Whamcloud - gitweb
LU-3032 ptlrpc: race in pinger (use-after-free situation)
[fs/lustre-release.git] / lustre / ptlrpc / pinger.c
index f36e3e1..06dc234 100644 (file)
@@ -1,6 +1,4 @@
-/* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
- * vim:expandtab:shiftwidth=8:tabstop=8:
- *
+/*
  * GPL HEADER START
  *
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  * GPL HEADER END
  */
 /*
- * Copyright  2008 Sun Microsystems, Inc. All rights reserved
+ * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright (c) 2011, 2013, Intel Corporation.
  */
 /*
  * This file is part of Lustre, http://www.lustre.org/
 #include <obd_class.h>
 #include "ptlrpc_internal.h"
 
-struct semaphore pinger_sem;
+static int suppress_pings;
+CFS_MODULE_PARM(suppress_pings, "i", int, 0644, "Suppress pings");
+
+struct mutex pinger_mutex;
 static CFS_LIST_HEAD(pinger_imports);
-static struct list_head timeout_list = CFS_LIST_HEAD_INIT(timeout_list);
+static cfs_list_t timeout_list = CFS_LIST_HEAD_INIT(timeout_list);
+
+int ptlrpc_pinger_suppress_pings()
+{
+       return suppress_pings;
+}
+EXPORT_SYMBOL(ptlrpc_pinger_suppress_pings);
+
 struct ptlrpc_request *
 ptlrpc_prep_ping(struct obd_import *imp)
 {
@@ -100,15 +110,15 @@ int ptlrpc_ping(struct obd_import *imp)
 
         DEBUG_REQ(D_INFO, req, "pinging %s->%s",
                   imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd));
-        ptlrpcd_add_req(req, PSCOPE_OTHER);
+        ptlrpcd_add_req(req, PDL_POLICY_ROUND, -1);
 
         RETURN(0);
 }
 
-void ptlrpc_update_next_ping(struct obd_import *imp)
+void ptlrpc_update_next_ping(struct obd_import *imp, int soon)
 {
 #ifdef ENABLE_PINGER
-        int time = PING_INTERVAL;
+        int time = soon ? PING_INTERVAL_SHORT : PING_INTERVAL;
         if (imp->imp_state == LUSTRE_IMP_DISCON) {
                 int dtime = max_t(int, CONNECTION_SWITCH_MIN,
                                   AT_OFF ? 0 :
@@ -138,7 +148,7 @@ static inline int ptlrpc_next_reconnect(struct obd_import *imp)
                 return cfs_time_shift(obd_timeout);
 }
 
-static atomic_t suspend_timeouts = ATOMIC_INIT(0);
+static cfs_atomic_t suspend_timeouts = CFS_ATOMIC_INIT(0);
 static cfs_time_t suspend_wakeup_time = 0;
 
 cfs_duration_t pinger_check_timeout(cfs_time_t time)
@@ -147,22 +157,20 @@ cfs_duration_t pinger_check_timeout(cfs_time_t time)
         cfs_time_t timeout = PING_INTERVAL;
 
         /* The timeout list is a increase order sorted list */
-        mutex_down(&pinger_sem);
-        list_for_each_entry(item, &timeout_list, ti_chain) {
+       mutex_lock(&pinger_mutex);
+        cfs_list_for_each_entry(item, &timeout_list, ti_chain) {
                 int ti_timeout = item->ti_timeout;
                 if (timeout > ti_timeout)
                         timeout = ti_timeout;
                 break;
         }
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
 
         return cfs_time_sub(cfs_time_add(time, cfs_time_seconds(timeout)),
                                          cfs_time_current());
 }
 
-#ifdef __KERNEL__
-static wait_queue_head_t suspend_timeouts_waitq;
-#endif
+static cfs_waitq_t suspend_timeouts_waitq;
 
 cfs_time_t ptlrpc_suspend_wakeup_time(void)
 {
@@ -176,8 +184,9 @@ void ptlrpc_deactivate_timeouts(struct obd_import *imp)
         if (imp->imp_no_timeout)
                 return;
         imp->imp_no_timeout = 1;
-        atomic_inc(&suspend_timeouts);
-        CDEBUG(D_HA|D_WARNING, "deactivate timeouts %u\n", atomic_read(&suspend_timeouts));
+        cfs_atomic_inc(&suspend_timeouts);
+        CDEBUG(D_HA|D_WARNING, "deactivate timeouts %u\n",
+               cfs_atomic_read(&suspend_timeouts));
 #endif
 }
 
@@ -188,18 +197,19 @@ void ptlrpc_activate_timeouts(struct obd_import *imp)
         if (!imp->imp_no_timeout)
                 return;
         imp->imp_no_timeout = 0;
-        LASSERT(atomic_read(&suspend_timeouts) > 0);
-        if (atomic_dec_and_test(&suspend_timeouts)) {
+        LASSERT(cfs_atomic_read(&suspend_timeouts) > 0);
+        if (cfs_atomic_dec_and_test(&suspend_timeouts)) {
                 suspend_wakeup_time = cfs_time_current();
-                wake_up(&suspend_timeouts_waitq);
+                cfs_waitq_signal(&suspend_timeouts_waitq);
         }
-        CDEBUG(D_HA|D_WARNING, "activate timeouts %u\n", atomic_read(&suspend_timeouts));
+        CDEBUG(D_HA|D_WARNING, "activate timeouts %u\n",
+               cfs_atomic_read(&suspend_timeouts));
 #endif
 }
 
 int ptlrpc_check_suspend(void)
 {
-        if (atomic_read(&suspend_timeouts))
+        if (cfs_atomic_read(&suspend_timeouts))
                 return 1;
         return 0;
 }
@@ -208,12 +218,12 @@ int ptlrpc_check_and_wait_suspend(struct ptlrpc_request *req)
 {
         struct l_wait_info lwi;
 
