Whamcloud - gitweb
LU-13508 mdc: chlg device could be used after free
[fs/lustre-release.git] / lustre / mdc / mdc_request.c
index 048c25a..82d1b5e 100644 (file)
 #include <linux/pagemap.h>
 #include <linux/user_namespace.h>
 #include <linux/utsname.h>
-#ifdef HAVE_UIDGID_HEADER
-# include <linux/uidgid.h>
-#endif
+#include <linux/delay.h>
+#include <linux/uidgid.h>
+#include <linux/device.h>
+#include <linux/xarray.h>
 
 #include <lustre_errno.h>
 
@@ -48,6 +49,7 @@
 #include <llog_swab.h>
 #include <lprocfs_status.h>
 #include <lustre_acl.h>
+#include <lustre_compat.h>
 #include <lustre_fid.h>
 #include <uapi/linux/lustre/lustre_ioctl.h>
 #include <lustre_kernelcomm.h>
@@ -239,8 +241,9 @@ again:
        rc = mdc_getattr_common(exp, req);
        if (rc) {
                if (rc == -ERANGE) {
-                       acl_bufsize = MIN(imp->imp_connect_data.ocd_max_easize,
-                                         XATTR_SIZE_MAX);
+                       acl_bufsize = min_t(__u32,
+                                           imp->imp_connect_data.ocd_max_easize,
+                                           XATTR_SIZE_MAX);
                        mdc_reset_acl_req(req);
                        goto again;
                }
@@ -294,8 +297,9 @@ again:
        rc = mdc_getattr_common(exp, req);
        if (rc) {
                if (rc == -ERANGE) {
-                       acl_bufsize = MIN(imp->imp_connect_data.ocd_max_easize,
-                                         XATTR_SIZE_MAX);
+                       acl_bufsize = min_t(__u32,
+                                           imp->imp_connect_data.ocd_max_easize,
+                                           XATTR_SIZE_MAX);
                        mdc_reset_acl_req(req);
                        goto again;
                }
@@ -348,7 +352,7 @@ static int mdc_xattr_common(struct obd_export *exp,const struct req_format *fmt,
        /* Flush local XATTR locks to get rid of a possible cancel RPC */
        if (opcode == MDS_REINT && fid_is_sane(fid) &&
            exp->exp_connect_data.ocd_ibits_known & MDS_INODELOCK_XATTR) {
-               struct list_head cancels = LIST_HEAD_INIT(cancels);
+               LIST_HEAD(cancels);
                int count;
 
                /* Without that packing would fail */
@@ -376,8 +380,8 @@ static int mdc_xattr_common(struct obd_export *exp,const struct req_format *fmt,
        if (opcode == MDS_REINT) {
                struct mdt_rec_setxattr *rec;
 
-               CLASSERT(sizeof(struct mdt_rec_setxattr) ==
-                        sizeof(struct mdt_rec_reint));
+               BUILD_BUG_ON(sizeof(struct mdt_rec_setxattr) !=
+                            sizeof(struct mdt_rec_reint));
                rec = req_capsule_client_get(&req->rq_pill, &RMF_REC_REINT);
                rec->sx_opcode = REINT_SETXATTR;
                rec->sx_fsuid  = from_kuid(&init_user_ns, current_fsuid());
@@ -412,12 +416,12 @@ static int mdc_xattr_common(struct obd_export *exp,const struct req_format *fmt,
 
         /* make rpc */
         if (opcode == MDS_REINT)
-               mdc_get_mod_rpc_slot(req, NULL);
+               ptlrpc_get_mod_rpc_slot(req);
 
         rc = ptlrpc_queue_wait(req);
 
        if (opcode == MDS_REINT)
-               mdc_put_mod_rpc_slot(req, NULL);
+               ptlrpc_put_mod_rpc_slot(req);
 
         if (rc)
                 ptlrpc_req_finished(req);
@@ -451,6 +455,7 @@ static int mdc_getxattr(struct obd_export *exp, const struct lu_fid *fid,
        LASSERT(obd_md_valid == OBD_MD_FLXATTR ||
                obd_md_valid == OBD_MD_FLXATTRLS);
 
+       /* The below message is checked in sanity-selinux.sh test_20d */
        CDEBUG(D_INFO, "%s: get xattr '%s' for "DFID"\n",
               exp->exp_obd->obd_name, name, PFID(fid));
        rc = mdc_xattr_common(exp, &RQF_MDS_GETXATTR, fid, MDS_GETXATTR,
@@ -500,7 +505,7 @@ out:
        return rc;
 }
 
