PG: always clear_primary_state when leaving Primary

Otherwise, entries from the log collection process might leak into the next
epoch, where we might end up choosing a different authoritative log.  In this
case, it resulted in us not rolling back to log entries on one of the replicas
prior to trying to recover from an affected object due to the peer_missing not
being cleared.

Fixes: #10059
Backport: giant, firefly, dumpling
Signed-off-by: Samuel Just <sjust@redhat.com>
PG: always clear_primary_state on new interval, but only clear pg temp if not primary

Signed-off-by: Samuel Just <sjust@redhat.com>
PGLog: include rollback_info_trimmed_to in (read|write)_log

Fixes: #10157
Backport: firefly, giant
Signed-off-by: Samuel Just <sjust@redhat.com>
safe_io: do not set ending \0 in safe_read_file()

Signed-off-by: Kefu Chai <tchaikov@gmail.com>
mds: disallow write operations when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: don't trim log when MDS is readonly

When MDS is readonly, keep metadata objects (not include the journal) of
cephfs unchanged. This allows us to submit new entries to the log while
MDS is readonly. (Log entries submitted after MDS becomes readonly can
be safely dropped)

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: keep locks in sync state when MDS is readonly

when transit locks to sync state, we may submit new entries to the log.
This should be safe as long as we don't trim old log segments.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disallow slave requests when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disable misc internal activitiles when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disallow reconnectiong to readonly MDS

this force reconnecting clients to drop any write caps.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: add helper to force MDS readonly

the helper function marks MDS readonly, then revokes write caps from
clients.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: notify clients when MDS goes to readonly

notice clients that MDS goes to readonly and MDS won't issue write
caps any more.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
client: handle MDS 'force readonly' message

make client return -EROFS for write when MDS is readonly, instead of
waiting forever.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: add asok command to force MDS readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: allow choosing action for wirte error

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: don't blindly create empty object when dirfrag is missing

mark the corresponding CDir as bad instead.

Signed-off-by: Yan, Zheng <zyan@redhat.com>
SimpleMessenger: allow RESETSESSION whenever we forget an endpoint

In the past (e229f8451d37913225c49481b2ce2896ca6788a2) we decided to disable
reset of lossless Pipes, because lossless peers resetting caused trouble and
they can't forget about each other. But they actually can: if mark_down()
is called.

I can't figure out how else we could forget about a remote endpoint, so I think
it's okay if we tell them we reset in order to clean up state. That's desirable
so that we don't get into strange situations with out-of-whack counters.

Fixes: #10080
Backport: giant, firefly, dumpling

Signed-off-by: Greg Farnum <gfarnum@redhat.com>
mds: drop dirty dentries in deleted directory

opened dirfrags and null dirty dentries in deleted directory inode
prevent MDCache::eval_stray() from purging the delete inode.

It's safe to not commit null dirty dentries in deleted directory to
corresponding dirfrag objects, because these dirfrag objects will be
deleted soon.

Fixes: #10164
Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: properly unregister asok commands

Signed-off-by: Yan, Zheng <zyan@redhat.com>
mds: disallow flush dentry/journal when MDS is readonly

Signed-off-by: Yan, Zheng <zyan@redhat.com>