-        if (atomic_read(&suspend_timeouts)) {
+        if (cfs_atomic_read(&suspend_timeouts)) {
                 DEBUG_REQ(D_NET, req, "-- suspend %d regular timeout",
-                          atomic_read(&suspend_timeouts));
+                          cfs_atomic_read(&suspend_timeouts));
                 lwi = LWI_INTR(NULL, NULL);
                 l_wait_event(suspend_timeouts_waitq,
-                             atomic_read(&suspend_timeouts) == 0, &lwi);
+                             cfs_atomic_read(&suspend_timeouts) == 0, &lwi);
                 DEBUG_REQ(D_NET, req, "-- recharge regular timeout");
                 return 1;
         }
@@ -222,53 +232,84 @@ int ptlrpc_check_and_wait_suspend(struct ptlrpc_request *req)
 
 #ifdef __KERNEL__
 
+static bool ir_up;
+
+void ptlrpc_pinger_ir_up(void)
+{
+       CDEBUG(D_HA, "IR up\n");
+       ir_up = true;
+}
+EXPORT_SYMBOL(ptlrpc_pinger_ir_up);
+
+void ptlrpc_pinger_ir_down(void)
+{
+       CDEBUG(D_HA, "IR down\n");
+       ir_up = false;
+}
+EXPORT_SYMBOL(ptlrpc_pinger_ir_down);
+
 static void ptlrpc_pinger_process_import(struct obd_import *imp,
                                          unsigned long this_ping)
 {
-        int force, level;
+       int level;
+       int force;
+       int force_next;
+       int suppress;
 
-        spin_lock(&imp->imp_lock);
-        level = imp->imp_state;
-        force = imp->imp_force_verify;
-        if (force)
-                imp->imp_force_verify = 0;
-        spin_unlock(&imp->imp_lock);
+       spin_lock(&imp->imp_lock);
 
-        CDEBUG(level == LUSTRE_IMP_FULL ? D_INFO : D_HA,
-               "level %s/%u force %u deactive %u pingable %u\n",
-               ptlrpc_import_state_name(level), level,
-               force, imp->imp_deactive, imp->imp_pingable);
+       level = imp->imp_state;
+       force = imp->imp_force_verify;
+       force_next = imp->imp_force_next_verify;
+       /*
+        * This will be used below only if the import is "FULL".
+        */
+       suppress = ir_up && OCD_HAS_FLAG(&imp->imp_connect_data, PINGLESS);
 
-        if (cfs_time_aftereq(imp->imp_next_ping - 5 * CFS_TICK,
-                             this_ping) && force == 0)
-                return;
+       imp->imp_force_verify = 0;
+
+       if (cfs_time_aftereq(imp->imp_next_ping - 5 * CFS_TICK, this_ping) &&
+           !force) {
+               spin_unlock(&imp->imp_lock);
+               return;
+       }
+
+       imp->imp_force_next_verify = 0;
+
+       spin_unlock(&imp->imp_lock);
+
+       CDEBUG(level == LUSTRE_IMP_FULL ? D_INFO : D_HA, "%s->%s: level %s/%u "
+              "force %u force_next %u deactive %u pingable %u suppress %u\n",
+              imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd),
+              ptlrpc_import_state_name(level), level, force, force_next,
+              imp->imp_deactive, imp->imp_pingable, suppress);
 
         if (level == LUSTRE_IMP_DISCON && !imp_is_deactive(imp)) {
-                /* wait at least a timeout before trying recovery again */
+                /* wait for a while before trying recovery again */
                 imp->imp_next_ping = ptlrpc_next_reconnect(imp);
-                ptlrpc_initiate_recovery(imp);
+                if (!imp->imp_no_pinger_recover)
+                        ptlrpc_initiate_recovery(imp);
         } else if (level != LUSTRE_IMP_FULL ||
                    imp->imp_obd->obd_no_recov ||
                    imp_is_deactive(imp)) {
-                CDEBUG(D_HA, "not pinging %s (in recovery "
-                       " or recovery disabled: %s)\n",
-                       obd2cli_tgt(imp->imp_obd),
-                       ptlrpc_import_state_name(level));
-        } else if (imp->imp_pingable || force) {
-                ptlrpc_ping(imp);
-        }
+               CDEBUG(D_HA, "%s->%s: not pinging (in recovery "
+                      "or recovery disabled: %s)\n",
+                      imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd),
+                      ptlrpc_import_state_name(level));
+       } else if ((imp->imp_pingable && !suppress) || force_next || force) {
+               ptlrpc_ping(imp);
+       }
 }
 
 static int ptlrpc_pinger_main(void *arg)
 {
-        struct ptlrpc_svc_data *data = (struct ptlrpc_svc_data *)arg;
-        struct ptlrpc_thread *thread = data->thread;
-        ENTRY;
+        struct ptlrpc_thread *thread = (struct ptlrpc_thread *)arg;
+       ENTRY;
 