-#ifdef CONFIG_FS_POSIX_ACL
+#ifdef CONFIG_LUSTRE_FS_POSIX_ACL
 static int mdc_unpack_acl(struct ptlrpc_request *req, struct lustre_md *md)
 {
         struct req_capsule     *pill = &req->rq_pill;
@@ -584,14 +589,14 @@ int mdc_get_lustre_md(struct obd_export *exp, struct ptlrpc_request *req,
                        GOTO(out, rc = -EPROTO);
                }
 
-               lmv_size = md->body->mbo_eadatasize;
-               if (lmv_size == 0) {
-                       CDEBUG(D_INFO, "OBD_MD_FLDIREA is set, "
-                              "but eadatasize 0\n");
-                       RETURN(-EPROTO);
-               }
-
                if (md->body->mbo_valid & OBD_MD_MEA) {
+                       lmv_size = md->body->mbo_eadatasize;
+                       if (lmv_size == 0) {
+                               CDEBUG(D_INFO, "OBD_MD_FLDIREA is set, "
+                                      "but eadatasize 0\n");
+                               RETURN(-EPROTO);
+                       }
+
                        lmv = req_capsule_server_sized_get(pill, &RMF_MDT_MD,
                                                           lmv_size);
                        if (lmv == NULL)
@@ -601,14 +606,43 @@ int mdc_get_lustre_md(struct obd_export *exp, struct ptlrpc_request *req,
                        if (rc < 0)
                                GOTO(out, rc);
 
-                       if (rc < (typeof(rc))sizeof(*md->lmv)) {
-                               CDEBUG(D_INFO, "size too small:  "
-                                      "rc < sizeof(*md->lmv) (%d < %d)\n",
-                                       rc, (int)sizeof(*md->lmv));
+                       if (rc < (int)sizeof(*md->lmv)) {
+                               struct lmv_foreign_md *lfm = md->lfm;
+
+                               /* short (< sizeof(struct lmv_stripe_md))
+                                * foreign LMV case
+                                */
+                               if (lfm->lfm_magic != LMV_MAGIC_FOREIGN) {
+                                       CDEBUG(D_INFO,
+                                              "lmv size too small: %d < %d\n",
+                                              rc, (int)sizeof(*md->lmv));
+                                       GOTO(out, rc = -EPROTO);
+                               }
+                       }
+               }
+
+               /* since 2.12.58 intent_getattr fetches default LMV */
+               if (md->body->mbo_valid & OBD_MD_DEFAULT_MEA) {
+                       lmv_size = sizeof(struct lmv_user_md);
+                       lmv = req_capsule_server_sized_get(pill,
+                                                          &RMF_DEFAULT_MDT_MD,
+                                                          lmv_size);
+                       if (!lmv)
+                               GOTO(out, rc = -EPROTO);
+
+                       rc = md_unpackmd(md_exp, &md->default_lmv, lmv,
+                                        lmv_size);
+                       if (rc < 0)
+                               GOTO(out, rc);
+
+                       if (rc < (int)sizeof(*md->default_lmv)) {
+                               CDEBUG(D_INFO,
+                                      "default lmv size too small: %d < %d\n",
+                                       rc, (int)sizeof(*md->default_lmv));
                                GOTO(out, rc = -EPROTO);
                        }
                }
-        }
+       }
         rc = 0;
 
        if (md->body->mbo_valid & OBD_MD_FLACL) {
@@ -620,7 +654,7 @@ int mdc_get_lustre_md(struct obd_export *exp, struct ptlrpc_request *req,
                         rc = mdc_unpack_acl(req, md);
                         if (rc)
                                 GOTO(out, rc);
-#ifdef CONFIG_FS_POSIX_ACL
+#ifdef CONFIG_LUSTRE_FS_POSIX_ACL
                 } else {
                         md->posix_acl = NULL;
 #endif
@@ -630,7 +664,7 @@ int mdc_get_lustre_md(struct obd_export *exp, struct ptlrpc_request *req,
         EXIT;
 out:
         if (rc) {
-#ifdef CONFIG_FS_POSIX_ACL
+#ifdef CONFIG_LUSTRE_FS_POSIX_ACL
                 posix_acl_release(md->posix_acl);
 #endif
         }
@@ -654,7 +688,7 @@ void mdc_replay_open(struct ptlrpc_request *req)
 
        if (mod == NULL) {
                DEBUG_REQ(D_ERROR, req,
-                         "Can't properly replay without open data.");
+                         "cannot properly replay without open data");
                EXIT;
                return;
        }
@@ -751,14 +785,14 @@ int mdc_set_open_replay_data(struct obd_export *exp,
         /* Outgoing messages always in my byte order. */
         LASSERT(body != NULL);
 
