path: root/tools/dlock.c

/*
 * Copyright (C) 2014 Red Hat, Inc.
 *
 * This file is part of LVM2.
 *
 * This copyrighted material is made available to anyone wishing to use,
 * modify, copy, or redistribute it subject to the terms and conditions
 * of the GNU Lesser General Public License v.2.1.
 */

#include "tools.h"
#include "metadata.h"
#include "lvmetad.h"
#include "lvmlockd.h"
#include "lvmcache.h"
#include "lvmlockd-client.h"

static int _mode_num(const char *mode)
{
	if (!strcmp(mode, "na"))
		return -2;
	if (!strcmp(mode, "un"))
		return -1;
	if (!strcmp(mode, "nl"))
		return 0;
	if (!strcmp(mode, "sh"))
		return 1;
	if (!strcmp(mode, "ex"))
		return 2;
	return -3;
}

/* same rules as strcmp */
static int _mode_compare(const char *m1, const char *m2)
{
	int n1 = _mode_num(m1);
	int n2 = _mode_num(m2);

	if (n1 < n2)
		return -1;
	if (n1 == n2)
		return 0;
	if (n1 > n2)
		return 1;
	return -2;
}

/*
 * Mode is selected by:
 * 1. mode from command line option (only taken if allow_override is set)
 * 2. the function arg passed by the calling command (def_mode)
 * 3. look up a default mode for the command
 *    (cases where the caller doesn't know a default)
 *
 * MODE_NOARG: don't use mode from command line option
 */

/*
 * dlock_gl_create() is used by vgcreate to acquire and/or create the
 * global lock.  vgcreate will have a lock_type for the new vg which
 * dlock_gl_create() can provide in the lock-gl call.
 *
 * dlock_gl() and dlock_gl_create() differ in the specific cases where
 * ENOLS (no lockspace found) is overriden.  In the vgcreate case, the
 * override cases are related to sanlock bootstrap, and the lock_type of
 * the vg being created is needed.
 *
 * 1. vgcreate of the first dlock-type vg calls dlock_gl_create()
 *    to acquire the global lock.
 *
 * 2. vgcreate/dlock_gl_create passes gl lock request to lvmlockd,
 *    along with lock_type of the new vg.
 *
 * 3. lvmlockd finds no global lockspace/lock.
 *
 * 4. dlm:
 *    If the lock_type from vgcreate is dlm, lvmlockd creates the
 *    dlm global lockspace, and queues the global lock request
 *    for vgcreate.  dlock_gl_create returns sucess with the gl held.
 *
 *    sanlock:
 *    If the lock_type from vgcreate is sanlock, lvmlockd returns -ENOLS
 *    with the NO_GL_LS flag.  lvmlockd cannot create or acquire a sanlock
 *    global lock until the VG exists on disk (the locks live within the VG).
 *
 *    dlock_gl_create sees sanlock/ENOLS/NO_GL_LS (and optionally the
 *    "enable" lock-gl arg), determines that this is the sanlock
 *    bootstrap special case, and returns success without the global lock.
 *   
 *    vgcreate creates the VG on disk, and calls lvmlockd_init_vg() which
 *    initializes/enables a global lock on the new VG's internal sanlock lv.
 *    Future dlock_gl/dlock_gl_create calls will acquire the existing gl.
 */

int dlock_gl_create(struct cmd_context *cmd, const char *def_mode, uint32_t flags,
		    const char *vg_lock_type)
{
	const char *mode = NULL;
	uint32_t result_flags;
	int result;
	int ret;

	if (!(flags & DL_GL_MODE_NOARG)) {
		mode = arg_str_value(cmd, lockgl_ARG, NULL);
		if (mode && def_mode && strcmp(mode, "enable") &&
		    (_mode_compare(mode, def_mode) < 0) &&
		    !find_config_tree_bool(cmd, global_allow_override_lock_modes_CFG, NULL)) {
			log_error("Disallowed lock-gl mode \"%s\"", mode);
			return 0;
		}
	}

	if (!mode)
		mode = def_mode;

	if (!mode) {
		log_error("Unknown lock-gl mode");
		return 0;
	}

	if (!strcmp(mode, "ex") && find_config_tree_bool(cmd, global_read_only_lock_modes_CFG, NULL)) {
		log_error("Disallow lock-gl ex with read_only_lock_modes");
		return 0;
	}

	ret = lvmlockd_send(cmd, command_name(cmd), "lock_gl",
			    NULL, vg_lock_type, NULL, NULL, NULL, mode, "update_names",
			    &result, &result_flags);
	if (!ret) {
		/* no result from lvmlockd */
		log_error("Locking failed for global lock");
		return 0;
	}

