Add format-version back/forward compat test

Signed-off-by: Zach Brown <zab@versity.com> Signed-off-by: Bryant G. Duffy-Ly <bduffyly@versity.com>
t_quiet appends command output
2026-01-10 21:50:20 +00:00 · 2022-05-13 10:16:30 -07:00 · 2022-05-13 10:16:30 -07:00 · 2022-05-13 10:16:30 -07:00 · 2022-05-13 10:16:30 -07:00 · 2022-05-13 10:16:02 -07:00
39 changed files with 929 additions and 490 deletions
--- a/ReleaseNotes.md
+++ b/ReleaseNotes.md
@@ -1,41 +1,6 @@
 Versity ScoutFS Release Notes
 =============================

---
-v1.6
-\
-*Jul 7, 2022*
-
-* **Fix memory leaks in rare corner cases**
-\
-  Analysis tools found a few corner cases that leaked small structures,
-  generally around error handling or startup and shutdown.
-
-* **Add --skip-likely-huge scoutfs print command option**
-\
-  Add an option to scoutfs print to reduce the size of the output
-  so that it can be used to see system-wide metadata without being
-  overwhelmed by file-level details.
-
---
-v1.5
-\
-*Jun 21, 2022*
-
-* **Fix persistent error during server startup**
-\
-  Fixed a case where the server would always hit a consistent error on
-  seartup, preventing the system from mounting.  This required a rare
-  but valid state across the clients.
-
-* **Fix a client hang that would lead to fencing**
-\
-  The client module's use of in-kernel networking was missing annotation
-  that could lead to communication hanging.  The server would fence the
-  client when it stopped communicating.  This could be identified by the
-  server fencing a client after it disconnected with no attempt by the
-  client to reconnect.
-
 ---
 v1.4
 \
--- a/kmod/src/Makefile
+++ b/kmod/src/Makefile
@@ -46,10 +46,6 @@ scoutfs-y +=			\
 	volopt.o		\
 	xattr.o

-ifdef KC_BUILD_KERNELCOMPAT
-scoutfs-y += kernelcompat.o
-endif
-
 #
 # The raw types aren't available in userspace headers.  Make sure all
 # the types we use in the headers are the exported __ versions.
--- a/kmod/src/Makefile.kernelcompat
+++ b/kmod/src/Makefile.kernelcompat
@@ -34,52 +34,3 @@ endif
 ifneq (,$(shell grep 'FMODE_KABI_ITERATE' include/linux/fs.h))
 ccflags-y += -DKC_FMODE_KABI_ITERATE
 endif
-
-#
-# v4.11-12447-g104b4e5139fe
-#
-# Renamed __percpu_counter_add to percpu_counter_add_batch to clarify
-# that the __ wasn't less safe, just took an extra parameter.
-#
-ifneq (,$(shell grep 'percpu_counter_add_batch' include/linux/percpu_counter.h))
-ccflags-y += -DKC_PERCPU_COUNTER_ADD_BATCH
-endif
-
-#
-# v4.11-4550-g7dea19f9ee63
-#
-# Introduced memalloc_nofs_{save,restore} preferred instead of _noio_.
-#
-ifneq (,$(shell grep 'memalloc_nofs_save' include/linux/sched/mm.h))
-ccflags-y += -DKC_MEMALLOC_NOFS_SAVE
-endif
-
-#
-# v4.7-12414-g1eff9d322a44
-#
-# Renamed bi_rw to bi_opf to force old code to catch up.  We use it as a
-# single switch between old and new bio structures.
-#
-ifneq (,$(shell grep 'bi_opf' include/linux/blk_types.h))
-ccflags-y += -DKC_BIO_BI_OPF
-endif
-
-#
-# v4.12-rc2-201-g4e4cbee93d56
-#
-# Moves to bi_status BLK_STS_ API instead of having a mix of error
-# end_io args or bi_error.
-#
-ifneq (,$(shell grep 'bi_status' include/linux/blk_types.h))
-ccflags-y += -DKC_BIO_BI_STATUS
-endif
-
-#
-# v3.11-8765-ga0b02131c5fc
-#
-# Remove the old ->shrink() API, ->{scan,count}_objects is preferred.
-#
-ifneq (,$(shell grep '(*shrink)' include/linux/shrinker.h))
-ccflags-y += -DKC_SHRINKER_SHRINK
-KC_BUILD_KERNELCOMPAT=1
-endif
--- a/kmod/src/alloc.c
+++ b/kmod/src/alloc.c
@@ -84,21 +84,6 @@ static u64 smallest_order_length(u64 len)
 	return 1ULL << (free_extent_order(len) * 3);
 }

-/*
- * An extent modification dirties three distinct leaves of an allocator
- * btree as it adds and removes the blkno and size sorted items for the
- * old and new lengths of the extent.  Dirtying the paths to these
- * leaves can grow the tree and grow/shrink neighbours at each level.
- * We over-estimate the number of blocks allocated and freed (the paths
- * share a root, growth doesn't free) to err on the simpler and safer
- * side.  The overhead is minimal given the relatively large list blocks
- * and relatively short allocator trees.
- */
-static u32 extent_mod_blocks(u32 height)
-{
-	return ((1 + height) * 2) * 3;
-}
-
 /*
 * Free extents don't have flags and are stored in two indexes sorted by
 * block location and by length order, largest first.  The location key
@@ -892,14 +877,6 @@ static int find_zone_extent(struct super_block *sb, struct scoutfs_alloc_root *r
 * -ENOENT is returned if we run out of extents in the source tree
 * before moving the total.
 *
- * If meta_reserved is non-zero then -EINPROGRESS can be returned if the
- * current meta allocator's avail blocks or room for freed blocks would
- * have fallen under the reserved amount.  The could have been
- * successfully dirtied in this case but the number of blocks moved is
- * not returned.  The caller is expected to deal with the partial
- * progress by commiting the dirty trees and examining the resulting
- * modified trees to see if they need to continue moving extents.
- *
 * The caller can specify that extents in the source tree should first
 * be found based on their zone bitmaps.  We'll first try to find
 * extents in the exclusive zones, then vacant zones, and then we'll
@@ -914,7 +891,7 @@ int scoutfs_alloc_move(struct super_block *sb, struct scoutfs_alloc *alloc,
 		       struct scoutfs_block_writer *wri,
 		       struct scoutfs_alloc_root *dst,
 		       struct scoutfs_alloc_root *src, u64 total,
-		       __le64 *exclusive, __le64 *vacant, u64 zone_blocks, u64 meta_reserved)
+		       __le64 *exclusive, __le64 *vacant, u64 zone_blocks)
 {
 	struct alloc_ext_args args = {
 		.alloc = alloc,
@@ -964,14 +941,6 @@ int scoutfs_alloc_move(struct super_block *sb, struct scoutfs_alloc *alloc,
 		if (ret < 0)
 			break;

-		if (meta_reserved != 0 &&
-		    scoutfs_alloc_meta_low(sb, alloc, meta_reserved +
-					   extent_mod_blocks(src->root.height) +
-					   extent_mod_blocks(dst->root.height))) {
-			ret = -EINPROGRESS;
-			break;
-		}
-
 		/* searching set start/len, finish initializing alloced extent */
 		ext.map = found.map ? ext.start - found.start + found.map : 0;
 		ext.flags = found.flags;
@@ -1096,6 +1065,15 @@ out:
 * than completely exhausting the avail list or overflowing the freed
 * list.
 *
+ * An extent modification dirties three distinct leaves of an allocator
+ * btree as it adds and removes the blkno and size sorted items for the
+ * old and new lengths of the extent.  Dirtying the paths to these
+ * leaves can grow the tree and grow/shrink neighbours at each level.
+ * We over-estimate the number of blocks allocated and freed (the paths
+ * share a root, growth doesn't free) to err on the simpler and safer
+ * side.  The overhead is minimal given the relatively large list blocks
+ * and relatively short allocator trees.
+ *
 * The caller tells us how many extents they're about to modify and how
 * many other additional blocks they may cow manually.  And finally, the
 * caller could be the first to dirty the avail and freed blocks in the
@@ -1104,7 +1082,7 @@ out:
 static bool list_has_blocks(struct super_block *sb, struct scoutfs_alloc *alloc,
 			    struct scoutfs_alloc_root *root, u32 extents, u32 addl_blocks)
 {
-	u32 tree_blocks = extent_mod_blocks(root->root.height) * extents;
+	u32 tree_blocks = (((1 + root->root.height) * 2) * 3) * extents;
 	u32 most = 1 + tree_blocks + addl_blocks;

