Andreas Dilger adilger · review.whamcloud.com

LU-20211 mdt: replace inactive OST objects past truncate size

A truncate to a non-zero size on a file with a stripe on an
unavailable OST still has to reach that OST, even when the truncate
discards all of the stripe's data.  Only truncate(0) replaced the
layout, since a full layout replace loses the data before the size.

If every stripe on an unavailable OST holds no data before the new
size, replace each of those OST objects with a new object of the same
stripe size on an available OST, using a single-stripe layout swap
with a volatile victim, and keep the rest of the layout and its data.
lod_layout_has_unavailable_stripe() lists the stripes and checks the
first file offset each one holds, also in the probe before
mdt_attr_set() takes the layout lock.  If any unavailable stripe holds
data before the size, or the layout has EC parity, keep the layout
and do a normal truncate.  lod_pick_replacement_ost() moves all
objects of one unavailable OST to the same new OST, so an overstriped
component keeps its stripes per OST, and picks that OST in the
component's pool with the most free space that the component does not
use yet.  If the component already uses every usable OST, e.g. it is
striped over all OSTs or its whole pool, reuse its OST with the most
free space that no other replacement took, and have
mdd_swap_single_stripe() mark a component that gets two objects on
one OST as overstriped, and clear it again if the swap is rolled
back.  A compressed component cannot be overstriped, so the swap
refuses it and its layout is kept.  If the new object lands on
another OST, it is not swapped in.  The single-stripe swap passes
the OST object FIDs in the FID order that mdd_swap_layouts() sorts
the two files into.

Return the requested size with MS_LAYOUT_REPLACED, not the MDT inode
size, which a DoM file does not update.  The client discards its
dirty pages from the page after that size before the layout change,
since the replaced objects hold no data before it.  A resent truncate
is reconstructed with the current layout for any size.

Add sanity/test_27xu for plain, DoM, pool, all-OST and overstriped
layouts, and a layout that must be kept.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ibe54e4c62c3d1d648308ab90f67a677c1d3ebbe5

LU-12669 ec: wait for stripes that parity cannot rebuild

A read of an EC file whose raid set has more data stripes on stopped
OSTs than parity can rebuild fails with -EAGAIN or -EIO, while the
same read of a file without parity waits for the OSTs to return,
e.g. after an OSS failover.  Adding parity to a file should not make
it less available than a plain striped file.

When CIT_EC_RD finds too many unavailable stripes or too little
parity, set the new cl_io::ci_ec_wait, which cl_io_loop() turns into
a restart, and record that raid set's range.  Restart the read up to
the start of that raid set as CIT_EC_RD, so earlier raid sets are
still rebuilt from parity, then read that raid set as a plain read
without the no-delay flag, which waits for the stripes' OSTs.  The
rest of the read goes back to the no-delay read, so later raid sets
are also rebuilt from parity.  A synchronous direct read whose aio
was freed for the CIT_EC_RD restart gets a new one.  A read of a
deactivated OST still fails at once.  Since waiting for the OSTs is
not an error, print a debug message instead of a console warning.

Change sanity-ec test_29a to check that such a buffered or direct
read waits for its OSTs and then returns the right data, and add
test_29b and test_29c for reads whose second or first raid set is
rebuilt from parity.

Test-Parameters: testlist=sanity-ec ostcount=8
Fixes: 783c13bb0b8f ("LU-12669 ec: recover data from parity")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I9956bab1b63744d0b52d03268b95c78ca73ebbe5

LU-20958 llite: only update blocks after a flush

vvp_io_fsync_end() merges the stripe attributes into the inode after
every flush and OST sync, to update the blocks for LSOM.  Neither
takes a lock on the stripes, so the merged size and blocks are only
what this client last cached for each stripe.  That replaces a valid
i_size, e.g. a strict SOM size from the MDS, with a smaller one, down
to 0, for example in the local flush before lseek(SEEK_DATA).  An
lseek of an EC file with a stripe on an unavailable OST then finds no
data before this EOF.

Only update i_blocks there, which is what LSOM needed, and not while
i_size and i_blocks came from the MDS.

A write only locks the stripes it covers, and a stripe that this
client never held a lock on only has the size last cached for it, 0
if never seen, so the merge after a write, an O_SYNC write or a tiny
write could also shrink i_size, e.g. to 1MiB after a write at offset
0 of a 3MiB file with three 1MiB stripes whose size came from the
MDS.  Have lov_merge_lvb_kms() report such a stripe in the new
cl_attr::cat_kms_partial, and since a write never makes a file
shorter, let these merges only grow i_size then.  When the size of
every stripe is known, they may still shrink i_size, e.g. after a
truncate on another client.  If that truncate changed the layout, a
write merge can keep a stale larger i_size until a glimpse, which
only affects the lazy SOM size sent at close.

Add sanity-flr test_44j, which checks that an fsync does not
shrink the strict SOM size of a mirrored file.

Test-Parameters: testlist=sanity-flr
Fixes: dfb08bbf77a1 ("LU-16465 llite: fix LSOM blocks for ftruncate and close")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Id5561dd9af3aec5f966ae4db4bc055bb213ebbe5

LU-18456 tcu: delay trash creation ".lustre/trash/MDTXXXX"

In the previous patch, the global visible trash dir
".lustre/trash/MDTXXX" is created immediately when a server
finished MDT stack setup and recovery.

However, this may result in sanity-scrub.sh/test_4b failure. The
creation and initialization of the Trash Can dir will trigger the
OI scrub fixing and update the scrub accounting and result in
"prior_updated" checking failed.

In this patch, the Trash Can initialization will be disabled by
default at the server startup time. Or it can be enabled via a MDT
mount option.

In the meanwhile, we improve the tunable "mdd.*.trash_can_enable".
When Trash Can is enabled, the server will check whether it is
initialized. If not, the server will launch a thread to create and
initial the Trash Can dir.

Add a test case sanityn/test_117a.

Change-Id: I9989bb8530d492ed063dc8106ac34be8ee80643e
Signed-off-by: Yingjin Qian <qian@ddn.com>

LU-17957 mdd: POSIX interface for non-root immutable files

Allow a non-root file owner to make their own file immutable using
POSIX tools, without CAP_LINUX_IMMUTABLE or root: set the file's
atime to at least mdd.posix_immutable_min_atime_delta seconds in the
future, then remove all write permission (chmod a-w). When
mdd.posix_immutable is enabled (default off) and both conditions are
met, the MDS sets IMMUTABLE_FL automatically.

A new on-disk LMA flag, RETENTION_FL (LMAC_RETENTION), marks files
made immutable this way, as opposed to plain "chattr +i", whose
IMMUTABLE_FL never auto-clears. A file is "expired" once its atime
has passed. Expiry lazily clears IMMUTABLE_FL|RETENTION_FL on the
next operation that needs the file writable, so files that are never
touched again keep the flags as MDS-internal bookkeeping only.
RETENTION_FL is always stripped from client-visible replies, and
state is refreshed on the next lookup or getattr. A privileged chattr
(root, or a caller with CAP_LINUX_IMMUTABLE or the RBAC role) that
manually toggles IMMUTABLE_FL also clears RETENTION_FL, so the file
isn't left with a stale retention marker.

mdd.posix_immutable_min_atime_delta (default 24h, minimum 30s)
bounds how far in the future the atime must be set, to keep the
window comfortably larger than the client's clock time.
ll_revalidate_dentry compares atime against the current time on
each lookup.

Changing IMMUTABLE_FL/APPEND_FL requires both CAP_LINUX_IMMUTABLE and
the nodemap RBAC role NODEMAP_RBAC_IMMUTABLE_FLAGS (surfaced as
uc_rbac_immutable_flags). The RBAC role lets a nodemap deny this
capability to clients that would otherwise have it, rather than
granting it to clients that lack it. Every other place that bypasses
a retained/immutable file's checks on CAP_LINUX_IMMUTABLE alone --
lu_immutable_relocate_check() (swap/migrate), the migrate sanity
check in mdd_migrate_sanity_check(), and mdt_swap_write_permission()
-- requires the same RBAC role, so a nodemap can deny the capability
consistently across all of these paths, not just chattr.

mdt_swap_write_permission() still calls mo_permission() for every
caller, so once IMMUTABLE_FL is bypassed via the capability/RBAC
check, the usual owner/mode/ACL checks in
__mdd_permission_internal() keep applying, and a caller with
CAP_LINUX_IMMUTABLE but without DAC write access cannot swap layouts
on a file it could not otherwise write. mdt_swap_layouts() also
rejects, rather than honours, a client-supplied
SWAP_LAYOUTS_MDS_RELEASE or SWAP_LAYOUTS_MDS_HSM, since both are
MDS-internal-only flags that would otherwise let a modified client
skip the immutable and uid/gid checks in mdd_swap_layouts().

mdd_fix_attr() stops MDS_PERM_BYPASS (set from the client's
ATTR_FORCE, e.g. by ll_setattr() when clearing setuid/setgid, or by
ll_hsm_import()) from skipping the APPEND_FL or IMMUTABLE_FL checks
on a non-flag setattr. Previously an owner could use ATTR_FORCE to set
atime to a time in the past, forcing immediate "expiry" of a retained
file and bypassing retention, or to write to an administrator's
chattr +i file before CAP_LINUX_IMMUTABLE was actually checked.

mdt_init_ucred_reint()'s CAP_FS_SET raise on MDS_CLOSE (LU-5564)
includes CAP_LINUX_IMMUTABLE, and only MDS_HSM_RELEASE and
MDS_CLOSE_LAYOUT_SWAP were excluded from it. Add
MDS_CLOSE_LAYOUT_MERGE and MDS_CLOSE_LAYOUT_SPLIT to that exclusion,
since those closes also reach mdt_close_handle_layouts() and should
not get a blanket immutable-override capability for a layout-
modifying operation.

A caller with CAP_LINUX_IMMUTABLE and the RBAC immutable_flags role
(e.g. root on an admin nodemap) may migrate an immutable file or swap
its layout at any time, regardless of retention/expiry. A caller
without both must wait for expiry first. This requires relaxing a
few MAY_WRITE checks (layout swap, migration) specifically for such
callers, since normal MAY_WRITE checks reject IMMUTABLE_FL files for
every caller, including root, unless explicitly bypassed via the
capability check. The capability check needs the request's ucred,
which the standalone swap_layouts RPC handler did not previously set
up, so it now initializes and releases ucred around the permission
check. lfs migrate retries its read-only source open after EPERM,
since copying a file only needs read access. Since
mdd_layout_swap_allowed() now enforces immutability, it also gains an
explicit exemption for SWAP_LAYOUTS_MDS_HSM, to keep HSM restore
working as before: by the time the swap runs, mdt_hsm_is_admin() has
already checked CAP_SYS_ADMIN and released its ucred, so this path
cannot be checked via CAP_LINUX_IMMUTABLE.

On the client, ll_update_inode_flags() strips IMMUTABLE_FL whenever
RETENTION_FL is set, so a POSIX-retained file is never cached as
S_IMMUTABLE and the VFS never blocks locally on stale cached flags
once atime has passed. The MDS stays the sole authority enforcing
immutability on each modifying RPC. RETENTION_FL itself is never
reported to userspace (fileattr_get(), stat via mdt_body, statx).
fileattr_get() also folds the atime and flags from its fresh MDS
getattr into the inode, so the next FS_IOC_GETFLAGS/lsattr call
reflects the MDS's current state.

Test-Parameters: testlist=sanityn serverversion=2.17 env=SANITYN_EXCEPT=32b
Test-Parameters: testlist=sanityn clientversion=2.17

Signed-off-by: Chakshu Kansal <ckansal@ddn.com>
Change-Id: Iab9c0f69dd8152a7eaa48e8454120af469ea4d63

LU-20211 lod: count offline OSTs to skip per-stripe checks

Checking a file for stripes on unavailable OSTs looks up the OST of
every stripe and its state, on every truncate (layout replace probe),
FLR primary mirror pick and migration parent FID update, even though
an OST is rarely unavailable.  A read-only OST was also treated as
usable for truncate, so a truncate of a file with an object there
would fail with -EROFS instead of replacing that object.

Add lod_ost_offline_count, the number of OSTs that cannot modify
their objects: the OSP import is not connected or is deactivated, or
the OST reported OS_STATFS_READONLY in its last statfs.  LOD gives
each OST's OSP a pointer to the count with KEY_OFFLINE_COUNT when the
OST is added, and clears it under ltd_mutex before the OST is
removed.  The OSP raises the count by one while it is unusable,
checked under a lock at each import event, read-only state change in
osp_pre_update_msfs() and pointer change, so an OST that is offline
when it is added is counted at once and a late IMP_EVENT_ACTIVE
cannot undo a newer disconnect.  A connected OST that is full or not
precreating is not counted, since it can still be truncated and have
its parent FID changed.

Skip the per-stripe checks while the count is zero in
lod_layout_check(MD_LAYOUT_UNAVAILABLE) and
lod_obj_stripe_replace_parent_fid_offline_cb().  lod_ost_offline()
treats a read-only OST and an invalid (deactivated) import as
offline, as the count does, reading the import and the OSP's cached
statfs rather than waiting for LOD's next statfs refresh.

lod_primary_pick() must still avoid a mirror on any inactive OST, so
it skips its check only while every OST is active, and takes each
stripe's OST index from llc_ost_indices[] instead of an FLD lookup.

While the checks are skipped, a stripe on an OST index that was
removed from the configuration is no longer reported unavailable.

Show the count in lod.*.ost_offline_count, and add sanity/test_27xw
to check that it rises when an OST is deactivated, stopped or made
read-only and returns to zero afterward, that truncate(0) moves a
file off a read-only OST, and that a no-create OST is not counted.

Test-Parameters: trivial testlist=sanity-flr,sanity-ec
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I94d6b7e0b796824e00b3be87b2f036bc5d3ebbe5

LU-19823 lod: fit EC raid sets to the OSTs without domains

With "lfs setstripe -c 6 --ec 6+3" on 8 OSTs, QoS shrank the single
raid set to 5+3 so that its parity fit, while RR placed all 6 data
stripes and then failed with ENOSPC when it found only 2 OSTs left
for the parity.  Which one ran depended on the free space balance of
the OSTs, so sanity-ec test_27h passed or failed depending on the
earlier tests.

lod_ec_fit_fdoms() already fits the raid sets to the failure domains
before either allocator places the data.  Without failure domains,
count each active OST as a domain of its own, so RR and QoS fit the
same K.  A -c component wider than the active OSTs is fitted by the
stripes it can place, and keeps that stripe count.  If its raid sets
must shrink, it is still to at least 3/4 of the requested K.  As with
domains, a layout may be stored with the smaller K of its raid sets.
Describe this in lfs-setstripe.1.

ec_split_stripes() split an odd number of data stripes with K=2 into
raid sets of 2 and one set with a single data stripe, e.g. {2, 2, 1}
for 5 stripes.  The parity of that set is only a copy of its one data
stripe, but it needs as many parity stripes as a full raid set, and
the extra set made layouts such as "-c 5 --ec 2+2" fail the check that
the parity stripes fit in the data stripe count.  Use one raid set
fewer in this case, so the residual stripe goes into the first raid
set, {3, 2} for 5 stripes and {3, 2, 2} for 7.  K=2 with an odd total
of 5 or more stripes is the only case that made a single-stripe raid
set, other splits are unchanged.  All users of the split size their
buffers from esc_k0 rather than K, as a 3-stripe file with K=2 already
gives one raid set of 3.  The split is computed from the layout rather
than stored in it, so it has to change before EC layouts are in use.

A 3-stripe raid set needs one more OST or failure domain than the
others.  If there are only enough for K=2, lod_ec_fit_fdoms() leaves
out one data stripe, so "-c 5 --ec 2+2" with 4 failure domains is
two raid sets of 2+2, and with 5 it is 3+2 and 2+2.

lod_ec_shrink_data_geometry() reduced the split one data stripe at a
time when fewer OSTs were available, which could leave a single-stripe
raid set, e.g. {2, 2, 1} for 5 of 6 stripes, unlike the split that
clients compute from the layout.  Use ec_split_stripes() for the
reduced count instead, also for the RR shrink to 75% of the stripes.
Since the fitted raid sets were checked against the failure domains,
never make a raid set larger when shrinking: use the largest raid set
as K if a single raid set of K would be larger, and leave out one more
stripe if an odd count with K=2 would make a raid set of 3.  Move
lod_ec_shrink_data_geometry() after lod_comp_find_linked(), which it
now uses to set the smaller K in the parity component too.
lod_stripe_count_min() counted every kept raid set as esc_k0 stripes,
so "-c 9 --ec 2+1", {3, 2, 2, 2}, could not shrink at all.  Leave out
the smallest raid sets instead.

