mds: disallow write operations when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: don't trim log when MDS is readonly

When MDS is readonly, keep metadata objects (not include the journal) of
cephfs unchanged. This allows us to submit new entries to the log while
MDS is readonly. (Log entries submitted after MDS becomes readonly can
be safely dropped)

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: keep locks in sync state when MDS is readonly

when transit locks to sync state, we may submit new entries to the log.
This should be safe as long as we don't trim old log segments.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disallow slave requests when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disable misc internal activitiles when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disallow reconnectiong to readonly MDS

this force reconnecting clients to drop any write caps.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: add helper to force MDS readonly

the helper function marks MDS readonly, then revokes write caps from
clients.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: notify clients when MDS goes to readonly

notice clients that MDS goes to readonly and MDS won't issue write
caps any more.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
client: handle MDS 'force readonly' message

make client return -EROFS for write when MDS is readonly, instead of
waiting forever.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: add asok command to force MDS readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: allow choosing action for wirte error

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: don't blindly create empty object when dirfrag is missing

mark the corresponding CDir as bad instead.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mon: mkfs compatset may be different from runtime compatset

When we create a monitor we set a given number of compat features on
disk to clearly state the features a given monitor supports -- mostly to
break backward compatibility when such compatibility cannot be
guaranteed.

However, we may wish to toggle some features during runtime; e.g., wait
for all the monitors in the quorum to support a given feature before
flipping a switch and state that all monitors now require feature X.

We are already flipping those switches during runtime, but we weren't
allowing the monitor to set a subset of those features during mkfs.
While the initial approach worked fine with clusters being upgraded and
fresh clusters, it could become weird in a mixed-version environment.

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: Elector: ignore victory from mon without required features

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: Elector: put dangling message reference

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: Elector: output features in handle_propose()

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: Monitor: return 'required_features' on get_required_features()

We were returning 'quorum_features' instead.  This would lead to funny
and weird behavior.  I hate funny.

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mds: drop dirty dentries in deleted directory

opened dirfrags and null dirty dentries in deleted directory inode
prevent MDCache::eval_stray() from purging the delete inode.

It's safe to not commit null dirty dentries in deleted directory to
corresponding dirfrag objects, because these dirfrag objects will be
deleted soon.

Fixes: #10164
Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: properly unregister asok commands

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disallow flush dentry/journal when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>