 	if (le32_to_cpu(alloc->avail.first_nr) < most) {
--- a/kmod/src/alloc.h
+++ b/kmod/src/alloc.h
@@ -131,7 +131,7 @@ int scoutfs_alloc_move(struct super_block *sb, struct scoutfs_alloc *alloc,
 		       struct scoutfs_block_writer *wri,
 		       struct scoutfs_alloc_root *dst,
 		       struct scoutfs_alloc_root *src, u64 total,
-		       __le64 *exclusive, __le64 *vacant, u64 zone_blocks, u64 meta_reserved);
+		       __le64 *exclusive, __le64 *vacant, u64 zone_blocks);
 int scoutfs_alloc_insert(struct super_block *sb, struct scoutfs_alloc *alloc,
 			 struct scoutfs_block_writer *wri, struct scoutfs_alloc_root *root,
 			 u64 start, u64 len);
--- a/kmod/src/block.c
+++ b/kmod/src/block.c
@@ -21,7 +21,6 @@
 #include <linux/blkdev.h>
 #include <linux/rhashtable.h>
 #include <linux/random.h>
-#include <linux/sched/mm.h>

 #include "format.h"
 #include "super.h"
@@ -58,7 +57,7 @@ struct block_info {
 	atomic64_t access_counter;
 	struct rhashtable ht;
 	wait_queue_head_t waitq;
-	KC_DEFINE_SHRINKER(shrinker);
+	struct shrinker shrinker;
 	struct work_struct free_work;
 	struct llist_head free_llist;
 };
@@ -129,7 +128,7 @@ static __le32 block_calc_crc(struct scoutfs_block_header *hdr, u32 size)
 static struct block_private *block_alloc(struct super_block *sb, u64 blkno)
 {
 	struct block_private *bp;
-	unsigned int nofs_flags;
+	unsigned int noio_flags;

 	/*
 	 * If we had multiple blocks per page we'd need to be a little
@@ -157,9 +156,9 @@ static struct block_private *block_alloc(struct super_block *sb, u64 blkno)
 		 * spurious reclaim-on dependencies and warnings.
 		 */
 		lockdep_off();
-		nofs_flags = memalloc_nofs_save();
+		noio_flags = memalloc_noio_save();
 		bp->virt = __vmalloc(SCOUTFS_BLOCK_LG_SIZE, GFP_NOFS | __GFP_HIGHMEM, PAGE_KERNEL);
-		memalloc_nofs_restore(nofs_flags);
+		memalloc_noio_restore(noio_flags);
 		lockdep_on();

 		if (!bp->virt) {
@@ -437,10 +436,11 @@ static void block_remove_all(struct super_block *sb)
 * possible.  Final freeing, verifying checksums, and unlinking errored
 * blocks are all done by future users of the blocks.
 */
-static void block_end_io(struct super_block *sb, unsigned int opf,
+static void block_end_io(struct super_block *sb, int rw,
 			 struct block_private *bp, int err)
 {
 	DECLARE_BLOCK_INFO(sb, binf);
+	bool is_read = !(rw & WRITE);

 	if (err) {
 		scoutfs_inc_counter(sb, block_cache_end_io_error);
@@ -450,7 +450,7 @@ static void block_end_io(struct super_block *sb, unsigned int opf,
 	if (!atomic_dec_and_test(&bp->io_count))
 		return;

-	if (!op_is_write(opf) && !test_bit(BLOCK_BIT_ERROR, &bp->bits))
+	if (is_read && !test_bit(BLOCK_BIT_ERROR, &bp->bits))
 		set_bit(BLOCK_BIT_UPTODATE, &bp->bits);

 	clear_bit(BLOCK_BIT_IO_BUSY, &bp->bits);
@@ -463,13 +463,13 @@ static void block_end_io(struct super_block *sb, unsigned int opf,
 		wake_up(&binf->waitq);
 }

-static void KC_DECLARE_BIO_END_IO(block_bio_end_io, struct bio *bio)
+static void block_bio_end_io(struct bio *bio, int err)
 {
 	struct block_private *bp = bio->bi_private;
 	struct super_block *sb = bp->sb;

 	TRACE_BLOCK(end_io, bp);
-	block_end_io(sb, kc_bio_get_opf(bio), bp, kc_bio_get_errno(bio));
+	block_end_io(sb, bio->bi_rw, bp, err);
 	bio_put(bio);
 }

@@ -477,7 +477,7 @@ static void KC_DECLARE_BIO_END_IO(block_bio_end_io, struct bio *bio)
 * Kick off IO for a single block.
 */
 static int block_submit_bio(struct super_block *sb, struct block_private *bp,
-			    unsigned int opf)
+			    int rw)
 {
 	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 	struct bio *bio = NULL;
@@ -510,9 +510,8 @@ static int block_submit_bio(struct super_block *sb, struct block_private *bp,
 				break;
 			}

-			kc_bio_set_opf(bio, opf);
-			kc_bio_set_sector(bio, sector + (off >> 9));
-			bio_set_dev(bio, sbi->meta_bdev);
+			bio->bi_sector = sector + (off >> 9);
+			bio->bi_bdev = sbi->meta_bdev;
 			bio->bi_end_io = block_bio_end_io;
 			bio->bi_private = bp;

@@ -529,18 +528,18 @@ static int block_submit_bio(struct super_block *sb, struct block_private *bp,
 			BUG();

 		if (!bio_add_page(bio, page, PAGE_SIZE, 0)) {
-			submit_bio(bio);
+			submit_bio(rw, bio);
 			bio = NULL;
 		}
 	}

 	if (bio)
-		submit_bio(bio);
+		submit_bio(rw, bio);

 	blk_finish_plug(&plug);

 	/* let racing end_io know we're done */
-	block_end_io(sb, opf, bp, ret);
+	block_end_io(sb, rw, bp, ret);

 	return ret;
 }
@@ -641,7 +640,7 @@ static struct block_private *block_read(struct super_block *sb, u64 blkno)

 	if (!test_bit(BLOCK_BIT_UPTODATE, &bp->bits) &&
 	     test_and_clear_bit(BLOCK_BIT_NEW, &bp->bits)) {
-		ret = block_submit_bio(sb, bp, REQ_OP_READ);
+		ret = block_submit_bio(sb, bp, READ);
 		if (ret < 0)
 			goto out;
 	}
@@ -940,7 +939,7 @@ int scoutfs_block_writer_write(struct super_block *sb,
 		/* retry previous write errors */
 		clear_bit(BLOCK_BIT_ERROR, &bp->bits);

-		ret = block_submit_bio(sb, bp, REQ_OP_WRITE);
+		ret = block_submit_bio(sb, bp, WRITE);
 		if (ret < 0)
 			break;
 	}
@@ -1040,17 +1039,6 @@ u64 scoutfs_block_writer_dirty_bytes(struct super_block *sb,
 	return wri->nr_dirty_blocks * SCOUTFS_BLOCK_LG_SIZE;
 }

-static unsigned long block_count_objects(struct shrinker *shrink, struct shrink_control *sc)
-{
-	struct block_info *binf = container_of(shrink, struct block_info, shrinker);
-	struct super_block *sb = binf->sb;
-
-	scoutfs_inc_counter(sb, block_cache_scan_objects);
-
-	return min_t(u64, (u64)atomic_read(&binf->total_inserted) * SCOUTFS_BLOCK_LG_PAGES_PER,
-		     ULONG_MAX / 2); /* magic numbers as we approach ~0UL :/ */
-}
-
 /*
 * Remove a number of cached blocks that haven't been used recently.
 *
@@ -1071,19 +1059,23 @@ static unsigned long block_count_objects(struct shrinker *shrink, struct shrink_
 * atomically remove blocks when the only references are ours and the
 * hash table.
 */
-static unsigned long block_scan_objects(struct shrinker *shrink, struct shrink_control *sc)
+static int block_shrink(struct shrinker *shrink, struct shrink_control *sc)
 {
-	struct block_info *binf = container_of(shrink, struct block_info, shrinker);
+	struct block_info *binf = container_of(shrink, struct block_info,
+					       shrinker);
 	struct super_block *sb = binf->sb;
 	struct rhashtable_iter iter;
 	struct block_private *bp;
-	unsigned long freed = 0;
 	unsigned long nr;
 	u64 recently;