-        cfs_daemonize(data->name);
+        cfs_daemonize(thread->t_name);
 
         /* Record that the thread is running */
-        thread->t_flags = SVC_RUNNING;
+        thread_set_flags(thread, SVC_RUNNING);
         cfs_waitq_signal(&thread->t_ctl_waitq);
 
         /* And now, loop forever, pinging as needed. */
@@ -277,16 +318,16 @@ static int ptlrpc_pinger_main(void *arg)
                 struct l_wait_info lwi;
                 cfs_duration_t time_to_next_wake;
                 struct timeout_item *item;
-                struct list_head *iter;
+                cfs_list_t *iter;
 
-                mutex_down(&pinger_sem);
-                list_for_each_entry(item, &timeout_list, ti_chain) {
+               mutex_lock(&pinger_mutex);
+                cfs_list_for_each_entry(item, &timeout_list, ti_chain) {
                         item->ti_cb(item, item->ti_cb_data);
                 }
-                list_for_each(iter, &pinger_imports) {
+                cfs_list_for_each(iter, &pinger_imports) {
                         struct obd_import *imp =
-                                list_entry(iter, struct obd_import,
-                                           imp_pinger_chain);
+                                cfs_list_entry(iter, struct obd_import,
+                                               imp_pinger_chain);
 
                         ptlrpc_pinger_process_import(imp, this_ping);
                         /* obd_timeout might have changed */
@@ -294,9 +335,9 @@ static int ptlrpc_pinger_main(void *arg)
                             cfs_time_after(imp->imp_next_ping,
                                            cfs_time_add(this_ping,
                                                         cfs_time_seconds(PING_INTERVAL))))
-                                ptlrpc_update_next_ping(imp);
+                                ptlrpc_update_next_ping(imp, 0);
                 }
-                mutex_up(&pinger_sem);
+               mutex_unlock(&pinger_mutex);
                 /* update memory usage info */
                 obd_update_maxusage();
 
@@ -308,143 +349,161 @@ static int ptlrpc_pinger_main(void *arg)
                    next ping time to next_ping + .01 sec, which means
                    we will SKIP the next ping at next_ping, and the
                    ping will get sent 2 timeouts from now!  Beware. */
-                CDEBUG(D_INFO, "next wakeup in "CFS_DURATION_T" ("CFS_TIME_T")\n",
-                                time_to_next_wake,
-                                cfs_time_add(this_ping, cfs_time_seconds(PING_INTERVAL)));
+                CDEBUG(D_INFO, "next wakeup in "CFS_DURATION_T" ("
+                       CFS_TIME_T")\n", time_to_next_wake,
+                       cfs_time_add(this_ping,cfs_time_seconds(PING_INTERVAL)));
                 if (time_to_next_wake > 0) {
-                        lwi = LWI_TIMEOUT(max_t(cfs_duration_t, time_to_next_wake, cfs_time_seconds(1)),
-                                            NULL, NULL);
+                        lwi = LWI_TIMEOUT(max_t(cfs_duration_t,
+                                                time_to_next_wake,
+                                                cfs_time_seconds(1)),
+                                          NULL, NULL);
                         l_wait_event(thread->t_ctl_waitq,
-                                     thread->t_flags & (SVC_STOPPING|SVC_EVENT),
+                                     thread_is_stopping(thread) ||
+                                     thread_is_event(thread),
                                      &lwi);
-                        if (thread->t_flags & SVC_STOPPING) {
-                                thread->t_flags &= ~SVC_STOPPING;
+                        if (thread_test_and_clear_flags(thread, SVC_STOPPING)) {
                                 EXIT;
                                 break;
-                        } else if (thread->t_flags & SVC_EVENT) {
+                        } else {
                                 /* woken after adding import to reset timer */
-                                thread->t_flags &= ~SVC_EVENT;
+                                thread_test_and_clear_flags(thread, SVC_EVENT);
                         }
                 }
         }
 
-        thread->t_flags = SVC_STOPPED;
+        thread_set_flags(thread, SVC_STOPPED);
         cfs_waitq_signal(&thread->t_ctl_waitq);
 
         CDEBUG(D_NET, "pinger thread exiting, process %d\n", cfs_curproc_pid());
         return 0;
 }
 
-static struct ptlrpc_thread *pinger_thread = NULL;
+static struct ptlrpc_thread pinger_thread;
 
