X-Git-Url: https://git.whamcloud.com/?a=blobdiff_plain;f=lustre%2Ftarget%2Fout_handler.c;h=d9ba4dc57ab264e95ec8482b468b44eee4eb9f5b;hb=a41c6fad4672a60166088b9ad8aeb4f1b51c38e7;hp=5d771a72b4ade7c01c367f21ce7171b169fcca8c;hpb=0754bc8f2623bea184111af216f7567608db35b6;p=fs%2Flustre-release.git

diff --git a/lustre/target/out_handler.c b/lustre/target/out_handler.c
index 5d771a7..d9ba4dc 100644
--- a/lustre/target/out_handler.c
+++ b/lustre/target/out_handler.c
@@ -31,10 +31,21 @@
 
 #define DEBUG_SUBSYSTEM S_CLASS
 
-#include <obd_class.h>
+#include <llog_swab.h>
+#include <lustre_obdo.h>
+#include <lustre_swab.h>
+#include <lustre_update.h>
 #include <md_object.h>
+#include <obd_class.h>
 #include "tgt_internal.h"
-#include <lustre_update.h>
+
+static inline void orr_cpu_to_le(struct out_read_reply *orr_dst,
+				 const struct out_read_reply *orr_src)
+{
+	orr_dst->orr_size = cpu_to_le32(orr_src->orr_size);
+	orr_dst->orr_padding = cpu_to_le32(orr_src->orr_padding);
+	orr_dst->orr_offset = cpu_to_le64(orr_dst->orr_offset);
+}
 
 static void out_reconstruct(const struct lu_env *env, struct dt_device *dt,
 			    struct dt_object *obj,
@@ -106,10 +117,10 @@ static int out_create(struct tgt_session_info *tsi)
 	ENTRY;
 
 	wobdo = object_update_param_get(update, 0, &size);
-	if (wobdo == NULL || IS_ERR(wobdo) || size != sizeof(*wobdo)) {
-		CERROR("%s: obdo is NULL, invalid RPC: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(wobdo) || size != sizeof(*wobdo)) {
+		CERROR("%s: obdo is NULL, invalid RPC: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(wobdo));
+		RETURN(PTR_ERR(wobdo));
 	}
 
 	if (ptlrpc_req_need_swab(tsi->tsi_pill->rc_req))
@@ -120,17 +131,17 @@ static int out_create(struct tgt_session_info *tsi)
 	dof->dof_type = dt_mode_to_dft(attr->la_mode);
 	if (update->ou_params_count > 1) {
 		fid = object_update_param_get(update, 1, &size);
-		if (fid == NULL || IS_ERR(fid) || size != sizeof(*fid)) {
-			CERROR("%s: invalid fid: rc = %d\n",
-			       tgt_name(tsi->tsi_tgt), -EPROTO);
-			RETURN(err_serious(-EPROTO));
+		if (IS_ERR(fid) || size != sizeof(*fid)) {
+			CERROR("%s: invalid fid: rc = %ld\n",
+			       tgt_name(tsi->tsi_tgt), PTR_ERR(fid));
+			RETURN(PTR_ERR(fid));
 		}
 		if (ptlrpc_req_need_swab(tsi->tsi_pill->rc_req))
 			lustre_swab_lu_fid(fid);
 		if (!fid_is_sane(fid)) {
 			CERROR("%s: invalid fid "DFID": rc = %d\n",
 			       tgt_name(tsi->tsi_tgt), PFID(fid), -EPROTO);
-			RETURN(err_serious(-EPROTO));
+			RETURN(-EPROTO);
 		}
 	}
 