-        /* Only if the import is replayable, we set replay_open data */
-        if (och && imp->imp_replayable) {
-                mod = obd_mod_alloc();
-                if (mod == NULL) {
-                        DEBUG_REQ(D_ERROR, open_req,
-                                  "Can't allocate md_open_data");
-                        RETURN(0);
-                }
+       /* Only if the import is replayable, we set replay_open data */
+       if (och && imp->imp_replayable) {
+               mod = obd_mod_alloc();
+               if (mod == NULL) {
+                       DEBUG_REQ(D_ERROR, open_req,
+                                 "cannot allocate md_open_data");
+                       RETURN(0);
+               }
 
                 /**
                  * Take a reference on \var mod, to be freed on mdc_close().
@@ -810,8 +844,9 @@ static void mdc_free_open(struct md_open_data *mod)
         * The worst thing is eviction if the client gets open lock
         **/
 
-       DEBUG_REQ(D_RPCTRACE, mod->mod_open_req, "free open request rq_replay"
-                 "= %d\n", mod->mod_open_req->rq_replay);
+       DEBUG_REQ(D_RPCTRACE, mod->mod_open_req,
+                 "free open request, rq_replay=%d",
+                 mod->mod_open_req->rq_replay);
 
        ptlrpc_request_committed(mod->mod_open_req, committed);
        if (mod->mod_close_req)
@@ -901,7 +936,7 @@ static int mdc_close(struct obd_export *exp, struct md_op_data *op_data,
 
                mod->mod_close_req = req;
 
-               DEBUG_REQ(D_HA, mod->mod_open_req, "matched open");
+               DEBUG_REQ(D_RPCTRACE, mod->mod_open_req, "matched open");
                /* We no longer want to preserve this open for replay even
                 * though the open was committed. b=3632, b=3633 */
                spin_lock(&mod->mod_open_req->rq_lock);
@@ -948,41 +983,41 @@ static int mdc_close(struct obd_export *exp, struct md_op_data *op_data,
 
         ptlrpc_request_set_replen(req);
 
-       mdc_get_mod_rpc_slot(req, NULL);
+       ptlrpc_get_mod_rpc_slot(req);
        rc = ptlrpc_queue_wait(req);
-       mdc_put_mod_rpc_slot(req, NULL);
-
-        if (req->rq_repmsg == NULL) {
-                CDEBUG(D_RPCTRACE, "request failed to send: %p, %d\n", req,
-                       req->rq_status);
-                if (rc == 0)
-                        rc = req->rq_status ?: -EIO;
-        } else if (rc == 0 || rc == -EAGAIN) {
-                struct mdt_body *body;
-
-                rc = lustre_msg_get_status(req->rq_repmsg);
-                if (lustre_msg_get_type(req->rq_repmsg) == PTL_RPC_MSG_ERR) {
-                        DEBUG_REQ(D_ERROR, req, "type == PTL_RPC_MSG_ERR, err "
-                                  "= %d", rc);
-                        if (rc > 0)
-                                rc = -rc;
-                }
-                body = req_capsule_server_get(&req->rq_pill, &RMF_MDT_BODY);
-                if (body == NULL)
-                        rc = -EPROTO;
-        } else if (rc == -ESTALE) {
-                /**
-                 * it can be allowed error after 3633 if open was committed and
-                 * server failed before close was sent. Let's check if mod
-                 * exists and return no error in that case
-                 */
-                if (mod) {
-                        DEBUG_REQ(D_HA, req, "Reset ESTALE = %d", rc);
-                        LASSERT(mod->mod_open_req != NULL);
-                        if (mod->mod_open_req->rq_committed)
-                                rc = 0;
-                }
-        }
+       ptlrpc_put_mod_rpc_slot(req);
+
+       if (req->rq_repmsg == NULL) {
+               CDEBUG(D_RPCTRACE, "request %p failed to send: rc = %d\n", req,
+                      req->rq_status);
+               if (rc == 0)
+                       rc = req->rq_status ?: -EIO;
+       } else if (rc == 0 || rc == -EAGAIN) {
+               struct mdt_body *body;
+
+               rc = lustre_msg_get_status(req->rq_repmsg);
+               if (lustre_msg_get_type(req->rq_repmsg) == PTL_RPC_MSG_ERR) {
+                       DEBUG_REQ(D_ERROR, req,
+                                 "type = PTL_RPC_MSG_ERR: rc = %d", rc);
+                       if (rc > 0)
+                               rc = -rc;
+               }
+               body = req_capsule_server_get(&req->rq_pill, &RMF_MDT_BODY);
+               if (body == NULL)
+                       rc = -EPROTO;
+       } else if (rc == -ESTALE) {
+               /**
+                * it can be allowed error after 3633 if open was committed and
+                * server failed before close was sent. Let's check if mod
+                * exists and return no error in that case
+                */
+               if (mod) {
+                       DEBUG_REQ(D_HA, req, "Reset ESTALE = %d", rc);
+                       LASSERT(mod->mod_open_req != NULL);
+                       if (mod->mod_open_req->rq_committed)
+                               rc = 0;
+               }
+       }
 
 out:
         if (mod) {
@@ -1004,14 +1039,11 @@ static int mdc_getpage(struct obd_export *exp, const struct lu_fid *fid,
        struct ptlrpc_request   *req;
        struct ptlrpc_bulk_desc *desc;
        int                      i;
-       wait_queue_head_t        waitq;
        int                      resends = 0;
-       struct l_wait_info       lwi;
        int                      rc;
        ENTRY;
 