Have sanity-ec test_27h check that a layout which can't fit fails, and
one that can gets fewer data stripes, with both the RR and QoS
allocators.  Add test_31h to check the new raid sets with --ec-map and
that "-c 5 --ec 2+2" works, test_31i for "-c 5 --ec 2+2" with 4 and 5
failure domains, and test_65e for recovery of a 3-stripe raid set.

Test-Parameters: trivial testlist=sanity-ec
Fixes: c53abca9f9ee ("LU-19852 lod: raidset aware stripe allocator")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ief45b5df095e03fd96065b85eb6b1008bd3ebbe5

LU-9512 llite: Add O_TMPFILE support

This patch adds VFS tmpfile (O_TMPFILE (nameless))
file support. The file will be automatically deleted
when it is closed.

VFS tmpfile (tmpfile) support which is little different
from standard volatile file creation already present.
While volatile file is either destroyed on close or
swapped (migrate) but never link'ed. The tmpfile
support via inode_operations->tmpfile can be linked
and be brought out of orphan list and can be listed like
regular file.

tmpfile uses unique (LUSTRE_VOLATILE_HDR + random) as
name, same as volatile file. This is because, currently
any file with such unique name is already put on
orphan (unlink, yet still open). Therefore tmpfile
piggybacks on this already implemented feature to
implement tmpfiles. However, tmpfile and volatile
files in Lustrefs is not same as mentioned above.

Also, a new per-file LMA incompat bit, LMAI_TMPFILE,
set at create time and never cleared the new
MDS_CREATE_TMPFILE op bias and sp_cr_tmpfile

With this we have:
- File open with ll_tmpfile (O_TMPFILE): linking allowed
- regular open-unlinked: linking not allowed
- Volatile file (HSM/migrate): linking not allowed

Test is exercised against older 2.16 server also.
New sanity/63d test is added as verification.

Test-Parameters: trivial serverversion=2.17.0 testlist=sanity
Test-Parameters: trivial serverversion=2.16.0 testlist=sanity env=ONLY="63d"
Signed-off-by: Arshad Hussain <arshad.hussain@aeoncomputing.com>
Change-Id: I74b44bf2e4cfac10fef09d32679b104e83020b36

LU-20896 llite: wait for OST for O_CIPHERTEXT EC reads

An O_CIPHERTEXT direct read of an EC file with an unavailable data
stripe would fail with -EIO or -EAGAIN with the key loaded, since the
buffered CIT_EC_RD recovery read decrypts the data.  Without the key,
that recovery read would leave the ciphertext uptodate in the page
cache, where a reader that later adds the key would see it as clear
text, and it would stop at i_size rather than at the end of the last
encryption unit.

Read the whole DIO request again without the no-delay flag instead,
which waits for the OST to return, as for a file without parity,
until the ciphertext can be rebuilt from parity directly.  A read
from a deactivated OST still fails with -EIO.  Also skip the EC DIO
read retry after a signal.

Add sanity-ec test_69e to check that such a read waits for a stopped
OST and then returns the ciphertext.

Fixes: bd9ebb7e51a6 ("LU-20896 llite: transfer ciphertext for O_CIPHERTEXT DIO")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Icdd28a844cc6f41ce3c86be8f9b1ec2a0d3ebbe5

LU-15834 lod: add a mirror in place for mirror extend

"lfs mirror extend" allocated the new mirror in a separate volatile
file and merged it into the file, so LOD allocated its objects
without seeing the file's other mirrors.  The new mirror could land on
the same OSTs, OSSs and failure domains as an existing mirror, which
defeats the purpose of the mirror.

Add a "lustre.lov.extend" layout operation that adds the components
of one new mirror to the file as a stale mirror without objects, and
llapi_mirror_extend() to send it.  A plain file is converted to a
mirrored file first.  The resync of the new mirror then instantiates
it while all other mirrors are in view, so the existing OST, OSS and
failure domain avoidance applies.  A parity mirror is bound to the
data mirror named by its link id, as a merge does.

"lfs mirror extend" uses it for data and EC parity mirrors when the
MDT has OBD_CONNECT2_FLR_EC, and falls back to the volatile file and
merge otherwise, or when the new mirror names its OSTs, since the OST
list of a component without objects is not stored until the resync,
has an extension component, which only a write instantiates, or is
copied with --non-direct, as the resync uses O_DIRECT.  A component
of the new mirror without a pool gets the pool of the default layout
of the parent directory or the root, as the copy created there did.
The client refreshes the layout after the extend, as a getxattr of
the layout returns the cached one.

The extend fails before it changes the layout if the file is open
for write elsewhere, as the resync could not start.  An interrupted
extend leaves a stale mirror, like "--no-sync", instead of an orphan
volatile file.

A resync instantiated every stale component within the extent that
the in-sync mirrors had instantiated, which is the whole file once
one mirror covers [0, EOF), so a new PFL mirror of a small file got
objects for all of its components.  Send the file size in rs_size of
MDS_REINT_RESYNC, flagged by MDS_RESYNC_SIZE in rs_bias, and stop the
resync instantiation there, keeping at least the first component as
a create does.

lod_verify_layout() verifies the new mirror as a layout of its own,
not as a continuation of the file's layout as for "lustre.lov.add".
A mirror whose DoM size differs from that of the file is refused, as
lod_parse_striping() would refuse the layout.

Add sanity-flr test_8a to check that the new mirror avoids the OSTs of
the existing mirrors, based on the test from Bobi Jam's patch, that a
busy file or one with another DoM size is left unchanged, and that a
self-extending mirror is added.
Add sanity-flr test_8b to check that the new mirror gets the default
pool of the directory.
sanity-flr test_0f accepts 3/4 of the OSTs for a "-c -1" mirror, as
the in-place mirror avoids the OSTs of the other mirrors like "lfs
mirror create", where the merged copy got all of them.
sanity-flr test_61b and test_61d skip their timestamp checks after a
split of an in-place extended file, as the resynced objects keep the
time of the copy until a time-only setattr reaches every mirror
(LU-21006).

Test-Parameters: serverversion=2.17 testlist=sanity-flr
Test-Parameters: clientversion=2.17 testlist=sanity-flr
Fixes: 125f98fb5c10 ("LU-9771 flr: lfs mirror create and extend commands")
Fixes: 5999c0b881e8 ("LU-9771 flr: resync support and test tool")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ie7a3b82b5a8677bc3ecb34c5eaf6e699a53ebbe5

LU-12187 lod: add an EC layout version to lcme_cstripe_count

The EC parity stripe count lcme_cstripe_count is limited to
LOV_EC_MAX_CODING_STRIPES (15), so only the low 4 bits of the
byte are needed.  Make it a 4-bit field and use the high 4 bits
as lcme_ec_version, before the EC layout format is in a release.
The fields are reversed under __BIG_ENDIAN_BITFIELD so the count
is in the low 4 bits of the on-disk byte on every host.

Every reader recomputes which data stripes a parity stripe covers
from the layout: the raid-set split from ec_split_stripes(), the
parity stripe placement and the encoding matrix.  Any later change
to these would make an older client silently pair parity with the
wrong data, so the version names the whole mapping.  Version 0
(LCME_EC_VERSION_0) is the mapping 2.18.0 is released with, and
LCME_EC_VERSION_MAX is the latest one this code knows.

The version is kept in the parity component, which defines the
mapping for its pair; it is zero in data components.  The MDS sets
it when it allocates the parity stripes in lod_comp_prep_create():
a new parity gets the version asked for in a template or in a
layout from a user, limited to LCME_EC_VERSION_MAX, so clients
never need to negotiate one.  A parity without objects is also
stored with at most LCME_EC_VERSION_MAX, since this MDS will map
it when it is instantiated.  A later MDS can keep writing an
older version until its clients understand the new one, e.g. with
a connect flag or a tunable.

For a parity with a later version than LCME_EC_VERSION_MAX:
- the LOV client treats its data as unlinked, so the data stripes
  are read as plain RAID0 and never reconstructed from parity;
- llapi leaves the parity stale when it resyncs the rest of the
  file, refuses to verify it with -EOPNOTSUPP, and 'lfs getstripe
  --ec-map' prints the version instead of a raid-set split it
  would compute wrongly;
- LOD keeps the layout as loaded from disk and writes the version
  back unchanged once the parity has objects, does not resize or
  re-stamp the parity when its objects are given by a layout swap or
  open replay, and lod_verify_striping() rejects such a version for
  a parity with objects in a layout from a user.

The in-memory llc_cstripe_count (LOD and llapi) and
lsme_cstripe_count (LOV) become 4-bit fields, with the version
in llc_ec_version and lsme_ec_version.

Add sanity-ec test_1m to check that the MDS limits a later version
in a template to the one it knows for a new parity, and test_1n
(ldiskfs) to check that a file whose parity has an unknown version
on disk is still readable and writable, that its parity is not
verified or resynced and keeps its version, and that a parity
instantiated later in the same file gets the MDS version.

Test-Parameters: trivial testlist=sanity-ec
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Iaad6ff45868437d8195d67608ec7d0108b3ebbe5

LU-21006 lov: send FLR time setattr to all mirrors

A setattr of only times or flags on a mirrored file would reach the
OST objects of one mirror, the one lov_io_mirror_init() picks for
reads, because lov_foreach_io_layout() walks only that mirror.  The
client stat merges the times of the objects of every valid mirror,
so a mirror that missed the setattr kept a newer mtime from its last
write or resync, and "touch -d" into the past was lost.  Since the
preferred mirror is chosen per lov_object, this happened for a
random subset of files and clients, and the mtime of a file whose
setattr mirror was later split off became the time of the resync.

Send a setattr that is not a truncate or fallocate to every valid
component of every mirror, parity included.  Stale components are
rewritten by resync.  The mirrors other than the one picked for I/O
are updated without delay and without an extent lock, and their
setattr errors are ignored, so an unavailable or deactivated OST
there does not block or fail the setattr.  Without the lock, another
client that holds a lock on the objects of such a mirror keeps their
cached times until that lock is cancelled, and a time earlier than
the current one can still be lost on a mirror whose OST is down.

Add sanity-flr test_61e to check the mtime after either mirror of a
plain or PFL file is split off, and test_61f to check that a stopped
OST, or a deactivated OSC, in the other mirror does not fail
"touch -d".

Fixes: 526dbd3d8723 ("LU-9771 flr: read support for flr")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I571cf2c1feea54272afdb383a43ab918c93ebbe5

LU-20281 tests: skip sanity/27Ke on read-only root

if a test system uses read-only root, then you can't modify
/etc/passwd, /etc/group -- it's OK to jus skip the test then.

Test-Parameters: trivial
Signed-off-by: Alex Zhuravlev <bzzz@whamcloud.com>
Change-Id: I0973e6be0375bb715e661dd2013cacbae1e98f8c

LU-7426 tests: enable indexed llog testing

switch llog testing code to use indexed llogs.

Signed-off-by: Alex Zhuravlev <bzzz@whamcloud.com>
Change-Id: I157cbd35c0cf78009039595afef8d3c30fa8e26c

LU-11962 flr: fix FLR and SOM state after a layout swap

The SOM xattr stays with the inode when its layout is swapped, e.g. by
"lfs migrate" of a mirrored file after "lfs mirror resync".  The new
layout is usually not FLR, so writes do not go through a layout write
intent that makes SOM stale, and mdt_lsom_update() does not change
strict SOM at close.  The MDT then keeps returning the old size and
blocks as strict, and clients do not glimpse the OSTs.  Also,
lod_parse_striping() does not reset the FLR state for a plain layout,
so after such a swap LOD keeps the state of the layout it replaced.

Make strict SOM stale on both files in mdd_swap_layouts(), in the
transaction of the swap, so that a replay never finds the swap
committed without it.  HSM release keeps the strict SOM it sets.
Revoke the UPDATE locks too, so that clients drop strict attributes
they cached, and reset the FLR state of a plain layout in
lod_parse_striping().

Fixes: ce61bcac8661 ("LU-9771 clio: no glimpse for data immutable file")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I4dd07511ca0cad7a412623976370fefb17f97e32

LU-11962 flr: fix the handling of foreign mirrors

Several places mishandle a mirror made of a foreign HSM component, as
PCC-RO adds:
- the client copies the EC stripe counts into every layout entry, but
  for a foreign entry they share a union with lsme_foreign_flags, so
  getxattr("lustre.lov") and llapi_layout_get_by_fd() report its HSM
  flags as 0;
- "lfs getstripe" prints all of its lhm_* fields whatever is asked,
  so "lfs getstripe -N" prints them after the mirror count, and it is
  the last initialized component that "-c", "-S" or "-i" show;
- lod_primary_pick() may pick it as the primary mirror for a write
  when the OSTs of the data mirror are unavailable;
- mdd_split_ea(), and data_mirror_remains() and
  last_non_stale_mirror() of lfs, count it as data, so "lfs mirror
  split" can remove the only data mirror, or the only in-sync one;
- a designated read of it, e.g. "lfs mirror read -N", which any user
  with read access can do, hits the LASSERT in
  lov_io_layout_at_mirror(), and "lfs mirror verify" reads from it.

Move the EC stripe counts out of the union, print an HSM component
only for the verbose and layout pattern output and never as the last
initialized one, never pick an HSM mirror in lod_primary_pick(), and
do not count foreign mirrors as data when splitting or verifying.
Refuse designated I/O to a foreign mirror in lov_io_mirror_init().

Add sanity-pcc test_51 to check the HSM flags, "lfs getstripe -N" and
"-c", the split of data mirrors, and the read and verify of a file
attached to PCC-RO.

Test-Parameters: testlist=sanity-pcc,sanity-flr
Fixes: 472e0f27d411 ("LU-19545 ec: tight binding parity mirror to data mirror")
Fixes: 22e9e7e8b264 ("LU-12187 llapi: EC layout creation support")
Fixes: ce98bfe5f726 ("LU-10499 pcc: add readonly mode for PCC")
Fixes: aebb405e32e4 ("LU-10499 pcc: use foreign layout for PCCRO on server side")
Fixes: 2e591389646c ("LU-19548 lfs: update mirror split for EC support")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Idb5f277a3117a352a99cecdaefd6ee7ee89b5397

LU-12669 ec: EC feature test build (DO NOT LAND)

A test vehicle, not for landing. It squashes the open changes below,
at the patchsets listed, onto master 7183418602 (v2_17_60) so that
they can be built and tested together: every open change with both the
218_review_priority and pt_ecro hashtags as of 2026-11-04, plus the
changes marked * or +. It is refreshed as they get new patchsets.

68361 (LU-20690) stores EC parity as LOV_PATTERN_PARITY and no longer
accepts the RAID0|PARITY encoding of master, so EC files must be
created with this build.

64441 (LU-12187 layout pattern negotiation) is applied after 62868,
which drops the module parameters 64441 negotiates with.  The local
fix after 64441 keeps the negotiation with FLR EC on by default
(enable_flr_ec=1, mdt_enable_flr_ec=1).

64919 ps52 and 69392 both make an EC read that parity cannot rebuild
wait for its stripes' OSTs instead of failing: 64919 changes sanity-ec
test_29a to expect it, and 69392 implements it (cl_io::ci_ec_wait),
with the same test_29a and a new test_29b.