-	scoutfs_inc_counter(sb, block_cache_scan_objects);
+	nr = sc->nr_to_scan;
+	if (nr == 0)
+		goto out;

-	nr = DIV_ROUND_UP(sc->nr_to_scan, SCOUTFS_BLOCK_LG_PAGES_PER);
+	scoutfs_inc_counter(sb, block_cache_shrink);
+
+	nr = DIV_ROUND_UP(nr, SCOUTFS_BLOCK_LG_PAGES_PER);

 restart:
 	recently = accessed_recently(binf);
@@ -1126,7 +1118,6 @@ restart:
 			if (block_remove_solo(sb, bp)) {
 				scoutfs_inc_counter(sb, block_cache_shrink_remove);
 				TRACE_BLOCK(shrink, bp);
-				freed++;
 				nr--;
 			}
 			block_put(sb, bp);
@@ -1135,8 +1126,9 @@ restart:

 	rhashtable_walk_stop(&iter);
 	rhashtable_walk_exit(&iter);
-
-	return freed;
+out:
+	return min_t(u64, (u64)atomic_read(&binf->total_inserted) * SCOUTFS_BLOCK_LG_PAGES_PER,
+		     INT_MAX);
 }

 struct sm_block_completion {
@@ -1144,11 +1136,11 @@ struct sm_block_completion {
 	int err;
 };

-static void KC_DECLARE_BIO_END_IO(sm_block_bio_end_io, struct bio *bio)
+static void sm_block_bio_end_io(struct bio *bio, int err)
 {
 	struct sm_block_completion *sbc = bio->bi_private;

-	sbc->err = kc_bio_get_errno(bio);
+	sbc->err = err;
 	complete(&sbc->comp);
 	bio_put(bio);
 }
@@ -1163,8 +1155,9 @@ static void KC_DECLARE_BIO_END_IO(sm_block_bio_end_io, struct bio *bio)
 * only layer that sees the full block buffer so we pass the calculated
 * crc to the caller for them to check in their context.
 */
-static int sm_block_io(struct super_block *sb, struct block_device *bdev, unsigned int opf,
-		       u64 blkno, struct scoutfs_block_header *hdr, size_t len, __le32 *blk_crc)
+static int sm_block_io(struct super_block *sb, struct block_device *bdev, int rw, u64 blkno,
+		       struct scoutfs_block_header *hdr, size_t len,
+		       __le32 *blk_crc)
 {
 	struct scoutfs_block_header *pg_hdr;
 	struct sm_block_completion sbc;
@@ -1178,7 +1171,7 @@ static int sm_block_io(struct super_block *sb, struct block_device *bdev, unsign
 		return -EIO;

 	if (WARN_ON_ONCE(len > SCOUTFS_BLOCK_SM_SIZE) ||
-	    WARN_ON_ONCE(!op_is_write(opf) && !blk_crc))
+	    WARN_ON_ONCE(!(rw & WRITE) && !blk_crc))
 		return -EINVAL;

 	page = alloc_page(GFP_NOFS);
@@ -1187,7 +1180,7 @@ static int sm_block_io(struct super_block *sb, struct block_device *bdev, unsign

 	pg_hdr = page_address(page);

-	if (op_is_write(opf)) {
+	if (rw & WRITE) {
 		memcpy(pg_hdr, hdr, len);
 		if (len < SCOUTFS_BLOCK_SM_SIZE)
 			memset((char *)pg_hdr + len, 0,
@@ -1201,9 +1194,8 @@ static int sm_block_io(struct super_block *sb, struct block_device *bdev, unsign
 		goto out;
 	}

-	bio->bi_opf = opf | REQ_SYNC;
-	kc_bio_set_sector(bio, blkno << (SCOUTFS_BLOCK_SM_SHIFT - 9));
-	bio_set_dev(bio, bdev);
+	bio->bi_sector = blkno << (SCOUTFS_BLOCK_SM_SHIFT - 9);
+	bio->bi_bdev = bdev;
 	bio->bi_end_io = sm_block_bio_end_io;
 	bio->bi_private = &sbc;
 	bio_add_page(bio, page, SCOUTFS_BLOCK_SM_SIZE, 0);
@@ -1211,12 +1203,12 @@ static int sm_block_io(struct super_block *sb, struct block_device *bdev, unsign
 	init_completion(&sbc.comp);
 	sbc.err = 0;

-	submit_bio(bio);
+	submit_bio((rw & WRITE) ? WRITE_SYNC : READ_SYNC, bio);

 	wait_for_completion(&sbc.comp);
 	ret = sbc.err;

-	if (ret == 0 && !op_is_write(opf)) {
+	if (ret == 0 && !(rw & WRITE)) {
 		memcpy(hdr, pg_hdr, len);
 		*blk_crc = block_calc_crc(pg_hdr, SCOUTFS_BLOCK_SM_SIZE);
 	}
@@ -1230,14 +1222,14 @@ int scoutfs_block_read_sm(struct super_block *sb,
 			  struct scoutfs_block_header *hdr, size_t len,
 			  __le32 *blk_crc)
 {
-	return sm_block_io(sb, bdev, REQ_OP_READ, blkno, hdr, len, blk_crc);
+	return sm_block_io(sb, bdev, READ, blkno, hdr, len, blk_crc);
 }

 int scoutfs_block_write_sm(struct super_block *sb,
 			   struct block_device *bdev, u64 blkno,
 			   struct scoutfs_block_header *hdr, size_t len)
 {
-	return sm_block_io(sb, bdev, REQ_OP_WRITE, blkno, hdr, len, NULL);
+	return sm_block_io(sb, bdev, WRITE, blkno, hdr, len, NULL);
 }

 int scoutfs_block_setup(struct super_block *sb)
@@ -1262,8 +1254,7 @@ int scoutfs_block_setup(struct super_block *sb)
 	atomic_set(&binf->total_inserted, 0);
 	atomic64_set(&binf->access_counter, 0);
 	init_waitqueue_head(&binf->waitq);
-	KC_INIT_SHRINKER_FUNCS(struct block_info, shrinker,
-			       &binf->shrinker, block_count_objects, block_scan_objects);
+	binf->shrinker.shrink = block_shrink;
 	binf->shrinker.seeks = DEFAULT_SEEKS;
 	register_shrinker(&binf->shrinker);
 	INIT_WORK(&binf->free_work, block_free_work);
--- a/kmod/src/counters.h
+++ b/kmod/src/counters.h
@@ -30,8 +30,6 @@
 	EXPAND_COUNTER(block_cache_free)			\
 	EXPAND_COUNTER(block_cache_free_work)			\
 	EXPAND_COUNTER(block_cache_remove_stale)		\
-	EXPAND_COUNTER(block_cache_count_objects)		\
-	EXPAND_COUNTER(block_cache_scan_objects)		\
 	EXPAND_COUNTER(block_cache_shrink)			\
 	EXPAND_COUNTER(block_cache_shrink_next)			\
 	EXPAND_COUNTER(block_cache_shrink_recent)		\
@@ -237,12 +235,12 @@ struct scoutfs_counters {
 #define SCOUTFS_PCPU_COUNTER_BATCH (1 << 30)

 #define scoutfs_inc_counter(sb, which)					\
-	percpu_counter_add_batch(&SCOUTFS_SB(sb)->counters->which, 1,	\
-				 SCOUTFS_PCPU_COUNTER_BATCH)
+	__percpu_counter_add(&SCOUTFS_SB(sb)->counters->which, 1,	\
+			     SCOUTFS_PCPU_COUNTER_BATCH)

 #define scoutfs_add_counter(sb, which, cnt)				\
-	percpu_counter_add_batch(&SCOUTFS_SB(sb)->counters->which, cnt,	\
-				 SCOUTFS_PCPU_COUNTER_BATCH)
+	__percpu_counter_add(&SCOUTFS_SB(sb)->counters->which, cnt,	\
+			     SCOUTFS_PCPU_COUNTER_BATCH)

 void __init scoutfs_init_counters(void);
 int scoutfs_setup_counters(struct super_block *sb);
--- a/kmod/src/data.c
+++ b/kmod/src/data.c
@@ -529,6 +529,11 @@ static int scoutfs_get_block(struct inode *inode, sector_t iblock,
 		goto out;
 	}