        *request = NULL;
-       init_waitqueue_head(&waitq);
 
 restart_bulk:
        req = ptlrpc_request_alloc(class_exp2cliimp(exp), &RQF_MDS_READPAGE);
@@ -1028,7 +1060,7 @@ restart_bulk:
        ptlrpc_at_set_req_timeout(req);
 
        desc = ptlrpc_prep_bulk_imp(req, npages, 1,
-                                   PTLRPC_BULK_PUT_SINK | PTLRPC_BULK_BUF_KIOV,
+                                   PTLRPC_BULK_PUT_SINK,
                                    MDS_BULK_PORTAL,
                                    &ptlrpc_bulk_kiov_pin_ops);
        if (desc == NULL) {
@@ -1056,9 +1088,12 @@ restart_bulk:
                               exp->exp_obd->obd_name, -EIO);
                        RETURN(-EIO);
                }
-               lwi = LWI_TIMEOUT_INTR(cfs_time_seconds(resends), NULL, NULL,
-                                      NULL);
-               l_wait_event(waitq, 0, &lwi);
+
+               /* If a signal interrupts then the timeout returned will
+                * not be zero. In that case return -EINTR
+                */
+               if (msleep_interruptible(resends * 1000))
+                       RETURN(-EINTR);
 
                goto restart_bulk;
        }
@@ -1087,7 +1122,7 @@ static void mdc_release_page(struct page *page, int remove)
        if (remove) {
                lock_page(page);
                if (likely(page->mapping != NULL))
-                       truncate_complete_page(page->mapping, page);
+                       delete_from_page_cache(page);
                unlock_page(page);
        }
        put_page(page);
@@ -1103,16 +1138,17 @@ static struct page *mdc_page_locate(struct address_space *mapping, __u64 *hash,
         */
        unsigned long offset = hash_x_index(*hash, hash64);
        struct page *page;
+       unsigned long flags;
        int found;
 
-       spin_lock_irq(&mapping->tree_lock);
+       ll_xa_lock_irqsave(&mapping->i_pages, flags);
        found = radix_tree_gang_lookup(&mapping->page_tree,
                                       (void **)&page, offset, 1);
-       if (found > 0 && !radix_tree_exceptional_entry(page)) {
+       if (found > 0 && !ll_xa_is_value(page)) {
                struct lu_dirpage *dp;
 
                get_page(page);
-               spin_unlock_irq(&mapping->tree_lock);
+               ll_xa_unlock_irqrestore(&mapping->i_pages, flags);
                /*
                 * In contrast to find_lock_page() we are sure that directory
                 * page cannot be truncated (while DLM lock is held) and,
@@ -1161,7 +1197,7 @@ static struct page *mdc_page_locate(struct address_space *mapping, __u64 *hash,
                        page = ERR_PTR(-EIO);
                }
        } else {
-               spin_unlock_irq(&mapping->tree_lock);
+               ll_xa_unlock_irqrestore(&mapping->i_pages, flags);
                page = NULL;
        }
        return page;
@@ -1223,12 +1259,12 @@ static void mdc_adjust_dirpages(struct page **pages, int cfs_pgs, int lu_pgs)
        int i;
 
        for (i = 0; i < cfs_pgs; i++) {
-               struct lu_dirpage       *dp = kmap(pages[i]);
-               struct lu_dirpage       *first = dp;
-               struct lu_dirent        *end_dirent = NULL;
-               struct lu_dirent        *ent;
-               __u64           hash_end = le64_to_cpu(dp->ldp_hash_end);
-               __u32           flags = le32_to_cpu(dp->ldp_flags);
+               struct lu_dirpage *dp = kmap(pages[i]);
+               struct lu_dirpage *first = dp;
+               struct lu_dirent *end_dirent = NULL;
+               struct lu_dirent *ent;
+               __u64 hash_end = dp->ldp_hash_end;
+               __u32 flags = dp->ldp_flags;
 
                while (--lu_pgs > 0) {
                        ent = lu_dirent_start(dp);
@@ -1243,8 +1279,8 @@ static void mdc_adjust_dirpages(struct page **pages, int cfs_pgs, int lu_pgs)
                                break;
 