Included, in apply order (change/patchset):
   69350/7   LU-12669 ec: create lock placeholder for reconstructed
             pages
   69702/1   LU-20708 llite: rebuild faulting EC pages from parity
   69694/5   LU-20958 llite: only update blocks after a flush
   64086/49  LU-20958 lov: handle unavailable EC stripes in lseek
   69828/2   LU-20958 llite: drop strict SOM size with the UPDATE lock
   62868/4   LU-12187 llite: enable FLR EC support unconditionally
   69762/7   LU-20287 lov: don't block setattr on unavailable OST
   66882/45  LU-20211 mdt: trunc(0) layout replace on inactive stripes
 * 69305/6   LU-8933 lod: balance round-robin first stripe start
   69421/5   LU-19823 lod: balance RR allocation across failure
             domains
   69422/10  LU-8933 lod: leave inactive targets out of the RR array
   69426/6   LU-19823 lod: spread failover groups over the RR array
   69697/8   LU-20967 osd-ldiskfs: name the failure_domain local file
   69517/9   LU-20690 ec: implement STRIPE I/O scope
   69575/8   LU-20690 utils: add EC parity-stripe I/O helpers
   68361/26  LU-20690 ec: store EC parity like RAID10
   69703/5   LU-20690 ec: verify parity against data, allow p > k
   69908/2   LU-12669 ec: fix degraded read page leak and short read
 + 69913/1   LU-20708 osc: let read faults switch mirrors on a bad OSC
 + 69914/1   LU-12328 llite: move a failed DIO read to the next mirror
   69493/5   LU-19823 lod: unique failure domains per EC raid set
   64919/52  LU-12669 lov: slow and dead OST detection for degraded
             reads
   local     EC feature merge fix: 64919 with 64086 and 68361
 + 69709/2   LU-12669 lov: peer-relative deadline for EC raid set
             reads
   69710/2   LU-12669 lov: split EC reads at a raid set parity cannot
             cover
 + 64441/34  LU-12187 lov: MDS layout pattern negotiation
   local     local: 64441 on 62868: FLR EC on by default
   69392/3   LU-12669 ec: wait for stripes that parity cannot rebuild
 * 69768/6   LU-11962 flr: fix the handling of foreign mirrors
 + 69769/4   LU-11962 flr: fix FLR and SOM state after a layout swap
   70067/3   LU-20690 ec: copy parity in 1+N recovery reads
 + 69916/3   LU-21014 lod: keep EC raid sets on distinct OSTs in RR
   70150/1   LU-19823 lod: fit EC raid sets to the OSTs without
             domains

* untagged parent of a tagged change
+ untagged, added on request

local = fix for conflicts with master or between the changes, not in
Gerrit.

Conflicts resolved by hand: 69828, 62868, 69517, 69703, 69914, 69493,
64919, 69709, 69710, 64441, 69392, 69768, 69769.

Test-Parameters: fortestonly ostcount=8
Test-Parameters: fortestonly testlist=sanity-ec ostcount=8
Assisted-by: ClaudeCode:claude-opus-5.5 llm_code_and_review_tools
Signed-off-by: Maximilian Dilger <mdilger@whamcloud.com>
Change-Id: I647c485c7b6b92acdd4484f94663243d191a0b37

LU-21089 utils: mount a read-only target under another fsname

An ldiskfs snapshot has to start under its own fsname. Today that
needs tunefs.lustre --rename, which writes into the snapshot. ZFS
snapshots avoid it: the new name is a dataset property.

Add the mount.lustre option fsname=<name>, allowed only with
rdonly_dev. It replaces the fsname in the on-disk mount data and in
the service name before the kernel mount. The kernel already
accepts the renamed target under rdonly_dev (tgt_server_data_init()
ignores the old last_rcvd UUID). With rdonly_dev, mount.lustre also
no longer clears the LDD_F_UPDATE flag on the device, so it writes
nothing. The "update" mount option is still passed to the kernel.

conf-sanity: add test_176, start an OST under a forked fsname with
rdonly_dev, then under its own name again, and check that fsname=
is refused without rdonly_dev and on a client.

Signed-off-by: Hiroshi Nishida <hnishida@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5
Change-Id: I7624503125866a2b0125fecb969351c6359376b3

LU-20455 tests: run subtests from separate .ltsh files

Test scripts like sanity.sh (38000 lines) and conf-sanity.sh (13000
lines) are hard to read and navigate, and patches conflict often
because every new subtest is added to the same few files.

Allow subtests to be kept in lustre/tests/$TESTSUITE.d/*.ltsh files,
each holding one or more test_NNN() functions and the helpers they
share.  build_test_filter() finds the files and reads the YAML header
in the leading comment block of each one, run_test() first runs the
file subtests that sort before the subtest it is called for, and runs
the rest after the last subtest in $TESTSUITE.sh, before the suite's
own cleanup.  The suite scripts need no changes, and the subtests run
in numeric order interleaved with the subtests still in
$TESTSUITE.sh.  ONLY, EXCEPT, always_except(), EXCEPT_SLOW,
START_AT and STOP_AT apply to them as usual.  Each file is sourced
only when the first of its subtests runs.  The code is in the new
ltsh.sh, sourced by test-framework.sh, with the header parser in
ltsh.awk.

The header gives the summary passed to run_test(), the commits that
added or changed the subtest, whose first ticket is added to the
banner unless a Jira ticket is given, a description, a list of
keywords for the modules and features it exercises, and its typical
duration, which are not printed but help to find and understand the
subtest.  It replaces the usual skip checks at the start of a subtest:
MDT, OST and client counts, MDS and OSS node counts, server and client
versions, OSD type, separate MGS, required tools, free space and
inodes of the filesystem or of the least free MDT or OST, and SLOW,
with a "reason:" added to the skip message.  "start:" and "end:"
declare the filesystem state (mounted, unmounted with servers up,
stopped, or freshly formatted) that the subtest needs and leaves, by
default mounted.  The framework changes the state only as needed and
trusts "end:" rather than checking it, so that later the subtests can
be reordered to avoid needless remounts.  "formatted" has the
framework reformat before or after the subtest, skipping the reformat
at the start if the previous subtest reformatted at its end.  "fsck:"
checks the ldiskfs targets with run_e2fsck() after each subtest that
passes, or after the last subtest of the file if it passes.  This
setup runs in the subtest's subshell, so a failure fails only that
subtest.  "expect: must_fail" or "should_fail" runs the subtest with
run_test_must_fail() or run_test_should_fail(), where a header, setup
or fsck error is also the expected failure.  "modifies:" and
"observes:" list the shared state a subtest changes, such as fail_loc,
mounts or config, and the state it reads, such as stats or free space,
from a fixed list.  With PARALLEL=yes only subtests that give both
lists empty are run.  Lists in the header of the file add to those of
each subtest.  A file with one subtest can leave out "subtests:".  The
headers are valid YAML, so other tools can read them.  Errors in a
subtest's header keys fail that subtest, YAML errors fail all subtests
of that file, and a test_NNN() missing from the header fails as a
subtest of its own, rather than any of them stopping the whole suite.

conf-sanity-framework.sh uses its own reformat_and_config(), setup(),
start_servers() and stop_servers() for this, which keep a separate MGS
running, and keeps the client unmounted between subtests.

Move some subtests to exercise each part of this, with a description
and the list of commits of each from git history and the tickets.
Their version checks now use the "git describe" form of the commit
that added each feature, since the history of those lines is lost by
the move:
- sanity 27I: single subtest without "subtests:", OST count,
  modifies: and observes:
- sanity 230i, 230j: MDT count for both subtests with a different
  version check for each, modifies: and observes: only for 230j
- conf-sanity 151a, 151b: OSD type, start stopped, end formatted
- conf-sanity 153a, 153c: start formatted, run before and after 153b
  in conf-sanity.sh, shared helper, fsck after the last subtest.  Also
  mount $FSNAME there instead of a hard-coded "lustre".

Add sanity-ltsh.sh, in no test group, to test the framework itself
with the subtests in sanity-ltsh.d/: filesystem state changes, skips
from "requires:", header errors, fsck finding corruption and not
running after a failed subtest, and "expect:".  "fsck:" needs the
LU-20967 fix, or e2fsck finds the unnamed failure_domain file on the
OSTs.

Have the lustre-test-scripts agent skill put new subtests in .ltsh
files and describe how to move existing ones, and mention the files in
AGENTS.md.

Describe file format and header fields in lustre/tests/README-ltsh.md.
Install the files with the test scripts, and have prepare-commit-msg
run shellcheck on them as it does for *.sh files, with --shell=bash
since they have no #! line.  Also fix its pattern for newly added
files ("new file:"), which never matched, and default the line range
of a file that has no hunk in HEAD, which was an arithmetic error that
stopped all checks, so new *.sh files are checked as well.
checkpatch.pl applies its shell script checks to *.ltsh files, and
allows long lines that end in a commit reference like those of
"Fixes:", as the header "commit:" lists use.

Test-Parameters: testlist=sanity-ltsh
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ie5a6c96781d8ff41f40b3eee7c2aef18ef3ebbe5

LU-21060 utils: add client jobstats selectors

- lljobstat has no OSC or MDC selector and does not know several
  client metadata counters.
- A record with only byte counters leaves the operation total unset.
- Add -O/--osc and -M/--mdc, recognize the client operation names,
  and set the operation total for byte-only records.
- Extend sanity test_850: check both selector forms against an lctl
  fixture, and saved, empty and invalid input. It skips when PyYAML
  is missing, and accepts ENOENT from lctl on a node without any
  job_stats file.
- Also fix the program name in the lljobstat(8) SYNOPSIS.
- The kernel interfaces follow in the next LU-21060 patch.

Test-Parameters: trivial
Test-Parameters: testlist=sanity env=ONLY=850
Signed-off-by: Andreas Krause <akrause@nvidia.com>
Change-Id: Icb9093c3e0d4d8b45a82bb4916d9695b0d63b07d

LU-16789 utils: use AIO for 'lfs migrate'

Create a mini async IO framework with ll_aio_ prefix. The framework
is a wrapper layer of libaio to run asynchronous IO. However, it
can also run traditional synchronous IO with POSIX APIs without
any code change if io queue is initialized with sync_mode=true.
Or if libaio is not available on the running system, or an AIO
context cannot be created, the framework will fallback to
synchronous mode automatically.

Create function ll_aio_copy() to copy data from one fd to another.
The function can work in async/sync mode, with different buffer size
and different number of async IO tasks. The function also integrates
checking file, stats report and IO throttling.

Due to LU-18032, the last chunk of file may not be aligned so cannot
be read/written by libaio. So the last partial chunk will be
read/written in sync mode with POSIX API in sync mode even if
ll_aio_copy() is called in async mode.

In async mode, 2 more fields are appended to stats report:
read_tasks and write_tasks, which indicate how many tasks are pending
on reading/writing data when the stats is printed.

Replace migrate_copy_data() with an AIO version of
migrate_copy_data_aio() based on ll_aio_copy().
Command `lfs migrate` and `lfs mirror extend` will benefit from it.

Add --aio-tasks=TASKS parameter for `lfs migrate` and
`lfs mirror extend` command. It tells how many AIO tasks will be
started to transfer data.

But if --aio-tasks=0, the IO will fallback to synchronous mode. All
the read/write will be performed in synchronous mode sequentially.

Add --chunk-size=SIZE_MB parameter to specify the buffer chunk size
in MB used to transfer data.

Add --bandwidth as an alias for -W. Building utilities or
tests now requires libaio-devel. The RPM specification
requires libaio-devel at build time and recommends libaio
at runtime.

Signed-off-by: Feng Lei <flei@whamcloud.com>
Test-Parameters: trivial
Test-Parameters: testlist=sanity-flr
Change-Id: I50521db8e84d745edaaad791cb44fc3107ae411d
Assisted-by: Codex:gpt-6.1-sol
Assisted-by: ClaudeCode:claude-opus-5-5

LU-9 lod: show the round-robin allocator state

The weights of the targets shown by lod.*.qos_ost_weights don't
explain which target the allocator chooses, since that depends on the
order of the round-robin array, its start index and offset, and the
failure domains and servers of the targets.

Add svr_id, tgt_active, failure_domain and rr_slot, the slot of the
target in the round-robin array, to lod.*.qos_ost_weights,
lod.*.qos_mdt_weights and the pool qos_ost_weights files.  Add
lod.*.qos_rr_state, lod.*.mdt_qos_rr_state and the pool qos_rr_state
files to show the round-robin array in allocation order and the start
index, offset and weighted round-robin laps of each allocation stream.
Reading them takes lq_rw_sem so that rr_slot matches the array, and
can wait while QoS allocation holds it.

Also fix writing lod.*.qos_mdt_weights, which reset the MDT penalties
under the OST lq_rw_sem and marked the OST QoS data dirty instead of
the MDT data.

Add a man page for lod.qos_rr_state and sanity test_51j to check the
array slots, the streams and leaving out an inactive OST.

Fixes: a44956f0d57d ("LU-16501 lod: add qos_ost_weights to debugfs")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I6c824dc4dc3124976ddd3aa6f3e16cb9d13ebbe5

LU-11962 flr: handle FLR files with a single mirror

lov_init_composite() refuses an FLR layout (RDONLY, WRITE_PENDING or
SYNC_PENDING) with a single mirror, so I/O to such a file fails with
-EINVAL.  LOD also forces the FLR state of a single-mirror file to
NONE when it parses or writes the layout.  Also, a WRITE_PENDING file
with nothing stale cannot be made RDONLY again: "lfs mirror resync"
does nothing, and lod_declare_update_write_pending() returns -EALREADY
for the resync.

This is for forward compatibility: accept a single mirror in an FLR
layout on the client and in LOD, and let the resync of a WRITE_PENDING
file with nothing stale make it RDONLY with strict SOM.  Nothing
creates such a layout yet, since older clients cannot use it: a new
file with one mirror and a mirror split down to one mirror still get
state NONE.  Reset the FLR state in lod_qos_parse_config(), so that a
file given a single mirror under a directory with a mirrored default
layout does not keep the RDONLY state of that default.  A later change
can make a non-mirrored file RDONLY for strict SOM once all clients
accept it.

Add OBD_FAIL_FLR_SPLIT_KEEP_STATE so that "lfs mirror split" can leave
an FLR file with a single mirror, and sanity-flr test_49b to read,
write, resync and extend such a file, and to create one under a
mirrored default layout.

Test-Parameters: testlist=sanity-flr
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ia4566b30e16047f84cb728fb8f62f5e684500c1e

LU-19917 mgc: dynamic MGS NIDs discovery

Enable fault tolerant MGS on the client: the client MGC can connect to
any server running an MGS follower, and it learns about those servers
on its own.

. a client MGC still tries the first MGS node on the mount line first,
  since with no follower running only the MGS answers, but takes the
  other nodes in a random order, so that clients spread the load
  across the followers there; a server MGC keeps the order given.
  mount.lustre(8) says so now
. the imperative recovery log adds the NIDs of every server that runs
  an MGS, by the LDD_F_SV_TYPE_MGS bit of its entry, to the client MGC
  import at the tail, so this works with no configuration while the
  NIDs from the mount line stay preferred.  A node already known
  keeps the NIDs it has, unlike a target import, since an MGS from the
  mount line may listen on more networks than its targets registered.
  That is independent of mgc.*.dynamic_nids, which covers the target
  imports
. the server MGC device is renamed "mgc<NID>", since it only ever
  connects to the primary MGS, while the client MGC stays "MGC<NID>".
  Userspace and the tests name the one they mean, and it is now what
  "lctl dl" and "lctl get_param mgc.*" show on a server.  A target no
  longer reuses a client's MGC, so it has no OBD_CONNECT_FTM to drop
. a client MGC pings at max(PING_INTERVAL_SHORT, obd_timeout / 20),
  capped at PING_INTERVAL, so it notices a dead MGS in time to not
  miss an IR update.  At the default obd_timeout that is 7s rather
  than 25s, only once followers have run (the IR log has named an MGS
  other than the one it is connected to) and while the client is
  connected to an MGS other than the primary one.  While MGS0 is down
  there are no IR updates to miss, and MGS0 on its primary node does
  not see the faster pings of every client
. a follower builds the fsdb on the first MGS_CONFIG_READ when the
  filesystem is in its CONFIGS directory, and serves the nidtbl it
  has.  A follower whose nidtbl is still empty answers -EAGAIN: its
  entries carry the leader's versions, so an empty table would claim
  a version the client never got entries for.  So does a follower
  that does not have the filesystem, since -ENOENT would make the
  client stop asking for good
. the IR log parser reports why it stops instead of breaking silently.
  Its "datalen < 0" test after the subtraction goes, the bound just
  above it already covers that
. a mount line names at most MGC_MGS_NODES_MAX MGS nodes, where it had
  no bound before; mount.lustre(8) says so and the rest are dropped
  with a console warning
. the tests that read a server MGC match either case, since the server
  they talk to may be an older one; an except file cannot express "the
  server has the rename", because that file is read from the server.
  An old client running its own recovery-small test_141 against a new
  server is the other way round and is excepted: its "*MGC*" globs
  match no server MGC namespace any more
. conf-sanity test_145g is new, and checks that a client MGC moves to
  a follower when the MGS stops; test_160, test_161 and recovery-small
  set_ir_status() are adjusted for a node that can run both an MGS
  follower and a client MGC
. conf-sanity test_73e waits for the targets to re-register after it
  restarts the MGS, and needs LU-19692 on the server to do so: the
  client now mounts as soon as an MGS answers, so it no longer waits
  out the whole reconnect and would otherwise get an empty OSC import
. conf-sanity test_250 updates the MGS version check to match the
  actual version in which the test and functionality landed

Test-Parameters: mdtcount=4 testlist=conf-sanity serverversion=2.17 env=CONF_SANITY_EXCEPT="73e 88a 250"
Test-Parameters: mdtcount=4 testlist=conf-sanity clientversion=2.17
Test-Parameters: mdtcount=4 testlist=recovery-small serverversion=2.17
Test-Parameters: mdtcount=4 testlist=recovery-small clientversion=2.17
Fixes: f5e198dc687a ("LU-18951 utils: lctl lcfg_erase erase fsname params")
Signed-off-by: Lai Siyao <lai.siyao@whamcloud.com>
Signed-off-by: Oleg Drokin <green@whamcloud.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Ib6d2b1ff6bce8d1a51a54982356c859448cf7f05

LU-19917 mgs: add MGS follower IR support

Let an MGS follower serve imperative recovery (IR).  The follower
keeps its own nidtbl, fed from MGS0's IR log, and notifies the
clients attached to it when that changes.