@@ -159,10 +170,10 @@ static int out_attr_set(struct tgt_session_info *tsi)
 	ENTRY;
 
 	wobdo = object_update_param_get(update, 0, &size);
-	if (wobdo == NULL || IS_ERR(wobdo) || size != sizeof(*wobdo)) {
-		CERROR("%s: empty obdo in the update: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(wobdo) || size != sizeof(*wobdo)) {
+		CERROR("%s: empty obdo in the update: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(wobdo));
+		RETURN(PTR_ERR(wobdo));
 	}
 
 	attr->la_valid = 0;
@@ -185,6 +196,7 @@ static int out_attr_get(struct tgt_session_info *tsi)
 {
 	const struct lu_env	*env = tsi->tsi_env;
 	struct tgt_thread_info	*tti = tgt_th_info(env);
+	struct object_update	*update = tti->tti_u.update.tti_update;
 	struct obdo		*obdo = &tti->tti_u.update.tti_obdo;
 	struct lu_attr		*la = &tti->tti_attr;
 	struct dt_object        *obj = tti->tti_u.update.tti_dt_object;
@@ -193,6 +205,9 @@ static int out_attr_get(struct tgt_session_info *tsi)
 
 	ENTRY;
 
+	if (unlikely(update->ou_result_size < sizeof(*obdo)))
+		return -EPROTO;
+
 	if (!lu_object_exists(&obj->do_lu)) {
 		/* Usually, this will be called when the master MDT try
 		 * to init a remote object(see osp_object_init), so if
@@ -247,32 +262,28 @@ static int out_xattr_get(struct tgt_session_info *tsi)
 	}
 
 	name = object_update_param_get(update, 0, NULL);
-	if (name == NULL || IS_ERR(name)) {
-		CERROR("%s: empty name for xattr get: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(name)) {
+		CERROR("%s: empty name for xattr get: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(name));
+		RETURN(PTR_ERR(name));
 	}
 
 	update_result = object_update_result_get(reply, 0, NULL);
 	if (update_result == NULL) {
 		CERROR("%s: empty name for xattr get: rc = %d\n",
 		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+		RETURN(-EPROTO);
 	}
 
+	lbuf->lb_len = (int)tti->tti_u.update.tti_update->ou_result_size;
 	lbuf->lb_buf = update_result->our_data;
-	lbuf->lb_len = OUT_UPDATE_REPLY_SIZE -
-		       cfs_size_round((unsigned long)update_result->our_data -
-				      (unsigned long)update_result);
+	if (lbuf->lb_len == 0)
+		lbuf->lb_buf = 0;
 	dt_read_lock(env, obj, MOR_TGT_CHILD);
 	rc = dt_xattr_get(env, obj, lbuf, name);
 	dt_read_unlock(env, obj);
-	if (rc < 0) {
+	if (rc < 0)
 		lbuf->lb_len = 0;
-		GOTO(out, rc);
-	}
-	lbuf->lb_len = rc;
-	rc = 0;
 	CDEBUG(D_INFO, "%s: "DFID" get xattr %s len %d\n",
 	       tgt_name(tsi->tsi_tgt), PFID(lu_object_fid(&obj->do_lu)),
 	       name, (int)lbuf->lb_len);
@@ -281,7 +292,7 @@ static int out_xattr_get(struct tgt_session_info *tsi)
 
 out:
 	object_update_result_insert(reply, lbuf->lb_buf, lbuf->lb_len, idx, rc);
-	RETURN(rc);
+	RETURN(0);
 }
 
 static int out_index_lookup(struct tgt_session_info *tsi)
@@ -295,14 +306,17 @@ static int out_index_lookup(struct tgt_session_info *tsi)
 
 	ENTRY;
 
+	if (unlikely(update->ou_result_size < sizeof(tti->tti_fid1)))
+		return -EPROTO;
+
 	if (!lu_object_exists(&obj->do_lu))
 		RETURN(-ENOENT);
 
 	name = object_update_param_get(update, 0, NULL);
-	if (name == NULL || IS_ERR(name)) {
-		CERROR("%s: empty name for lookup: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(name)) {
+		CERROR("%s: empty name for lookup: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(name));
+		RETURN(PTR_ERR(name));
 	}
 
 	dt_read_lock(env, obj, MOR_TGT_CHILD);
@@ -351,24 +365,25 @@ static int out_xattr_set(struct tgt_session_info *tsi)
 	ENTRY;
 
 	name = object_update_param_get(update, 0, NULL);
-	if (name == NULL || IS_ERR(name)) {
-		CERROR("%s: empty name for xattr set: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(name)) {
+		CERROR("%s: empty name for xattr set: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(name));
+		RETURN(PTR_ERR(name));
 	}
 
