
|
|
spin_unlock_irq(&ms->lock);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If device is suspended, complete the bio.
|
|
|
|
*/
|
2009-12-10 16:52:03 -07:00
|
|
|
if (dm_noflush_suspending(ms->ti))
|
|
|
|
bio_endio(bio, DM_ENDIO_REQUEUE);
|
|
|
|
else
|
|
|
|
bio_endio(bio, -EIO);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Hold bio until the suspend is complete.
|
|
|
|
*/
|
|
|
|
bio_list_add(&ms->holds, bio);
|
|
|
|
spin_unlock_irq(&ms->lock);
|
|
|
|
}
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
/*-----------------------------------------------------------------
|
|
|
|
* Reads
|
|
|
|
*---------------------------------------------------------------*/
|
|
|
|
static void read_callback(unsigned long error, void *context)
|
|
|
|
{
|
|
|
|
struct bio *bio = context;
|
|
|
|
struct mirror *m;
|
|
|
|
|
|
|
|
m = bio_get_m(bio);
|
|
|
|
bio_set_m(bio, NULL);
|
|
|
|
|
|
|
|
if (likely(!error)) {
|
|
|
|
bio_endio(bio, 0);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
fail_mirror(m, DM_RAID1_READ_ERROR);
|
|
|
|
|
|
|
|
if (likely(default_ok(m)) || mirror_available(m->ms, bio)) {
|
|
|
|
DMWARN_LIMIT("Read failure on mirror device %s. "
|
|
|
|
"Trying alternative device.",
|
|
|
|
m->dev->name);
|
|
|
|
queue_bio(m->ms, bio, bio_rw(bio));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
DMERR_LIMIT("Read failure on mirror device %s. Failing I/O.",
|
|
|
|
m->dev->name);
|
|
|
|
bio_endio(bio, -EIO);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Asynchronous read. */
|
|
|
|
static void read_async_bio(struct mirror *m, struct bio *bio)
|
|
|
|
{
|
2008-04-24 14:43:17 -06:00
|
|
|
struct dm_io_region io;
|
2008-02-07 19:11:37 -07:00
|
|
|
struct dm_io_request io_req = {
|
|
|
|
.bi_rw = READ,
|
|
|
|
.mem.type = DM_IO_BVEC,
|
|
|
|
.mem.ptr.bvec = bio->bi_io_vec + bio->bi_idx,
|
|
|
|
.notify.fn = read_callback,
|
|
|
|
.notify.context = bio,
|
|
|
|
.client = m->ms->io_client,
|
|
|
|
};
|
|
|
|
|
|
|
|
map_region(&io, m, bio);
|
|
|
|
bio_set_m(bio, m);
|
2008-10-21 10:45:06 -06:00
|
|
|
BUG_ON(dm_io(&io_req, 1, &io, NULL));
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int region_in_sync(struct mirror_set *ms, region_t region,
|
|
|
|
int may_block)
|
|
|
|
{
|
|
|
|
int state = dm_rh_get_state(ms->rh, region, may_block);
|
|
|
|
return state == DM_RH_CLEAN || state == DM_RH_DIRTY;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static void do_reads(struct mirror_set *ms, struct bio_list *reads)
|
|
|
|
{
|
|
|
|
region_t region;
|
|
|
|
struct bio *bio;
|
|
|
|
struct mirror *m;
|
|
|
|
|
|
|
|
while ((bio = bio_list_pop(reads))) {
|
2008-10-21 10:45:06 -06:00
|
|
|
region = dm_rh_bio_to_region(ms->rh, bio);
|
2008-02-07 19:11:37 -07:00
|
|
|
m = get_default_mirror(ms);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* We can only read balance if the region is in sync.
|
|
|
|
*/
|
2008-10-21 10:45:06 -06:00
|
|
|
if (likely(region_in_sync(ms, region, 1)))
|
2005-04-16 16:20:36 -06:00
|
|
|
m = choose_mirror(ms, bio->bi_sector);
|
2008-02-07 19:11:37 -07:00
|
|
|
else if (m && atomic_read(&m->error_count))
|
|
|
|
m = NULL;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
if (likely(m))
|
|
|
|
read_async_bio(m, bio);
|
|
|
|
else
|
|
|
|
bio_endio(bio, -EIO);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*-----------------------------------------------------------------
|
|
|
|
* Writes.
|
|
|
|
*
|
|
|
|
* We do different things with the write io depending on the
|
|
|
|
* state of the region that it's in:
|
|
|
|
*
|
|
|
|
* SYNC: increment pending, use kcopyd to write to *all* mirrors
|
|
|
|
* RECOVERING: delay the io until recovery completes
|
|
|
|
* NOSYNC: increment pending, just write to the default mirror
|
|
|
|
*---------------------------------------------------------------*/
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
static void write_callback(unsigned long error, void *context)
|
|
|
|
{
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
unsigned i, ret = 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct bio *bio = (struct bio *) context;
|
|
|
|
struct mirror_set *ms;
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
int should_wake = 0;
|
|
|
|
unsigned long flags;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
ms = bio_get_m(bio)->ms;
|
|
|
|
bio_set_m(bio, NULL);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* NOTE: We don't decrement the pending count here,
|
|
|
|
* instead it is done by the targets endio function.
|
|
|
|
* This way we handle both writes to SYNC and NOSYNC
|
|
|
|
* regions with the same code.
|
|
|
|
*/
|
2009-12-10 16:52:05 -07:00
|
|
|
if (likely(!error)) {
|
|
|
|
bio_endio(bio, ret);
|
|
|
|
return;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
for (i = 0; i < ms->nr_mirrors; i++)
|
|
|
|
if (test_bit(i, &error))
|
|
|
|
fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
|
|
|
|
|
2009-12-10 16:52:05 -07:00
|
|
|
/*
|
|
|
|
* Need to raise event. Since raising
|
|
|
|
* events can block, we need to do it in
|
|
|
|
* the main thread.
|
|
|
|
*/
|
|
|
|
spin_lock_irqsave(&ms->lock, flags);
|
|
|
|
if (!ms->failures.head)
|
|
|
|
should_wake = 1;
|
|
|
|
bio_list_add(&ms->failures, bio);
|
|
|
|
spin_unlock_irqrestore(&ms->lock, flags);
|
|
|
|
if (should_wake)
|
|
|
|
wakeup_mirrord(ms);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static void do_write(struct mirror_set *ms, struct bio *bio)
|
|
|
|
{
|
|
|
|
unsigned int i;
|
2008-04-24 14:43:17 -06:00
|
|
|
struct dm_io_region io[ms->nr_mirrors], *dest = io;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct mirror *m;
|
2007-05-09 03:33:04 -06:00
|
|
|
struct dm_io_request io_req = {
|
2010-09-03 03:56:19 -06:00
|
|
|
.bi_rw = WRITE | (bio->bi_rw & WRITE_FLUSH_FUA),
|
2007-05-09 03:33:04 -06:00
|
|
|
.mem.type = DM_IO_BVEC,
|
|
|
|
.mem.ptr.bvec = bio->bi_io_vec + bio->bi_idx,
|
|
|
|
.notify.fn = write_callback,
|
|
|
|
.notify.context = bio,
|
|
|
|
.client = ms->io_client,
|
|
|
|
};
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2011-01-13 12:59:48 -07:00
|
|
|
if (bio->bi_rw & REQ_DISCARD) {
|
|
|
|
io_req.bi_rw |= REQ_DISCARD;
|
|
|
|
io_req.mem.type = DM_IO_KMEM;
|
|
|
|
io_req.mem.ptr.addr = NULL;
|
|
|
|
}
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
for (i = 0, m = ms->mirror; i < ms->nr_mirrors; i++, m++)
|
|
|
|
map_region(dest++, m, bio);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
/*
|
|
|
|
* Use default mirror because we only need it to retrieve the reference
|
|
|
|
* to the mirror set in write_callback().