. when a follower attaches to the node's MGC, the MGC starts one
  recover cld of its own for the follower's filesystem, which reads
  <fsname>-mdtir from the start and updates no import, and stops it
  when the follower detaches.  Only that cld feeds the follower, so
  feeding it costs one read per IR event on the node however many
  targets it has, and OSTs still read no IR log for their own imports
. mgc_apply_recover_logs() hands the follower the validated entries of
  each page in one OBD_NOTIFY_IR_UPDATE, and mgs_follower_ir_update()
  applies them under one fsdb lookup, keeping the targets sorted by
  version.  It wakes the IR notify thread only when the nidtbl changed
. mgc_process_log() returns the enqueue error for a recover cld
  directly rather than falling through to mgc_process_cfg_log(), which
  on a combined MGS/MDT went on to parse <fsname>-mdtir as a config
  log
. a follower IR log whose entries the follower cannot apply re-reads
  from the start, since cfg_last_idx already covers the whole read
  and the MGS only re-sends an entry when that target's version
  changes.  A verdict on an entry - -EPROTO from the nidtbl update, or
  the entry validation - is not re-read, since it would only be
  repeated
. a follower does not read or write the persisted nidtbl version: it
  allocates no versions of its own and rebuilds the target list by
  replaying the log, so a restored version would claim coverage of
  entries it has not been given
. an entry whose NID size is larger than struct lnet_nid is skipped
  without failing the whole log
. conf-sanity test_145c checks that a follower's nidtbl follows MGS0's
  over repeated target restarts, and that a client mounted through the
  follower gets the restarted target's NIDs from it

Test-Parameters: mdtcount=4 testlist=recovery-small clientversion=2.17
Signed-off-by: Lai Siyao <lai.siyao@whamcloud.com>
Signed-off-by: Oleg Drokin <green@whamcloud.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I44dd044575d525a13c5a11b5d514b0c44e23b485

LU-20611 lfs: find over a target, with --device

lfs find can read a Lustre target directly from its device, instead of
walking a directory. It runs the same predicates over the target's own
objects through llapi_find_device(). For --device or a block device,
nothing needs to be mounted, and no client or MDS is used.

There are five ways to name the target:
- --device DEVICE: a block device, disk image or snapshot
- a block device given where a directory would be; lfs_find_is_device()
  checks with statx() for the type only, which sends no glimpse, and a
  disk image is a regular file, so it needs --device. A block device
  node stored on Lustre is a file, and is walked as before: statfs()
  tells it apart
- --target NAME: a target mounted on this node, found through
  osd-*.NAME.mntdev
- --fsname FSNAME: this node's mounted targets of that filesystem
- --local: every MDT and OST mounted here; the MGS is skipped
Only one target may be named. --internal adds the objects that the
target keeps for itself; without a target it is a usage error.

--fsname must be a name that mkfs.lustre accepts, checked with
llapi_name_verify(), so a typo is refused instead of matching
nothing. A label is split at its last '-', because a filesystem name
may contain '-'. Unlike lsnapshot -F, the lengths are compared too, so
test-MDT0000 is not taken as a target of testfs. There is no short
option, to keep -F free for --fid, as in lfs getstripe. A bare FSNAME
is still a relative path.

A second f* long option makes "--f" ambiguous: "lfs find --f" and
"lfs find -f" (which getopt_long_only() reads as a long option) meant
--foreign before, and are now refused. "--fo" still works.

The options are parsed by lfs_find_parse() and kept in struct
find_param: fp_device, fp_target and fp_fsname at its end, and two of
fp_unused_bits for --local and --internal. The library's find
functions do not read them. lfs_find() hands the search to the target
before it applies the walk's defaults, because the walk's default
thread count is one that llapi_find_device() refuses.
--maxdepth with a negative value is now refused; before, -1 was taken
as no limit.

--local and --fsname go on past a target that cannot be read, and
report the failure in the exit status. With --ost or --mdt they skip
the targets of the other type, which those options cannot name.
ENOTSUP does not end a sweep either: an OST cannot answer everything an
MDT can, and a node may serve a kind of target this build cannot read.
Only an MDT answers the layout options, so a sweep that reads an MDT
skips the OSTs: a node that serves an MDT and an OST answers --pool in
full and exits 0. With no MDT to read, or with --ost, each OST still
fails.

Without the scan backend from the server package, llapi_find_device()
fails with ENOTSUP and says why. This is what a client gets.

conf-sanity test_300a stops the filesystem and compares lfs find
--device on the MDT with a client walk made before: every FID the
client saw must be on the device, "--type f" must return every regular
file and no directory, and -printf %LO must give each file the OST
object FIDs that the client saw. Both sides print with -printf, and the
temporary files go through stack_trap. test_300b writes files on ost1,
and a scan of the stopped OST must print each one's object FID with
%LO. Both also run llapi_scan_device_test, for what lfs find does not
show: the scan statistics, thread counts, the pre-filter and bad
arguments. Each fails, not skips, if the scanner is missing, because
that is a broken install. run_tests() in
lustre/tests/llapi_test_utils.{c,h} is split, so that run_test_tbl()
can take a device instead of a mount point. test_300a also checks
--device=VALUE, both ways of naming a target twice, and that
--internal only adds objects. test_300c runs --local with --ost
on ost1's node and with --mdt on mds1's while the targets are mounted,
and checks that each finds objects. Where mds1 and ost1 are one
ldiskfs node it also checks that each reads only targets of its type,
that --local --stripe-count skips the OST and succeeds, and that
--target on the OST refuses it.
--local, --target and --fsname run again after everything is stopped,
and each must report what it could not find; an invalid --fsname is
refused. The plain-argument form is checked only when the MDT is a
block device. test_300d compares --device with a walk for each
predicate and for -printf %Lo, and checks the refused options and an
OST sweep. llapi_scan_device_test test7 calls llapi_find_device()
directly, for its own refusals and statistics.

lfs-find.1 documents the five selectors, and how a search of a target
answers differently: one MDT of a DNE namespace, sizes from SOM, --ost
and --mdt naming the target, and the refused options.

Test-Parameters: trivial
Test-Parameters: testlist=conf-sanity env=ONLY=300a,300b,300c,300d
Signed-off-by: Hiroshi Nishida <hnishida@thelustrecollective.com>
Assisted-by: ClaudeCode:Opus-5 llm_code_and_review_tools
Change-Id: Ib25109943ad40afbc2d272a65e70c364c376b2b7

LU-19916 mgs: keep MGS follower config and rules current

An MGS follower serves its clients the copies of the <fsname>-client,
params and sptlrpc logs in the CONFIGS of the target it runs on, but
nothing told it when MGS0 changed them, so its clients kept the old
config until they reconnected.  Nor did it have MGS0's
mgs.srpc.flavor.* rules, which MGS0 keeps in _mgs-sptlrpc: with an
empty rule set tgt_connect_check_sptlrpc() lets an MGS take any
flavor, so a client without a flavor could get the config from a
follower that MGS0 would have refused.

The follower registers as an observer of the MGC so it hears about
config changes; obd_notify() takes a union obd_notify_data to carry
the payload.  It is unregistered before it is freed, since the MGC is
shared by every target on the node and outlives any one of them, and
the MGC holds the observer link for read across every notify:
unregistering takes it for write, so an unmount waits out a notify
already inside the MGS rather than tearing it down underneath it.  The
MGC only notifies for the clds of the target that runs the follower,
whose copies the follower serves.  A follower queues each lock revoke
to its own workqueue, since a revoke waits until every one of its
clients has cancelled the lock, and the requeue thread that notifies
it serves every MGC on the node.

While a follower runs, the MGC also keeps a copy of _mgs-sptlrpc in
its target's CONFIGS, fetched by the requeue thread rather than under
server_mgs_lock(), since MGS0 may be down.  The follower loads the
rules from that copy when it starts and whenever it changes, and
refuses every client until it has one.  It loads them in the notify
itself, which the MGC sends under the cld_lock of that log, so that
the next copy cannot rewrite the log while it is read.  MGS0 now
always keeps an _mgs-sptlrpc, empty if it has no rules, so that a
copy also says there are none.  A follower still sends a client with
an sptlrpc flavor to MGS0.

conf-sanity test_145d checks that a follower whose target has no copy
of _mgs-sptlrpc refuses a client while MGS0 is down, and serves it
once MGS0 is back, test_145e that a client of a follower sees a
set_param -P made on MGS0 without reconnecting, and test_145f that a
follower takes and drops an mgs.srpc.flavor rule set on MGS0.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I1fc8dd86c86574c20c470a9800bf25a2283ebbe5

LU-15437 llapi: read parameter files in larger chunks

llapi_param reads a parameter file PAGE_SIZE bytes at a time into a
buffer allocated from the heap on every call.  Read 64KiB at a time
into a stack buffer instead, so a large parameter such as a full
"fldb" dump is read in far fewer syscalls and without the per-call
allocation.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-4.8 ltvm,llm_code_and_review_tools
Assisted-by: Codex:gpt-6.1-sol
Change-Id: I8db7ffcc1246c236359637b578acdd28523ebbe5

LU-21066 ldiskfs: avoid FORTIFY warning in ext4_set_dirdata()

ext4_set_dirdata() writes the LUFID record after the filename
through de->name[], which is declared as char name[EXT4_NAME_LEN].
For names of 238 bytes or longer the 17-byte LUFID record runs past
the end of that array.  The bytes are still inside the directory
record, but on kernels built with CONFIG_FORTIFY_SOURCE (all EL10
kernels) the memcpy() triggers:

  memcpy: detected field-spanning write (size 17) of single field
    "&de->name[de->name_len + 1]" at ldiskfs/namei.c:1720 (size 16)
  WARNING: ... at ldiskfs/namei.c:1720 ldiskfs_set_dirdata+0xc2/0xe0

on the MDS, from mdt_create() -> ... -> add_dirent_to_buf(), for any
client create with such a name.  With panic_on_warn this panics the
MDS.

Use unsafe_memcpy() for the write, matching the existing workaround
for the same FORTIFY_SOURCE false positive in
ext4_htree_store_dirent().  The dirdata bytes lie past the
EXT4_NAME_LEN bound but within the directory entry's rec_len; the
on-disk format and the bytes written are unchanged.

This covers the ext4-dirdata-core.patch copies: rhel10.0, rhel10.1,
linux-6.12, linux-6.18 (also used by rhel10.2) and linux-7.0 (also
used by ubuntu26).  The same memcpy() pattern in ext4_insert_dentry()
in the ext4-data-in-dirent.patch series (ubuntu24, the 6.6-6.11
mainline and rhel9 kernels) is left for a follow-up.

Fixes: 409935cc7094 ("LU-19847 ldiskfs: dirent and fscrypt+case_insensitive")
Test-Parameters: serverdistro=el10.1 testlist=sanity
Test-Parameters: serverdistro=el10.2 testlist=sanity
Signed-off-by: Artem Blagodarenko <ablagodarenko@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5
Change-Id: Ifc28965d9aab16033a5a6489451eeef1585250ad

LU-20879 target: filter OUT update protocol for MDS

Check that OUT RPCs are only on connections from an MDS to ensure the
OUT protocol does not need to be supported across a large number of
releases for interoperability.  Issue found during testing of
LU-20879 patches.

Add sanity.sh test_435 to confirm.

Lustre-change: https://review.whamcloud.com/69467
Lustre-commit: 9168cf113e369d6a656ee9ae089ae2e55a93df80

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Icf9bac7011e9e520839f2f28e8908bb1123ebbe5

LU-18672 lmv: update stale tgt statfs if uninitialized

If LMV finds an MDT with a statfs timestamp that is over
1h old, then it will forcefully refresh this MDT's stats.
However, the 1h interval is too long for some workloads.

Always try to update the statfs cache if it is uninitialized, even
before the client uptime reaches the cache refresh interval.

Assisted-by: Codex:gpt-6.1-sol
Fixes: e262e0ffbe79 ("LU-17087 lmv: update stale tgt statfs every 1 hour")
Signed-off-by: Max Wang <wamax@amazon.com>
Change-Id: I7498a7ae9d6ea54fe9a868187b03415779d5d3da

LU-16832 lnet: add nanosecond delay latency support

Introduce nanosecond-resolution latency for LNet delay
fault injection. The previous interface accepted latency
only in seconds (u32). This change promotes the field to
nanoseconds (ktime) and plumbs it so that sub-second delays
in nanoseconds can be expressed precisely. Since this
changes the Netlink output we bump the LNet netlink
family version. The user land code is updated to accept
and process the new latency_ns option for the non ioctl
approach. All ioctl usage only accepts seconds. The
internal timer is moved to hrtimer for finer level of
time resolution.

Test-Parameters: trivial
Signed-off-by: Sohei Koyama <skoyama@ddn.com>
Signed-off-by: James Simmons <jsimmons@infradead.org>
Change-Id: I9ed1bd34cef0f0bf647f87d17dd68f05274e2b28

LU-20963 lod: clear ltd_discon when an MDT is reactivated

Since lod_statfs_and_check() also sets ltd_discon for a target that
is already inactive, an MDT deactivated with "mdc.active=0" got
ltd_discon set by the next statfs update.  Reactivating it with
"mdc.active=1" only set ltd_active again in lod_process_config(), and
statfs left ltd_discon set for an active target, so
lod_mdt_alloc_rr(), lod_mdt_alloc_qos(), lod_sync() and
lod_obd_set_info_async() would skip the MDT indefinitely.

Clear ltd_discon when lod_process_config() makes the MDT active.
Change ltd_active there under lod_lock, as lod_statfs_and_check()
does, and also mark the MDT inactive before closing its update llog,
so that new distributed transactions don't use it in between.

lod_process_config() also did not update ld_active_tgt_count when it
changed ltd_active, so the count of active MDTs could be wrong after
an MDT was deactivated or reactivated by config.  Update it and set
LQ_DIRTY there, as lod_statfs_and_check() does.

Add sanity test_27yc to check that a striped directory uses an MDT
again after it is reactivated by conf_param.

Fixes: ced540165ef5 ("LU-16623 lod: handle object allocation consistently")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I73135d6dc1a60893c5afbee65ee9d08b233ebbe5

LU-14319 flr: handle foreign mirrors in more places

A file attached to PCC-RO has a foreign HSM mirror with no data in
Lustre, and some code would handle it like a data mirror:
- lov_foreign_hsm_to_le() wrote the archive ID and version of the
  buffer to itself, so these fields of an HSM component were left
  with stale buffer contents on disk;
- a client setting a layout taken from such a file, e.g. a copytool
  restoring the striping of an archived file, or "lfs setstripe
  --copy", would get -EINVAL, as lod_qos_parse_config() parsed the
  foreign component as a plain one;
- "lfs mirror extend -N" would use the foreign mirror as template
  for the new mirror and fail with -EINVAL;
- "lfs mirror resync" would try to copy data into a stale foreign
  mirror;
- the MDT would not see a released file with a foreign mirror as
  released, and return neither its size nor its block count.

Fix lov_foreign_hsm_to_le().  Drop foreign mirrors covering [0, EOF)
from the layout of a new file set by a client, in the lov_foreign_md
form or as the plain component with LOV_PATTERN_FOREIGN that
llapi_layout_to_lum() makes of them.  Skip them in
llapi_layout_get_last_init_comp(), which also changes what "lfs find
--printf %L*" prints for such files, and in the stale components that
"lfs mirror resync" copies and reports as resynced, and do not clear
the stale flag of an HSM or PCC mirror at RESYNC_DONE.  Skip foreign
components in
mdt_hsm_is_released(), as mdt_hsm_set_released() does.  Also swab
all the components of a layout after a foreign one in
lustre_swab_lov_comp_md_v1().