+	if (create && !si->staging && scoutfs_inode_worm_denied(inode)) {
+		ret = -EACCES;
+		goto out;
+	}
+
 	/* convert unwritten to written, could be staging */
 	if (create && ext.map && (ext.flags & SEF_UNWRITTEN)) {
 		un.start = iblock;
@@ -1192,6 +1197,11 @@ int scoutfs_data_move_blocks(struct inode *from, u64 from_off,
 	if (ret)
 		goto out;

+	if (scoutfs_inode_worm_denied(to)) {
+		ret = -EACCES;
+		goto out;
+	}
+
 	if ((from_off & SCOUTFS_BLOCK_SM_MASK) ||
 	    (to_off & SCOUTFS_BLOCK_SM_MASK) ||
 	    ((byte_len & SCOUTFS_BLOCK_SM_MASK) &&
--- a/kmod/src/dir.c
+++ b/kmod/src/dir.c
@@ -1029,6 +1029,11 @@ static int scoutfs_unlink(struct inode *dir, struct dentry *dentry)
 		goto unlock;
 	}

+	if (scoutfs_inode_worm_denied(inode)) {
+		ret = -EACCES;
+		goto unlock;
+	}
+
 	if (should_orphan(inode)) {
 		ret = scoutfs_lock_orphan(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, scoutfs_ino(inode),
 					  &orph_lock);
@@ -1697,6 +1702,12 @@ static int scoutfs_rename_common(struct inode *old_dir,
 		goto out_unlock;
 	}

+	if ((old_inode && scoutfs_inode_worm_denied(old_inode)) ||
+	    (new_inode && scoutfs_inode_worm_denied(new_inode))) {
+		ret = -EACCES;
+		goto out_unlock;
+	}
+
 	if (should_orphan(new_inode)) {
 		ret = scoutfs_lock_orphan(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, scoutfs_ino(new_inode),
 					  &orph_lock);
--- a/kmod/src/file.c
+++ b/kmod/src/file.c
@@ -107,6 +107,11 @@ retry:
 	if (ret)
 		goto out;

+	if (scoutfs_inode_worm_denied(inode)) {
+		ret = -EACCES;
+		goto out;
+	}
+
 	ret = scoutfs_complete_truncate(inode, inode_lock);
 	if (ret)
 		goto out;
--- a/kmod/src/format.h
+++ b/kmod/src/format.h
@@ -8,7 +8,7 @@
 */
 #define SCOUTFS_FORMAT_VERSION_MIN		1
 #define SCOUTFS_FORMAT_VERSION_MIN_STR	__stringify(SCOUTFS_FORMAT_VERSION_MIN)
-#define SCOUTFS_FORMAT_VERSION_MAX		1
+#define SCOUTFS_FORMAT_VERSION_MAX		2
 #define SCOUTFS_FORMAT_VERSION_MAX_STR	__stringify(SCOUTFS_FORMAT_VERSION_MAX)

 /* statfs(2) f_type */
@@ -856,8 +856,12 @@ struct scoutfs_inode {
 	struct scoutfs_timespec ctime;
 	struct scoutfs_timespec mtime;
 	struct scoutfs_timespec crtime;
+	struct scoutfs_timespec worm_level1_expire;
 };

+#define SCOUTFS_INODE_FMT_V1_BYTES offsetof(struct scoutfs_inode, worm_level1_expire)
+#define SCOUTFS_INODE_FMT_V2_BYTES sizeof(struct scoutfs_inode)
+
 #define SCOUTFS_INO_FLAG_TRUNCATE 0x1

 #define SCOUTFS_ROOT_INO 1
--- a/kmod/src/inode.c
+++ b/kmod/src/inode.c
@@ -84,6 +84,7 @@ static void scoutfs_inode_ctor(void *obj)
 {
 	struct scoutfs_inode_info *si = obj;

+	seqlock_init(&si->seqlock);
 	init_rwsem(&si->extent_sem);
 	mutex_init(&si->item_mutex);
 	seqcount_init(&si->seqcount);
@@ -213,6 +214,30 @@ static u64 get_item_minor(struct scoutfs_inode_info *si, u8 type)
 	return si->item_minors[ind];
 }

+void scoutfs_inode_get_worm(struct inode *inode, struct timespec *ts)
+{
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+	unsigned int seq;
+
+	do {
+		seq = read_seqbegin(&si->seqlock);
+		*ts = si->worm_expire;
+	} while (read_seqretry(&si->seqlock, seq));
+}
+
+void scoutfs_inode_set_worm(struct inode *inode, u64 expire_sec, u32 expire_nsec)
+{
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+
+	/* we don't deal with native timespec truncating our 64bit .sec */
+	BUILD_BUG_ON(sizeof(si->worm_expire.tv_sec) != sizeof(expire_sec));
+
+	write_seqlock(&si->seqlock);
+	si->worm_expire.tv_sec = expire_sec;
+	si->worm_expire.tv_nsec = expire_nsec;
+	write_sequnlock(&si->seqlock);
+}
+
 /*
 * The caller has ensured that the fields in the incoming scoutfs inode
 * reflect both the inode item and the inode index items.  This happens
@@ -233,7 +258,7 @@ static void set_item_info(struct scoutfs_inode_info *si,
 	set_item_major(si, SCOUTFS_INODE_INDEX_DATA_SEQ_TYPE, sinode->data_seq);
 }

-static void load_inode(struct inode *inode, struct scoutfs_inode *cinode)
+static void load_inode(struct inode *inode, struct scoutfs_inode *cinode, int inode_bytes)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);

@@ -262,6 +287,12 @@ static void load_inode(struct inode *inode, struct scoutfs_inode *cinode)
 	si->crtime.tv_sec = le64_to_cpu(cinode->crtime.sec);
 	si->crtime.tv_nsec = le32_to_cpu(cinode->crtime.nsec);

+	if (inode_bytes == SCOUTFS_INODE_FMT_V2_BYTES)
+		scoutfs_inode_set_worm(inode, le64_to_cpu(cinode->worm_level1_expire.sec),
+				       le32_to_cpu(cinode->worm_level1_expire.nsec));
+	else
+		scoutfs_inode_set_worm(inode, 0, 0);
+
 	/*
 	 * i_blocks is initialized from online and offline and is then
 	 * maintained as blocks come and go.
@@ -272,6 +303,36 @@ static void load_inode(struct inode *inode, struct scoutfs_inode *cinode)
 	set_item_info(si, cinode);
 }

+/* Returns the max inode size given format version */
+static int max_inode_fmt_ver_bytes(struct super_block *sb)
+{
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
+	int ret = 0;
+
+	if (sbi->fmt_vers == 1)
+		ret = SCOUTFS_INODE_FMT_V1_BYTES;
+	else if (sbi->fmt_vers == 2)
+		ret = SCOUTFS_INODE_FMT_V2_BYTES;
+
+	return ret;
+}
+
+/* Returns if inode bytes is valid for our format version */
+static bool valid_inode_fmt_ver_bytes(struct super_block *sb, int bytes)
+{
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
+	int ver;
+
+	if (bytes == SCOUTFS_INODE_FMT_V1_BYTES)
+		ver = 1;
+	else if (bytes == SCOUTFS_INODE_FMT_V2_BYTES)
+		ver = 2;
+	else
+		ver = 0;
+
+	return ver > 0 && ver <= sbi->fmt_vers;
+}
+
 void scoutfs_inode_init_key(struct scoutfs_key *key, u64 ino)
 {
 	*key = (struct scoutfs_key) {
@@ -281,6 +342,23 @@ void scoutfs_inode_init_key(struct scoutfs_key *key, u64 ino)
 	};
 }