 int ptlrpc_start_pinger(void)
 {
-        struct l_wait_info lwi = { 0 };
-        struct ptlrpc_svc_data d;
-        int rc;
+       struct l_wait_info lwi = { 0 };
+       int rc;
 #ifndef ENABLE_PINGER
-        return 0;
+       return 0;
 #endif
-        ENTRY;
-
-        if (pinger_thread != NULL)
-                RETURN(-EALREADY);
-
-        OBD_ALLOC_PTR(pinger_thread);
-        if (pinger_thread == NULL)
-                RETURN(-ENOMEM);
-        cfs_waitq_init(&pinger_thread->t_ctl_waitq);
-        cfs_waitq_init(&suspend_timeouts_waitq);
-
-        d.name = "ll_ping";
-        d.thread = pinger_thread;
-
-        /* CLONE_VM and CLONE_FILES just avoid a needless copy, because we
-         * just drop the VM and FILES in cfs_daemonize_ctxt() right away. */
-        rc = cfs_kernel_thread(ptlrpc_pinger_main, &d, CLONE_VM | CLONE_FILES);
-        if (rc < 0) {
-                CERROR("cannot start thread: %d\n", rc);
-                OBD_FREE(pinger_thread, sizeof(*pinger_thread));
-                pinger_thread = NULL;
-                RETURN(rc);
-        }
-        l_wait_event(pinger_thread->t_ctl_waitq,
-                     pinger_thread->t_flags & SVC_RUNNING, &lwi);
-
-        RETURN(0);
+       ENTRY;
+
+       if (!thread_is_init(&pinger_thread) &&
+           !thread_is_stopped(&pinger_thread))
+               RETURN(-EALREADY);
+
+       cfs_waitq_init(&pinger_thread.t_ctl_waitq);
+       cfs_waitq_init(&suspend_timeouts_waitq);
+
+       strcpy(pinger_thread.t_name, "ll_ping");
+
+       /* CLONE_VM and CLONE_FILES just avoid a needless copy, because we
+        * just drop the VM and FILES in cfs_daemonize_ctxt() right away. */
+       rc = cfs_create_thread(ptlrpc_pinger_main,
+                              &pinger_thread, CFS_DAEMON_FLAGS);
+       if (rc < 0) {
+               CERROR("cannot start thread: %d\n", rc);
+               RETURN(rc);
+       }
+       l_wait_event(pinger_thread.t_ctl_waitq,
+                    thread_is_running(&pinger_thread), &lwi);
+
+       if (suppress_pings)
+               CWARN("Pings will be suppressed at the request of the "
+                     "administrator.  The configuration shall meet the "
+                     "additional requirements described in the manual.  "
+                     "(Search for the \"suppress_pings\" kernel module "
+                     "parameter.)\n");
+
+       RETURN(0);
 }
 
 int ptlrpc_pinger_remove_timeouts(void);
 
 int ptlrpc_stop_pinger(void)
 {
-        struct l_wait_info lwi = { 0 };
-        int rc = 0;
+       struct l_wait_info lwi = { 0 };
 #ifndef ENABLE_PINGER
-        return 0;
+       return 0;
 #endif
-        ENTRY;
+       ENTRY;
 
-        if (pinger_thread == NULL)
-                RETURN(-EALREADY);
+       if (thread_is_init(&pinger_thread) ||
+           thread_is_stopped(&pinger_thread))
+               RETURN(-EALREADY);
 
-        ptlrpc_pinger_remove_timeouts();
-        mutex_down(&pinger_sem);
-        pinger_thread->t_flags = SVC_STOPPING;
-        cfs_waitq_signal(&pinger_thread->t_ctl_waitq);
-        mutex_up(&pinger_sem);
+       ptlrpc_pinger_remove_timeouts();
 
-        l_wait_event(pinger_thread->t_ctl_waitq,
-                     (pinger_thread->t_flags & SVC_STOPPED), &lwi);
+       thread_set_flags(&pinger_thread, SVC_STOPPING);
+       cfs_waitq_signal(&pinger_thread.t_ctl_waitq);
 
-        OBD_FREE_PTR(pinger_thread);
-        pinger_thread = NULL;
-        RETURN(rc);
+       l_wait_event(pinger_thread.t_ctl_waitq,
+                    thread_is_stopped(&pinger_thread), &lwi);
+       RETURN(0);
 }
 
 void ptlrpc_pinger_sending_on_import(struct obd_import *imp)
 {
-        ptlrpc_update_next_ping(imp);
+        ptlrpc_update_next_ping(imp, 0);
+}
+EXPORT_SYMBOL(ptlrpc_pinger_sending_on_import);
+
+void ptlrpc_pinger_commit_expected(struct obd_import *imp)
+{
+       ptlrpc_update_next_ping(imp, 1);
+       LASSERT_SPIN_LOCKED(&imp->imp_lock);
+       /*
+        * Avoid reading stale imp_connect_data.  When not sure if pings are
+        * expected or not on next connection, we assume they are not and force
+        * one anyway to guarantee the chance of updating
+        * imp_peer_committed_transno.
+        */
+       if (imp->imp_state != LUSTRE_IMP_FULL ||
+           OCD_HAS_FLAG(&imp->imp_connect_data, PINGLESS))
+               imp->imp_force_next_verify = 1;
 }
 
 int ptlrpc_pinger_add_import(struct obd_import *imp)
 {
         ENTRY;
-        if (!list_empty(&imp->imp_pinger_chain))
+        if (!cfs_list_empty(&imp->imp_pinger_chain))
                 RETURN(-EALREADY);
 
-        mutex_down(&pinger_sem);
+       mutex_lock(&pinger_mutex);
         CDEBUG(D_HA, "adding pingable import %s->%s\n",
                imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd));
         /* if we add to pinger we want recovery on this import */
         imp->imp_obd->obd_no_recov = 0;
-        ptlrpc_update_next_ping(imp);
+        ptlrpc_update_next_ping(imp, 0);
         /* XXX sort, blah blah */
-        list_add_tail(&imp->imp_pinger_chain, &pinger_imports);
+        cfs_list_add_tail(&imp->imp_pinger_chain, &pinger_imports);
         class_import_get(imp);
 
         ptlrpc_pinger_wake_up();
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
 
         RETURN(0);
 }
+EXPORT_SYMBOL(ptlrpc_pinger_add_import);
 
 int ptlrpc_pinger_del_import(struct obd_import *imp)
 {
         ENTRY;
-        if (list_empty(&imp->imp_pinger_chain))
+        if (cfs_list_empty(&imp->imp_pinger_chain))
                 RETURN(-ENOENT);
 