So "lfs mirror resync" of a file whose only stale mirror is a
foreign one returns without a change, and leaves the file in the
WRITE_PENDING state until that mirror is updated.  "lfs migrate" of
a file with a foreign mirror drops the mirror instead of failing.

Add sanity-pcc test_53 to check mirror verify, setstripe --copy and
mirror extend of a PCC-RO file.

Test-Parameters: fortestonly testlist=sanity-hsm,sanity-pcc
Fixes: aebb405e32e4 ("LU-10499 pcc: use foreign layout for PCCRO on server side")
Fixes: ce98bfe5f726 ("LU-10499 pcc: add readonly mode for PCC")
Fixes: 61a002cd8631 ("LU-13602 flr: skip unknown FLR component types")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I3b1a46788433ffa91bb787583f54a3c4853ebbe5

LU-20690 lod: write 1+N EC data around a lost OST

A write to an EC file would fail while the OST of a data stripe in a
component of 1-data raid sets (--ec 1+N, or one data stripe) was
unavailable: the data mirror is the only mirror that can be the write
primary, and its object could not be written.  Yet each of the N
parity objects of such a raid set holds a copy of the data object at
the same object offsets.

When a write era starts (RDONLY -> WRITE_PENDING) the parity is still
in sync, so lod_ec_swap_unavail() swaps each unavailable data object
of such a component in the write extent with a parity object of the
same raid set on an available OST.  The data mirror stays a complete
write primary, and the parity component, which the write stales as
before, holds the unavailable object until the next resync rewrites
it.  The filter_fid of a swapped object is updated from the layout
that the next write to it carries; until then LFSCK reports an
unmatched pair and repairs the filter_fid.  The swapped-in object may
be outside the pool or OST list of the data component.

The swap needs each parity copy to be as large as the data object.
A copy written by resync with O_DIRECT ended on a page boundary, past
a file size that is not page aligned, and ended at the last data when
the file had a trailing hole, so a swapped-in copy would change the
file size.  The EC resync now truncates the parity mirror to the file
size when EOF is inside a component of 1-data raid sets, as FLR
resync does for a mirror.  Parity resynced by an older lfs is not
trimmed.

Swapping only happens at the start of a write era, while the parity
component is in sync.  An OST lost during a write era, and a 1-data
raid set in a component with larger raid sets, whose parity is not
at the data offsets, still need the OST to return.

Add sanity-ec test_313 to write 1+2 files with a data OST unavailable,
for an unaligned size, a sparse tail, a second PFL component and the
second stripe of a 2-stripe component, and check the swap, the file
size and the data before and after resync.

Test-Parameters: trivial testlist=sanity-ec,sanity-flr ostcount=8
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Iab02681175f14e69d78441647d6f1bd3b53ebbe5

LU-20434 build: strncpy() to strscpy() non-obvious cases

Some cases of strncpy() want to overwrite some bytes
of the destination and do not want to truncate the destination.

mdt_path_current() and mgs_replace_mdtname() use memcpy() to
overwrite segments.

mdd_xattrs_migrate_prep() can use strscpy().

nodemap_test_nid() should use strscpy_pad() as it is always passed
the sizeof() the buffer and the zero padding is needed. The buffer
is copied to userspace in full by server_iocontrol_nodemap(), so
zero it at declaration as well to cover the early return when no
nodemap is found.

Signed-off-by: Shaun Tancheff <shaun.tancheff@hpe.com>
Signed-off-by: Timothy Day <timday@thelustrecollective.com>
Change-Id: I8b70127fb5e4f870ff856bb2344f402eb2bd5f68

LU-14144 utils: find Lustre module params without --module

"set_param -P" is applied on each node by running "lctl set_param"
from an upcall or udev rule, which can't pass --module, so module
parameters could not be set persistently.

If no Lustre parameter matches, fall back to Lustre/LNet module
parameters, with the new LLAPI_PARAM_MODULES_FALLBACK flag for
llapi_param_get_paths_flags().  Existing patterns like "osc.*" are
unaffected since they match first.

Have "set_param -P" refuse parameters that are read-only at runtime,
since they would fail on every node at every mount.  This is also
done for "set_param -P -F".  A wildcard device type is not checked,
since a parameter may be read-only on servers but not on clients.

Fixes: 7c7edbcaa8ce ("LU-14144 utils: allow /sys/module/OBD/parameters/*")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I6594a5b8a7a28243617a12640127b4ca173ebbe5

LU-11962 lod: prepare for a SOM mirror in FLR files

Strict Size-on-MDT of files that are not mirrored will use a mirror
made of a single data-less foreign HSM component flagged HS_SOM, so
that clients send a layout write intent before they modify the file.
Prepare servers and utilities to handle files with such a mirror:

- move the code that appends an HSM mirror to a layout out of
  lod_declare_pccro_set() into lod_layout_add_hsm_mirror();
- define HS_SOM, shown as "som" by "lfs getstripe";
- clear the stale flag of a SOM component at RESYNC_DONE, as it has
  no data to resync, and accept its ID in the list of resynced ones;
- copy no data into a SOM mirror in llapi_mirror_resync_many(), and
  read from no foreign mirror in llapi_mirror_find(), so "lfs mirror
  resync" makes such a file RDONLY again;
- do not reuse a SOM mirror as the HSM mirror of PCC-RO.

Test-Parameters: trivial testlist=sanity-flr,sanity-pcc
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I28ceb8221a6402dfd69362989e9705ccb85056a8

LU-11962 ofd: prepare layout version checks for fencing

To fence writes from clients that the MDT evicted, OSTs compare the
layout version clients send with that of the object, but:
- the first layout version of an object can come from a client RPC,
  so clients cannot send the version of a non-FLR layout: a client
  flushing pages cached before another client instantiated a
  component would then be refused;
- "lfs mirror split" that leaves a file not mirrored keeps a write
  era that an interrupted resync closed on its objects.

Only record the first layout version of an object from the MDT or a
resync write in ofd_object_ff_update() and ofd_object_fallocate().  Make
mdd_xattr_split() send the new layout version to the objects of a file
that is no longer mirrored.  This prepares for clients to send a layout
version with every modifying RPC, and for OSTs to refuse unversioned
ones there.

Test-Parameters: testlist=sanity-flr
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ifb017449eac320db97665e7fabaa6d1a24f97ba9

LU-11962 flr: add strict SOM for non-mirrored files

The MDT can only return the size and blocks of a file without a
glimpse of every OST object when the file has strict Size-on-MDT,
which so far only "lfs mirror resync" sets, on mirrored files, so
stat() of files that are no longer modified still needs OST RPCs.

Add "lfs somsync --strict" and llapi_file_som_sync() to make a file
RDONLY with strict SOM, using the FLR resync protocol: with a write
lease, MDS_REINT_RESYNC on a non-FLR file, including one with a plain
layout, now appends a mirror made of a single data-less foreign HSM
component (HS_SOM), moves the file to SYNC_PENDING and closes its
write era on the OSTs.  The client then gets the final size and
blocks, and RESYNC_DONE makes the file RDONLY with SOM_FL_STRICT.  A
later write needs a layout write intent, which moves the file to
WRITE_PENDING and SOM to STALE as for any mirrored file.  Clients
since 2.15 handle such a layout unchanged.

Conversion needs write permission, is refused while the file is open
elsewhere, and is refused if mdt.*.enable_strict_som=0.  "lfs migrate"
makes SOM strict again after migrating an RDONLY file.

As for any mirrored file, a client that the MDT evicted but that
still holds the layout from before the conversion can write without
the MDT knowing until it notices the eviction.  Fencing such writes
needs clients to send a layout version for every file, which is left
for a later patch.

Test-Parameters: testlist=sanity-flr fstype=zfs env=ONLY=44h,ONLY_MINUTES=30
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I5fa514f54fe68d64111a2d54c1942137355fcfe7

LU-10499 pcc: output valid state for valid cached files

There are two cases where the command 'lfs pcc state' reports
'none' for PCC status of a file:
- File has not been cached at all into PCC. When the file is read,
  data will come from remote Lustre filesystem.
- File was cached into PCC but was detached later, while keeping
  the PCC copy (e.g. 'lfs pcc detach -k').  When the file is read,
  its layout version is compared against the PCC copy, and if the
  version matches, the file is attached again and the data will
  come from PCC.  The inode must still be cached on the client
  with its layout, so this is not reported after the client cache
  is dropped (e.g. 'sysctl -w vm.drop_caches=3').

This patch adds a valid flag to distinguish between these two
states. For the latter case, the command 'lfs pcc state' will
output as follows:
$ lfs pcc state /mnt/lustre/f105.sanity-pcc
file: /mnt/lustre/f105.sanity-pcc, type: none, flags: valid

Fixes from the original patch:
- check the PCC copy against the cached layout generation, as at
  open, so that 'lfs pcc state' does not refresh the layout with
  a layout lock RPC.
- do not set PCC_DATASET_NONE on the inode when no valid PCC copy
  is found, which would stop the file from being auto attached.
- also report the valid flag for a detached PCC inode that is not
  freed yet.
- only report the valid flag if the PCC backend auto attaches files,
  which would use the PCC copy.

Document the existing 'aborting' flag in lfs-pcc-state.1 as well.
Clear the state for each file in 'lfs pcc state', since the flags
of a file that is not cached on the client are not set, and would
otherwise be printed from the previous file.

Add sanity-pcc/test_105 to verify it works as expected.

Test-Parameters: trivial testlist=sanity-pcc
Signed-off-by: Qian Yingjin <qian@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I1d729bfe550b1bde0e78e8b3ec8217cd598fb64c

LU-8933 lod: leave inactive targets out of the RR array

Inactive OSTs stayed in the round-robin array, so every layout that
reached one skipped it and used up an index, and the OST after it in
the array got its share of first stripes as well as its own.

Leave inactive targets out of the array built by lod_qos_calc_rr(),
unless all of them are inactive, and rebuild the arrays when a target
becomes active or inactive, counted in lq_rr_gen along with failure
domain changes.  The RR allocators index the array by its own size
rather than the pool's.  The periodic statfs update still checks the
inactive targets, and notices when they become active again.  OSTs
that are full, read-only, or have max_create_count=0 are inactive for
this too, so they also leave the array until they can be used again.
This also stops directory stripes being allocated on an inactive MDT
that is not disconnected, e.g. one that is full or deactivated by
config, which lod_mdt_alloc_rr() and lod_mdt_alloc_qos() did not check
for.  Keep returning -EINPROGRESS when no target could be used and a
target of the pool is disconnected, or one left out of the array
became active since it was built, and don't let the smaller array
raise the rounds of an overstriped directory above
lod_max_stripes_per_mdt.  Overstriped OST layouts from the RR
allocator are likewise spread over the active OSTs only, e.g. "lfs
setstripe -C 8" with 1 of 8 OSTs inactive gets 8 stripes with 2 on one
OST, instead of 7 stripes.

Rebuilding the arrays after a target becomes active or inactive only
tries to take lq_rw_sem, and the allocators keep using the old array,
so creates don't wait behind allocators sleeping in precreate
(LU-15393).  Failure domain changes are now rebuilt the same way.
Only if the array stays stale for 10 * qos_maxage, or at once and then
every qos_maxage after an omitted target becomes active, does one
thread wait at most 2s for it, as QoS allocation does.  Move that
timed wait to lu_down_write_timeout() for both, and the backoff to
lu_rr_should_wait() and lu_rr_wait_failed(), which lod_rr_test checks.
Count the targets that become active in lq_active_gen for this.
Also avoid a static checker warning about lrfs_count - 1 underflowing
in lu_rr_fdoms_init().

Add sanity test_51i to check the first stripe balance and overstriping
with OST0001 deactivated, and test_51k to check that RR and QoS
directory stripes skip a deactivated MDT.  test_51i waits until every
OST has enough precreated objects, using up the short FID sequence
tail of any OST that has too few.  With 8 OSTs and 800 2-stripe files
test_51i gives these first stripes per active OST:

  before  50-200
  after   113-115

Check up to 32 OSTs in sanity test_51g, or 64 with SLOW=yes, and
check the OSSs used by other mirrors once per layout in lod_rr_test
rather than once per OST, so that test_51g takes about 20s.

Use the renamed timer cleanup API where available, with a fallback for
older kernels.

Fixes: ced540165ef5 ("LU-16623 lod: handle object allocation consistently")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Assisted-by: Codex:gpt-6.1-sol
Change-Id: I8361eea7d707559ba65a9377fa642ca7833ebbe5

LU-20923 llite: handle unexpected MDS reply contents

Several llite paths relied on invariants that an MDS reply or granted
lock is expected to satisfy, and handled only the expected case.  Make
each path handle the unexpected contents gracefully:

 - ll_update_inode() copies the FID from the reply body into the
   inode.  Check the reply FID against the inode FID before applying
   any attribute, and return -EPROTO on a mismatch, so a stale or
   foreign reply is dropped rather than partly applied; the FID is
   still populated the first time, when the inode FID is not yet set.

 - ll_inode_from_resource_lock() returns the inode cached on a lock
   resource, which is keyed by FID.  When the cached inode's FID does
   not match the resource name, log it and return no inode (as for the
   bogus-magic case) so the caller skips it; the grabbed inode is
   released with iput() after the resource lock is dropped, as iput()
   may sleep.

 - ll_lock_cancel_bits() maps an OPEN-bit lock's mode to the open mode
   to close.  For a lock granted in any other mode, log it and skip
   the open-close, leaving the OPEN bit cleared.

 - ll_lease_open() requires the open intent reply to carry the
   DISP_ENQ_OPEN_REF disposition.  Return -EPROTO when it does not; no
   open handle has been filled at that point, so only the intent is
   released.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I0515212561d3943f88561736616bfd09f43ebbe5

LU-20235 utils: replace llapi_mirror_copy_many() code

The llapi_mirror_copy_many() function was implemented during early
FLR development and has remained largely unused/unchanged since
then. It appears only to be used by the (unused?) "lfs mirror copy"
command and a few test cases. It is lacking "proper" sparse file
support, in that it is truncating the whole target mirror(s) and
then copying the data over, which has some risk of data loss if
the copy process is interrupted and the primary mirror is lost.

While this function cannot immediately be removed due to API
compatibility requirements, it would be better to use the copy engine
in llapi_mirror_resync_many() function that is used by "lfs mirror
resync", that has seen a number of improvements (better sparse file
handling, progress statistics) and will continue to be improved in
the future.

Test-Parameters: trivial testlist=sanity-flr,sanity-pfl
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Change-Id: Ic7f41a9146576fe2f91c6249753208ab0a3ebbe5

LU-18823 fld: replicate the full FLDB to every MDT

Only MDT0000 holds a complete FID Location Database (FLDB).  Each
other MDT keeps only its own sequence ranges on disk, fetched once
at mount, and caches other ranges in memory without persisting
them, so no MDT other than MDT0000 has a copy that could rebuild
the FLDB if MDT0000 were lost.

Keep a full on-disk copy of the FLDB on every MDT:

 - fld_server_read() returns the whole FLDB (all MDT and OST ranges)
   when the request range type is ANY, keeping the batched read.
 - fld_update_from_controller() fetches the entire FLDB at mount on a
   non-MDT0 MDT instead of only that MDT's own ranges.
 - mdt_register_lwp_callback() no longer skips the one-time FLDB
   refresh when the super-sequence is still being allocated from the
   controller (-EINPROGRESS/-EAGAIN) at the connect point.  The
   FLD_READ RPC is resent by ptlrpc until the controller is ready,
   so the refresh completes without a local retry loop.
 - a range looked up on demand is persisted with fld_insert_entry()
   rather than only cached, so ranges allocated after the mount
   refresh are added to the local FLDB as they are used.

The on-disk FLDB from any MDT can then be dumped and written back to
MDT0000 to restore it (see the "fldb" parameter).  MDTs run in
lockstep within a filesystem, so no connect flag is used to
negotiate the full read.

Test-Parameters: trivial testlist=conf-sanity
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I47ebaa6eadbfbdeb57784e0b77ce9e6f683ebbe5

LU-20879 target: consolidate OUT_UPDATE handling

Fetch OUT_UPDATE buffers in out_handle() with tgt_update_bufs_get(),
the helper shared with mdt_batch(), instead of its own copy of the
inline/bulk buffer setup, and check each update buffer with the new
out_update_request_check() helper.