|
|
|
|
*/
|
|
|
|
bio_set_m(bio, get_default_mirror(ms));
|
2007-05-09 03:33:04 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
BUG_ON(dm_io(&io_req, ms->nr_mirrors, io, NULL));
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static void do_writes(struct mirror_set *ms, struct bio_list *writes)
|
|
|
|
{
|
|
|
|
int state;
|
|
|
|
struct bio *bio;
|
|
|
|
struct bio_list sync, nosync, recover, *this_list = NULL;
|
2009-04-02 12:55:30 -06:00
|
|
|
struct bio_list requeue;
|
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
|
|
|
region_t region;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
if (!writes->head)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Classify each write.
|
|
|
|
*/
|
|
|
|
bio_list_init(&sync);
|
|
|
|
bio_list_init(&nosync);
|
|
|
|
bio_list_init(&recover);
|
2009-04-02 12:55:30 -06:00
|
|
|
bio_list_init(&requeue);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
while ((bio = bio_list_pop(writes))) {
|
2011-01-13 12:59:48 -07:00
|
|
|
if ((bio->bi_rw & REQ_FLUSH) ||
|
|
|
|
(bio->bi_rw & REQ_DISCARD)) {
|
2009-12-10 16:51:59 -07:00
|
|
|
bio_list_add(&sync, bio);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2009-04-02 12:55:30 -06:00
|
|
|
region = dm_rh_bio_to_region(ms->rh, bio);
|
|
|
|
|
|
|
|
if (log->type->is_remote_recovering &&
|
|
|
|
log->type->is_remote_recovering(log, region)) {
|
|
|
|
bio_list_add(&requeue, bio);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
state = dm_rh_get_state(ms->rh, region, 1);
|
2005-04-16 16:20:36 -06:00
|
|
|
switch (state) {
|
2008-10-21 10:45:06 -06:00
|
|
|
case DM_RH_CLEAN:
|
|
|
|
case DM_RH_DIRTY:
|
2005-04-16 16:20:36 -06:00
|
|
|
this_list = &sync;
|
|
|
|
break;
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
case DM_RH_NOSYNC:
|
2005-04-16 16:20:36 -06:00
|
|
|
this_list = &nosync;
|
|
|
|
break;
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
case DM_RH_RECOVERING:
|
2005-04-16 16:20:36 -06:00
|
|
|
this_list = &recover;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
bio_list_add(this_list, bio);
|
|
|
|
}
|
|
|
|
|
2009-04-02 12:55:30 -06:00
|
|
|
/*
|
|
|
|
* Add bios that are delayed due to remote recovery
|
|
|
|
* back on to the write queue
|
|
|
|
*/
|
|
|
|
if (unlikely(requeue.head)) {
|
|
|
|
spin_lock_irq(&ms->lock);
|
|
|
|
bio_list_merge(&ms->writes, &requeue);
|
|
|
|
spin_unlock_irq(&ms->lock);
|
2009-07-23 13:30:37 -06:00
|
|
|
delayed_wake(ms);
|
2009-04-02 12:55:30 -06:00
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Increment the pending counts for any regions that will
|
|
|
|
* be written to (writes to recover regions are going to
|
|
|
|
* be delayed).
|
|
|
|
*/
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_inc_pending(ms->rh, &sync);
|
|
|
|
dm_rh_inc_pending(ms->rh, &nosync);
|
2009-09-04 13:40:32 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If the flush fails on a previous call and succeeds here,
|
|
|
|
* we must not reset the log_failure variable. We need
|
|
|
|
* userspace interaction to do that.
|
|
|
|
*/
|
|
|
|
ms->log_failure = dm_rh_flush(ms->rh) ? 1 : ms->log_failure;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Dispatch io.
|
|
|
|
*/
|
2010-02-16 11:42:55 -07:00
|
|
|
if (unlikely(ms->log_failure) && errors_handled(ms)) {
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
spin_lock_irq(&ms->lock);
|
|
|
|
bio_list_merge(&ms->failures, &sync);
|
|
|
|
spin_unlock_irq(&ms->lock);
|
2008-10-21 10:45:06 -06:00
|
|
|
wakeup_mirrord(ms);
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
} else
|
2007-07-12 10:29:15 -06:00
|
|
|
while ((bio = bio_list_pop(&sync)))
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
do_write(ms, bio);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
while ((bio = bio_list_pop(&recover)))
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_delay(ms->rh, bio);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
while ((bio = bio_list_pop(&nosync))) {
|
2010-03-05 19:32:22 -07:00
|
|
|
if (unlikely(ms->leg_failure) && errors_handled(ms)) {
|
|
|
|
spin_lock_irq(&ms->lock);
|
|
|
|
bio_list_add(&ms->failures, bio);
|
|
|
|
spin_unlock_irq(&ms->lock);
|
|
|
|
wakeup_mirrord(ms);
|
|
|
|
} else {
|
2009-12-10 16:52:06 -07:00
|
|
|
map_bio(get_default_mirror(ms), bio);
|
|
|
|
generic_make_request(bio);
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
static void do_failures(struct mirror_set *ms, struct bio_list *failures)
|
|
|
|
{
|
|
|
|
struct bio *bio;
|
|
|
|
|
2009-12-10 16:52:04 -07:00
|
|
|
if (likely(!failures->head))
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
return;
|
|
|
|
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
/*
|
|
|
|
* If the log has failed, unattempted writes are being
|
2009-12-10 16:52:04 -07:00
|
|
|
* put on the holds list. We can't issue those writes
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
* until a log has been marked, so we must store them.
|
|
|
|
*
|
|
|
|
* If a 'noflush' suspend is in progress, we can requeue
|
|
|
|
* the I/O's to the core. This give userspace a chance
|
|
|
|
* to reconfigure the mirror, at which point the core
|
|
|
|
* will reissue the writes. If the 'noflush' flag is
|
|
|
|
* not set, we have no choice but to return errors.