-        mutex_down(&pinger_sem);
-        list_del_init(&imp->imp_pinger_chain);
+       mutex_lock(&pinger_mutex);
+        cfs_list_del_init(&imp->imp_pinger_chain);
         CDEBUG(D_HA, "removing pingable import %s->%s\n",
                imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd));
         /* if we remove from pinger we don't want recovery on this import */
         imp->imp_obd->obd_no_recov = 1;
         class_import_put(imp);
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
         RETURN(0);
 }
+EXPORT_SYMBOL(ptlrpc_pinger_del_import);
 
 /**
  * Register a timeout callback to the pinger list, and the callback will
@@ -479,21 +538,21 @@ ptlrpc_pinger_register_timeout(int time, enum timeout_event event,
 {
         struct timeout_item *item, *tmp;
 
-        LASSERT_SEM_LOCKED(&pinger_sem);
+        LASSERT_MUTEX_LOCKED(&pinger_mutex);
 
-        list_for_each_entry(item, &timeout_list, ti_chain)
+        cfs_list_for_each_entry(item, &timeout_list, ti_chain)
                 if (item->ti_event == event)
                         goto out;
 
         item = ptlrpc_new_timeout(time, event, cb, data);
         if (item) {
-                list_for_each_entry_reverse(tmp, &timeout_list, ti_chain) {
+                cfs_list_for_each_entry_reverse(tmp, &timeout_list, ti_chain) {
                         if (tmp->ti_timeout < time) {
-                                list_add(&item->ti_chain, &tmp->ti_chain);
+                                cfs_list_add(&item->ti_chain, &tmp->ti_chain);
                                 goto out;
                         }
                 }
-                list_add(&item->ti_chain, &timeout_list);
+                cfs_list_add(&item->ti_chain, &timeout_list);
         }
 out:
         return item;
@@ -504,68 +563,70 @@ out:
  */
 int ptlrpc_add_timeout_client(int time, enum timeout_event event,
                               timeout_cb_t cb, void *data,
-                              struct list_head *obd_list)
+                              cfs_list_t *obd_list)
 {
         struct timeout_item *ti;
 
-        mutex_down(&pinger_sem);
+       mutex_lock(&pinger_mutex);
         ti = ptlrpc_pinger_register_timeout(time, event, cb, data);
         if (!ti) {
-                mutex_up(&pinger_sem);
+               mutex_unlock(&pinger_mutex);
                 return (-EINVAL);
         }
-        list_add(obd_list, &ti->ti_obd_list);
-        mutex_up(&pinger_sem);
+        cfs_list_add(obd_list, &ti->ti_obd_list);
+       mutex_unlock(&pinger_mutex);
         return 0;
 }
+EXPORT_SYMBOL(ptlrpc_add_timeout_client);
 
-int ptlrpc_del_timeout_client(struct list_head *obd_list,
+int ptlrpc_del_timeout_client(cfs_list_t *obd_list,
                               enum timeout_event event)
 {
         struct timeout_item *ti = NULL, *item;
 
-        if (list_empty(obd_list))
+        if (cfs_list_empty(obd_list))
                 return 0;
-        mutex_down(&pinger_sem);
-        list_del_init(obd_list);
+       mutex_lock(&pinger_mutex);
+        cfs_list_del_init(obd_list);
         /**
          * If there are no obd attached to the timeout event
          * list, remove this timeout event from the pinger
          */
-        list_for_each_entry(item, &timeout_list, ti_chain) {
+        cfs_list_for_each_entry(item, &timeout_list, ti_chain) {
                 if (item->ti_event == event) {
                         ti = item;
                         break;
                 }
         }
         LASSERTF(ti != NULL, "ti is NULL ! \n");
-        if (list_empty(&ti->ti_obd_list)) {
-                list_del(&ti->ti_chain);
+        if (cfs_list_empty(&ti->ti_obd_list)) {
+                cfs_list_del(&ti->ti_chain);
                 OBD_FREE_PTR(ti);
         }
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
         return 0;
 }
+EXPORT_SYMBOL(ptlrpc_del_timeout_client);
 
 int ptlrpc_pinger_remove_timeouts(void)
 {
         struct timeout_item *item, *tmp;
 
-        mutex_down(&pinger_sem);
-        list_for_each_entry_safe(item, tmp, &timeout_list, ti_chain) {
-                LASSERT(list_empty(&item->ti_obd_list));
-                list_del(&item->ti_chain);
+       mutex_lock(&pinger_mutex);
+        cfs_list_for_each_entry_safe(item, tmp, &timeout_list, ti_chain) {
+                LASSERT(cfs_list_empty(&item->ti_obd_list));
+                cfs_list_del(&item->ti_chain);
                 OBD_FREE_PTR(item);
         }
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
         return 0;
 }
 
 void ptlrpc_pinger_wake_up()
 {
 #ifdef ENABLE_PINGER
-        pinger_thread->t_flags |= SVC_EVENT;
-        cfs_waitq_signal(&pinger_thread->t_ctl_waitq);
+       thread_add_flags(&pinger_thread, SVC_EVENT);
+       cfs_waitq_signal(&pinger_thread.t_ctl_waitq);
 #endif
 }
 