Check opcode in out_handler_find().  Check the object mode with
dt_mode_is_valid() before deriving object format.

Return -EINVAL from dt_record_write() when object is not writable.

Swabbing is now done in out_update_request_check(), so RMF_OUT_UPDATE,
lustre_swab_object_update(), and lustre_swab_object_update_request()
are now unused and are removed.

Test-Parameters: trivial
Fixes: dcaf8a6724ef ("LU-6741 osp: Pack small request inline")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I2cdb6c2ca8525bd62e9c1a41fafa6969d23ebbe5

LU-20923 mdc: keep existing inode on a lock FID collision

An MDC lock resource is keyed by the object FID, and
mdc_set_lock_data() attaches the inode being set to that resource.
When the resource already references a different inode that is still
live, keep the existing inode attached and do not attach the new one;
a later access re-enqueues the lock.  This replaces the previous
requirement that a resource could only ever reference an inode on its
way out (I_FREEING).

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I4da7da3f4846a9f38d09ec09c7d51c994d3ebbe5

LU-20923 lod: reject a remote striped create with no layout

lod_declare_striped_create() cannot select OST objects for a remote
object, so the caller must supply the stripe layout (lovea), which
normally happens only during migrate (mdd_migrate_create).  Return
-EINVAL when the layout is absent, so a remote striped create with no
layout fails cleanly instead of proceeding without one.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ib758bd0670ec7c4c3f82cee5e613c55cda3ebbe5

LU-20923 mdd: reject a PCC create without a layout

A PCC create (MDS_OPEN_PCC in cr_flags) must carry a layout
(MDS_OPEN_HAS_EA).  In mdd_create(), return -EINVAL for MDS_OPEN_PCC
without MDS_OPEN_HAS_EA rather than proceeding.  The reject path jumps
to the out_stop/out_free cleanup, which frees hsm_buf when
MDS_OPEN_PCC is set, so also initialize hsm_buf at its declaration
(like pin_buf); otherwise that path, which runs before hsm_buf is
memset, would free an uninitialized buffer.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I038b27bd1b99c869084e7d5c2fe79bf4073ebbe5

LU-20923 mdt: validate metadata request fields before use

Several MDT request-handling paths assumed the request format and the
operation encoded in the request agreed, and read format-specific
fields or mapped values without first checking that assumption.  Make
each path validate its inputs:

 - mdt_getxattr_pack_reply() serves both the intent getxattr format
   (no RMF_NAME, sized into RMF_EAVALS) and the plain MDS_GETXATTR
   format (RMF_NAME, sized into RMF_EADATA), selecting the operation
   from mbo_valid.  Require that the requested operation matches the
   fields the format provides - a name is fetched only when RMF_NAME
   is present, and OBD_MD_FLXATTRALL is requested exactly when the
   reply format carries RMF_EAVALS - and return -EPROTO otherwise.

 - mdt_reint_open() serves only the open intent.  Confirm the request
   uses RQF_LDLM_INTENT_OPEN, returning -EPROTO before fetching
   RMF_DLM_REP, rather than relying on the format.

 - mdt_create_unpack() and mdt_open_unpack() take the create mode from
   the request, and object creation maps its file type with
   dt_mode_to_dft().  Force S_IFREG for an O_CREAT open (which only
   ever creates a regular file, keeping the permission bits), and
   reject a REINT_CREATE whose mode does not name a supported file
   type with -EINVAL.

 - mdt_intent_getattr() and mdt_intent_lock_replace() hold a
   remote-object lock in mlh_rreg_lh.  Release that lock on the
   no-positive-disposition and no-local-lock exits, where it was
   previously left held, so it is dropped on those paths too.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I6aa2f0306dfb2ef8739d353805d0653e023ebbe5

LU-20565 tests: use EC_* layouts in sanity-ec 67a-71d

sanity-ec degraded-read subtests 67a-71d had a gate of 8 OSTs, and
most hard-coded an EC 4+2 layout although the geometry did not
matter to what they tested.  They would be skipped on the 4 and 7
OST test sessions.

Use the EC_ARG, EC_DSTRIPE and EC_CSTRIPE defaults that enable_ec()
scales to OSTCOUNT and drop the gates, so they run with 3 OSTs.  Put
each PFL boundary in front of an EC component on a multiple of the
row width.  68d mixes a 2+1 component with the default layout and
needs 4 OSTs so the two differ.  With only one parity stripe, 69d
skips its two-OST part, and 69b and 71c, which only fail two OSTs,
are skipped.  68a (2+1), 68c (4+1) and 71b (with a 4+2 file) keep
their layouts, with the gate lowered to 3, 5 and 6 OSTs.

Test-Parameters: trivial testlist=sanity-ec
Test-Parameters: testlist=sanity-ec ostcount=4
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Id80cd74077c3543b9b91ff95b32be302ef3ebbe5

LU-20565 tests: use EC_* layouts in sanity-ec 58b-65d

sanity-ec degraded-read subtests 58b-65d hard-coded an EC 4+2
layout with a gate of 6 or 8 OSTs, although the geometry did not
matter to what they tested.  They would be skipped on the 4 and 7
OST test sessions.

Use the EC_ARG, EC_DSTRIPE and EC_CSTRIPE defaults that enable_ec()
scales to OSTCOUNT and drop the gates, so they run with 3 OSTs.
Scale sizes and offsets tied to a 4-stripe row to EC_DSTRIPE, and
put each PFL boundary in front of an EC component on a multiple of
the row width.  60d and 65c mix a 2+1 component with the default
layout and need 4 OSTs so the two differ.  With only one parity
stripe, 59a and 63c skip their two-OST part, and 58b, 61d and 65d,
which only fail two OSTs, are skipped.

Test-Parameters: trivial testlist=sanity-ec
Test-Parameters: testlist=sanity-ec ostcount=4
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I8a0d5693af6204d29defa5da9fbb505a123ebbe5

LU-20565 tests: use EC_* layouts in sanity-ec 46d-52c

sanity-ec degraded-read subtests 46d-52c hard-coded an EC 4+2
layout with a gate of 6 or 8 OSTs, although the geometry did not
matter to what they tested.  They would be skipped on the 4 OST test
sessions, and the 8 OST gates also on the 7 OST sessions.

Use the EC_ARG, EC_DSTRIPE and EC_CSTRIPE defaults that enable_ec()
scales to OSTCOUNT and drop the gates, so they run with 3 OSTs.
Scale sizes, offsets and stripe indexes tied to a 4-stripe row to
EC_DSTRIPE, and put each PFL boundary in front of an EC component
on a multiple of the row width.  With only one parity stripe the
concurrent-I/O subtests 49b-49d, 50a and 50b fail one OST instead of
two, and 52c, which needs a data and a parity OST down, is skipped.
52b now fails EC_CSTRIPE + 1 data OSTs to exceed the parity.

Test-Parameters: trivial testlist=sanity-ec
Test-Parameters: testlist=sanity-ec ostcount=4
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I957515862d0ba36067a7d40b3d3808f7ce3ebbe5

LU-20565 tests: use EC_* layouts in sanity-ec layout tests

sanity-ec subtests 1f, 1h, 1k, 2b, 2f, 7b, 7c and 21c hard-coded an
EC 4+2 or 3+1 layout, most with a gate of 6 to 8 OSTs, although they
only check how parity components follow the data components, how a
parity mirror is split, or a migrate between EC layouts.  Most would
be skipped on the 4 and 7 OST test sessions.

Use the EC_ARG, EC_DSTRIPE and EC_CSTRIPE defaults that enable_ec()
scales to OSTCOUNT.  2b, 2f, 7b and 7c now run with 3 OSTs.  1f, 1h,
1k and 21c mix a fixed 2+1 layout with the default one, and need 4
OSTs so the two layouts differ.  Put each PFL boundary in front of
an EC component on a multiple of the row width.

Test-Parameters: trivial testlist=sanity-ec
Test-Parameters: testlist=sanity-ec ostcount=4
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ibb58f4778fdd722a8cc663b8f5a6f285dd3ebbe5

LU-20565 tests: merge similar sanity-ec degraded-read subtests

Many sanity-ec subtests ran the same create, write, resync and
degraded-read sequence and differed only in the file size, stripe
size, read offsets or the write before the resync.  Each repeated
the setup and the fault handling, and most hard-coded a 4+2 layout
with a gate of 6 or 8 OSTs, so they would be skipped on smaller
configurations.

Merge each group into one subtest that loops over the cases, and
keep the number of the subtest that remains:

- 61a: sub-stripe, partial-stripe, partial-row and multi-row file
  sizes with 64K, 256K, 1M and 4M stripes (42b 42c 46a 46b 46c
  61b)
- 58a: every pair of failed data OSTs, for 2+2 and for the default
  layout when it has 2 parity stripes (43b 45b 45d 52a 68b)
- 41a: aligned, unaligned and multi-row reads (41b 41c)
- 70a: overwrite then resync: across a row boundary, unaligned,
  after an extend, a partial row, either PFL component (67c 67d
  70b 70c 70d)
- 62a: staged, unaligned and sub-stripe appends (62b 62d)
- 60a: truncate mid-stripe, to a row boundary, to 0, and before an
  extend (60b 60c 73c)
- 32a: OST stop and start, then write and resync, twice (30c 33a)
- 34a: mirror resync, read and verify keep the size (34b)
- 20: parity component layout and stripe size for 4M, 1M and 64K
  stripes (1j)

Add ec_check_degraded() to read a file with the first, or each, data
OST that holds no parity failed, and optionally two of them.

The merged subtests use EC_ARG, EC_DSTRIPE and EC_CSTRIPE and size
files in rows of EC_DSTRIPE stripes, so they run with 3 OSTs (58a
with 4), and fail two OSTs only when EC_CSTRIPE >= 2.  Every
degraded read now compares the data with the healthy copy and
drops the client locks first: 41c read several ranges after one
drop_caches, 33a only checked that the read succeeded, and the
size of the unaligned appends in 62b was not checked.

Test-Parameters: trivial testlist=sanity-ec
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I430d4648463a5e78d21c6a2dd58b4ce7b03ebbe5

LU-14144 utils: remove "lctl modules" command

"lctl modules" printed gdb add-symbol-file commands from a list of
module names and source paths that has not been updated in years,
so it is missing most server modules and names stale .o files.
The kernel's gdb "lx-symbols" script, crash "mod -S", and drgn all
load module symbols properly.

Remove the command rather than keep another list of module names.
Remove the unused "ogdb" symbol dumps from test-framework.sh and
run-llog.sh.  Fix conf-sanity test_25, which passed the bogus .o
paths to rmmod and so never tried to remove any modules.

Test-Parameters: trivial
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I918b9ab2ab3d0c7fc38f575989860dadd13ebbe5

LU-10606 lod: store HSM attributes in a layout mirror

The HSM attributes of a file are kept in the "trusted.hsm" xattr,
apart from its layout, so FLR and PCC cannot see that a file has an
archive copy, nor that the copy is out of date.

Store them in a data-less foreign mirror of the layout instead, as
PCC-RO does, with type "posix", the HSM state flags and the archive ID
and version.  lod.*.hsm_layout selects where they are stored when they
change: 0 for "trusted.hsm" (the default until 2.19.53), 1 for the
layout, -1 for both.  A file without a layout keeps them in the xattr.
LOD reads the mirror first, then the xattr, returns both as
"trusted.hsm", also for a remote object, and lists them for a local
one, so the MDD, MDT, coordinator, changelogs, HSM release, restore
and migration, and tools that read the xattr are unchanged.  The
attributes move to the selected place the next time they change, and
are removed from the other one.

Only adding or removing the mirror changes the layout generation, as a
client takes a new generation after a failed restore for a restored
file.  Keep the HSM mirror of a file when its layout is replaced by a
swap, as the attributes do not move with the layout, also with
hsm_layout=0, and refuse to split it from the file.  It is not
resynced by "lfs mirror resync", and a write marks it stale but leaves
HS_DIRTY to be set at close with its changelog record.  PCC-RO adds a
mirror of its own and does not use the HSM one.

Describe the tunable in lod.hsm_layout(4).  Add sanity-hsm test_1g,
test_1h and test_1i for HSM in the layout, and sanity-pcc test_54 for
PCC-RO on an archived file.

Test-Parameters: fortestonly testlist=sanity-hsm,sanity-pcc
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I18ee438a4d767b7c5b8dc5a6293e00f85f3ebbe5

LU-10499 pcc: DIO attach copy for encrypted files

The PCC copy of an encrypted file holds its ciphertext, so the
kernel copy sets S_PCCCOPY to read the Lustre file as if the key
were not loaded.  The DIO copy by ll_fid_path_copy was not used for
encrypted files, since its direct reads would decrypt the data when
the key is loaded.

Now that direct IO of a file opened with O_CIPHERTEXT transfers the
ciphertext whether the key is loaded or not, have ll_fid_path_copy
open the source file with O_CIPHERTEXT for its direct IO, and use
the DIO copy for encrypted files.  O_CIPHERTEXT has no effect on
the direct IO of other files, except that its O_NONBLOCK does not
restore a released file, whose copy then fails and the kernel falls
back to the buffered copy.  A ciphertext read reaches the end of the
last encryption unit, so the copy may be up to one unit larger than
the clear text size, as with the kernel copy.

Add sanity-pcc test_50d to verify the PCC copy of an encrypted file.

Test-Parameters: trivial testlist=sanity-pcc
Test-Parameters: testlist=sanity-pcc clientarch=aarch64 clientdistro=rocky9.8
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ia3d6809c5e9631d7f375d51d9946fdb3373ebbe5

LU-16507 lmv: refresh the statfs of every NOCREATE MDT

The QoS and round-robin mkdir allocators skip an MDT marked NOCREATE,
and lmv_locate_tgt_by_space() only refreshed the statfs of the parent
MDT and of the MDT it picked.  Once no_create was cleared on another
MDT, the client would keep avoiding that MDT for new directories until
something else, like "lfs df", refreshed its statfs.  sanity test_413a
could fail with all directories on MDT0000 when it ran right after
test_413Aa, which marks every MDT NOCREATE.

Check every active MDT marked NOCREATE in lmv_locate_tgt_by_space(),
those other than the parent MDT only every 4 * qos_maxage, since
NOCREATE is usually set for a long time.  Mark the statfs as updated
when the async request is sent, so each MDT gets at most one request
per interval while a reply is pending or after an error reply, rather
than one more for each mkdir until the reply arrives.

Test-Parameters: trivial
Test-Parameters: mdscount=2 mdtcount=4 testlist=conf-sanity env=ONLY=112b,ONLY_REPEAT=10
Fixes: 1dbcd0bab881 ("LU-12998 mds: add no_create parameter to stop creates")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I603b2c6c2cdcc400b7dd29a533267a37cc3ebbe5

LU-20879 ptlrpc: send batched RPCs to the MDS request portal

The client has sent MDS_BATCH to OUT_PORTAL since batching was added,
so batched statahead is served by mdt_out, and also by ost_out on a
node that runs an OST, since the two share the portal. Yet a batched
getattr is ordinary client work: for a child on another MDT it sets
up the remote object, which fetches the attributes from that MDT, and
then locks the child there.

Those threads are also what MDT-to-MDT traffic depends on, which is
how recovery can hang. A restarting MDT reads the update logs that
its peers keep for it, through OUT on each peer, and cannot finish
its recovery without them. Meanwhile, on a peer, a batched getattr
for a child on the restarting MDT waits in an OUT thread for that
MDT, as OSP holds requests to an MDT until it has recovered. Once
such getattrs hold all the OUT threads of the peer - ost_out has
few - the update log read of the restarting MDT is queued behind
them and never served: it waits for the getattrs, and they wait for
its recovery.

Send MDS_BATCH to MDS_REQUEST_PORTAL, with replies on
MDC_REPLY_PORTAL, as for an unbatched getattr. The mdt service
dispatches MDS_BATCH by opcode like any other request, and its request
and reply limits are larger than mdt_out's.