	/*
	 * result and result_flags were returned from lvmlockd.
	 * In lvmlockd, result 0 is success, and error is < 0.
	 *
	 * ENOLS: no lockspace was found with a global lock.
	 * It may not exist (perhaps this command is creating the first),
	 * or it may not be visible or started on the system yet.
	 */

	if (result == -ENOLS) {
		/*
		 * It's not a problem if an unlock happens after the
		 * lockspace has been removed; ignore it.
		 */
		if (!strcmp(mode, "un"))
			return 1;

		/*
		 * This is the explicit sanlock bootstrap condition for
		 * proceding without the global lock: a chicken/egg case
		 * for the first sanlock VG that is created.
		 *
		 * When creating the first sanlock VG, there is no global
		 * lock to acquire because the gl will exist in the VG
		 * being created.  The "enable" option makes explicit that
		 * this is expected:
		 *
		 * vgcreate --lock-type sanlock --lock-gl enable
		 *
		 * There are three indications that this is the unique
		 * first-sanlock-vg bootstrap case:
		 *
		 * - result from lvmlockd is -ENOLS because lvmlockd found
		 *   no lockspace for this VG; expected because it's being
		 *   created here.
		 *
		 * - result flag LD_RF_NO_GL_LS from lvmlockd means that
		 *   lvmlockd has seen no other lockspace with a global lock.
		 *   This implies that this is probably the first sanlock vg
		 *   to be created.  If other sanlock vgs exist, the global
		 *   lock should be available from one of them.
		 *
		 * - command line lock-gl arg is "enable" which means the
		 *   user expects this to be the first sanlock vg, and the
		 *   global lock should be enabled in it.
		 */

		if ((result_flags & LD_RF_NO_GL_LS) &&
		    !strcmp(vg_lock_type, "sanlock") &&
		    !strcmp(mode, "enable")) {
			log_debug("Enabling sanlock global lock");
			lvmetad_validate_global_cache(cmd, 1);
			return 1;
		}

		/*
		 * This is an implicit sanlock bootstrap condition for
		 * proceeding without the global lock.  The command line does
		 * not indicate explicitly that this is a bootstrap situation
		 * (via "enable"), but it seems likely to be because lvmlockd
		 * has seen no dlock-type vgs.  It is possible that a global
		 * lock does exist in a vg that has not yet been seen.  If that
		 * vg appears after this creates a new vg with a new enabled
		 * gl, then there will be two enabled global locks, and one
		 * will need to be disabled.  (We could instead return an error
		 * here and insist with an error message that the --lock-gl
		 * enable option be used to exercise the explicit case above.)
		 */

		if ((result_flags & LD_RF_NO_GL_LS) &&
		    (result_flags & LD_RF_NO_LOCKSPACES) &&
		    !strcmp(vg_lock_type, "sanlock")) {
			log_print_unless_silent("Enabling sanlock global lock");
			lvmetad_validate_global_cache(cmd, 1);
			return 1;
		}

		/*
		 * Allow non-dlock-type vgs to be created even when the global
		 * lock is not available.  Once created, these vgs will only be
		 * accessible to the local system_id, and not protected by
		 * locks, so allowing the creation without a lock is a very
		 * minor exception to normal locking.
		 */

		if ((result_flags & LD_RF_NO_GL_LS) &&
		    (!strcmp(vg_lock_type, "none"))) {
			lvmetad_validate_global_cache(cmd, 1);
			return 1;
		}

		log_error("Global lock %s error %d", mode, result);
		return 0;
	}

	if (result < 0) {
		log_error("Global lock %s error %d", mode, result);
		return 0;
	}

	if (!(flags & DL_GL_SKIP_CACHE_VALIDATE))
		lvmetad_validate_global_cache(cmd, 0);