+/*
+ * Read an inode item into the caller's buffer and return the size that
+ * we read.   Returns errors if the inode size is unsupported or doesn't
+ * make sense for the format version.
+ */
+static int lookup_inode_item(struct super_block *sb, struct scoutfs_key *key,
+			     struct scoutfs_inode *sinode, struct scoutfs_lock *lock)
+{
+	int ret;
+
+	ret = scoutfs_item_lookup_within(sb, key, sinode, sizeof(struct scoutfs_inode), lock);
+	if (ret >= 0 && !valid_inode_fmt_ver_bytes(sb, ret))
+		return -EIO;
+
+	return ret;
+}
+
 /*
 * Refresh the vfs inode fields if the lock indicates that the current
 * contents could be stale.
@@ -316,13 +394,13 @@ int scoutfs_inode_refresh(struct inode *inode, struct scoutfs_lock *lock)

 	mutex_lock(&si->item_mutex);
 	if (atomic64_read(&si->last_refreshed) < refresh_gen) {
-		ret = scoutfs_item_lookup_exact(sb, &key, &sinode,
-						sizeof(sinode), lock);
-		if (ret == 0) {
-			load_inode(inode, &sinode);
+		ret = lookup_inode_item(sb, &key, &sinode, lock);
+		if (ret > 0) {
+			load_inode(inode, &sinode, ret);
 			atomic64_set(&si->last_refreshed, refresh_gen);
 			scoutfs_lock_add_coverage(sb, lock, &si->ino_lock_cov);
 			si->drop_invalidated = false;
+			ret = 0;
 		}
 	} else {
 		ret = 0;
@@ -455,6 +533,11 @@ retry:
 	if (ret)
 		goto out;

+	if (scoutfs_inode_worm_denied(inode)) {
+		ret = -EACCES;
+		goto out;
+	}
+
 	attr_size = (attr->ia_valid & ATTR_SIZE) ? attr->ia_size :
 		i_size_read(inode);

@@ -767,9 +850,10 @@ out:
 	return inode;
 }

-static void store_inode(struct scoutfs_inode *cinode, struct inode *inode)
+static void store_inode(struct scoutfs_inode *cinode, struct inode *inode, int inode_bytes)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+	struct timespec ts;
 	u64 online_blocks;
 	u64 offline_blocks;

@@ -803,6 +887,15 @@ static void store_inode(struct scoutfs_inode *cinode, struct inode *inode)
 	cinode->crtime.sec = cpu_to_le64(si->crtime.tv_sec);
 	cinode->crtime.nsec = cpu_to_le32(si->crtime.tv_nsec);
 	memset(cinode->crtime.__pad, 0, sizeof(cinode->crtime.__pad));
+
+	if (inode_bytes == SCOUTFS_INODE_FMT_V2_BYTES) {
+		scoutfs_inode_get_worm(inode, &ts);
+
+		cinode->worm_level1_expire.sec = cpu_to_le64(ts.tv_sec);
+		cinode->worm_level1_expire.nsec = cpu_to_le32(ts.tv_nsec);
+		memset(cinode->worm_level1_expire.__pad, 0,
+		       sizeof(cinode->worm_level1_expire.__pad));
+	}
 }

 /*
@@ -828,13 +921,15 @@ int scoutfs_dirty_inode_item(struct inode *inode, struct scoutfs_lock *lock)
 	struct super_block *sb = inode->i_sb;
 	struct scoutfs_inode sinode;
 	struct scoutfs_key key;
+	int inode_bytes;
 	int ret;

-	store_inode(&sinode, inode);
+	inode_bytes = max_inode_fmt_ver_bytes(sb);
+	store_inode(&sinode, inode, inode_bytes);

 	scoutfs_inode_init_key(&key, scoutfs_ino(inode));

-	ret = scoutfs_item_update(sb, &key, &sinode, sizeof(sinode), lock);
+	ret = scoutfs_item_update(sb, &key, &sinode, inode_bytes, lock);
 	if (!ret)
 		trace_scoutfs_dirty_inode(inode);
 	return ret;
@@ -1035,8 +1130,9 @@ void scoutfs_update_inode_item(struct inode *inode, struct scoutfs_lock *lock,
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 	struct super_block *sb = inode->i_sb;
 	const u64 ino = scoutfs_ino(inode);
-	struct scoutfs_key key;
 	struct scoutfs_inode sinode;
+	struct scoutfs_key key;
+	int inode_bytes;
 	int ret;
 	int err;

@@ -1045,15 +1141,17 @@ void scoutfs_update_inode_item(struct inode *inode, struct scoutfs_lock *lock,
 	/* set the meta version once per trans for any inode updates */
 	scoutfs_inode_set_meta_seq(inode);

+	inode_bytes = max_inode_fmt_ver_bytes(sb);
+
 	/* only race with other inode field stores once */
-	store_inode(&sinode, inode);
+	store_inode(&sinode, inode, inode_bytes);

 	ret = update_indices(sb, si, ino, inode->i_mode, &sinode, lock_list);
 	BUG_ON(ret);

 	scoutfs_inode_init_key(&key, ino);

-	err = scoutfs_item_update(sb, &key, &sinode, sizeof(sinode), lock);
+	err = scoutfs_item_update(sb, &key, &sinode, inode_bytes, lock);
 	if (err) {
 		scoutfs_err(sb, "inode %llu update err %d", ino, err);
 		BUG_ON(err);
@@ -1421,9 +1519,10 @@ int scoutfs_new_inode(struct super_block *sb, struct inode *dir, umode_t mode, d
 		      u64 ino, struct scoutfs_lock *lock, struct inode **inode_ret)
 {
 	struct scoutfs_inode_info *si;
-	struct scoutfs_key key;
 	struct scoutfs_inode sinode;
+	struct scoutfs_key key;
 	struct inode *inode;
+	int inode_bytes;
 	int ret;

 	inode = new_inode(sb);
@@ -1445,6 +1544,8 @@ int scoutfs_new_inode(struct super_block *sb, struct inode *dir, umode_t mode, d
 	si->drop_invalidated = false;
 	si->flags = 0;

+	scoutfs_inode_set_worm(inode, 0, 0);
+
 	scoutfs_inode_set_meta_seq(inode);
 	scoutfs_inode_set_data_seq(inode);

@@ -1455,14 +1556,16 @@ int scoutfs_new_inode(struct super_block *sb, struct inode *dir, umode_t mode, d
 	inode->i_rdev = rdev;
 	set_inode_ops(inode);

-	store_inode(&sinode, inode);
+	inode_bytes = max_inode_fmt_ver_bytes(sb);
+
+	store_inode(&sinode, inode, inode_bytes);
 	scoutfs_inode_init_key(&key, scoutfs_ino(inode));

 	ret = scoutfs_omap_set(sb, ino);
 	if (ret < 0)
 		goto out;

-	ret = scoutfs_item_create(sb, &key, &sinode, sizeof(sinode), lock);
+	ret = scoutfs_item_create(sb, &key, &sinode, inode_bytes, lock);
 	if (ret < 0)
 		scoutfs_omap_clear(sb, ino);
 out:
@@ -1712,7 +1815,7 @@ static int try_delete_inode_items(struct super_block *sb, u64 ino)
 	}

 	scoutfs_inode_init_key(&key, ino);
-	ret = scoutfs_item_lookup_exact(sb, &key, &sinode, sizeof(sinode), lock);
+	ret = lookup_inode_item(sb, &key, &sinode, lock);
 	if (ret < 0) {
 		if (ret == -ENOENT)
 			ret = 0;
@@ -2069,6 +2172,25 @@ out:
 	return ret;
 }

+/*
+ * Return true if the inode is protected by worm and the current time is
+ * before the expiration time.
+ */
+bool scoutfs_inode_worm_denied(struct inode *inode)
+{
+	struct timespec expire;
+	struct timespec cur;
+
+	scoutfs_inode_get_worm(inode, &expire);
+	if (expire.tv_sec != 0 || expire.tv_nsec != 0) {
+		cur = CURRENT_TIME;
+		if (timespec64_compare(&cur, &expire) < 0)
+			return true;
+	}
+
+	return false;
+}
+
 int scoutfs_inode_setup(struct super_block *sb)
 {
 	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
--- a/kmod/src/inode.h
+++ b/kmod/src/inode.h
@@ -23,6 +23,10 @@ struct scoutfs_inode_info {
 	u64 offline_blocks;
 	u32 flags;
 	struct timespec crtime;
+	struct timespec worm_expire;
+
+	/* Prevent readers from racing with xattr_set */
+	seqlock_t seqlock;

 	/*
 	 * Protects per-inode extent items, most particularly readers
@@ -141,4 +145,8 @@ void scoutfs_inode_orphan_stop(struct super_block *sb);
 void scoutfs_inode_flush_iput(struct super_block *sb);
 void scoutfs_inode_destroy(struct super_block *sb);