@@ -575,28 +636,30 @@ void ptlrpc_pinger_wake_up()
 
 static int               pet_refcount = 0;
 static int               pet_state;
-static wait_queue_head_t pet_waitq;
-static struct obd_export *pet_exp = NULL;
-static spinlock_t        pet_lock = SPIN_LOCK_UNLOCKED;
+static cfs_waitq_t       pet_waitq;
+CFS_LIST_HEAD(pet_list);
+static DEFINE_SPINLOCK(pet_lock);
 
 int ping_evictor_wake(struct obd_export *exp)
 {
-        spin_lock(&pet_lock);
-        if (pet_exp || (pet_state != PET_READY)) {
-                /* eventually the new obd will call here again. */
-                spin_unlock(&pet_lock);
-                return 1;
-        }
-
-        /* We have to make sure the obd isn't destroyed between now and when
-         * the ping evictor runs.  We'll take a reference here, and drop it
-         * when we finish in the evictor.  We don't really care about this
-         * export in particular; we just need one to keep the obd alive. */
-        pet_exp = class_export_get(exp);
-        spin_unlock(&pet_lock);
-
-        wake_up(&pet_waitq);
-        return 0;
+       struct obd_device *obd;
+
+       spin_lock(&pet_lock);
+       if (pet_state != PET_READY) {
+               /* eventually the new obd will call here again. */
+               spin_unlock(&pet_lock);
+               return 1;
+       }
+
+       obd = class_exp2obd(exp);
+       if (cfs_list_empty(&obd->obd_evict_list)) {
+               class_incref(obd, "evictor", obd);
+               cfs_list_add(&obd->obd_evict_list, &pet_list);
+       }
+       spin_unlock(&pet_lock);
+
+       cfs_waitq_signal(&pet_waitq);
+       return 0;
 }
 
 static int ping_evictor_main(void *arg)
@@ -610,20 +673,22 @@ static int ping_evictor_main(void *arg)
         cfs_daemonize_ctxt("ll_evictor");
 
         CDEBUG(D_HA, "Starting Ping Evictor\n");
-        pet_exp = NULL;
         pet_state = PET_READY;
         while (1) {
-                l_wait_event(pet_waitq, pet_exp ||
+                l_wait_event(pet_waitq, (!cfs_list_empty(&pet_list)) ||
                              (pet_state == PET_TERMINATE), &lwi);
-                if (pet_state == PET_TERMINATE)
+
+                /* loop until all obd's will be removed */
+                if ((pet_state == PET_TERMINATE) && cfs_list_empty(&pet_list))
                         break;
 
                 /* we only get here if pet_exp != NULL, and the end of this
                  * loop is the only place which sets it NULL again, so lock
                  * is not strictly necessary. */
-                spin_lock(&pet_lock);
-                obd = pet_exp->exp_obd;
-                spin_unlock(&pet_lock);
+               spin_lock(&pet_lock);
+               obd = cfs_list_entry(pet_list.next, struct obd_device,
+                                    obd_evict_list);
+               spin_unlock(&pet_lock);
 
                 expire_time = cfs_time_current_sec() - PING_EVICT_TIMEOUT;
 
@@ -634,14 +699,15 @@ static int ping_evictor_main(void *arg)
                  * the obd lock (class_unlink_export), which means we can't
                  * lose the last ref on the export.  If they've already been
                  * removed from the list, we won't find them here. */
-                spin_lock(&obd->obd_dev_lock);
-                while (!list_empty(&obd->obd_exports_timed)) {
-                        exp = list_entry(obd->obd_exports_timed.next,
-                                         struct obd_export,exp_obd_chain_timed);
-                        if (expire_time > exp->exp_last_request_time) {
-                                class_export_get(exp);
-                                spin_unlock(&obd->obd_dev_lock);
-                                 LCONSOLE_WARN("%s: haven't heard from client %s"
+               spin_lock(&obd->obd_dev_lock);
+               while (!cfs_list_empty(&obd->obd_exports_timed)) {
+                       exp = cfs_list_entry(obd->obd_exports_timed.next,
+                                            struct obd_export,
+                                            exp_obd_chain_timed);
+                       if (expire_time > exp->exp_last_request_time) {
+                               class_export_get(exp);
+                               spin_unlock(&obd->obd_dev_lock);
+                               LCONSOLE_WARN("%s: haven't heard from client %s"
                                               " (at %s) in %ld seconds. I think"
                                               " it's dead, and I am evicting"
                                               " it. exp %p, cur %ld expire %ld"
@@ -658,19 +724,19 @@ static int ping_evictor_main(void *arg)
                                        exp->exp_last_request_time);
                                 class_fail_export(exp);
                                 class_export_put(exp);
-                                spin_lock(&obd->obd_dev_lock);
-                        } else {
-                                /* List is sorted, so everyone below is ok */
-                                break;
-                        }
-                }
-                spin_unlock(&obd->obd_dev_lock);
-
-                class_export_put(pet_exp);
-
-                spin_lock(&pet_lock);
-                pet_exp = NULL;
-                spin_unlock(&pet_lock);
+                               spin_lock(&obd->obd_dev_lock);
+                       } else {
+                               /* List is sorted, so everyone below is ok */
+                               break;
+                       }
+               }
+               spin_unlock(&obd->obd_dev_lock);
+
+               spin_lock(&pet_lock);
+               cfs_list_del_init(&obd->obd_evict_list);
+               spin_unlock(&pet_lock);
+
+                class_decref(obd, "evictor", obd);
         }
         CDEBUG(D_HA, "Exiting Ping Evictor\n");
 