	return 1;
}

int dlock_gl(struct cmd_context *cmd, const char *def_mode, uint32_t flags)
{
	const char *mode = NULL;
	const char *opts = NULL;
	uint32_t result_flags;
	int result;
	int ret;

	if (!(flags & DL_GL_MODE_NOARG)) {
		mode = arg_str_value(cmd, lockgl_ARG, NULL);
		if (mode && def_mode &&
		    (_mode_compare(mode, def_mode) < 0) &&
		    !find_config_tree_bool(cmd, global_allow_override_lock_modes_CFG, NULL)) {
			log_error("Disallowed lock-gl mode \"%s\"", mode);
			return 0;
		}
	}

	if (!mode)
		mode = def_mode;

	if (!mode) {
		log_error("Unknown lock-gl mode");
		return 0;
	}

	if (!strcmp(mode, "ex") && find_config_tree_bool(cmd, global_read_only_lock_modes_CFG, NULL)) {
		log_error("Disallow lock-gl ex with read_only_lock_modes");
		return 0;
	}

	/*
	 * The dlock_gl() caller uses this flag when it is going to change the
	 * VG namesapce.  lvmlockd uses this to encode extra information in the
	 * global lock data (a separate version number in the lvb) about what
	 * was changed.  Other hosts will see this extra information in the gl
	 * data and know that the VG namespace changed, which determines the
	 * kind of cache refresh they need to do.
	 */
	if (flags & DL_GL_UPDATE_NAMES)
		opts = "update_names";

	ret = lvmlockd_send(cmd, command_name(cmd), "lock_gl",
			    NULL, NULL, NULL, NULL, NULL, mode, opts,
			    &result, &result_flags);
	if (!ret) {
		/* No result from lvmlockd, it is probably not running. */

		/*
		 * These options historically mean that locking is expected
		 * to fail and the command should be allowed to proceed anyway.
		 */
		if (arg_is_set(cmd, sysinit_ARG) || arg_is_set(cmd, ignorelockingfailure_ARG)) {
			log_debug("Ignore failed locking for global lock: option %s",
				  arg_is_set(cmd, sysinit_ARG) ? "sysinit" : "ignorelockingfailure");
			return 1;
		}
		
		/*
		 * We don't care if an unlock operation fails in this case, and
		 * we can allow a shared lock request to succeed without any
		 * serious harm.  To disallow basic reading/reporting when
		 * lvmlockd is stopped is too strict, unnecessary, and
		 * inconvenient.  We force a global cache validation in this
		 * case.
		 */

		if (!strcmp(mode, "un"))
			return 1;

		if (!strcmp(mode, "sh")) {
			log_warn("Reading without shared global lock.");
			lvmetad_validate_global_cache(cmd, 1);
			return 1;
		}

		log_error("Locking failed for global lock");
		return 0;
	}

	/*
	 * result and result_flags were returned from lvmlockd.
	 * In lvmlockd, result 0 is success, and error is < 0.
	 *
	 * ENOLS: no lockspace was found with a global lock.
	 * The VG with the global lock may not be visible or started yet,
	 * this should be a temporary condition.
	 *
	 * ESTARTING: the lockspace with the gl is starting.
	 * The VG with the global lock is starting and should finish shortly.
	 */

	if (result == -ENOLS || result == -ESTARTING) {

		/* It doesn't matter if an unlock operation fails. */
		if (!strcmp(mode, "un"))
			return 1;

		/*
		 * This is a general condition for allowing the command to
		 * proceed without a shared global lock when the global lock is
		 * not found or ready.  This should not be a persistent
		 * condition.  The VG containing the global lock should appear
		 * on the system, or the global lock should be enabled in
		 * another VG, or the the lockspace with the gl should finish
		 * starting.
		 *
		 * Same reasons as above for allowing the command to proceed
		 * with the shared gl.  We force a global cache validation and
		 * print a warning.
		 */

		if (strcmp(mode, "sh")) {
			log_error("Global lock %s error %d", mode, result);
			return 0;
		}

		if (result == -ESTARTING) {
			log_warn("Skipping global lock: lockspace is starting");
			lvmetad_validate_global_cache(cmd, 1);
			return 1;
		}