That puts batches in the threads that handle every other client
request, and exposes an old bug there. mdt_batch() sets
mdt_thread_info::mti_batch_env and nothing clears it: it is only
reset by mdt_thread_info_init(). mdt_intent_policy() reads it before
that has run for the request, so the next intent a thread handles
after a batch request is taken for a batch sub-request and trips:

  LustreError: (mdt_handler.c:5509:mdt_intent_policy())
  ASSERTION( pill == &info->mti_sub_pill ) failed
  Comm: mdt00_001

Clear mti_batch_env when mdt_batch() is done. As older servers still
have that bug, only send batches to MDS_REQUEST_PORTAL of a server
that grants OBD_CONNECT2_DNE_INTENT, which the client now asks for,
and keep using OUT_PORTAL for others. A server only advertises that
flag once it also handles IT_MDT_TO_MDT_READ, later in the LU-20808
series, so every server that does has this fix. The portal is chosen
in ptl_send_rpc(), on every send of a batch, a resend included, from
the connect flags of the server that send goes to: an MDT can fail
over to a partner running another version while a batch waits to be
sent or resent, as in a rolling upgrade. With an older server, or a
client without this change, statahead_batch_max=0 avoids the hang.

Add sanity test 123ae, which checks that the mdt service serves
batched statahead RPCs when the MDS grants the flag.

Test-Parameters: testlist=sanity serverversion=2.17
Fixes: 840274b5c5e9 ("LU-14393 protocol: basic batching processing framework")
Fixes: 4435d0121f72 ("LU-14139 statahead: batched statahead processing")
Signed-off-by: Di Wang <diwa@nvidia.com>
Assisted-by: ClaudeCode:Opus-5.5
Change-Id: Ifd6e3b31f25f03c009e21b591d8b3c6a59930050

LU-20808 tests: count remote-parent mkdir RPCs

Add sanity tests for mkdir under a parent on another MDT with DNE lock
intents. Each counts, from the OSP stats, the OUT_UPDATE and
LDLM_ENQUEUE RPCs that the MDT creating the child sends to the
parent's MDT, and compares the result with a child made where no
intent is involved. ptlrpc leaves LDLM_ENQUEUE out of its per-opcode
counts, so the enqueues are read from ldlm_ibits_enqueue.

 370a   owner and mode, as root and as a user; the parent's link
        count; many creates of one name at once; a name that already
        exists, which takes the parent locks once and is then looked
        up without them
 370b   a parent with S_ISGID
 370c   a parent with a project ID to inherit
 370d   a default ACL small enough to come back with the lock, one too
        large for that, and write permission granted by an ACL only,
        and then taken away, which the MDS itself has to refuse
 370e   default file layouts - plain, PFL, and one too large for the
        reply - the default directory layout, and the pin

The budgets are what the intent leaves: one transaction, an attribute
read before the lock, and a read that appending to the update log may
need, plus one read for a value too large for the reply. Without the
intent, the same operations exceed them. A create also has to send
at least one OUT_UPDATE, the one that inserts the name in the parent,
and each child is checked to be on MDT1, so that a test that crossed
no MDT boundary cannot pass.

The tests skip on a filesystem with a single MDT, with an MDS older
than 2.17.59, and unless MDT0 and MDT1 have agreed on
OBD_CONNECT2_DNE_INTENT with each other.

Test-Parameters: mdtcount=4 mdscount=2 testlist=sanity env=ONLY=370
Signed-off-by: Di Wang <diwa@nvidia.com>
Assisted-by: ClaudeCode:Opus-5.5
Change-Id: I9668eac5d5cbffc95d54fddaff2740b70f4c8dba

LU-9 lod: weighted round-robin QoS allocation

When OST free space is unbalanced, lod_ost_alloc_qos() picks each
stripe at random, weighted by free space less penalties for recently
used OSTs and OSSs.  The random choice only balances allocations on
average, so some OSTs get far more or fewer objects than their share,
and first stripes are not balanced at all.

Use the round-robin array and start index for QoS allocation too, and
map each round-robin index to an OST by weight, so that OSTs are used
in proportion to their free space, and in round-robin order if their
free space is the same.  Each pass through the array spaces its
indices evenly over the total weight, at least as far apart as the
largest weight so that consecutive indices use different OSTs, or one
per OST if the weights are nearly equal.  After every index has been
used as a start, the spacing is shifted by a golden ratio fraction, so
that OSTs whose weight is not a multiple of the spacing get their
share over several passes.  An OST gets at most one stripe of a
layout, so cap the weights at 1/stripes of the total and share the
rest among the other OSTs by weight, and overstriped layouts other
than EC still fall back to round-robin allocation.

Drop the penalties from the OST weights, since they only served to
spread the random choices, so the tgt_penalty values shown by
lod.*.qos_ost_weights no longer affect OST allocation.  qos_prio_free
now moves the weights above the average down toward it, so 100%
allocates in proportion to free space, and 0% uses the OSTs with more
than the average free space equally.  Fuller OSTs keep a weight in
proportion to their free space.  lod.*.qos_ost_weights shows the
weights that are used.  Scale the weights down by a power of two if
needed so their sums cannot overflow.  MDT QoS allocation and the
qos_threshold_rr and qos_prio_free defaults are unchanged.

An OST that can't be used for a stripe now only moves that stripe on
to the next OST in the array.  Before, the random choice skipped the
weight of avoided, used or failing OSTs differently than it summed
it, so allocation often failed and fell back to round-robin when
OSTs were offline (LU-20526).  Also return success when a layout
using the default striping gets fewer stripes than requested but at
least the minimum, instead of -ENOSPC, which skipped the round-robin
fallback and failed the create.

Add lod.*.qos_wrr_enable, 1 by default, which can be set to 0 to pick
the OSTs at random by the same weights, without the penalties, as a
fallback in case of problems with weighted round-robin allocation.

Add man pages for lod.qos_threshold_rr, lod.qos_prio_free,
lod.qos_maxage and lod.qos_ost_weights, and their mdt_ versions, and
for lod.qos_wrr_enable.  Also fix lod.*.qos_maxage, which showed
mdt_qos_maxage.

Add a QoS mode to lod_rr_test and run it in sanity test_51g, and add
sanity test_51h to run test_51d with qos_threshold_rr=0, and to check
that qos_wrr_enable=0 uses all OSTs.  Repeat the creates of test_51d
if an OST starts a new FID sequence during them, since it has no
precreated objects for a while.  lod_rr_test with 3-48 OSTs on 2-4
OSSs, and more free space on the last OSS, finds these fail to put
4/5-5/4 of each OST's capped share of objects on it, or 2/3-3/2 of its
share of first objects.  Before is modelled as the weighted random
choice without penalties:

                           before         after
  2x free space            335/3516       0/3516
  4x free space            1665/3516      0/3516
  10x, qos_prio_free=90%   2305/3516      0/3516
  2x, qos_prio_free=50%    160/3516       0/3516
  10x on one OST, 1-4 OSS  2712/4689      0/4689

For example 16 OSTs on 2 OSSs, 4 stripes, 4x free space on OSS1:

             OSS0 OSTs            OSS1 OSTs
             objects  #0 objects  objects  #0 objects
  before     167-191  34-44       605-636  136-188
  after      156-164  39-41       640      160
  wanted     160      40          640      160

Fixes: ced540165ef5 ("LU-16623 lod: handle object allocation consistently")
Signed-off-by: Frederick Dilger <fdilger@whamcloud.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Ie314438e03f867fe978adc37d62b504532961cd2

LU-20808 tests: count rename and unlink RPCs across MDTs

Add sanity tests for the rename and unlink lock intents, and for the
permission checks the requesting MDT makes from the parent state an
intent brings back:

 370f   mkdir under a remote parent is allowed or denied just as under
        a local one: on a group the client claims, on none, and on one
        only the identity upcall grants, with and without the upcall;
        rename and unlink are allowed on a claimed group
 370g   a file renamed from a remote parent, back again, and onto an
        existing file keeps its data, owner, mode, xattr and ACL,
        within the RPC budget of each shape
 370h   rmdir, rmdir of a directory that is not empty, and unlink of a
        file and of one of its hard links, under a remote parent
 370i   directories created in and removed from a parent striped over
        both MDTs
 370j   mkdir under a remote parent whose MDT fails the intent with
        -EPROTO, as an MDT without it does, still succeeds

370f makes directories with "lfs mkdir", which leaves the permission
check to the MDS, so that a denial comes from the MDS and not from
the client. 370g renames between directories right under the root,
where the ancestor walks that order the rename locks stop; deeper,
they read every ancestor on the other MDT, which no intent covers.

Test-Parameters: mdtcount=4 mdscount=2 testlist=sanity env=ONLY=370
Signed-off-by: Di Wang <diwa@nvidia.com>
Assisted-by: ClaudeCode:Opus-5.5
Change-Id: Idde9b21a4cb8f215d7f7eeb2159d1b73f07cf79a

LU-10499 pcc: add lctl pcc abort command to abort attaches

Add the command "lctl pcc abort [--detach|-d] [--verbose|-v]
[--wait|-w] MNTPATH [PCCPATH]" to abort the attaches in progress to
one or all PCC backends on a client, without removing the backends.
The files already in the cache stay attached, unless --detach is
given, which detaches them but keeps their PCC copies.  With --wait
it waits for the aborted attaches to finish.

Add PCC_CLEANUP_FL_KEEP_CONF to keep the PCC backend configured, and
PCC_CLEANUP_FL_NOT_DETACH and PCC_DETACH_FL_NOT_DETACH so that the
scan of the PCC backend only aborts the attaches.  NOT_DETACH keeps
the PCC copies, as PCC_CLEANUP_FL_KEEP_DATA does.

"lctl pcc del|clear --keep-data --abort" now aborts the attaches in
progress, and like --keep-data alone keeps the cached files attached.

Document the command in the new lctl-pcc-abort.8 man page, and add
sanity-pcc test_109 to verify it.

Test-Parameters: trivial testlist=sanity-pcc
Signed-off-by: Qian Yingjin <qian@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ib7152f7418aa1beb840919e98bf8de53c99b5c54

LU-10499 pcc: add --pin option for 'lfs pcc attach'

Add a --pin|-p option to "lfs pcc attach" and "lfs pcc attach_fid"
to pin each file for the PCC backend before attaching it, so that
users do not need to run "lfs pcc pin" separately.  A file that
cannot be pinned is not attached.  Without --id, the backend is
chosen once, so that the file is pinned for the backend it is
attached to.

Add llapi_pcc_pin_fd(), llapi_pcc_pin_fid(), llapi_pcc_unpin_fd()
and llapi_pcc_unpin_fid() to match the pool pin functions, which
use the same lustre.pin xattr.  attach_fid pins the file with
llapi_pcc_pin_fid(), which also works on subdirectory mounts.  The
pin functions share the pin xattr update and no longer leak the
parsed pin object.

Setting lustre.pin on the MDT took the UPDATE lock as well as the
XATTR lock.  This would cancel a combined UPDATE|LAYOUT lock on the
client and detach a PCC-RO file, so "lfs pcc pin" of an attached
file would detach it.  Do not take the UPDATE lock for the pin,
whether it is set as lustre.pin or as trusted.pin, and do not update
ctime, which clients cache under the UPDATE lock, as for the HSM
state.

Add llapi_pcc_pin_file.3 for the pin functions, and sanity-pcc
test_204d and test_204e.

Was-Change-Id: I35a0e399294020efdb0e4710500e8f7b846c290f
Was-Change-Id: If0120d745418836cfdf449a795b6f524c40f9c27
Test-Parameters: trivial testlist=sanity-pcc
Fixes: 84100d7f7d38 ("LU-10499 pcc: tunable GID to pin/unpin files")
Signed-off-by: Lei Feng <flei@whamcloud.com>
Signed-off-by: Qian Yingjin <qian@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Iee873821ff5815fd6b56ed8f4c48147f5ef9321f

LU-18166 pcc: add option --rmdir to cleanup FID directories

This patch adds an option --rmdir to "lctl pcc clear|del" command
to cleanup the empty intermediate FID directories on PCC backend
if they are unnecessary.

Usually the command "lctl pcc clear|del" will delete all PCC cache
including the configuration on a client.
Add another option "--keep-conf" to cleanup only PCC caches
and keep the PCC configurations on a client, so that "--keep-conf
--keep-data --rmdir" only removes the empty directories.

Fixes from the original patch:
- the directories were removed in the breadth-first scan order, so
  a parent was removed before its children were empty, and only the
  deepest FID directories were removed.  Remove them in reverse scan
  order after the scan.
- do not remove the top directory of the PCC backend, which is the
  configured backend path.
- keep the man pages in lctl-pcc.8 rather than splitting them.
- allocate each scanned directory item only as large as its
  pathname, since all of them are kept until the end of the scan.
- ignore directories that are already removed.

Add sanity-pcc/test_111 to verify both options work as expected.

Test-Parameters: trivial testlist=sanity-pcc
Signed-off-by: Qian Yingjin <qian@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I35c8dbbbd7b642567eb2e026509bbf42c1053379

LU-10499 pcc: abort in-progress attach by PCC detach command

A user may want to abort in-progress attach for some purposes such
as freeing space for PCC backend.
To support this operation, we add an "abort" option for PCC detach
command to abort the in-progress attach.

"lfs pcc detach --abort" sets PCC_STATE_FL_ATTACH_ABORTING on a file
that is being attached.  The kernel copy checks it for each buffer,
and the DIO copy helper is killed, so the attach fails with
-ECANCELED and removes its partial PCC copy.  The kernel records the
pid of each running ll_fid_path_copy for this, from the usermode
helper init callback.  "lctl pcc del|clear --abort" aborts the
attaches of all files on the PCC backend.  With --wait, both wait for
the aborted attaches to finish.

Changes from the original patches:
- ll_fid_path_copy no longer polls the PCC state of the file with the
  per-file LL_IOC_PCC_STATE ioctl, which is deprecated.  Killing the
  helper aborts the copy at once.
- "lctl pcc del|clear -a" did not work, since "a" was missing from
  the getopt string.
- "lctl pcc del|clear --abort" without --wait skipped the removal of
  every PCC copy, since it checked the input abort flag instead of
  the returned PCC_DETACH_FL_ATTACHING.
- The detach no longer polls with msleep(), see the --wait option.

Add sanity-pcc test_108a for "lfs pcc detach --abort" of the kernel
and DIO copies, and test_108b for "lctl pcc clear --abort --wait".

LU-10499 pcc: abort data copy via ll_fid_path_copy

For data copying via ll_fid_path_copy in direct I/O mode in user
space, the client calls llapi_pcc_state_fd() to obtain the file
PCC state. If it is marked with PCC_STATE_FL_ATTACH_ABORTING, the
data copy process ll_fid_path_copy exits immediately.
To reduce the overhead of these check, we do not check for each
data copy iter, instead, we do a check for certain times of I/Os
(32 times by default). For I/O size of 32MiB, it will be checking
1 times per second at 1GiB/s. There should be some time-lag
before the copy tool quits finally.

Was-Change-Id: I20631e5481a7e97d7a1ed0729bcd269ef6248a2c

LU-10499 pcc: abort data copy when clear PCC backend

This patch adds an option "--abort" for "lctl pcc del|clear"
command tools.
With this option, the user will first set ATTACH_ABORTING flag on
all in-progress attaching files, and then wait for them to abort
the attache when remove a PCC backend from a client.

Was-Change-Id: I4e2f3ec8866e9af45f4524a9f45ee418ef4cb5be

Test-Parameters: trivial testlist=sanity-pcc
Signed-off-by: Qian Yingjin <qian@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I49fb1c42838f8d7e9728a5c4c6f3d60e959b233b

LU-10499 pcc: wait for in-progress attaches when remove PCC

When remove a PCC backend from a client, it should wait for all
in-progress attaches finished. Otherwise, it results in the failure
of the PCC backend umount operation.

The reason is that the PCC copy is referenced in the kernel, not
used by any applications in user space and the tool "lsof" can not
check whether the target PCC backend is used or not.

Count the attaches using each PCC backend, and with the new "wait"
argument of "clear" and "del PCCPATH" for llite.*.pcc, wait for them
after removing the backend.  An older kernel ignores the argument and
removes the backend without waiting.  Always wait at unmount.

Fixes from the original patches:
- "clear_wait" never waited, since it also matched "clear".
- pccs_generation was changed without holding pccs_rw_sem.
- "lfs pcc detach --wait" polled the file state with msleep() and
  could not be interrupted.  Use a killable wait on a waitqueue
  that is woken when an attach finishes.

Also add the missing newline to the "is being attached" message of
llapi_pcc_scan_detach(), and wait for attaches in the sanity-pcc
cleanup_pcc_mapping() so that the PCC backend can be unmounted.

Add sanity-pcc test_106 for "lctl pcc del|clear --wait" and
test_107 for "lfs pcc detach --wait" with PCC-RO and PCC-RW.