|
|
|
|
*
|
|
|
|
* Some writes on the failures list may have been
|
|
|
|
* submitted before the log failure and represent a
|
|
|
|
* failure to write to one of the devices. It is ok
|
|
|
|
* for us to treat them the same and requeue them
|
|
|
|
* as well.
|
|
|
|
*/
|
2009-12-10 16:52:04 -07:00
|
|
|
while ((bio = bio_list_pop(failures))) {
|
2009-12-10 16:52:05 -07:00
|
|
|
if (!ms->log_failure) {
|
2009-12-10 16:52:04 -07:00
|
|
|
ms->in_sync = 0;
|
2009-12-10 16:52:05 -07:00
|
|
|
dm_rh_mark_nosync(ms->rh, bio);
|
2009-12-10 16:52:04 -07:00
|
|
|
}
|
2009-12-10 16:52:05 -07:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If all the legs are dead, fail the I/O.
|
|
|
|
* If we have been told to handle errors, hold the bio
|
|
|
|
* and wait for userspace to deal with the problem.
|
|
|
|
* Otherwise pretend that the I/O succeeded. (This would
|
|
|
|
* be wrong if the failed leg returned after reboot and
|
|
|
|
* got replicated back to the good legs.)
|
|
|
|
*/
|
|
|
|
if (!get_valid_mirror(ms))
|
|
|
|
bio_endio(bio, -EIO);
|
|
|
|
else if (errors_handled(ms))
|
|
|
|
hold_bio(ms, bio);
|
|
|
|
else
|
|
|
|
bio_endio(bio, 0);
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
}
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void trigger_event(struct work_struct *work)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms =
|
|
|
|
container_of(work, struct mirror_set, trigger_event);
|
|
|
|
|
|
|
|
dm_table_event(ms->ti->table);
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*-----------------------------------------------------------------
|
|
|
|
* kmirrord
|
|
|
|
*---------------------------------------------------------------*/
|
2008-04-24 15:10:42 -06:00
|
|
|
static void do_mirror(struct work_struct *work)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
struct mirror_set *ms = container_of(work, struct mirror_set,
|
|
|
|
kmirrord_work);
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
struct bio_list reads, writes, failures;
|
|
|
|
unsigned long flags;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
spin_lock_irqsave(&ms->lock, flags);
|
2005-04-16 16:20:36 -06:00
|
|
|
reads = ms->reads;
|
|
|
|
writes = ms->writes;
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
failures = ms->failures;
|
2005-04-16 16:20:36 -06:00
|
|
|
bio_list_init(&ms->reads);
|
|
|
|
bio_list_init(&ms->writes);
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
bio_list_init(&ms->failures);
|
|
|
|
spin_unlock_irqrestore(&ms->lock, flags);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_update_states(ms->rh, errors_handled(ms));
|
2005-04-16 16:20:36 -06:00
|
|
|
do_recovery(ms);
|
|
|
|
do_reads(ms, &reads);
|
|
|
|
do_writes(ms, &writes);
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
do_failures(ms, &failures);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
/*-----------------------------------------------------------------
|
|
|
|
* Target functions
|
|
|
|
*---------------------------------------------------------------*/
|
|
|
|
static struct mirror_set *alloc_context(unsigned int nr_mirrors,
|
|
|
|
uint32_t region_size,
|
|
|
|
struct dm_target *ti,
|
2008-04-24 14:43:35 -06:00
|
|
|
struct dm_dirty_log *dl)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
size_t len;
|
|
|
|
struct mirror_set *ms = NULL;
|
|
|
|
|
|
|
|
len = sizeof(*ms) + (sizeof(ms->mirror[0]) * nr_mirrors);
|
|
|
|
|
some kmalloc/memset ->kzalloc (tree wide)
Transform some calls to kmalloc/memset to a single kzalloc (or kcalloc).
Here is a short excerpt of the semantic patch performing
this transformation:
@@
type T2;
expression x;
identifier f,fld;
expression E;
expression E1,E2;
expression e1,e2,e3,y;
statement S;
@@
x =
- kmalloc
+ kzalloc
(E1,E2)
... when != \(x->fld=E;\|y=f(...,x,...);\|f(...,x,...);\|x=E;\|while(...) S\|for(e1;e2;e3) S\)
- memset((T2)x,0,E1);
@@
expression E1,E2,E3;
@@
- kzalloc(E1 * E2,E3)
+ kcalloc(E1,E2,E3)
[akpm@linux-foundation.org: get kcalloc args the right way around]
Signed-off-by: Yoann Padioleau <padator@wanadoo.fr>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Acked-by: Russell King <rmk@arm.linux.org.uk>
Cc: Bryan Wu <bryan.wu@analog.com>
Acked-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Dave Airlie <airlied@linux.ie>
Acked-by: Roland Dreier <rolandd@cisco.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: Dmitry Torokhov <dtor@mail.ru>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Acked-by: Pierre Ossman <drzeus-list@drzeus.cx>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: "David S. Miller" <davem@davemloft.net>
Acked-by: Greg KH <greg@kroah.com>
Cc: James Bottomley <James.Bottomley@steeleye.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-19 02:49:03 -06:00
|
|
|
ms = kzalloc(len, GFP_KERNEL);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (!ms) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Cannot allocate mirror context";
|
2005-04-16 16:20:36 -06:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
spin_lock_init(&ms->lock);
|
2009-12-10 16:52:06 -07:00
|
|
|
bio_list_init(&ms->reads);
|
|
|
|
bio_list_init(&ms->writes);
|
|
|
|
bio_list_init(&ms->failures);
|
|
|
|
bio_list_init(&ms->holds);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
ms->ti = ti;
|
|
|
|
ms->nr_mirrors = nr_mirrors;
|
|
|
|
ms->nr_regions = dm_sector_div_up(ti->len, region_size);
|
|
|
|
ms->in_sync = 0;
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
ms->log_failure = 0;
|
2009-12-10 16:52:06 -07:00
|
|
|
ms->leg_failure = 0;
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
atomic_set(&ms->suspend, 0);
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
atomic_set(&ms->default_mirror, DEFAULT_MIRROR);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2009-04-02 12:55:24 -06:00
|
|
|
ms->read_record_pool = mempool_create_slab_pool(MIN_READ_RECORDS,
|
|
|
|
_dm_raid1_read_record_cache);
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
if (!ms->read_record_pool) {
|
|
|
|
ti->error = "Error creating mirror read_record_pool";
|
|
|
|
kfree(ms);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2011-05-29 06:03:09 -06:00
|
|
|
ms->io_client = dm_io_client_create();
|
2007-05-09 03:33:04 -06:00
|
|
|
if (IS_ERR(ms->io_client)) {
|
|
|
|
ti->error = "Error creating dm_io client";