		if ((result_flags & LD_RF_NO_GL_LS) ||
		    (result_flags & LD_RF_NO_LOCKSPACES)) {
			log_warn("Skipping global lock: not found");
			lvmetad_validate_global_cache(cmd, 1);
			return 1;
		}

		log_error("Global lock %s error %d", mode, result);
		return 0;
	}

	if ((result_flags & LD_RF_DUP_GL_LS) && strcmp(mode, "un"))
		log_warn("Duplicate sanlock global locks should be corrected");

	if (result < 0) {
		log_error("Global lock %s error %d", mode, result);
		return 0;
	}

	if (!(flags & DL_GL_SKIP_CACHE_VALIDATE))
		lvmetad_validate_global_cache(cmd, 0);

	return 1;
}

int dlock_vg(struct cmd_context *cmd, const char *vg_name,
	     const char *def_mode, uint32_t flags)
{
	const char *mode = NULL;
	const char *opts = NULL;
	uint32_t result_flags;
	int result;
	int ret;

	/*
	 * Only real vgs have locks; orphans are covered by global lock.
	 */
	if (!is_real_vg(vg_name))
		return 1;

	/*
	 * DLOCK_VG_NA is used in special cases to disable the vg lock.
	 */
	if (cmd->command->flags & DLOCK_VG_NA)
		return 1;

	/*
	 * DL_VG_MODE_NOARG disables getting the mode from --lock-vg arg.
	 */
	if (!(flags & DL_VG_MODE_NOARG)) {
		mode = arg_str_value(cmd, lockvg_ARG, NULL);
		if (mode && def_mode &&
		    (_mode_compare(mode, def_mode) < 0) &&
		    !find_config_tree_bool(cmd, global_allow_override_lock_modes_CFG, NULL)) {
			log_error("Disallowed lock-vg mode \"%s\"", mode);
			return 0;
		}
	}

	if (!mode)
		mode = def_mode;

	if (!mode) {
		/*
		 * Default mode is needed, but was not provided
		 * in the function args.  This happens when dlock_vg
		 * is called from a process_each function that handles
		 * different commands.  Commands that only
		 * read/check/report/display the vg have DLOCK_VG_SH
		 * set in commands.h.  All other commands modify the vg.
		 */
		if (cmd->command->flags & DLOCK_VG_SH)
			mode = "sh";
		else
			mode = "ex";
	}

	if (!strcmp(mode, "ex") && find_config_tree_bool(cmd, global_read_only_lock_modes_CFG, NULL)) {
		log_error("Disallow lock-vg ex with read_only_lock_modes");
		return 0;
	}

	ret = lvmlockd_send(cmd, command_name(cmd), "lock_vg",
			    vg_name, NULL, NULL, NULL, NULL, mode, opts,
			    &result, &result_flags);
	if (!ret) {
		/* No result from lvmlockd, it is probably not running. */

		/* See comment in dlock_gl() about this case. */

		if (arg_count(cmd, sysinit_ARG) || arg_count(cmd, ignorelockingfailure_ARG)) {
			log_debug("Ignore failed locking for VG %s: option %s", vg_name,
				  arg_count(cmd, sysinit_ARG) ? "sysinit" : "ignorelockingfailure");
			return 1;
		}

		/* See comment in dlock_gl() about these cases. */

		if (!strcmp(mode, "un"))
			return 1;
				
		if (!strcmp(mode, "sh")) {
			log_warn("Reading VG %s without shared lock.", vg_name);
			return 1;
		}

		log_error("Locking failed for VG %s", vg_name);
		return 0;
	}

	/*
	 * result and result_flags were returned from lvmlockd.
	 * In lvmlockd, result 0 is success, and error is < 0.
	 *
	 * ELOCALVG: the VG is local and does not need a dlock.
	 *
	 * EOTHERVG: the VG is local and belongs to another system_id.
	 *
	 * ENOLS: no lockspace for the VG was found, the VG may not
	 * be started yet.  The VG should be started manually or by system,
	 * e.g. vgchange --lock-start
	 *
	 * ESTARTING: the lockspace for the VG is starting and should
	 * finish shortly.
	 */