+void scoutfs_inode_get_worm(struct inode *inode, struct timespec *ts);
+void scoutfs_inode_set_worm(struct inode *inode, u64 expire_sec, u32 expire_nsec);
+bool scoutfs_inode_worm_denied(struct inode *inode);
+
 #endif
--- a/kmod/src/ioctl.c
+++ b/kmod/src/ioctl.c
@@ -659,6 +659,11 @@ static long scoutfs_ioc_setattr_more(struct file *file, unsigned long arg)
 	if (ret)
 		goto unlock;

+	if (scoutfs_inode_worm_denied(inode)) {
+		ret = -EACCES;
+		goto unlock;
+	}
+
 	/* can only change size/dv on untouched regular files */
 	if ((sm.i_size != 0 || sm.data_version != 0) &&
 	    ((!S_ISREG(inode->i_mode) ||
@@ -823,7 +828,7 @@ static long scoutfs_ioc_search_xattrs(struct file *file, unsigned long arg)
 		goto out;
 	}

-	if (scoutfs_xattr_parse_tags(name, sx.name_bytes, &tgs) < 0 ||
+	if (scoutfs_xattr_parse_tags(sb, name, sx.name_bytes, &tgs) < 0 ||
 	    !tgs.srch) {
 		ret = -EINVAL;
 		goto out;
--- a/kmod/src/item.c
+++ b/kmod/src/item.c
@@ -1697,8 +1697,8 @@ static int copy_val(void *dst, int dst_len, void *src, int src_len)
 * The amount of bytes copied is returned which can be 0 or truncated if
 * the caller's buffer isn't big enough.
 */
-int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
-			void *val, int val_len, struct scoutfs_lock *lock)
+static int item_lookup(struct super_block *sb, struct scoutfs_key *key,
+		       void *val, int val_len, int len_limit, struct scoutfs_lock *lock)
 {
 	DECLARE_ITEM_CACHE_INFO(sb, cinf);
 	struct cached_item *item;
@@ -1718,6 +1718,8 @@ int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
 	item = item_rbtree_walk(&pg->item_root, key, NULL, NULL, NULL);
 	if (!item || item->deletion)
 		ret = -ENOENT;
+	else if (len_limit > 0 && item->val_len > len_limit)
+		ret = -EIO;
 	else
 		ret = copy_val(val, val_len, item->val, item->val_len);

@@ -1726,13 +1728,30 @@ out:
 	return ret;
 }

+int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
+			void *val, int val_len, struct scoutfs_lock *lock)
+{
+	return item_lookup(sb, key, val, val_len, 0, lock);
+}
+
+/*
+ * Return -EIO if the item we find has a value larger than the caller's
+ * val_len, rather than truncating and returning the size of the copied
+ * value.
+ */
+int scoutfs_item_lookup_within(struct super_block *sb, struct scoutfs_key *key,
+			       void *val, int val_len, struct scoutfs_lock *lock)
+{
+	return item_lookup(sb, key, val, val_len, val_len, lock);
+}
+
 int scoutfs_item_lookup_exact(struct super_block *sb, struct scoutfs_key *key,
 			      void *val, int val_len,
 			      struct scoutfs_lock *lock)
 {
 	int ret;

-	ret = scoutfs_item_lookup(sb, key, val, val_len, lock);
+	ret = item_lookup(sb, key, val, val_len, 0, lock);
 	if (ret == val_len)
 		ret = 0;
 	else if (ret >= 0)
--- a/kmod/src/item.h
+++ b/kmod/src/item.h
@@ -3,6 +3,8 @@

 int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
 			void *val, int val_len, struct scoutfs_lock *lock);
+int scoutfs_item_lookup_within(struct super_block *sb, struct scoutfs_key *key,
+			       void *val, int val_len, struct scoutfs_lock *lock);
 int scoutfs_item_lookup_exact(struct super_block *sb, struct scoutfs_key *key,
 			      void *val, int val_len,
 			      struct scoutfs_lock *lock);
--- a/kmod/src/kernelcompat.c
+++ b/kmod/src/kernelcompat.c
@@ -1,23 +0,0 @@
-
-#include "kernelcompat.h"
-
-#ifdef KC_SHRINKER_SHRINK
-#include <linux/shrinker.h>
-/*
- * If a target doesn't have that .{count,scan}_objects() interface then
- * we have a .shrink() helper that performs the shrink work in terms of
- * count/scan.
- */
-int kc_shrink_wrapper(struct shrinker *shrink, struct shrink_control *sc)
-{
-	struct kc_shrinker_funcs *funcs = KC_SHRINKER_FUNCS(shrink);
-	unsigned long nr;
-
-	if (sc->nr_to_scan != 0)
-		funcs->scan_objects(shrink, sc);
-
-	nr = funcs->count_objects(shrink, sc);
-
-	return min_t(unsigned long, nr, INT_MAX);
-}
-#endif
--- a/kmod/src/kernelcompat.h
+++ b/kmod/src/kernelcompat.h
@@ -46,81 +46,4 @@ static inline int dir_emit_dots(struct file *file, void *dirent,
 }
 #endif

-#ifndef KC_DIR_EMIT_DOTS
-#define percpu_counter_add_batch __percpu_counter_add
-#endif
-
-#ifndef KC_MEMALLOC_NOFS_SAVE
-#define memalloc_nofs_save memalloc_noio_save
-#define memalloc_nofs_restore memalloc_noio_restore
-#endif
-
-#ifdef KC_BIO_BI_OPF
-#define kc_bio_get_opf(bio)		\
-({					\
-	(bio)->bi_opf;			\
-})
-#define kc_bio_set_opf(bio, opf)	\
-do {					\
-	(bio)->bi_opf = opf;		\
-} while (0)
-#define kc_bio_set_sector(bio, sect)	\
-do {					\
-	(bio)->bi_iter.bi_sector = sect;\
-} while (0)
-#else
-#define kc_bio_get_opf(bio)		\
-({					\
-	(bio)->bi_rw;			\
-})
-#define kc_bio_set_opf(bio, opf)	\
-do {					\
-	(bio)->bio_rw = opf;		\
-} while (0)
-#define kc_bio_set_sector(bio, sect)	\
-do {					\
-	(bio)->bi_sector = sect;	\
-} while (0)
-#endif
-
-#ifdef KC_BIO_BI_STATUS
-#define KC_DECLARE_BIO_END_IO(name, bio)	name(bio)
-#define kc_bio_get_errno(bio)			({ blk_status_to_errno((bio)->bi_status); })
-#else
-#define KC_DECLARE_BIO_END_IO(name, bio)	name(bio, int _error_arg)
-#define kc_bio_get_errno(bio)			({ (int)((void)(bio), _error_arg); })
-#endif
-
-#ifndef KC_SHRINKER_SHRINK
-#define KC_DEFINE_SHRINKER(name) struct shrinker name
-#define KC_INIT_SHRINKER_FUNCS(type, name, shrink, count, scan) do {	\
-	__typeof__(shrink) _shrink = (shrink);				\
-	_shrink->count_objects = count;					\
-	_shrink->scan_objects = scan;					\
-} while (0)
-#else
-#include <linux/shrinker.h>
-struct kc_shrinker_funcs {
-	unsigned long (*count_objects)(struct shrinker *, struct shrink_control *sc);
-	unsigned long (*scan_objects)(struct shrinker *, struct shrink_control *sc);
-};
-/* using adjacent member of an unnamed struct */
-#define KC_DEFINE_SHRINKER(name)				\
-	{							\
-		struct kc_shrinker_funcs shrinker_funcs;	\
-		struct shinker name;				\
-	}
-#define KC_SHRINKER_FUNCS(shrinker) \
-	((void *)((long)(shrink) - sizeof(struct kc_shrinker_funcs)))
-#define KC_INIT_SHRINKER_FUNCS(type, name, shrink, count, scan) do {				\
-	BUILD_BUG_ON(offsetof(cont, shrink_funcs) + sizeof(struct kc_shrinker_funcs)) !=	\
-		     offsetof(cont, name) + sizeof(struct kc_shrinker_funcs);			\
-	struct kc_shrinker_funcs *_funcs = KC_SHRINKER_FUNCS(shrink)				\
-	__typeof__(shrink) _shrink = (shrink);							\
-	_funcs->count_objects = count;								\
-	_funcs->scan_objects = scan;								\
-	_shrink->shrink = kc_shrink_wrapper;							\
-} while (0)
-#endif
-
 #endif
--- a/kmod/src/net.c
+++ b/kmod/src/net.c
@@ -355,7 +355,6 @@ static int submit_send(struct super_block *sb,
 		}
 		if (rid != 0) {
 			spin_unlock(&conn->lock);
-			kfree(msend);
 			return -ENOTCONN;
 		}
 	}
@@ -992,8 +991,6 @@ static void scoutfs_net_listen_worker(struct work_struct *work)
 		if (ret < 0)
 			break;