|
2008-02-07 19:11:37 -07:00
|
|
|
mempool_destroy(ms->read_record_pool);
|
2007-05-09 03:33:04 -06:00
|
|
|
kfree(ms);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
ms->rh = dm_region_hash_create(ms, dispatch_bios, wakeup_mirrord,
|
|
|
|
wakeup_all_recovery_waiters,
|
|
|
|
ms->ti->begin, MAX_RECOVERY,
|
|
|
|
dl, region_size, ms->nr_regions);
|
|
|
|
if (IS_ERR(ms->rh)) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Error creating dirty region hash";
|
2007-10-19 15:38:39 -06:00
|
|
|
dm_io_client_destroy(ms->io_client);
|
2008-02-07 19:11:37 -07:00
|
|
|
mempool_destroy(ms->read_record_pool);
|
2005-04-16 16:20:36 -06:00
|
|
|
kfree(ms);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return ms;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void free_context(struct mirror_set *ms, struct dm_target *ti,
|
|
|
|
unsigned int m)
|
|
|
|
{
|
|
|
|
while (m--)
|
|
|
|
dm_put_device(ti, ms->mirror[m].dev);
|
|
|
|
|
2007-05-09 03:33:04 -06:00
|
|
|
dm_io_client_destroy(ms->io_client);
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_region_hash_destroy(ms->rh);
|
2008-02-07 19:11:37 -07:00
|
|
|
mempool_destroy(ms->read_record_pool);
|
2005-04-16 16:20:36 -06:00
|
|
|
kfree(ms);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
|
|
|
|
unsigned int mirror, char **argv)
|
|
|
|
{
|
2006-03-27 02:17:48 -07:00
|
|
|
unsigned long long offset;
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
char dummy;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
if (sscanf(argv[1], "%llu%c", &offset, &dummy) != 1) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Invalid offset";
|
2005-04-16 16:20:36 -06:00
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
2010-03-05 19:32:27 -07:00
|
|
|
if (dm_get_device(ti, argv[0], dm_table_get_mode(ti->table),
|
2005-04-16 16:20:36 -06:00
|
|
|
&ms->mirror[mirror].dev)) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Device lookup failure";
|
2005-04-16 16:20:36 -06:00
|
|
|
return -ENXIO;
|
|
|
|
}
|
|
|
|
|
2007-10-19 15:47:58 -06:00
|
|
|
ms->mirror[mirror].ms = ms;
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
atomic_set(&(ms->mirror[mirror].error_count), 0);
|
|
|
|
ms->mirror[mirror].error_type = 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
ms->mirror[mirror].offset = offset;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Create dirty log: log_type #log_params <log_params>
|
|
|
|
*/
|
2008-04-24 14:43:35 -06:00
|
|
|
static struct dm_dirty_log *create_dirty_log(struct dm_target *ti,
|
2008-10-21 10:45:06 -06:00
|
|
|
unsigned argc, char **argv,
|
|
|
|
unsigned *args_used)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-10-21 10:45:06 -06:00
|
|
|
unsigned param_count;
|
2008-04-24 14:43:35 -06:00
|
|
|
struct dm_dirty_log *dl;
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
char dummy;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
if (argc < 2) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Insufficient mirror log arguments";
|
2005-04-16 16:20:36 -06:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
if (sscanf(argv[1], "%u%c", ¶m_count, &dummy) != 1) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Invalid mirror log argument count";
|
2005-04-16 16:20:36 -06:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
*args_used = 2 + param_count;
|
|
|
|
|
|
|
|
if (argc < *args_used) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Insufficient mirror log arguments";
|
2005-04-16 16:20:36 -06:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2009-12-10 16:52:02 -07:00
|
|
|
dl = dm_dirty_log_create(argv[0], ti, mirror_flush, param_count,
|
|
|
|
argv + 2);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (!dl) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Error creating mirror dirty log";
|
2005-04-16 16:20:36 -06:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return dl;
|
|
|
|
}
|
|
|
|
|
2007-05-09 03:32:59 -06:00
|
|
|
static int parse_features(struct mirror_set *ms, unsigned argc, char **argv,
|
|
|
|
unsigned *args_used)
|
|
|
|
{
|
|
|
|
unsigned num_features;
|
|
|
|
struct dm_target *ti = ms->ti;
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
char dummy;
|
2007-05-09 03:32:59 -06:00
|
|
|
|
|
|
|
*args_used = 0;
|
|
|
|
|
|
|
|
if (!argc)
|
|
|
|
return 0;
|
|
|
|
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
if (sscanf(argv[0], "%u%c", &num_features, &dummy) != 1) {
|
2007-05-09 03:32:59 -06:00
|
|
|
ti->error = "Invalid number of features";
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
argc--;
|
|
|
|
argv++;
|
|
|
|
(*args_used)++;
|
|
|
|
|
|
|
|
if (num_features > argc) {
|
|
|
|
ti->error = "Not enough arguments to support feature count";
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!strcmp("handle_errors", argv[0]))
|
|
|
|
ms->features |= DM_RAID1_HANDLE_ERRORS;
|
|
|
|
else {
|
|
|
|
ti->error = "Unrecognised feature requested";
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
(*args_used)++;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Construct a mirror mapping:
|
|
|
|
*
|
|
|
|
* log_type #log_params <log_params>
|
|
|
|
* #mirrors [mirror_path offset]{2,}
|
2007-05-09 03:32:59 -06:00
|
|
|
* [#features <features>]
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
|
|
|
* log_type is "core" or "disk"
|
|
|
|
* #log_params is between 1 and 3
|
2007-05-09 03:32:59 -06:00
|
|
|
*
|
|
|
|
* If present, features must be "handle_errors".
|
2005-04-16 16:20:36 -06:00
|
|
|
*/
|
|
|
|
static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
|
|
|
|
{
|
|
|
|
int r;
|
|
|
|
unsigned int nr_mirrors, m, args_used;
|
|
|
|
struct mirror_set *ms;
|
2008-04-24 14:43:35 -06:00
|
|
|
struct dm_dirty_log *dl;
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
char dummy;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
dl = create_dirty_log(ti, argc, argv, &args_used);
|
|
|
|
if (!dl)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
argv += args_used;
|
|
|
|
argc -= args_used;
|
|
|
|
|
dm: reject trailing characters in sccanf input
Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.
For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".
As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.
This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.