@@ -684,9 +750,9 @@ void ping_evictor_start(void)
         if (++pet_refcount > 1)
                 return;
 
-        init_waitqueue_head(&pet_waitq);
+        cfs_waitq_init(&pet_waitq);
 
-        rc = cfs_kernel_thread(ping_evictor_main, NULL, CLONE_VM | CLONE_FILES);
+        rc = cfs_create_thread(ping_evictor_main, NULL, CFS_DAEMON_FLAGS);
         if (rc < 0) {
                 pet_refcount--;
                 CERROR("Cannot start ping evictor thread: %d\n", rc);
@@ -700,7 +766,7 @@ void ping_evictor_stop(void)
                 return;
 
         pet_state = PET_TERMINATE;
-        wake_up(&pet_waitq);
+        cfs_waitq_signal(&pet_waitq);
 }
 EXPORT_SYMBOL(ping_evictor_stop);
 #else /* !__KERNEL__ */
@@ -722,7 +788,7 @@ static int pinger_check_rpcs(void *arg)
         cfs_time_t curtime = cfs_time_current();
         struct ptlrpc_request *req;
         struct ptlrpc_request_set *set;
-        struct list_head *iter;
+        cfs_list_t *iter;
         struct obd_import *imp;
         struct pinger_data *pd = &pinger_args;
         int rc;
@@ -736,7 +802,7 @@ static int pinger_check_rpcs(void *arg)
         }
 
         /* have we reached ping point? */
-        if (!pd->pd_set && time_before(curtime, pd->pd_next_ping)) {
+        if (!pd->pd_set && cfs_time_before(curtime, pd->pd_next_ping)) {
                 pd->pd_recursion--;
                 return 0;
         }
@@ -755,19 +821,19 @@ static int pinger_check_rpcs(void *arg)
         set = pd->pd_set;
 
         /* add rpcs into set */
-        mutex_down(&pinger_sem);
-        list_for_each(iter, &pinger_imports) {
-                struct obd_import *imp =
-                        list_entry(iter, struct obd_import, imp_pinger_chain);
+       mutex_lock(&pinger_mutex);
+        cfs_list_for_each(iter, &pinger_imports) {
+                struct obd_import *imp = cfs_list_entry(iter, struct obd_import,
+                                                        imp_pinger_chain);
                 int generation, level;
 
                 if (cfs_time_aftereq(pd->pd_this_ping,
                                      imp->imp_next_ping - 5 * CFS_TICK)) {
                         /* Add a ping. */
-                        spin_lock(&imp->imp_lock);
-                        generation = imp->imp_generation;
-                        level = imp->imp_state;
-                        spin_unlock(&imp->imp_lock);
+                       spin_lock(&imp->imp_lock);
+                       generation = imp->imp_generation;
+                       level = imp->imp_state;
+                       spin_unlock(&imp->imp_lock);
 
                         if (level != LUSTRE_IMP_FULL) {
                                 CDEBUG(D_HA,
@@ -799,16 +865,16 @@ static int pinger_check_rpcs(void *arg)
                 }
         }
         pd->pd_this_ping = curtime;
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
 
         /* Might be empty, that's OK. */
-        if (set->set_remaining == 0)
+        if (cfs_atomic_read(&set->set_remaining) == 0)
                 CDEBUG(D_RPCTRACE, "nothing to ping\n");
 
-        list_for_each(iter, &set->set_requests) {
+        cfs_list_for_each(iter, &set->set_requests) {
                 struct ptlrpc_request *req =
-                        list_entry(iter, struct ptlrpc_request,
-                                   rq_set_chain);
+                        cfs_list_entry(iter, struct ptlrpc_request,
+                                       rq_set_chain);
                 DEBUG_REQ(D_RPCTRACE, req, "pinging %s->%s",
                           req->rq_import->imp_obd->obd_uuid.uuid,
                           obd2cli_tgt(req->rq_import->imp_obd));
@@ -827,10 +893,10 @@ do_check_set:
         }
 