-		acc_sock->sk->sk_allocation = GFP_NOFS;
-
 		/* inherit accepted request funcs from listening conn */
 		acc_conn = scoutfs_net_alloc_conn(sb, conn->notify_up,
 						  conn->notify_down,
@@ -1056,8 +1053,6 @@ static void scoutfs_net_connect_worker(struct work_struct *work)
 	if (ret)
 		goto out;

-	sock->sk->sk_allocation = GFP_NOFS;
-
 	/* caller specified connect timeout */
 	tv.tv_sec = conn->connect_timeout_ms / MSEC_PER_SEC;
 	tv.tv_usec = (conn->connect_timeout_ms % MSEC_PER_SEC) * USEC_PER_MSEC;
@@ -1346,12 +1341,10 @@ scoutfs_net_alloc_conn(struct super_block *sb,
 	if (!conn)
 		return NULL;

-	if (info_size) {
-		conn->info = kzalloc(info_size, GFP_NOFS);
-		if (!conn->info) {
-			kfree(conn);
-			return NULL;
-		}
+	conn->info = kzalloc(info_size, GFP_NOFS);
+	if (!conn->info) {
+		kfree(conn);
+		return NULL;
 	}

 	conn->workq = alloc_workqueue("scoutfs_net_%s",
@@ -1457,8 +1450,6 @@ int scoutfs_net_bind(struct super_block *sb,
 	if (ret)
 		goto out;

-	sock->sk->sk_allocation = GFP_NOFS;
-
 	optval = 1;
 	ret = kernel_setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
 				(char *)&optval, sizeof(optval));
--- a/kmod/src/omap.c
+++ b/kmod/src/omap.c
@@ -157,15 +157,6 @@ static int free_rid(struct omap_rid_list *list, struct omap_rid_entry *entry)
 	return nr;
 }

-static void free_rid_list(struct omap_rid_list *list)
-{
-	struct omap_rid_entry *entry;
-	struct omap_rid_entry *tmp;
-
-	list_for_each_entry_safe(entry, tmp, &list->head, head)
-		free_rid(list, entry);
-}
-
 static int copy_rids(struct omap_rid_list *to, struct omap_rid_list *from, spinlock_t *from_lock)
 {
 	struct omap_rid_entry *entry;
@@ -813,10 +804,6 @@ void scoutfs_omap_server_shutdown(struct super_block *sb)
 	llist_for_each_entry_safe(req, tmp, requests, llnode)
 		kfree(req);

-	spin_lock(&ominf->lock);
-	free_rid_list(&ominf->rids);
-	spin_unlock(&ominf->lock);
-
 	synchronize_rcu();
 }

@@ -877,10 +864,6 @@ void scoutfs_omap_destroy(struct super_block *sb)
 		rhashtable_walk_stop(&iter);
 		rhashtable_walk_exit(&iter);

-		spin_lock(&ominf->lock);
-		free_rid_list(&ominf->rids);
-		spin_unlock(&ominf->lock);
-
 		rhashtable_destroy(&ominf->group_ht);
 		rhashtable_destroy(&ominf->req_ht);
 		kfree(ominf);
--- a/kmod/src/server.c
+++ b/kmod/src/server.c
@@ -689,18 +689,23 @@ static int alloc_move_refill_zoned(struct super_block *sb, struct scoutfs_alloc_
 	return scoutfs_alloc_move(sb, &server->alloc, &server->wri, dst, src,
 				  min(target - le64_to_cpu(dst->total_len),
 				      le64_to_cpu(src->total_len)),
-				  exclusive, vacant, zone_blocks, 0);
+				  exclusive, vacant, zone_blocks);
+}
+
+static inline int alloc_move_refill(struct super_block *sb, struct scoutfs_alloc_root *dst,
+				    struct scoutfs_alloc_root *src, u64 lo, u64 target)
+{
+	return alloc_move_refill_zoned(sb, dst, src, lo, target, NULL, NULL, 0);
 }

 static int alloc_move_empty(struct super_block *sb,
 			    struct scoutfs_alloc_root *dst,
-			    struct scoutfs_alloc_root *src, u64 meta_reserved)
+			    struct scoutfs_alloc_root *src)
 {
 	DECLARE_SERVER_INFO(sb, server);

 	return scoutfs_alloc_move(sb, &server->alloc, &server->wri,
-				  dst, src, le64_to_cpu(src->total_len), NULL, NULL, 0,
-				  meta_reserved);
+				  dst, src, le64_to_cpu(src->total_len), NULL, NULL, 0);
 }

 /*
@@ -1267,7 +1272,6 @@ static int server_get_log_trees(struct super_block *sb,
 	char *err_str = NULL;
 	u64 nr;
 	int ret;
-	int err;

 	if (arg_len != 0) {
 		ret = -EINVAL;
@@ -1311,27 +1315,16 @@ static int server_get_log_trees(struct super_block *sb,
 		goto unlock;
 	}

-	if (ret != -ENOENT) {
-		/* need to sync lt with respect to changes in other structures */
-		scoutfs_key_init_log_trees(&key, le64_to_cpu(lt.rid), le64_to_cpu(lt.nr));
-		ret = scoutfs_btree_dirty(sb, &server->alloc, &server->wri,
-					  &super->logs_root, &key);
-		if (ret < 0) {
-			err_str = "dirtying lt btree key";
-			goto unlock;
-		}
-	}
-
 	/* drops and re-acquires the mutex and commit if it has to wait */
 	ret = finalize_and_start_log_merge(sb, &lt, rid, &hold);
 	if (ret < 0)
-		goto update;
+		goto unlock;

 	if (get_volopt_val(server, SCOUTFS_VOLOPT_DATA_ALLOC_ZONE_BLOCKS_NR, &data_zone_blocks)) {
 		ret = get_data_alloc_zone_bits(sb, rid, exclusive, vacant, data_zone_blocks);
 		if (ret < 0) {
 			err_str = "getting alloc zone bits";
-			goto update;
+			goto unlock;
 		}
 	} else {
 		data_zone_blocks = 0;
@@ -1348,13 +1341,13 @@ static int server_get_log_trees(struct super_block *sb,
 					&lt.meta_freed);
 	if (ret < 0) {
 		err_str = "splicing committed meta_freed";
-		goto update;
+		goto unlock;
 	}

-	ret = alloc_move_empty(sb, &super->data_alloc, &lt.data_freed, 0);
+	ret = alloc_move_empty(sb, &super->data_alloc, &lt.data_freed);
 	if (ret < 0) {
 		err_str = "emptying committed data_freed";
-		goto update;
+		goto unlock;
 	}

 	ret = scoutfs_alloc_fill_list(sb, &server->alloc, &server->wri,
@@ -1363,7 +1356,7 @@ static int server_get_log_trees(struct super_block *sb,
 				      SCOUTFS_SERVER_META_FILL_TARGET);
 	if (ret < 0) {
 		err_str = "filling meta_avail";
-		goto update;
+		goto unlock;
 	}

 	if (le64_to_cpu(server->meta_avail->total_len) <= scoutfs_server_reserved_meta_blocks(sb))
@@ -1376,7 +1369,7 @@ static int server_get_log_trees(struct super_block *sb,
 				      exclusive, vacant, data_zone_blocks);
 	if (ret < 0) {
 		err_str = "refilling data_avail";
-		goto update;
+		goto unlock;
 	}

 	if (le64_to_cpu(lt.data_avail.total_len) < SCOUTFS_SERVER_DATA_FILL_LO)
@@ -1396,7 +1389,7 @@ static int server_get_log_trees(struct super_block *sb,
 		if (ret < 0) {
 			zero_data_alloc_zone_bits(&lt);
 			err_str = "setting data_avail zone bits";
-			goto update;
+			goto unlock;
 		}

 		lt.data_alloc_zone_blocks = cpu_to_le64(data_zone_blocks);
@@ -1405,18 +1398,13 @@ static int server_get_log_trees(struct super_block *sb,
 	/* give the transaction a new seq (must have been ==) */
 	lt.get_trans_seq = cpu_to_le64(scoutfs_server_next_seq(sb));