	if (result == -ELOCALVG)
		return 1;

	if (result == -EOTHERVG) {
		/*
		 * The VG is local and owned by another system_id.
		 * lvmlockd knows this because it caches the identity of
		 * local VGs (for the ELOCALVG case above).
		 *
		 * . By returning 0 (failure) here we can skip this VG
		 *   before vg_read() is even called.
		 *
		 * . By returning 1 (success) here we will continue through
		 *   vg_read(), after which we will see the foreign
		 *   system_id in the metadata, and return FAILED_SYSTEMID.
		 *   This VG would then be skipped by ignore_vg() instead
		 *   of being skipped here.
		 *
		 * Skipping the foreign VG here is more efficient, but not
		 * consistent with the way foreign VGs are ignored when
		 * lvmlockd is not used, so we return success instead.
		 * If we decide to skip the VG here (return 0), then we
		 * would need to override this when cmd->include_foreign_vgs
		 * is set (the command wants to read/report foreign VGs.)
		 */
		log_debug("local VG %s owned by other system_id", vg_name);
		return 0;
	}

	if (result == -ENOLS || result == -ESTARTING) {

		/* It doesn't matter if an unlock operation fails. */
		if (!strcmp(mode, "un"))
			return 1;

		if (strcmp(mode, "sh")) {
			/*
			 * An ex lock request always fails here.  Based on the
			 * result number and result flags we can often print a
			 * reason for the failure.
			 *
			 * (In the future we might want to continue through
			 * vg_read with the lock and fail after the vg_read.
			 * Doing the vg_read may provide more information about
			 * the failure here.)
			 */
			if ((result == -ENOLS) && (result_flags & LD_RF_INACTIVE_LS)) {
				if (result_flags & LD_RF_ADD_LS_ERROR)
					log_error("VG %s lock failed: lock start error", vg_name);
				else
					log_error("VG %s lock failed: locking stopped", vg_name);

			} else if (result == -ENOLS) {
				log_error("VG %s lock failed: lock start required", vg_name);

			} else if (result == -ESTARTING) {
				log_error("VG %s lock failed: lock start in progress", vg_name);

			} else {
				log_error("VG %s lock failed: %d", vg_name, result);
			}
			return 0;
		}

		/*
		 * When a sh lock failed we will allow the command to proceed
		 * because there's little harm that it could do.  See the
		 * reasoning above for proceeding after a failed gl sh lock.
		 * Do we want to invalidate the cached VG in these cases to
		 * force rereading from disk?
		 */

		if (result == -ESTARTING) {
			log_warn("Skipping lock for VG %s: lock start in progress", vg_name);
			return 1;
		}

		if ((result == -ENOLS) && (result_flags & LD_RF_ADD_LS_ERROR)) {
			log_warn("Skipping lock for VG %s: lock start error", vg_name);
			return 1;
		}

		if ((result == -ENOLS) && (result_flags & LD_RF_INACTIVE_LS)) {
			log_warn("Skipping lock for VG %s: locking stopped", vg_name);
			return 1;
		}

		if (result == -ENOLS) {
			log_warn("Skipping lock for VG %s: lock start required", vg_name);
			return 1;
		}

		log_error("VG %s shared lock error %d", vg_name, result);
		return 0;
	}

	/*
	 * A notice from lvmlockd that duplicate gl locks have been found.
	 * It would be good for the user to disable one of them.
	 */
	if ((result_flags & LD_RF_DUP_GL_LS) && strcmp(mode, "un"))
		log_warn("Duplicate sanlock global lock in VG %s", vg_name);

	if (result < 0) {
		log_error("VG %s lock error: %d", vg_name, result);
		return 0;
	}

	return 1;
}

/* A shortcut for back to back dlock_gl() + dlock_vg() */

int dlock_gl_vg(struct cmd_context *cmd, const char *vg_name,
		const char *def_gl_mode, const char *def_vg_mode,
		uint32_t flags)
{
	if (!dlock_gl(cmd, def_gl_mode, flags))
		return 0;

	if (!dlock_vg(cmd, vg_name, def_vg_mode, flags)) {
		dlock_gl(cmd, "un", DL_GL_MODE_NOARG);
		return 0;
	}

	return 1;
}