+	/* If buffer == NULL (-ENODATA), then it might mean delete xattr */
 	buf = object_update_param_get(update, 1, &buf_len);
-	if (IS_ERR(buf))
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(buf) && PTR_ERR(buf) != -ENODATA)
+		RETURN(PTR_ERR(buf));
 
 	lbuf->lb_buf = buf;
 	lbuf->lb_len = buf_len;
 
 	tmp = object_update_param_get(update, 2, &size);
-	if (tmp == NULL || IS_ERR(tmp) || size != sizeof(*tmp)) {
-		CERROR("%s: emptry or wrong size %zu flag: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), size, -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(tmp) || size != sizeof(*tmp)) {
+		CERROR("%s: emptry or wrong size %zu flag: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), size, PTR_ERR(tmp));
+		RETURN(PTR_ERR(tmp));
 	}
 
 	if (ptlrpc_req_need_swab(tsi->tsi_pill->rc_req))
@@ -392,10 +407,10 @@ static int out_xattr_del(struct tgt_session_info *tsi)
 	ENTRY;
 
 	name = object_update_param_get(update, 0, NULL);
-	if (name == NULL || IS_ERR(name)) {
-		CERROR("%s: empty name for xattr set: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(name)) {
+		CERROR("%s: empty name for xattr set: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(name));
+		RETURN(PTR_ERR(name));
 	}
 
 	rc = out_tx_xattr_del(tsi->tsi_env, obj, name, &tti->tti_tea,
@@ -455,17 +470,17 @@ static int out_index_insert(struct tgt_session_info *tsi)
 	ENTRY;
 
 	name = object_update_param_get(update, 0, NULL);
-	if (name == NULL || IS_ERR(name)) {
-		CERROR("%s: empty name for index insert: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(name)) {
+		CERROR("%s: empty name for index insert: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(name));
+		RETURN(PTR_ERR(name));
 	}
 
 	fid = object_update_param_get(update, 1, &size);
-	if (fid == NULL || IS_ERR(fid) || size != sizeof(*fid)) {
-		CERROR("%s: invalid fid: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(fid) || size != sizeof(*fid)) {
+		CERROR("%s: invalid fid: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(fid));
+		RETURN(PTR_ERR(fid));
 	}
 
 	if (ptlrpc_req_need_swab(tsi->tsi_pill->rc_req))
@@ -474,14 +489,14 @@ static int out_index_insert(struct tgt_session_info *tsi)
 	if (!fid_is_sane(fid)) {
 		CERROR("%s: invalid FID "DFID": rc = %d\n",
 		       tgt_name(tsi->tsi_tgt), PFID(fid), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+		RETURN(-EPROTO);
 	}
 
 	ptype = object_update_param_get(update, 2, &size);
-	if (ptype == NULL || IS_ERR(ptype) || size != sizeof(*ptype)) {
-		CERROR("%s: invalid type for index insert: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(ptype) || size != sizeof(*ptype)) {
+		CERROR("%s: invalid type for index insert: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(ptype));
+		RETURN(PTR_ERR(ptype));
 	}
 
 	if (ptlrpc_req_need_swab(tsi->tsi_pill->rc_req))
@@ -510,10 +525,10 @@ static int out_index_delete(struct tgt_session_info *tsi)
 		RETURN(-ENOENT);
 
 	name = object_update_param_get(update, 0, NULL);
-	if (name == NULL || IS_ERR(name)) {
-		CERROR("%s: empty name for index delete: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(name)) {
+		CERROR("%s: empty name for index delete: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(name));
+		RETURN(PTR_ERR(name));
 	}
 