The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-03-28 11:41:26 -06:00
|
|
|
if (!argc || sscanf(argv[0], "%u%c", &nr_mirrors, &dummy) != 1 ||
|
2008-04-24 14:43:19 -06:00
|
|
|
nr_mirrors < 2 || nr_mirrors > DM_KCOPYD_MAX_REGIONS + 1) {
|
2006-06-26 01:27:35 -06:00
|
|
|
ti->error = "Invalid number of mirrors";
|
2008-04-24 14:43:35 -06:00
|
|
|
dm_dirty_log_destroy(dl);
|
2005-04-16 16:20:36 -06:00
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
argv++, argc--;
|
|
|
|
|
2007-05-09 03:32:59 -06:00
|
|
|
if (argc < nr_mirrors * 2) {
|
|
|
|
ti->error = "Too few mirror arguments";
|
2008-04-24 14:43:35 -06:00
|
|
|
dm_dirty_log_destroy(dl);
|
2005-04-16 16:20:36 -06:00
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
ms = alloc_context(nr_mirrors, dl->type->get_region_size(dl), ti, dl);
|
|
|
|
if (!ms) {
|
2008-04-24 14:43:35 -06:00
|
|
|
dm_dirty_log_destroy(dl);
|
2005-04-16 16:20:36 -06:00
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Get the mirror parameter sets */
|
|
|
|
for (m = 0; m < nr_mirrors; m++) {
|
|
|
|
r = get_mirror(ms, ti, m, argv);
|
|
|
|
if (r) {
|
|
|
|
free_context(ms, ti, m);
|
|
|
|
return r;
|
|
|
|
}
|
|
|
|
argv += 2;
|
|
|
|
argc -= 2;
|
|
|
|
}
|
|
|
|
|
|
|
|
ti->private = ms;
|
2012-07-27 08:08:00 -06:00
|
|
|
|
|
|
|
r = dm_set_target_max_io_len(ti, dm_rh_get_region_size(ms->rh));
|
|
|
|
if (r)
|
|
|
|
goto err_free_context;
|
|
|
|
|
2009-12-10 16:51:59 -07:00
|
|
|
ti->num_flush_requests = 1;
|
2011-01-13 12:59:48 -07:00
|
|
|
ti->num_discard_requests = 1;
|
2012-07-27 08:08:08 -06:00
|
|
|
ti->discard_zeroes_data_unsupported = true;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2011-01-13 12:59:58 -07:00
|
|
|
ms->kmirrord_wq = alloc_workqueue("kmirrord",
|
|
|
|
WQ_NON_REENTRANT | WQ_MEM_RECLAIM, 0);
|
2007-05-09 03:32:50 -06:00
|
|
|
if (!ms->kmirrord_wq) {
|
|
|
|
DMERR("couldn't start kmirrord");
|
2007-10-19 15:38:39 -06:00
|
|
|
r = -ENOMEM;
|
|
|
|
goto err_free_context;
|
2007-05-09 03:32:50 -06:00
|
|
|
}
|
|
|
|
INIT_WORK(&ms->kmirrord_work, do_mirror);
|
2008-04-24 15:10:42 -06:00
|
|
|
init_timer(&ms->timer);
|
|
|
|
ms->timer_pending = 0;
|
dm raid1: handle write failures
This patch gives mirror the ability to handle device failures
during normal write operations.
The 'write_callback' function is called when a write completes.
If all the writes failed or succeeded, we report failure or
success respectively. If some of the writes failed, we call
fail_mirror; which increments the error count for the device, notes
the type of error encountered (DM_RAID1_WRITE_ERROR), and
selects a new primary (if necessary). Note that the primary
device can never change while the mirror is not in-sync (IOW,
while recovery is happening.) This means that the scenario
where a failed write changes the primary and gives
recovery_complete a chance to misread the primary never happens.
The fact that the primary can change has necessitated the change
to the default_mirror field. We need to protect against reading
garbage while the primary changes. We then add the bio to a new
list in the mirror set, 'failures'. For every bio in the 'failures'
list, we call a new function, '__bio_mark_nosync', where we mark
the region 'not-in-sync' in the log and properly set the region
state as, RH_NOSYNC. Userspace must also be notified of the
failure. This is done by 'raising an event' (dm_table_event()).
If fail_mirror is called in process context the event can be raised
right away. If in interrupt context, the event is deferred to the
kmirrord thread - which raises the event if 'event_waiting' is set.
Backwards compatibility is maintained by ignoring errors if
the DM_FEATURES_HANDLE_ERRORS flag is not present.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:29 -07:00
|
|
|
INIT_WORK(&ms->trigger_event, trigger_event);
|
2007-05-09 03:32:50 -06:00
|
|
|
|
2007-05-09 03:32:59 -06:00
|
|
|
r = parse_features(ms, argc, argv, &args_used);
|
2007-10-19 15:38:39 -06:00
|
|
|
if (r)
|
|
|
|
goto err_destroy_wq;
|
2007-05-09 03:32:59 -06:00
|
|
|
|
|
|
|
argv += args_used;
|
|
|
|
argc -= args_used;
|
|
|
|
|
2007-07-12 10:29:04 -06:00
|
|
|
/*
|
|
|
|
* Any read-balancing addition depends on the
|
|
|
|
* DM_RAID1_HANDLE_ERRORS flag being present.
|
|
|
|
* This is because the decision to balance depends
|
|
|
|
* on the sync state of a region. If the above
|
|
|
|
* flag is not present, we ignore errors; and
|
|
|
|
* the sync state may be inaccurate.
|
|
|
|
*/
|
|
|
|
|
2007-05-09 03:32:59 -06:00
|
|
|
if (argc) {
|
|
|
|
ti->error = "Too many mirror arguments";
|
2007-10-19 15:38:39 -06:00
|
|
|
r = -EINVAL;
|
|
|
|
goto err_destroy_wq;
|
2007-05-09 03:32:59 -06:00
|
|
|
}
|
|
|
|
|
2011-05-29 06:03:13 -06:00
|
|
|
ms->kcopyd_client = dm_kcopyd_client_create();
|
|
|
|
if (IS_ERR(ms->kcopyd_client)) {
|
|
|
|
r = PTR_ERR(ms->kcopyd_client);
|
2007-10-19 15:38:39 -06:00
|
|
|
goto err_destroy_wq;
|
2011-05-29 06:03:13 -06:00
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
wakeup_mirrord(ms);
|
2005-04-16 16:20:36 -06:00
|
|
|
return 0;
|
2007-10-19 15:38:39 -06:00
|
|
|
|
|
|
|
err_destroy_wq:
|
|
|
|
destroy_workqueue(ms->kmirrord_wq);
|
|
|
|
err_free_context:
|
|
|
|
free_context(ms, ti, ms->nr_mirrors);
|
|
|
|
return r;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static void mirror_dtr(struct dm_target *ti)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms = (struct mirror_set *) ti->private;
|
|
|
|
|
2008-04-24 15:10:42 -06:00
|
|
|
del_timer_sync(&ms->timer);
|
2007-05-09 03:32:50 -06:00
|
|
|
flush_workqueue(ms->kmirrord_wq);
|
2012-08-20 15:51:24 -06:00
|
|
|
flush_work(&ms->trigger_event);
|
2008-04-24 14:43:19 -06:00
|
|
|
dm_kcopyd_client_destroy(ms->kcopyd_client);
|
2007-05-09 03:32:50 -06:00
|
|
|
destroy_workqueue(ms->kmirrord_wq);
|
2005-04-16 16:20:36 -06:00
|
|
|
free_context(ms, ti, ms->nr_mirrors);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Mirror mapping function
|
|
|
|
*/
|
|
|
|
static int mirror_map(struct dm_target *ti, struct bio *bio,
|
|
|
|
union map_info *map_context)
|
|
|
|
{
|
|
|
|
int r, rw = bio_rw(bio);
|
|
|
|
struct mirror *m;
|
|
|
|
struct mirror_set *ms = ti->private;
|
2008-02-07 19:11:37 -07:00
|
|
|
struct dm_raid1_read_record *read_record = NULL;
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
if (rw == WRITE) {
|
2008-02-07 19:11:37 -07:00
|
|
|
/* Save region for mirror_end_io() handler */
|
2008-10-21 10:45:06 -06:00
|
|
|
map_context->ll = dm_rh_bio_to_region(ms->rh, bio);
|
2005-04-16 16:20:36 -06:00
|
|
|
queue_bio(ms, bio, rw);
|
2006-12-08 03:41:06 -07:00
|
|
|
return DM_MAPIO_SUBMITTED;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
r = log->type->in_sync(log, dm_rh_bio_to_region(ms->rh, bio), 0);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (r < 0 && r != -EWOULDBLOCK)
|
|
|
|
return r;
|
|
|
|
|
|
|
|
/*
|
2008-02-07 19:11:37 -07:00
|
|
|
* If region is not in-sync queue the bio.