                        /* Save the hash and flags of this lu_dirpage. */
-                       hash_end = le64_to_cpu(dp->ldp_hash_end);
-                       flags = le32_to_cpu(dp->ldp_flags);
+                       hash_end = dp->ldp_hash_end;
+                       flags = dp->ldp_flags;
 
                        /* Check if lu_dirpage contains no entries. */
                        if (end_dirent == NULL)
@@ -1279,14 +1315,6 @@ struct readpage_param {
        struct md_callback      *rp_cb;
 };
 
-#ifndef HAVE_DELETE_FROM_PAGE_CACHE
-static inline void delete_from_page_cache(struct page *page)
-{
-       remove_from_page_cache(page);
-       put_page(page);
-}
-#endif
-
 /**
  * Read pages from server.
  *
@@ -1319,7 +1347,7 @@ static int mdc_read_page_remote(void *data, struct page *page0)
        fid = &op_data->op_fid1;
        LASSERT(inode != NULL);
 
-       OBD_ALLOC(page_pool, sizeof(page_pool[0]) * max_pages);
+       OBD_ALLOC_PTR_ARRAY(page_pool, max_pages);
        if (page_pool != NULL) {
                page_pool[0] = page0;
        } else {
@@ -1328,8 +1356,7 @@ static int mdc_read_page_remote(void *data, struct page *page0)
        }
 
        for (npages = 1; npages < max_pages; npages++) {
-               page = __page_cache_alloc(mapping_gfp_mask(inode->i_mapping)
-                                         | __GFP_COLD);
+               page = page_cache_alloc(inode->i_mapping);
                if (page == NULL)
                        break;
                page_pool[npages] = page;
@@ -1389,7 +1416,7 @@ static int mdc_read_page_remote(void *data, struct page *page0)
        }
 
        if (page_pool != &page0)
-               OBD_FREE(page_pool, sizeof(page_pool[0]) * max_pages);
+               OBD_FREE_PTR_ARRAY(page_pool, max_pages);
 
        RETURN(rc);
 }
@@ -1542,6 +1569,53 @@ fail:
        goto out_unlock;
 }
 
+static int mdc_statfs_interpret(const struct lu_env *env,
+                               struct ptlrpc_request *req, void *args, int rc)
+{
+       struct obd_info *oinfo = args;
+       struct obd_statfs *osfs;
+
+       if (!rc) {
+               osfs = req_capsule_server_get(&req->rq_pill, &RMF_OBD_STATFS);
+               if (!osfs)
+                       return -EPROTO;
+
+               oinfo->oi_osfs = osfs;
+
+               CDEBUG(D_CACHE, "blocks=%llu free=%llu avail=%llu "
+                      "objects=%llu free=%llu state=%x\n",
+                       osfs->os_blocks, osfs->os_bfree, osfs->os_bavail,
+                       osfs->os_files, osfs->os_ffree, osfs->os_state);
+       }
+
+       oinfo->oi_cb_up(oinfo, rc);
+
+       return rc;
+}
+
+static int mdc_statfs_async(struct obd_export *exp,
+                           struct obd_info *oinfo, time64_t max_age,
+                           struct ptlrpc_request_set *unused)
+{
+       struct ptlrpc_request *req;
+       struct obd_info *aa;
+
+       req = ptlrpc_request_alloc_pack(class_exp2cliimp(exp), &RQF_MDS_STATFS,
+                                       LUSTRE_MDS_VERSION, MDS_STATFS);
+       if (req == NULL)
+               return -ENOMEM;
+
+       ptlrpc_request_set_replen(req);
+       req->rq_interpret_reply = mdc_statfs_interpret;
+
+       aa = ptlrpc_req_async_args(aa, req);
+       *aa = *oinfo;
+
+       ptlrpcd_add_req(req);
+
+       return 0;
+}
+
 static int mdc_statfs(const struct lu_env *env,
                       struct obd_export *exp, struct obd_statfs *osfs,
                      time64_t max_age, __u32 flags)
@@ -1690,9 +1764,9 @@ static int mdc_ioc_hsm_progress(struct obd_export *exp,
 
        ptlrpc_request_set_replen(req);
 
-       mdc_get_mod_rpc_slot(req, NULL);
+       ptlrpc_get_mod_rpc_slot(req);
        rc = ptlrpc_queue_wait(req);
-       mdc_put_mod_rpc_slot(req, NULL);
+       ptlrpc_put_mod_rpc_slot(req);
 
        GOTO(out, rc);
 out:
@@ -1748,6 +1822,7 @@ static int mdc_ioc_hsm_ct_register(struct obd_import *imp, __u32 archive_count,
                *archive_array = archive_count;
 
        ptlrpc_request_set_replen(req);
+       req->rq_no_resend = 1;
 
        rc = mdc_queue_wait(req);
        GOTO(out, rc);
@@ -1893,9 +1968,9 @@ static int mdc_ioc_hsm_state_set(struct obd_export *exp,
 
        ptlrpc_request_set_replen(req);
 