 	rc = out_tx_index_delete(tsi->tsi_env, obj, (const struct dt_key *)name,
@@ -536,7 +551,7 @@ static int out_destroy(struct tgt_session_info *tsi)
 	if (!fid_is_sane(fid)) {
 		CERROR("%s: invalid FID "DFID": rc = %d\n",
 		       tgt_name(tsi->tsi_tgt), PFID(fid), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+		RETURN(-EPROTO);
 	}
 
 	if (!lu_object_exists(&obj->do_lu))
@@ -565,19 +580,19 @@ static int out_write(struct tgt_session_info *tsi)
 	ENTRY;
 
 	buf = object_update_param_get(update, 0, &buf_len);
-	if (buf == NULL || IS_ERR(buf) || buf_len == 0) {
-		CERROR("%s: empty buf for xattr set: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(buf) || buf_len == 0) {
+		CERROR("%s: empty buf for xattr set: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(buf));
+		RETURN(PTR_ERR(buf));
 	}
 	lbuf->lb_buf = buf;
 	lbuf->lb_len = buf_len;
 
 	tmp = object_update_param_get(update, 1, &size);
-	if (tmp == NULL || IS_ERR(tmp) || size != sizeof(*tmp)) {
-		CERROR("%s: empty or wrong size %zu pos: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), size, -EPROTO);
-		RETURN(err_serious(-EPROTO));
+	if (IS_ERR(tmp) || size != sizeof(*tmp)) {
+		CERROR("%s: empty or wrong size %zu pos: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), size, PTR_ERR(tmp));
+		RETURN(PTR_ERR(tmp));
 	}
 
 	if (ptlrpc_req_need_swab(tsi->tsi_pill->rc_req))
@@ -599,7 +614,7 @@ static int out_read(struct tgt_session_info *tsi)
 	struct dt_object	*obj = tti->tti_u.update.tti_dt_object;
 	struct object_update_reply *reply = tti->tti_u.update.tti_update_reply;
 	int index = tti->tti_u.update.tti_update_reply_index;
-	struct lu_rdbuf	*rdbuf = &tti->tti_u.rdbuf.tti_rdbuf;
+	struct lu_rdbuf	*rdbuf;
 	struct object_update_result *update_result;
 	struct out_read_reply	*orr;
 	void *tmp;
@@ -619,18 +634,18 @@ static int out_read(struct tgt_session_info *tsi)
 		GOTO(out, rc = -ENOENT);
 
 	tmp = object_update_param_get(update, 0, NULL);
-	if (tmp == NULL || IS_ERR(tmp)) {
-		CERROR("%s: empty size for read: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		GOTO(out, rc = err_serious(-EPROTO));
+	if (IS_ERR(tmp)) {
+		CERROR("%s: empty size for read: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(tmp));
+		GOTO(out, rc = PTR_ERR(tmp));
 	}
 	size = le64_to_cpu(*(size_t *)(tmp));
 
 	tmp = object_update_param_get(update, 1, NULL);
-	if (tmp == NULL || IS_ERR(tmp)) {
-		CERROR("%s: empty pos for read: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), -EPROTO);
-		GOTO(out, rc = err_serious(-EPROTO));
+	if (IS_ERR(tmp)) {
+		CERROR("%s: empty pos for read: rc = %ld\n",
+		       tgt_name(tsi->tsi_tgt), PTR_ERR(tmp));
+		GOTO(out, rc = PTR_ERR(tmp));
 	}
 	pos = le64_to_cpu(*(__u64 *)(tmp));
 