|
2005-04-16 16:20:36 -06:00
|
|
|
*/
|
2008-02-07 19:11:37 -07:00
|
|
|
if (!r || (r == -EWOULDBLOCK)) {
|
|
|
|
if (rw == READA)
|
|
|
|
return -EWOULDBLOCK;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
queue_bio(ms, bio, rw);
|
2006-12-08 03:41:06 -07:00
|
|
|
return DM_MAPIO_SUBMITTED;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
/*
|
|
|
|
* The region is in-sync and we can perform reads directly.
|
|
|
|
* Store enough information so we can retry if it fails.
|
|
|
|
*/
|
2005-04-16 16:20:36 -06:00
|
|
|
m = choose_mirror(ms, bio->bi_sector);
|
2008-02-07 19:11:37 -07:00
|
|
|
if (unlikely(!m))
|
2005-04-16 16:20:36 -06:00
|
|
|
return -EIO;
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
read_record = mempool_alloc(ms->read_record_pool, GFP_NOIO);
|
|
|
|
if (likely(read_record)) {
|
|
|
|
dm_bio_record(&read_record->details, bio);
|
|
|
|
map_context->ptr = read_record;
|
|
|
|
read_record->m = m;
|
|
|
|
}
|
|
|
|
|
|
|
|
map_bio(m, bio);
|
|
|
|
|
2006-12-08 03:41:06 -07:00
|
|
|
return DM_MAPIO_REMAPPED;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static int mirror_end_io(struct dm_target *ti, struct bio *bio,
|
|
|
|
int error, union map_info *map_context)
|
|
|
|
{
|
|
|
|
int rw = bio_rw(bio);
|
|
|
|
struct mirror_set *ms = (struct mirror_set *) ti->private;
|
2008-02-07 19:11:37 -07:00
|
|
|
struct mirror *m = NULL;
|
|
|
|
struct dm_bio_details *bd = NULL;
|
|
|
|
struct dm_raid1_read_record *read_record = map_context->ptr;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* We need to dec pending if this was a write.
|
|
|
|
*/
|
2008-02-07 19:11:37 -07:00
|
|
|
if (rw == WRITE) {
|
dm raid1: fix crash with mirror recovery and discard
This patch fixes a crash when a discard request is sent during mirror
recovery.
Firstly, some background. Generally, the following sequence happens during
mirror synchronization:
- function do_recovery is called
- do_recovery calls dm_rh_recovery_prepare
- dm_rh_recovery_prepare uses a semaphore to limit the number
simultaneously recovered regions (by default the semaphore value is 1,
so only one region at a time is recovered)
- dm_rh_recovery_prepare calls __rh_recovery_prepare,
__rh_recovery_prepare asks the log driver for the next region to
recover. Then, it sets the region state to DM_RH_RECOVERING. If there
are no pending I/Os on this region, the region is added to
quiesced_regions list. If there are pending I/Os, the region is not
added to any list. It is added to the quiesced_regions list later (by
dm_rh_dec function) when all I/Os finish.
- when the region is on quiesced_regions list, there are no I/Os in
flight on this region. The region is popped from the list in
dm_rh_recovery_start function. Then, a kcopyd job is started in the
recover function.
- when the kcopyd job finishes, recovery_complete is called. It calls
dm_rh_recovery_end. dm_rh_recovery_end adds the region to
recovered_regions or failed_recovered_regions list (depending on
whether the copy operation was successful or not).
The above mechanism assumes that if the region is in DM_RH_RECOVERING
state, no new I/Os are started on this region. When I/O is started,
dm_rh_inc_pending is called, which increases reg->pending count. When
I/O is finished, dm_rh_dec is called. It decreases reg->pending count.
If the count is zero and the region was in DM_RH_RECOVERING state,
dm_rh_dec adds it to the quiesced_regions list.
Consequently, if we call dm_rh_inc_pending/dm_rh_dec while the region is
in DM_RH_RECOVERING state, it could be added to quiesced_regions list
multiple times or it could be added to this list when kcopyd is copying
data (it is assumed that the region is not on any list while kcopyd does
its jobs). This results in memory corruption and crash.
There already exist bypasses for REQ_FLUSH requests: REQ_FLUSH requests
do not belong to any region, so they are always added to the sync list
in do_writes. dm_rh_inc_pending does not increase count for REQ_FLUSH
requests. In mirror_end_io, dm_rh_dec is never called for REQ_FLUSH
requests. These bypasses avoid the crash possibility described above.
These bypasses were improperly implemented for REQ_DISCARD when
the mirror target gained discard support in commit
5fc2ffeabb9ee0fc0e71ff16b49f34f0ed3d05b4 (dm raid1: support discard).
In do_writes, REQ_DISCARD requests is always added to the sync queue and
immediately dispatched (even if the region is in DM_RH_RECOVERING). However,
dm_rh_inc and dm_rh_dec is called for REQ_DISCARD resusts. So it violates the
rule that no I/Os are started on DM_RH_RECOVERING regions, and causes the list
corruption described above.
This patch changes it so that REQ_DISCARD requests follow the same path
as REQ_FLUSH. This avoids the crash.