-       mdc_get_mod_rpc_slot(req, NULL);
+       ptlrpc_get_mod_rpc_slot(req);
        rc = ptlrpc_queue_wait(req);
-       mdc_put_mod_rpc_slot(req, NULL);
+       ptlrpc_put_mod_rpc_slot(req);
 
        GOTO(out, rc);
 out:
@@ -1953,9 +2028,9 @@ static int mdc_ioc_hsm_request(struct obd_export *exp,
 
        ptlrpc_request_set_replen(req);
 
-       mdc_get_mod_rpc_slot(req, NULL);
+       ptlrpc_get_mod_rpc_slot(req);
        rc = ptlrpc_queue_wait(req);
-       mdc_put_mod_rpc_slot(req, NULL);
+       ptlrpc_put_mod_rpc_slot(req);
 
        GOTO(out, rc);
 
@@ -1970,34 +2045,51 @@ static int mdc_ioc_hsm_ct_start(struct obd_export *exp,
 static int mdc_quotactl(struct obd_device *unused, struct obd_export *exp,
                         struct obd_quotactl *oqctl)
 {
-       struct ptlrpc_request   *req;
-       struct obd_quotactl     *oqc;
-       int                      rc;
+       struct ptlrpc_request *req;
+       struct obd_quotactl *oqc;
+       int rc;
        ENTRY;
 
-       req = ptlrpc_request_alloc_pack(class_exp2cliimp(exp),
-                                       &RQF_MDS_QUOTACTL, LUSTRE_MDS_VERSION,
-                                       MDS_QUOTACTL);
+       req = ptlrpc_request_alloc(class_exp2cliimp(exp), &RQF_MDS_QUOTACTL);
        if (req == NULL)
                RETURN(-ENOMEM);
 
+
+       if (LUSTRE_Q_CMD_IS_POOL(oqctl->qc_cmd))
+               req_capsule_set_size(&req->rq_pill,
+                                    &RMF_OBD_QUOTACTL,
+                                    RCL_CLIENT,
+                                    sizeof(*oqc) + LOV_MAXPOOLNAME + 1);
+
+       rc = ptlrpc_request_pack(req, LUSTRE_MDS_VERSION,
+                                MDS_QUOTACTL);
+       if (rc) {
+               ptlrpc_request_free(req);
+               RETURN(rc);
+       }
+
        oqc = req_capsule_client_get(&req->rq_pill, &RMF_OBD_QUOTACTL);
-       *oqc = *oqctl;
+       QCTL_COPY(oqc, oqctl);
 
        ptlrpc_request_set_replen(req);
        ptlrpc_at_set_req_timeout(req);
 
        rc = ptlrpc_queue_wait(req);
-       if (rc)
-               CERROR("ptlrpc_queue_wait failed, rc: %d\n", rc);
+       if (rc) {
+               CERROR("%s: ptlrpc_queue_wait failed: rc = %d\n",
+                      exp->exp_obd->obd_name, rc);
+               GOTO(out, rc);
+       }
 
        if (req->rq_repmsg &&
            (oqc = req_capsule_server_get(&req->rq_pill, &RMF_OBD_QUOTACTL))) {
-               *oqctl = *oqc;
+               QCTL_COPY(oqctl, oqc);
        } else if (!rc) {
-               CERROR ("Can't unpack obd_quotactl\n");
                rc = -EPROTO;
+               CERROR("%s: cannot unpack obd_quotactl: rc = %d\n",
+                       exp->exp_obd->obd_name, rc);
        }
+out:
        ptlrpc_req_finished(req);
 
        RETURN(rc);
@@ -2006,7 +2098,7 @@ static int mdc_quotactl(struct obd_device *unused, struct obd_export *exp,
 static int mdc_ioc_swap_layouts(struct obd_export *exp,
                                struct md_op_data *op_data)
 {
-       struct list_head cancels = LIST_HEAD_INIT(cancels);
+       LIST_HEAD(cancels);
        struct ptlrpc_request   *req;
        int                      rc, count;
        struct mdc_swap_layouts *msl, *payload;
@@ -2497,6 +2589,81 @@ static int mdc_fsync(struct obd_export *exp, const struct lu_fid *fid,
         RETURN(rc);
 }
 