         /* Expire all the requests that didn't come back. */
-        mutex_down(&pinger_sem);
-        list_for_each(iter, &set->set_requests) {
-                req = list_entry(iter, struct ptlrpc_request,
-                                 rq_set_chain);
+       mutex_lock(&pinger_mutex);
+        cfs_list_for_each(iter, &set->set_requests) {
+                req = cfs_list_entry(iter, struct ptlrpc_request,
+                                     rq_set_chain);
 
                 if (req->rq_phase == RQ_PHASE_COMPLETE)
                         continue;
@@ -845,15 +911,15 @@ do_check_set:
                  * phase and take care of inflights. */
                 ptlrpc_rqphase_move(req, RQ_PHASE_COMPLETE);
                 imp = req->rq_import;
-                spin_lock(&imp->imp_lock);
-                if (!list_empty(&req->rq_list)) {
-                        list_del_init(&req->rq_list);
-                        atomic_dec(&imp->imp_inflight);
-                }
-                spin_unlock(&imp->imp_lock);
-                set->set_remaining--;
-        }
-        mutex_up(&pinger_sem);
+               spin_lock(&imp->imp_lock);
+               if (!cfs_list_empty(&req->rq_list)) {
+                       cfs_list_del_init(&req->rq_list);
+                       cfs_atomic_dec(&imp->imp_inflight);
+               }
+               spin_unlock(&imp->imp_lock);
+               cfs_atomic_dec(&set->set_remaining);
+       }
+       mutex_unlock(&pinger_mutex);
 
         ptlrpc_set_destroy(set);
         pd->pd_set = NULL;
@@ -894,26 +960,41 @@ int ptlrpc_stop_pinger(void)
 void ptlrpc_pinger_sending_on_import(struct obd_import *imp)
 {
 #ifdef ENABLE_PINGER
-        mutex_down(&pinger_sem);
-        ptlrpc_update_next_ping(imp);
+       mutex_lock(&pinger_mutex);
+        ptlrpc_update_next_ping(imp, 0);
         if (pinger_args.pd_set == NULL &&
-            time_before(imp->imp_next_ping, pinger_args.pd_next_ping)) {
+            cfs_time_before(imp->imp_next_ping, pinger_args.pd_next_ping)) {
                 CDEBUG(D_HA, "set next ping to "CFS_TIME_T"(cur "CFS_TIME_T")\n",
                         imp->imp_next_ping, cfs_time_current());
                 pinger_args.pd_next_ping = imp->imp_next_ping;
         }
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
+#endif
+}
+
+void ptlrpc_pinger_commit_expected(struct obd_import *imp)
+{
+#ifdef ENABLE_PINGER
+       mutex_lock(&pinger_mutex);
+        ptlrpc_update_next_ping(imp, 1);
+        if (pinger_args.pd_set == NULL &&
+            cfs_time_before(imp->imp_next_ping, pinger_args.pd_next_ping)) {
+                CDEBUG(D_HA,"set next ping to "CFS_TIME_T"(cur "CFS_TIME_T")\n",
+                        imp->imp_next_ping, cfs_time_current());
+                pinger_args.pd_next_ping = imp->imp_next_ping;
+        }
+       mutex_unlock(&pinger_mutex);
 #endif
 }
 
 int ptlrpc_add_timeout_client(int time, enum timeout_event event,
                               timeout_cb_t cb, void *data,
-                              struct list_head *obd_list)
+                              cfs_list_t *obd_list)
 {
         return 0;
 }
 
-int ptlrpc_del_timeout_client(struct list_head *obd_list,
+int ptlrpc_del_timeout_client(cfs_list_t *obd_list,
                               enum timeout_event event)
 {
         return 0;
@@ -922,17 +1003,17 @@ int ptlrpc_del_timeout_client(struct list_head *obd_list,
 int ptlrpc_pinger_add_import(struct obd_import *imp)
 {
         ENTRY;
-        if (!list_empty(&imp->imp_pinger_chain))
+        if (!cfs_list_empty(&imp->imp_pinger_chain))
                 RETURN(-EALREADY);
 
         CDEBUG(D_HA, "adding pingable import %s->%s\n",
                imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd));
         ptlrpc_pinger_sending_on_import(imp);
 
-        mutex_down(&pinger_sem);
-        list_add_tail(&imp->imp_pinger_chain, &pinger_imports);
+       mutex_lock(&pinger_mutex);
+        cfs_list_add_tail(&imp->imp_pinger_chain, &pinger_imports);
         class_import_get(imp);
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
 
         RETURN(0);
 }
@@ -940,15 +1021,15 @@ int ptlrpc_pinger_add_import(struct obd_import *imp)
 int ptlrpc_pinger_del_import(struct obd_import *imp)
 {
         ENTRY;
-        if (list_empty(&imp->imp_pinger_chain))
+        if (cfs_list_empty(&imp->imp_pinger_chain))
                 RETURN(-ENOENT);
 
-        mutex_down(&pinger_sem);
-        list_del_init(&imp->imp_pinger_chain);
+       mutex_lock(&pinger_mutex);
+        cfs_list_del_init(&imp->imp_pinger_chain);
         CDEBUG(D_HA, "removing pingable import %s->%s\n",
                imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd));
         class_import_put(imp);
-        mutex_up(&pinger_sem);
+       mutex_unlock(&pinger_mutex);
         RETURN(0);
 }
 
@@ -958,7 +1039,7 @@ void ptlrpc_pinger_wake_up()
         /* XXX force pinger to run, if needed */
         struct obd_import *imp;
         ENTRY;
-        list_for_each_entry(imp, &pinger_imports, imp_pinger_chain) {
+        cfs_list_for_each_entry(imp, &pinger_imports, imp_pinger_chain) {
                 CDEBUG(D_RPCTRACE, "checking import %s->%s\n",
                        imp->imp_obd->obd_uuid.uuid, obd2cli_tgt(imp->imp_obd));
 #ifdef ENABLE_LIBLUSTRE_RECOVERY