Reference: https://bugzilla.redhat.com/837607
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2012-07-20 07:25:03 -06:00
|
|
|
if (!(bio->bi_rw & (REQ_FLUSH | REQ_DISCARD)))
|
2009-12-10 16:51:59 -07:00
|
|
|
dm_rh_dec(ms->rh, map_context->ll);
|
2008-02-07 19:11:37 -07:00
|
|
|
return error;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
if (error == -EOPNOTSUPP)
|
|
|
|
goto out;
|
|
|
|
|
2010-08-07 10:20:39 -06:00
|
|
|
if ((error == -EWOULDBLOCK) && (bio->bi_rw & REQ_RAHEAD))
|
2008-02-07 19:11:37 -07:00
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (unlikely(error)) {
|
|
|
|
if (!read_record) {
|
|
|
|
/*
|
|
|
|
* There wasn't enough memory to record necessary
|
|
|
|
* information for a retry or there was no other
|
|
|
|
* mirror in-sync.
|
|
|
|
*/
|
2008-02-19 12:44:19 -07:00
|
|
|
DMERR_LIMIT("Mirror read failed.");
|
2008-02-07 19:11:37 -07:00
|
|
|
return -EIO;
|
|
|
|
}
|
2008-02-19 12:44:19 -07:00
|
|
|
|
|
|
|
m = read_record->m;
|
|
|
|
|
2008-02-07 19:11:37 -07:00
|
|
|
DMERR("Mirror read failed from %s. Trying alternative device.",
|
|
|
|
m->dev->name);
|
|
|
|
|
|
|
|
fail_mirror(m, DM_RAID1_READ_ERROR);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* A failed read is requeued for another attempt using an intact
|
|
|
|
* mirror.
|
|
|
|
*/
|
|
|
|
if (default_ok(m) || mirror_available(ms, bio)) {
|
|
|
|
bd = &read_record->details;
|
|
|
|
|
|
|
|
dm_bio_restore(bd, bio);
|
|
|
|
mempool_free(read_record, ms->read_record_pool);
|
|
|
|
map_context->ptr = NULL;
|
|
|
|
queue_bio(ms, bio, rw);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
DMERR("All replicated volumes dead, failing I/O");
|
|
|
|
}
|
|
|
|
|
|
|
|
out:
|
|
|
|
if (read_record) {
|
|
|
|
mempool_free(read_record, ms->read_record_pool);
|
|
|
|
map_context->ptr = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return error;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
static void mirror_presuspend(struct dm_target *ti)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
struct mirror_set *ms = (struct mirror_set *) ti->private;
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2009-12-10 16:52:03 -07:00
|
|
|
struct bio_list holds;
|
|
|
|
struct bio *bio;
|
|
|
|
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
atomic_set(&ms->suspend, 1);
|
|
|
|
|
2010-03-05 19:32:35 -07:00
|
|
|
/*
|
|
|
|
* Process bios in the hold list to start recovery waiting
|
|
|
|
* for bios in the hold list. After the process, no bio has
|
|
|
|
* a chance to be added in the hold list because ms->suspend
|
|
|
|
* is set.
|
|
|
|
*/
|
|
|
|
spin_lock_irq(&ms->lock);
|
|
|
|
holds = ms->holds;
|
|
|
|
bio_list_init(&ms->holds);
|
|
|
|
spin_unlock_irq(&ms->lock);
|
|
|
|
|
|
|
|
while ((bio = bio_list_pop(&holds)))
|
|
|
|
hold_bio(ms, bio);
|
|
|
|
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
/*
|
|
|
|
* We must finish up all the work that we've
|
|
|
|
* generated (i.e. recovery work).
|
|
|
|
*/
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_stop_recovery(ms->rh);
|
2006-11-08 18:44:44 -07:00
|
|
|
|
|
|
|
wait_event(_kmirrord_recovery_stopped,
|
2008-10-21 10:45:06 -06:00
|
|
|
!dm_rh_recovery_in_flight(ms->rh));
|
2006-11-08 18:44:44 -07:00
|
|
|
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
if (log->type->presuspend && log->type->presuspend(log))
|
|
|
|
/* FIXME: need better error handling */
|
|
|
|
DMWARN("log presuspend failed");
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Now that recovery is complete/stopped and the
|
|
|
|
* delayed bios are queued, we need to wait for
|
|
|
|
* the worker thread to complete. This way,
|
|
|
|
* we know that all of our I/O has been pushed.
|
|
|
|
*/
|
|
|
|
flush_workqueue(ms->kmirrord_wq);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void mirror_postsuspend(struct dm_target *ti)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms = ti->private;
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
|
2007-10-19 15:47:57 -06:00
|
|
|
if (log->type->postsuspend && log->type->postsuspend(log))
|
2005-04-16 16:20:36 -06:00
|
|
|
/* FIXME: need better error handling */
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
DMWARN("log postsuspend failed");
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static void mirror_resume(struct dm_target *ti)
|
|
|
|
{
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
struct mirror_set *ms = ti->private;
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
|
|
|
|
atomic_set(&ms->suspend, 0);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (log->type->resume && log->type->resume(log))
|
|
|
|
/* FIXME: need better error handling */
|
|
|
|
DMWARN("log resume failed");
|
2008-10-21 10:45:06 -06:00
|
|
|
dm_rh_start_recovery(ms->rh);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-02-07 19:11:39 -07:00
|
|
|
/*
|
|
|
|
* device_status_char
|
|
|
|
* @m: mirror device/leg we want the status of
|
|
|
|
*
|
|
|
|
* We return one character representing the most severe error
|
|
|
|
* we have encountered.
|
|
|
|
* A => Alive - No failures
|
|
|
|
* D => Dead - A write failure occurred leaving mirror out-of-sync
|
|
|
|
* S => Sync - A sychronization failure occurred, mirror out-of-sync
|
|
|
|
* R => Read - A read failure occurred, mirror data unaffected
|
|
|
|
*
|
|
|
|
* Returns: <char>
|
|
|
|
*/
|
|
|
|
static char device_status_char(struct mirror *m)
|
|
|
|
{
|
|
|
|
if (!atomic_read(&(m->error_count)))
|
|
|
|
return 'A';
|
|
|
|
|
2009-12-10 16:52:02 -07:00
|
|
|
return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
|
|
|
|
(test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
|
2008-02-07 19:11:39 -07:00
|
|
|
(test_bit(DM_RAID1_SYNC_ERROR, &(m->error_type))) ? 'S' :
|
|
|
|
(test_bit(DM_RAID1_READ_ERROR, &(m->error_type))) ? 'R' : 'U';
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
static int mirror_status(struct dm_target *ti, status_type_t type,
|
2012-07-27 08:08:16 -06:00
|
|
|
unsigned status_flags, char *result, unsigned maxlen)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2007-05-09 03:32:58 -06:00
|
|
|
unsigned int m, sz = 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct mirror_set *ms = (struct mirror_set *) ti->private;
|
2008-10-21 10:45:06 -06:00
|
|
|
struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