@@ -638,8 +653,9 @@ static int out_read(struct tgt_session_info *tsi)
 	orr = (struct out_read_reply *)update_result->our_data;
 
 	nbufs = (size + OUT_BULK_BUFFER_SIZE - 1) / OUT_BULK_BUFFER_SIZE;
-	OBD_ALLOC(rdbuf->rb_bufs, nbufs * sizeof(rdbuf->rb_bufs[0]));
-	if (rdbuf->rb_bufs == NULL)
+	OBD_ALLOC(rdbuf, sizeof(struct lu_rdbuf) +
+			 nbufs * sizeof(rdbuf->rb_bufs[0]));
+	if (rdbuf == NULL)
 		GOTO(out, rc = -ENOMEM);
 
 	rdbuf->rb_nbufs = 0;
@@ -647,19 +663,15 @@ static int out_read(struct tgt_session_info *tsi)
 	for (i = 0; i < nbufs; i++) {
 		__u32 read_size;
 
-		OBD_ALLOC_PTR(rdbuf->rb_bufs[i]);
-		if (rdbuf->rb_bufs[i] == NULL)
-			GOTO(out_free, rc = -ENOMEM);
-
 		read_size = size > OUT_BULK_BUFFER_SIZE ?
 			    OUT_BULK_BUFFER_SIZE : size;
-		OBD_ALLOC(rdbuf->rb_bufs[i]->lb_buf, read_size);
-		if (rdbuf->rb_bufs[i] == NULL)
+		OBD_ALLOC(rdbuf->rb_bufs[i].lb_buf, read_size);
+		if (rdbuf->rb_bufs[i].lb_buf == NULL)
 			GOTO(out_free, rc = -ENOMEM);
 
-		rdbuf->rb_bufs[i]->lb_len = read_size;
+		rdbuf->rb_bufs[i].lb_len = read_size;
 		dt_read_lock(env, obj, MOR_TGT_CHILD);
-		rc = dt_read(env, obj, rdbuf->rb_bufs[i], &pos);
+		rc = dt_read(env, obj, &rdbuf->rb_bufs[i], &pos);
 		dt_read_unlock(env, obj);
 
 		total_size += rc < 0 ? 0 : rc;
@@ -670,7 +682,6 @@ static int out_read(struct tgt_session_info *tsi)
 		size -= read_size;
 	}
 
-	rdbuf->rb_bytes = total_size;
 	/* send pages to client */
 	rc = tgt_send_buffer(tsi, rdbuf);
 	if (rc < 0)
@@ -683,13 +694,13 @@ static int out_read(struct tgt_session_info *tsi)
 	update_result->our_datalen += orr->orr_size;
 out_free:
 	for (i = 0; i < nbufs; i++) {
-		if (rdbuf->rb_bufs[i] != NULL) {
-			OBD_FREE(rdbuf->rb_bufs[i]->lb_buf,
-				 rdbuf->rb_bufs[i]->lb_len);
-			OBD_FREE_PTR(rdbuf->rb_bufs[i]);
+		if (rdbuf->rb_bufs[i].lb_buf != NULL) {
+			OBD_FREE(rdbuf->rb_bufs[i].lb_buf,
+				 rdbuf->rb_bufs[i].lb_len);
 		}
 	}
-	OBD_FREE(rdbuf->rb_bufs, nbufs * sizeof(rdbuf->rb_bufs[0]));
+	OBD_FREE(rdbuf, sizeof(struct lu_rdbuf) +
+			nbufs * sizeof(rdbuf->rb_bufs[0]));
 out:
 	/* Insert read buffer */
 	update_result->our_rc = ptlrpc_status_hton(rc);
@@ -908,7 +919,8 @@ int out_handle(struct tgt_session_info *tsi)
 	unsigned int			reply_index = 0;
 	int				rc = 0;
 	int				rc1 = 0;
-	int				ouh_size;
+	int				ouh_size, reply_size;
+	int				updates;
 	ENTRY;
 
 	req_capsule_set(pill, &RQF_OUT_UPDATE);
@@ -932,18 +944,9 @@ int out_handle(struct tgt_session_info *tsi)
 	if (update_buf_count == 0)
 		RETURN(err_serious(-EPROTO));
 