+struct mdc_rmfid_args {
+       int *mra_rcs;
+       int mra_nr;
+};
+
+int mdc_rmfid_interpret(const struct lu_env *env, struct ptlrpc_request *req,
+                         void *args, int rc)
+{
+       struct mdc_rmfid_args *aa;
+       int *rcs, size;
+       ENTRY;
+
+       if (!rc) {
+               aa = ptlrpc_req_async_args(aa, req);
+
+               size = req_capsule_get_size(&req->rq_pill, &RMF_RCS,
+                                           RCL_SERVER);
+               LASSERT(size == sizeof(int) * aa->mra_nr);
+               rcs = req_capsule_server_get(&req->rq_pill, &RMF_RCS);
+               LASSERT(rcs);
+               LASSERT(aa->mra_rcs);
+               LASSERT(aa->mra_nr);
+               memcpy(aa->mra_rcs, rcs, size);
+       }
+
+       RETURN(rc);
+}
+
+static int mdc_rmfid(struct obd_export *exp, struct fid_array *fa,
+                    int *rcs, struct ptlrpc_request_set *set)
+{
+       struct ptlrpc_request *req;
+       struct mdc_rmfid_args *aa;
+       struct mdt_body *b;
+       struct lu_fid *tmp;
+       int rc, flen;
+       ENTRY;
+
+       req = ptlrpc_request_alloc(class_exp2cliimp(exp), &RQF_MDS_RMFID);
+       if (req == NULL)
+               RETURN(-ENOMEM);
+
+       flen = fa->fa_nr * sizeof(struct lu_fid);
+       req_capsule_set_size(&req->rq_pill, &RMF_FID_ARRAY,
+                            RCL_CLIENT, flen);
+       req_capsule_set_size(&req->rq_pill, &RMF_FID_ARRAY,
+                            RCL_SERVER, flen);
+       req_capsule_set_size(&req->rq_pill, &RMF_RCS,
+                            RCL_SERVER, fa->fa_nr * sizeof(__u32));
+       rc = ptlrpc_request_pack(req, LUSTRE_MDS_VERSION, MDS_RMFID);
+       if (rc) {
+               ptlrpc_request_free(req);
+               RETURN(rc);
+       }
+       tmp = req_capsule_client_get(&req->rq_pill, &RMF_FID_ARRAY);
+       memcpy(tmp, fa->fa_fids, flen);
+
+       mdc_pack_body(req, NULL, 0, 0, -1, 0);
+       b = req_capsule_client_get(&req->rq_pill, &RMF_MDT_BODY);
+       b->mbo_ctime = ktime_get_real_seconds();
+
+       ptlrpc_request_set_replen(req);
+
+       LASSERT(rcs);
+       aa = ptlrpc_req_async_args(aa, req);
+       aa->mra_rcs = rcs;
+       aa->mra_nr = fa->fa_nr;
+       req->rq_interpret_reply = mdc_rmfid_interpret;
+
+       ptlrpc_set_add_req(set, req);
+       ptlrpc_check_set(NULL, set);
+
+       RETURN(rc);
+}
+
 static int mdc_import_event(struct obd_device *obd, struct obd_import *imp,
                            enum obd_import_event event)
 {
@@ -2754,67 +2921,97 @@ static int mdc_cleanup(struct obd_device *obd)
        return osc_cleanup_common(obd);
 }
 
-static struct obd_ops mdc_obd_ops = {
-        .o_owner            = THIS_MODULE,
-        .o_setup            = mdc_setup,
-        .o_precleanup       = mdc_precleanup,
-        .o_cleanup          = mdc_cleanup,
-        .o_add_conn         = client_import_add_conn,
-        .o_del_conn         = client_import_del_conn,
-        .o_connect          = client_connect_import,
+static const struct obd_ops mdc_obd_ops = {
+       .o_owner            = THIS_MODULE,
+       .o_setup            = mdc_setup,
+       .o_precleanup       = mdc_precleanup,
+       .o_cleanup          = mdc_cleanup,
+       .o_add_conn         = client_import_add_conn,
+       .o_del_conn         = client_import_del_conn,
+       .o_connect          = client_connect_import,
        .o_reconnect        = osc_reconnect,
        .o_disconnect       = osc_disconnect,
-        .o_iocontrol        = mdc_iocontrol,
-        .o_set_info_async   = mdc_set_info_async,
-        .o_statfs           = mdc_statfs,
+       .o_iocontrol        = mdc_iocontrol,
+       .o_set_info_async   = mdc_set_info_async,
+       .o_statfs           = mdc_statfs,
+       .o_statfs_async     = mdc_statfs_async,
        .o_fid_init         = client_fid_init,
        .o_fid_fini         = client_fid_fini,
-        .o_fid_alloc        = mdc_fid_alloc,
-        .o_import_event     = mdc_import_event,
-        .o_get_info         = mdc_get_info,
-        .o_get_uuid         = mdc_get_uuid,
-        .o_quotactl         = mdc_quotactl,
+       .o_fid_alloc        = mdc_fid_alloc,
+       .o_import_event     = mdc_import_event,
+       .o_get_info         = mdc_get_info,
+       .o_get_uuid         = mdc_get_uuid,
+       .o_quotactl         = mdc_quotactl,
 };
 