|
2008-02-07 19:11:39 -07:00
|
|
|
char buffer[ms->nr_mirrors + 1];
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case STATUSTYPE_INFO:
|
|
|
|
DMEMIT("%d ", ms->nr_mirrors);
|
2008-02-07 19:11:39 -07:00
|
|
|
for (m = 0; m < ms->nr_mirrors; m++) {
|
2005-04-16 16:20:36 -06:00
|
|
|
DMEMIT("%s ", ms->mirror[m].dev->name);
|
2008-02-07 19:11:39 -07:00
|
|
|
buffer[m] = device_status_char(&(ms->mirror[m]));
|
|
|
|
}
|
|
|
|
buffer[m] = '\0';
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-02-07 19:11:39 -07:00
|
|
|
DMEMIT("%llu/%llu 1 %s ",
|
2008-10-21 10:45:06 -06:00
|
|
|
(unsigned long long)log->type->get_sync_count(log),
|
2008-02-07 19:11:39 -07:00
|
|
|
(unsigned long long)ms->nr_regions, buffer);
|
2007-05-09 03:32:58 -06:00
|
|
|
|
2008-10-21 10:45:06 -06:00
|
|
|
sz += log->type->status(log, type, result+sz, maxlen-sz);
|
2007-05-09 03:32:58 -06:00
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
break;
|
|
|
|
|
|
|
|
case STATUSTYPE_TABLE:
|
2008-10-21 10:45:06 -06:00
|
|
|
sz = log->type->status(log, type, result, maxlen);
|
2007-05-09 03:32:58 -06:00
|
|
|
|
2006-10-03 02:15:32 -06:00
|
|
|
DMEMIT("%d", ms->nr_mirrors);
|
2005-04-16 16:20:36 -06:00
|
|
|
for (m = 0; m < ms->nr_mirrors; m++)
|
2006-10-03 02:15:32 -06:00
|
|
|
DMEMIT(" %s %llu", ms->mirror[m].dev->name,
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
(unsigned long long)ms->mirror[m].offset);
|
2007-05-09 03:32:59 -06:00
|
|
|
|
|
|
|
if (ms->features & DM_RAID1_HANDLE_ERRORS)
|
|
|
|
DMEMIT(" 1 handle_errors");
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-06-22 03:12:33 -06:00
|
|
|
static int mirror_iterate_devices(struct dm_target *ti,
|
|
|
|
iterate_devices_callout_fn fn, void *data)
|
|
|
|
{
|
|
|
|
struct mirror_set *ms = ti->private;
|
|
|
|
int ret = 0;
|
|
|
|
unsigned i;
|
|
|
|
|
|
|
|
for (i = 0; !ret && i < ms->nr_mirrors; i++)
|
|
|
|
ret = fn(ti, ms->mirror[i].dev,
|
2009-07-23 13:30:42 -06:00
|
|
|
ms->mirror[i].offset, ti->len, data);
|
2009-06-22 03:12:33 -06:00
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
static struct target_type mirror_target = {
|
|
|
|
.name = "mirror",
|
2011-01-13 12:59:58 -07:00
|
|
|
.version = {1, 12, 1},
|
2005-04-16 16:20:36 -06:00
|
|
|
.module = THIS_MODULE,
|
|
|
|
.ctr = mirror_ctr,
|
|
|
|
.dtr = mirror_dtr,
|
|
|
|
.map = mirror_map,
|
|
|
|
.end_io = mirror_end_io,
|
dm raid1: fix EIO after log failure
This patch adds the ability to requeue write I/O to
core device-mapper when there is a log device failure.
If a write to the log produces and error, the pending writes are
put on the "failures" list. Since the log is marked as failed,
they will stay on the failures list until a suspend happens.
Suspends come in two phases, presuspend and postsuspend. We must
make sure that all the writes on the failures list are requeued
in the presuspend phase (a requirement of dm core). This means
that recovery must be complete (because writes may be delayed
behind it) and the failures list must be requeued before we
return from presuspend.
The mechanisms to ensure recovery is complete (or stopped) was
already in place, but needed to be moved from postsuspend to
presuspend. We rely on 'flush_workqueue' to ensure that the
mirror thread is complete and therefore, has requeued all writes
in the failures list.
Because we are using flush_workqueue, we must ensure that no
additional 'queue_work' calls will produce additional I/O
that we need to requeue (because once we return from
presuspend, we are unable to do anything about it). 'queue_work'
is called in response to the following functions:
- complete_resync_work = NA, recovery is stopped
- rh_dec (mirror_end_io) = NA, only calls 'queue_work' if it
is ready to recover the region
(recovery is stopped) or it needs
to clear the region in the log*
**this doesn't get called while
suspending**
- rh_recovery_end = NA, recovery is stopped
- rh_recovery_start = NA, recovery is stopped
- write_callback = 1) Writes w/o failures simply call
bio_endio -> mirror_end_io -> rh_dec
(see rh_dec above)
2) Writes with failures are put on
the failures list and queue_work is
called**
** write_callbacks don't happen
during suspend **
- do_failures = NA, 'queue_work' not called if suspending
- add_mirror (initialization) = NA, only done on mirror creation
- queue_bio = NA, 1) delayed I/O scheduled before flush_workqueue
is called. 2) No more I/Os are being issued.
3) Re-attempted READs can still be handled.
(Write completions are handled through rh_dec/
write_callback - mention above - and do not
use queue_bio.)
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2008-02-07 19:11:35 -07:00
|
|
|
.presuspend = mirror_presuspend,
|
2005-04-16 16:20:36 -06:00
|
|
|
.postsuspend = mirror_postsuspend,
|
|
|
|
.resume = mirror_resume,
|
|
|
|
.status = mirror_status,
|
2009-06-22 03:12:33 -06:00
|
|
|
.iterate_devices = mirror_iterate_devices,
|
2005-04-16 16:20:36 -06:00
|
|
|
};
|
|
|
|
|
|
|
|
static int __init dm_mirror_init(void)
|
|
|
|
{
|
|
|
|
int r;
|
|
|
|
|
2009-04-02 12:55:24 -06:00
|
|
|
_dm_raid1_read_record_cache = KMEM_CACHE(dm_raid1_read_record, 0);
|
|
|
|
if (!_dm_raid1_read_record_cache) {
|
|
|
|
DMERR("Can't allocate dm_raid1_read_record cache");
|
|
|
|
r = -ENOMEM;
|
|
|
|
goto bad_cache;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
r = dm_register_target(&mirror_target);
|
2009-04-02 12:55:24 -06:00
|
|
|
if (r < 0) {
|
2007-07-12 10:27:01 -06:00
|
|
|
DMERR("Failed to register mirror target");
|
2009-04-02 12:55:24 -06:00
|
|
|
goto bad_target;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2009-04-02 12:55:24 -06:00
|
|
|
bad_target:
|
|
|
|
kmem_cache_destroy(_dm_raid1_read_record_cache);
|
|
|
|
bad_cache:
|
2005-04-16 16:20:36 -06:00
|
|
|
return r;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit dm_mirror_exit(void)
|
|
|
|
{
|
2009-01-05 20:04:58 -07:00
|
|
|
dm_unregister_target(&mirror_target);
|
2009-04-02 12:55:24 -06:00
|
|
|
kmem_cache_destroy(_dm_raid1_read_record_cache);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Module hooks */
|
|
|
|
module_init(dm_mirror_init);
|
|
|
|
module_exit(dm_mirror_exit);
|
|
|
|
|
|
|
|
MODULE_DESCRIPTION(DM_NAME " mirror target");
|
|
|
|
MODULE_AUTHOR("Joe Thornber");
|
|
|
|
MODULE_LICENSE("GPL");
|