-	req_capsule_set_size(pill, &RMF_OUT_UPDATE_REPLY, RCL_SERVER,
-			     OUT_UPDATE_REPLY_SIZE);
-	rc = req_capsule_server_pack(pill);
-	if (rc != 0) {
-		CERROR("%s: Can't pack response: rc = %d\n",
-		       tgt_name(tsi->tsi_tgt), rc);
-		RETURN(rc);
-	}
-
 	OBD_ALLOC(update_bufs, sizeof(*update_bufs) * update_buf_count);
 	if (update_bufs == NULL)
-		RETURN(-ENOMEM);
+		RETURN(err_serious(-ENOMEM));
 
 	if (ouh->ouh_inline_length > 0) {
 		update_bufs[0] = ouh->ouh_inline_data;
@@ -952,7 +955,7 @@ int out_handle(struct tgt_session_info *tsi)
 
 		oub = req_capsule_client_get(pill, &RMF_OUT_UPDATE_BUF);
 		if (oub == NULL)
-			GOTO(out_free, rc = -EPROTO);
+			GOTO(out_free, rc = err_serious(-EPROTO));
 
 		desc = ptlrpc_prep_bulk_exp(pill->rc_req, update_buf_count,
 					    PTLRPC_BULK_OPS_COUNT,
@@ -961,16 +964,16 @@ int out_handle(struct tgt_session_info *tsi)
 					    MDS_BULK_PORTAL,
 					    &ptlrpc_bulk_kvec_ops);
 		if (desc == NULL)
-			GOTO(out_free, rc = -ENOMEM);
+			GOTO(out_free, rc = err_serious(-ENOMEM));
 
 		tmp = oub;
 		for (i = 0; i < update_buf_count; i++, tmp++) {
 			if (tmp->oub_size >= OUT_MAXREQSIZE)
-				GOTO(out_free, rc = -EPROTO);
+				GOTO(out_free, rc = err_serious(-EPROTO));
 
 			OBD_ALLOC(update_bufs[i], tmp->oub_size);
 			if (update_bufs[i] == NULL)
-				GOTO(out_free, rc = -ENOMEM);
+				GOTO(out_free, rc = err_serious(-ENOMEM));
 
 			desc->bd_frag_ops->add_iov_frag(desc, update_bufs[i],
 							tmp->oub_size);
@@ -979,25 +982,19 @@ int out_handle(struct tgt_session_info *tsi)
 		pill->rc_req->rq_bulk_write = 1;
 		rc = sptlrpc_svc_prep_bulk(pill->rc_req, desc);
 		if (rc != 0)
-			GOTO(out_free, rc);
+			GOTO(out_free, rc = err_serious(rc));
 
 		rc = target_bulk_io(pill->rc_req->rq_export, desc, &lwi);
 		if (rc < 0)
-			GOTO(out_free, rc);
+			GOTO(out_free, rc = err_serious(rc));
 	}
-	/* Prepare the update reply buffer */
-	reply = req_capsule_server_get(pill, &RMF_OUT_UPDATE_REPLY);
-	if (reply == NULL)
-		GOTO(out_free, rc = err_serious(-EPROTO));
-	reply->ourp_magic = UPDATE_REPLY_MAGIC;
-	tti->tti_u.update.tti_update_reply = reply;
-	tti->tti_mult_trans = !req_is_replay(tgt_ses_req(tsi));
-
 	/* validate the request and calculate the total update count and
 	 * set it to reply */
+	reply_size = 0;
+	updates = 0;
 	for (i = 0; i < update_buf_count; i++) {
-		struct object_update_request *our;
-		int			update_count;
+		struct object_update_request	*our;
+		int				 j;
 