-static struct md_ops mdc_md_ops = {
+static const struct md_ops mdc_md_ops = {
        .m_get_root         = mdc_get_root,
-        .m_null_inode      = mdc_null_inode,
-        .m_close            = mdc_close,
-        .m_create           = mdc_create,
-        .m_enqueue          = mdc_enqueue,
-        .m_getattr          = mdc_getattr,
-        .m_getattr_name     = mdc_getattr_name,
-        .m_intent_lock      = mdc_intent_lock,
-        .m_link             = mdc_link,
-        .m_rename           = mdc_rename,
-        .m_setattr          = mdc_setattr,
-        .m_setxattr         = mdc_setxattr,
-        .m_getxattr         = mdc_getxattr,
+       .m_null_inode       = mdc_null_inode,
+       .m_close            = mdc_close,
+       .m_create           = mdc_create,
+       .m_enqueue          = mdc_enqueue,
+       .m_getattr          = mdc_getattr,
+       .m_getattr_name     = mdc_getattr_name,
+       .m_intent_lock      = mdc_intent_lock,
+       .m_link             = mdc_link,
+       .m_rename           = mdc_rename,
+       .m_setattr          = mdc_setattr,
+       .m_setxattr         = mdc_setxattr,
+       .m_getxattr         = mdc_getxattr,
        .m_fsync                = mdc_fsync,
        .m_file_resync          = mdc_file_resync,
        .m_read_page            = mdc_read_page,
-        .m_unlink           = mdc_unlink,
-        .m_cancel_unused    = mdc_cancel_unused,
-        .m_init_ea_size     = mdc_init_ea_size,
-        .m_set_lock_data    = mdc_set_lock_data,
-        .m_lock_match       = mdc_lock_match,
-        .m_get_lustre_md    = mdc_get_lustre_md,
-        .m_free_lustre_md   = mdc_free_lustre_md,
-        .m_set_open_replay_data = mdc_set_open_replay_data,
-        .m_clear_open_replay_data = mdc_clear_open_replay_data,
-        .m_intent_getattr_async = mdc_intent_getattr_async,
-        .m_revalidate_lock      = mdc_revalidate_lock
+       .m_unlink           = mdc_unlink,
+       .m_cancel_unused    = mdc_cancel_unused,
+       .m_init_ea_size     = mdc_init_ea_size,
+       .m_set_lock_data    = mdc_set_lock_data,
+       .m_lock_match       = mdc_lock_match,
+       .m_get_lustre_md    = mdc_get_lustre_md,
+       .m_free_lustre_md   = mdc_free_lustre_md,
+       .m_set_open_replay_data = mdc_set_open_replay_data,
+       .m_clear_open_replay_data = mdc_clear_open_replay_data,
+       .m_intent_getattr_async = mdc_intent_getattr_async,
+       .m_revalidate_lock      = mdc_revalidate_lock,
+       .m_rmfid                = mdc_rmfid,
 };
 
+dev_t mdc_changelog_dev;
+struct class *mdc_changelog_class;
 static int __init mdc_init(void)
 {
-       return class_register_type(&mdc_obd_ops, &mdc_md_ops, true, NULL,
-                                  LUSTRE_MDC_NAME, &mdc_device_type);
+       int rc = 0;
+       rc = alloc_chrdev_region(&mdc_changelog_dev, 0,
+                                MDC_CHANGELOG_DEV_COUNT,
+                                MDC_CHANGELOG_DEV_NAME);
+       if (rc)
+               return rc;
+
+       mdc_changelog_class = class_create(THIS_MODULE, MDC_CHANGELOG_DEV_NAME);
+       if (IS_ERR(mdc_changelog_class)) {
+               rc = PTR_ERR(mdc_changelog_class);
+               goto out_dev;
+       }
+
+       rc = class_register_type(&mdc_obd_ops, &mdc_md_ops, true, NULL,
+                                LUSTRE_MDC_NAME, &mdc_device_type);
+       if (rc)
+               goto out_class;
+
+       return 0;
+
+out_class:
+       class_destroy(mdc_changelog_class);
+out_dev:
+       unregister_chrdev_region(mdc_changelog_dev, MDC_CHANGELOG_DEV_COUNT);
+       return rc;
 }
 
 static void __exit mdc_exit(void)
 {
-        class_unregister_type(LUSTRE_MDC_NAME);
+       class_unregister_type(LUSTRE_MDC_NAME);
+       class_destroy(mdc_changelog_class);
+       unregister_chrdev_region(mdc_changelog_dev, MDC_CHANGELOG_DEV_COUNT);
+       idr_destroy(&mdc_changelog_minor_idr);
 }
 
 MODULE_AUTHOR("OpenSFS, Inc. <http://www.lustre.org/>");