LU-10499 pcc: add wait option when remove a PCC backend

In this patch, we add a "wait" option for the PCC tool when remove
PCC backend from a client:
	lctl pcc del --wait $MOUNT $pcc_path
	lctl pcc clear --wait $MOUNT

With this option, the caller must wait for all in-progress
attaches finished when remove the PCC backend from a client.

Was-Change-Id: Ic8386329087a7129b0583fa823cbb50673893d0d

LU-10499 pcc: wait for attach finished for detach command

When detach a file from a PCC backend, this file may be still
attaching state. At this time, we add a flag to wait for the
attach finished (PCC_DETACH_FL_ATTACHING_WAIT). After that, retry
the detach.

Was-Change-Id: If85d95be744e3f7d6a07f880e78de5b68b579ed6

LU-10499 pcc: add --wait option for PCC detach command

This patch adds "--wait" option for PCC detach command.
PCC detach with this option must wait for in-progress attach on
this file finished.
Add sanity-pcc/test_107 to verify it.

Was-Change-Id: I63d52d514884b15a7b534d0f03deee441a12d3f1

Test-Parameters: trivial testlist=sanity-pcc
Signed-off-by: Qian Yingjin <qian@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I05b268e75841f9f17e77819ed20c85c78d7c6ad6

LU-10499 pcc: asynchronous PCCRO attach command support

Currently PCCRO attach via the command "lfs pcc attach" will block
during the data copying.
There is a requirement that this command can also do data copy
asynchronously. Thus we add an option "--async|-A" to the command
which will not block while the file data is being fetched.
The attach is done synchronously if llite.*.pcc_attach_thread_max
attach threads are already running, or a thread cannot be started.
Configuration errors, such as an unknown PCC backend id, are still
returned before the thread is started, while a failed background
copy leaves the file unattached.  Encrypted files can be attached
asynchronously as well, and sanity-pcc test_21j now does that.

The attach thread runs with the credentials of the process that
started the attach, as the synchronous attach does, so that the PCC
copy has its owner and quota.  This also applies to the asynchronous
attach on open of large files.  The PCC-RO layout is set as the PCC
super user, since the MDS checks write permission for the layout
change, while llite.*.pcc_mode allows users who can only read a file
to attach it.  Before, such an attach would fail, except for the
asynchronous attach that ran as root.

Document "lfs pcc attach -A" in lfs-pcc-attach.1 and
llapi_pcc_attach.3.

Was-Change-Id: I7757a9d0b66a3586abdc9053b73d69944561ffbd

Add sanity-pcc test_103 and test_104 to verify that it works
correctly, using a new OBD_FAIL_LLITE_PCC_COPYDATA_PAUSE fail_loc
to see the attach in progress.  Create the PCC backend loop device
as a sparse file and format it with lazy journal and inode table
init, to speed up the tests.

Was-Change-Id: I09f159810a778b8ef2bab93d0e2869237a3ebbe5

Test-Parameters: trivial testlist=sanity-pcc
Signed-off-by: Qian Yingjin <qian@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I6f31190c8b9e9b9876b34f8e484c6c8b7f16b6db

LU-18298 pcc: recover a PCC file handle degraded at open

A file descriptor that misses the PCC cache at open never uses PCC
again: the read, write and splice paths bail out on a NULL pccf_file,
and only pcc_file_release() resets it. Any layout blocking AST makes
pcc_try_auto_attach() decline at PIT_OPEN, and for PCC-RW the write
that follows restores the released file and detaches the cache:
sanity-pcc test_1c/1d "expected <pcc copy> size: 7654321 got: 0".

Open the copy on the first read, write or splice instead, once
something else has attached the inode; refreshing the layout at open
deadlocks the copytool against its own restore, seen in testing.
pccf_mmap_fallback bars a descriptor holding a Lustre VMA; encrypted
files stay out, as splice would hand back undecrypted pages. Also
make fsync of a descriptor with a Lustre VMA flush both the copy and
Lustre, and keep the PCC fsync error. New test_1i covers it.

Test-Parameters: trivial testlist=sanity-pcc
Fixes: f172b1168857 ("LU-10092 llite: Add persistent cache on client")
Signed-off-by: Oleg Drokin <green@whamcloud.com>
Assisted-by: ClaudeCode:Opus-5 llm_code_and_review_tools
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ibdad3f0825f118525c3bee44e359ba3998c2d235

LU-18298 pcc: pick up a lapsed copy in the detach ioctl

pcc_ioctl_detach() returns success without removing the HSM archive
when the client has no PCC inode attached, even though the copy is
still valid on the backend. "lfs pcc detach -k" leaves exactly that.

It has always relied on the caller having opened the file first, so
that pcc_file_open() re-attached it. Do that same PIT_OPEN attach in
the ioctl instead, under the dataset gating open uses, so no layout
is refreshed and no lock is taken. "lfs pcc detach_fid" also picks
up such a copy now, as long as the inode is still cached.

The next patch stops lfs pcc detach opening the file at all, which
is what makes sanity-pcc test_16 depend on this.

Test-Parameters: trivial testlist=sanity-pcc
Fixes: 2dadefb4148f ("LU-10092 pcc: change detach behavior and add keep option")
Signed-off-by: Oleg Drokin <green@whamcloud.com>
Assisted-by: ClaudeCode:Opus-5 llm_code_and_review_tools
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I617ccd6fb847a6b368b4b107fb0fc9fc8ffae00f

LU-20290 lustre: register servicenode NIDs with LNet visibility

Use the existing --servicenode target configuration to register
servicenode NID membership with LNet.

When ptlrpc.target_nid_policy=servicenode, the target publishes
one entry per service, keyed on the target service name (lsi_svname),
whose members are the local NIDs named by its mkfs failover.node
configuration.

Lustre enables the corresponding LNet discovery visibility policy.
Servicenode grouping determines the peer partitions advertised to
clients, superseding topology-derived self/NUMA grouping while the
policy is active.

Connections to Lustre targets register the service they use and
their connection NID with the corresponding LNet peer. Discovery
Push selection uses this association to select the servicenode
visibility partition appropriate for the client and prefers a
registered connection NID reachable from that partition, rather
than relying on the peer primary NID.

Keep service registrations associated with clients across LNet peer
restructuring. If a peer is removed without an immediate replacement,
retain its registrations independently and reattach them when LNet
can establish continuity through the original connection NID or
the previous peer primary NID. Registration lifetime remains tied
to the Lustre export.

Preserve existing registrations when a reconnect cannot establish
a new association. Transient registration failures (-ENOENT or
-ENOMEM) do not evict the export; retry registration on subsequent
requests, with serialized and rate-limited attempts.

Prevent unregistered peers from receiving unrelated servicenode
partitions through discovery Push. Partitions naming one or more
services require a matching peer service registration for both
ordinary and fallback selection. Uncovered NIDs retain singleton
partitions eligible for topology-based Push, preserving discovery
for peers without service registrations. Discovery GET selection
remains based on the addressed local NI.

This means peers without service registrations, including MGS-only
clients and routers, may no longer receive unsolicited Push updates
for mapped servicenode partitions. They can still discover those
partitions through GET.

Apply the servicenode restriction to target NID information published
to the MGS, including READY notifications. Build filtered notifications
using the target's advertised NID set so that new IR NID table entries
do not reintroduce NIDs outside the configured.

Test-Parameters: trivial testlist=conf-sanity env=ONLY="57c 57d 57e 57f 57g 57h 57i 57j 57k 57ka"

Signed-off-by: Serguei Smirnov <ssmirnov@thelustrecollective.com>
Signed-off-by: Chris Horn <chorn@ddn.com>
Assisted-by: Claude:claude-opus-5
Change-Id: Ie43ac027950bee70317531b7c1b84742151a2df3

LU-13745 tests: test splice() reads with PCC-RO

There is no test that splice() of a PCC-RO cached file reads from
the PCC copy through pcc_file_splice_read().  splice-test writes the
file before splicing it, which would invalidate a PCC-RO copy.

Add a -n option to splice-test to splice an existing file without
writing it, and copy the spliced data to stdout, so that it can be
compared with the expected data.  Also count the bytes actually read
from the pipe, not the requested size.

Add sanity-pcc test_21k to splice a PCC-RO cached file, with and
without O_DIRECT and a concurrent pipe reader, and check that no
read RPCs are sent to the OSTs and the data matches the PCC copy.

Test-Parameters: trivial testlist=sanity-pcc
Signed-off-by: James Simmons <jsimmons@infradead.org>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Iae2517110c7332a81d0334232772ef1844d320ae

LU-19916 mgs: allow reading config logs on a follower

An MGS follower refused every ioctl with -ENODEV, so an admin could
not check that a follower was running, compare its copies of MGS0's
config logs with the originals, or dump the configuration from any
server: "lctl --device MGS llog_print <log>" failed there.

Let mgs_iocontrol() of a follower handle the ioctls that only read its
logs: llog_print, llog_info, llog_check and llog_catlist.  They read
the copies of MGS0's logs in the CONFIGS of the target the follower
runs on.  mgs_follower_ioctl_check() allows a log by name only, since
a log ID can name any llog of that target, and llog_check of one of
its catalogs would destroy the catalog's empty plain logs.  Any other
ioctl is refused with -EROFS, which says why better than -ENODEV.

conf-sanity test_145h checks that a follower prints, lists and
describes the same <fsname>-client log as MGS0, and refuses to print
it by log ID or to cancel a record in it.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I41ab335e09b7e38d1a0c265eed9777a43e3ebbe5

LU-20889 tests: check status of each background job

Several tests started commands in the background and then ran
"wait || error ..." or "wait; rc=$?" to check them.  "wait" without
arguments always returns 0, so a failed job would never be detected.
conf-sanity test_110 and test_111 ran "wait $pids" on several PIDs,
which returns only the status of the last one, so a failure of any
other job would be missed.

Add wait_pids() to test-framework.sh to wait for each PID it is given
and return the status of the first one that failed.  Save the PIDs of
the background jobs in sanity test_51b and test_51c, sanityn
cleanup_81d(), sanity-sec test_48b, performance-sanity test_5a-5d,
lfsck-performance namespace_gen_one() and conf-sanity test_110 and
test_111, and check them with wait_pids() or "wait $pid".  Wait for
the ofd_access_log_reader PID in sanity test_165a-165g so that its
exit status is checked.

Test-Parameters: trivial
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I2889a6b8e2b1a1e6b64a56efb64a740e323ebbe5

LU-20505 osd-ldiskfs: advance scrub position after OI check

sanity-lfsck test_5 would fail with "(13) Fail to generate linkEA"
or "(5) unexpected status" because the namespace LFSCK skipped
objects while the OI scrub was rebuilding the OI:

  OIT scan failed at find target [0x200005221:0x1:0x0], cookie 198:
  rc = -115
  insert OI [0x200005221:0x1:0x0] -> 198/24953255

osd_preload_next() stops a preload batch once it reaches
os_pos_current, so the otable iterator caches the inode the scrub is
working on.  osd_scrub_next() advanced os_pos_current before that
inode went through osd_scrub_check_update(), so the LFSCK lookup of
the object could find no OI mapping and get -EINPROGRESS, and LFSCK
then skipped the object and the entries of a skipped directory.

Advance os_pos_current in osd_scrub_exec() only after the inode has
been checked and its OI mapping fixed.

Test-Parameters: trivial testlist=sanity-scrub
Test-Parameters: testlist=sanity-lfsck env=ONLY=5,ONLY_MINUTES=30
Test-Parameters: testlist=sanity-lfsck env=ONLY=5,ONLY_MINUTES=30
Test-Parameters: testlist=sanity-lfsck env=ONLY=5,ONLY_MINUTES=30
Test-Parameters: testlist=sanity-lfsck env=ONLY=5,ONLY_MINUTES=30
Fixes: e2ad44de38a4 ("LU-9488 scrub: reset noslot for full speed scrub")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ib684a0ee23d19b9ed079395fc95c02fefd3ebbe5

LU-6689 nodemap: refuse migrate early without layout_ops

Without the 'layout_ops' rbac role, 'lfs migrate' to another layout
and 'lfs mirror extend' are only refused on the final layout swap or
merge, once the file data has been copied into the volatile file they
work with, which means this whole copy is done for nothing.

To avoid this, make the client send the FID in the open intent and let
the MDT refuse right away a layout that is not the layout of the
original file. This is gated by the OBD_CONNECT2_MIGRATE_SRC connect
flag, so an older client or server simply keeps the late refusal.

Add sanity-sec test_64o.

Test-Parameters: testlist=sanity-sec clientversion=2.17 env=SANITY_SEC_EXCEPT="31 64a 64h"
Test-Parameters: testlist=sanity-sec serverversion=2.17 env=SANITY_SEC_EXCEPT="5 31 64a 64h"
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: Ia9baa5f4d182198da70dfac56524b281d6478971
Assisted-by: Claude:claude-opus-5

LU-19704 mdd: process all changelog users during init

changelog_user_init_cb(), called during server initialization, is
responsible for processing all previously registered changelog users
and computing the union of their masks so that the correct changelog
records are kept.

However, it was returning LLOG_PROC_BREAK immediately and so would
only process a single changelog user. This meant that after
remounting an MDT, changelog records could be missed.

It looks like changelog_user_init_cb() has been returning
LLOG_PROC_BREAK since it was first implemented in commit 2c74bfcb7a0
("multiple changelog consumer registration"). At that time, this was
likely correct behavior.

However, commit a15eb4f13224 ("LU-13055 mdd: per-user changelog names
and mask") introduced a per-user mask and updated
changelog_user_init_cb() to process each user's mask during server
init. That commit probably should have updated the function to return
0 so that all users would be processed.

Additionally, the mc_lastuser field of struct mdd_changelog was
updated unconditionally for each processed user, meaning that an
earlier user's ID could be overwritten by a subsequent user's ID.
However, that field is intended to have the highest ID registered so
far, so it is only correct to overwrite it when the ID for the user
being processed is higher than the previously seen maximum.

Fixes: a15eb4f13224 ("LU-13055 mdd: per-user changelog names and mask")
Signed-off-by: Thomas Bertschinger <bertschinger@lanl.gov>
Change-Id: Ic498be0a43d6d22c7b9d2ba9de2aa8560f1c5b5d

LU-20099 nrs: dispatch BRW requests in per-object batches

A server runs one NRS policy per head, so a site must choose between
the object locality of ORR and the QoS of TBF or mClock.  Under TBF or
mClock, the BRW requests of many clients reach the backend in arrival
order, interleaved across objects and offsets, which turns sequential
streams into random I/O on hard disks.

Add per-object batches to the classful scheduler, so TBF and mClock
both get them.  A class bucket of a batching rule queues each OST_READ
and OST_WRITE request by object FID, in logical offset order, and
dispatches a batch of one object, counted in whole pages, before the
next.  Other requests stay on the FIFO nc_list, and the older of that
list and the next object goes first.  A batch dispatches the lowest
queued offset of its object first, so a stream that falls behind,
such as a slow rank writing a shared file, catches up rather than
waiting for the streams ahead of it.  A request that arrives during a
batch joins the current round of its object, the round closes at the
end of the batch, and later requests join the next round, so requests
at lower offsets cannot hold back the rest of a round for more than
one batch.

By default, a rule batches only the requests to a target on rotational
storage, without OS_STATFS_NONROT in the statfs that the target
caches, and a batch holds as much as one RPC of the client that starts
it, from exp_max_brw_size().  A full size RPC then forms a batch of
its own, and smaller RPCs of one object are gathered into one RPC's
worth.  The new batch_kb= key of a policy start command sets the batch
size of every rule that does not name one, for every target, and the
key of a rule start command sets it for that rule; batch_kb=0 turns
batches off.  A rule shows its batch size only when it has one, so the
rule output of TBF does not change.

The policy charges a class bucket for its next request, so
nrs_class_req_first() keeps its choice until that request leaves the
bucket.  TBF and mClock now share one request type, nrs_class_req,
and use nrs_class_req_add/del/first/pop() instead of nc_list.  Move
the FID and offset parsing of ORR into nrs_brw_fid_get() and
nrs_brw_range_get(), which also count the niobufs from the request
buffer size rather than ioo_bufcnt.

Add sanityn test_77tj and test_77tk for TBF and mClock batches, and
test_77tl for the default batch size on rotational and non-rotational
OSTs.

Test-Parameters: testlist=sanityn env=ONLY=77
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm,llm_code_and_review_tools
Change-Id: I9e4feb8a465fe67ca35fbc967219fb8b23500c1e