 		our = update_bufs[i];
 		if (ptlrpc_req_need_swab(pill->rc_req))
@@ -1008,12 +1005,59 @@ int out_handle(struct tgt_session_info *tsi)
 			       " expect %x: rc = %d\n",
 			       tgt_name(tsi->tsi_tgt), our->ourq_magic,
 			       UPDATE_REQUEST_MAGIC, -EPROTO);
-			GOTO(out_free, rc = -EPROTO);
+			GOTO(out_free, rc = err_serious(-EPROTO));
+		}
+		updates += our->ourq_count;
+
+		/* need to calculate reply size */
+		for (j = 0; j < our->ourq_count; j++) {
+			update = object_update_request_get(our, j, NULL);
+			if (update == NULL)
+				GOTO(out, rc = err_serious(-EPROTO));
+			if (ptlrpc_req_need_swab(pill->rc_req))
+				lustre_swab_object_update(update);
+
+			if (!fid_is_sane(&update->ou_fid)) {
+				CERROR("%s: invalid FID "DFID": rc = %d\n",
+				       tgt_name(tsi->tsi_tgt),
+				       PFID(&update->ou_fid), -EPROTO);
+				GOTO(out, rc = err_serious(-EPROTO));
+			}
+
+			/* XXX: what ou_result_size can be considered safe? */
+
+			reply_size += sizeof(reply->ourp_lens[0]);
+			reply_size += sizeof(struct object_update_result);
+			reply_size += update->ou_result_size;
 		}
-  		update_count = our->ourq_count;
-		reply->ourp_count += update_count;
  	}
- 
+	reply_size += sizeof(*reply);
+
+	if (unlikely(reply_size > ouh->ouh_reply_size)) {
+		CERROR("%s: too small reply buf %u for %u, need %u at least\n",
+		       tgt_name(tsi->tsi_tgt), ouh->ouh_reply_size,
+		       updates, reply_size);
+		GOTO(out_free, rc = err_serious(-EPROTO));
+	}
+
+	req_capsule_set_size(pill, &RMF_OUT_UPDATE_REPLY, RCL_SERVER,
+			     ouh->ouh_reply_size);
+	rc = req_capsule_server_pack(pill);
+	if (rc != 0) {
+		CERROR("%s: Can't pack response: rc = %d\n",
+		       tgt_name(tsi->tsi_tgt), rc);
+		GOTO(out_free, rc = err_serious(-EPROTO));
+	}
+
+	/* Prepare the update reply buffer */
+	reply = req_capsule_server_get(pill, &RMF_OUT_UPDATE_REPLY);
+	if (reply == NULL)
+		GOTO(out_free, rc = -EPROTO);
+	reply->ourp_magic = UPDATE_REPLY_MAGIC;
+	reply->ourp_count = updates;
+	tti->tti_u.update.tti_update_reply = reply;
+	tti->tti_mult_trans = !req_is_replay(tgt_ses_req(tsi));
+
 	/* Walk through updates in the request to execute them */
 	for (i = 0; i < update_buf_count; i++) {
 		struct tgt_handler	*h;
@@ -1025,21 +1069,16 @@ int out_handle(struct tgt_session_info *tsi)
 		our = update_bufs[i];
 		update_count = our->ourq_count;
 		for (j = 0; j < update_count; j++) {
-			update = object_update_request_get(our, j, NULL);
-			if (update == NULL)
-				GOTO(out, rc = -EPROTO);
+			struct lu_object_conf conf;
 
-			if (ptlrpc_req_need_swab(pill->rc_req))
-				lustre_swab_object_update(update);
-
-			if (!fid_is_sane(&update->ou_fid)) {
-				CERROR("%s: invalid FID "DFID": rc = %d\n",
-				       tgt_name(tsi->tsi_tgt),
-				       PFID(&update->ou_fid), -EPROTO);
-				GOTO(out, rc = err_serious(-EPROTO));
-			}
+			update = object_update_request_get(our, j, NULL);
+			if (update->ou_type == OUT_CREATE)
+				conf.loc_flags = LOC_F_NEW;
+			else
+				conf.loc_flags = 0;
 
-			dt_obj = dt_locate(env, dt, &update->ou_fid);
+			dt_obj = dt_locate_at(env, dt, &update->ou_fid,
+				dt->dd_lu_dev.ld_site->ls_top_dev, &conf);
 			if (IS_ERR(dt_obj))
 				GOTO(out, rc = PTR_ERR(dt_obj));