-update:
 	/* update client's log tree's item */
-	scoutfs_key_init_log_trees(&key, le64_to_cpu(lt.rid), le64_to_cpu(lt.nr));
-	err = scoutfs_btree_force(sb, &server->alloc, &server->wri,
+	scoutfs_key_init_log_trees(&key, le64_to_cpu(lt.rid),
+				   le64_to_cpu(lt.nr));
+	ret = scoutfs_btree_force(sb, &server->alloc, &server->wri,
 				  &super->logs_root, &key, &lt, sizeof(lt));
-	BUG_ON(err < 0); /* can duplicate extents.. move dst in super, still in in lt src */
-	if (err < 0) {
-		if (ret == 0) {
-			ret = err;
-			err_str = "updating log trees";
-		}
-	}
+	if (ret < 0)
+		err_str = "updating log trees";

 unlock:
 	if (unlock_alloc)
@@ -1556,11 +1544,9 @@ static int server_get_roots(struct super_block *sb,
 * read and we finalize the tree so that it will be merged.  We reclaim
 * all the allocator items.
 *
- * The caller holds the commit rwsem which means we have to do our work
- * in one commit.  The alocator btrees can be very large and very
- * fragmented.  We return -EINPROGRESS if we couldn't fully reclaim the
- * allocators in one commit.   The caller should apply the current
- * commit and call again in a new commit.
+ * The caller holds the commit rwsem which means we do all this work in
+ * one server commit.  We'll need to keep the total amount of blocks in
+ * trees in check.
 *
 * By the time we're evicting a client they've either synced their data
 * or have been forcefully removed.  The free blocks in the allocator
@@ -1620,9 +1606,9 @@ static int reclaim_open_log_tree(struct super_block *sb, u64 rid)
 	}

 	/*
-	 * All of these can return errors, perhaps indicating successful
-	 * partial progress, after having modified the allocator trees.
-	 * We always have to update the roots in the log item.
+	 * All of these can return errors after having modified the
+	 * allocator trees.  We have to try and update the roots in the
+	 * log item.
 	 */
 	mutex_lock(&server->alloc_mutex);
 	ret = (err_str = "splice meta_freed to other_freed",
@@ -1632,21 +1618,18 @@ static int reclaim_open_log_tree(struct super_block *sb, u64 rid)
 	       scoutfs_alloc_splice_list(sb, &server->alloc, &server->wri, server->other_freed,
 					 &lt.meta_avail)) ?:
 	      (err_str = "empty data_avail",
-	       alloc_move_empty(sb, &super->data_alloc, &lt.data_avail, 100)) ?:
+	       alloc_move_empty(sb, &super->data_alloc, &lt.data_avail)) ?:
 	      (err_str = "empty data_freed",
-	       alloc_move_empty(sb, &super->data_alloc, &lt.data_freed, 100));
+	       alloc_move_empty(sb, &super->data_alloc, &lt.data_freed));
 	mutex_unlock(&server->alloc_mutex);

-	/* only finalize, allowing merging, once the allocators are fully freed */
-	if (ret == 0) {
-		/* the transaction is no longer open */
-		lt.commit_trans_seq = lt.get_trans_seq;
+	/* the transaction is no longer open */
+	lt.commit_trans_seq = lt.get_trans_seq;

-		/* the mount is no longer writing to the zones */
-		zero_data_alloc_zone_bits(&lt);
-		le64_add_cpu(&lt.flags, SCOUTFS_LOG_TREES_FINALIZED);
-		lt.finalize_seq = cpu_to_le64(scoutfs_server_next_seq(sb));
-	}
+	/* the mount is no longer writing to the zones */
+	zero_data_alloc_zone_bits(&lt);
+	le64_add_cpu(&lt.flags, SCOUTFS_LOG_TREES_FINALIZED);
+	lt.finalize_seq = cpu_to_le64(scoutfs_server_next_seq(sb));

 	err = scoutfs_btree_update(sb, &server->alloc, &server->wri,
 				  &super->logs_root, &key, &lt, sizeof(lt));
@@ -1655,7 +1638,7 @@ static int reclaim_open_log_tree(struct super_block *sb, u64 rid)
 out:
 	mutex_unlock(&server->logs_mutex);

-	if (ret < 0 && ret != -EINPROGRESS)
+	if (ret < 0)
 		scoutfs_err(sb, "server error %d reclaiming log trees for rid %016llx: %s",
 			    ret, rid, err_str);

@@ -3553,37 +3536,26 @@ struct farewell_request {
 * Reclaim all the resources for a mount which has gone away.  It's sent
 * us a farewell promising to leave or we actively fenced it.
 *
- * This can be called multiple times across different servers for
- * different reclaim attempts.  The existence of the mounted_client item
- * triggers reclaim and must be deleted last.  Each step knows that it
- * can be called multiple times and safely recognizes that its work
- * might have already been done.
- *
- * Some steps (reclaiming large fragmented allocators) may need multiple
- * calls to complete.  They return -EINPROGRESS which tells us to apply
- * the server commit and retry.
+ * It's safe to call this multiple times for a given rid.  Each
+ * individual action knows to recognize that it's already been performed
+ * and return success.
 */
 static int reclaim_rid(struct super_block *sb, u64 rid)
 {
 	COMMIT_HOLD(hold);
 	int ret;
-	int err;

-	do {
-		server_hold_commit(sb, &hold);
+	server_hold_commit(sb, &hold);

-		err = scoutfs_lock_server_farewell(sb, rid) ?:
-		      reclaim_open_log_tree(sb, rid) ?:
-		      cancel_srch_compact(sb, rid) ?:
-		      cancel_log_merge(sb, rid) ?:
-		      scoutfs_omap_remove_rid(sb, rid) ?:
-		      delete_mounted_client(sb, rid);
+	/* delete mounted client last, recovery looks for it */
+	ret = scoutfs_lock_server_farewell(sb, rid) ?:
+	      reclaim_open_log_tree(sb, rid) ?:
+	      cancel_srch_compact(sb, rid) ?:
+	      cancel_log_merge(sb, rid) ?:
+	      scoutfs_omap_remove_rid(sb, rid) ?:
+	      delete_mounted_client(sb, rid);

-		ret = server_apply_commit(sb, &hold, err == -EINPROGRESS ? 0 : err);
-
-	} while (err == -EINPROGRESS && ret == 0);
-
-	return ret;
+	return server_apply_commit(sb, &hold, ret);
 }

 /*
--- a/kmod/src/super.c
+++ b/kmod/src/super.c
@@ -496,7 +496,7 @@ static int scoutfs_fill_super(struct super_block *sb, void *data, int silent)

 	ret = assign_random_id(sbi);
 	if (ret < 0)
-		goto out;
+		return ret;

 	spin_lock_init(&sbi->next_ino_lock);
 	spin_lock_init(&sbi->data_wait_root.lock);
@@ -505,7 +505,7 @@ static int scoutfs_fill_super(struct super_block *sb, void *data, int silent)
 	/* parse options early for use during setup */
 	ret = scoutfs_options_early_setup(sb, data);
 	if (ret < 0)
-		goto out;
+		return ret;
 	scoutfs_options_read(sb, &opts);

 	ret = sb_set_blocksize(sb, SCOUTFS_BLOCK_SM_SIZE);
--- a/kmod/src/xattr.c
+++ b/kmod/src/xattr.c
@@ -79,10 +79,18 @@ static void init_xattr_key(struct scoutfs_key *key, u64 ino, u32 name_hash,
 #define SCOUTFS_XATTR_PREFIX		"scoutfs."
 #define SCOUTFS_XATTR_PREFIX_LEN	(sizeof(SCOUTFS_XATTR_PREFIX) - 1)

-static int unknown_prefix(const char *name)
+static int unknown_prefix(const char *name, bool *is_user)
 {
-	return strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
-	       strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) &&
+	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
+		if (is_user)
+			*is_user = true;
+		return false;
+	}
+
+	if (is_user)
+		*is_user = false;
+
+	return strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) &&
 	       strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) &&
 	       strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN)&&
 	       strncmp(name, SCOUTFS_XATTR_PREFIX, SCOUTFS_XATTR_PREFIX_LEN);
@@ -92,11 +100,13 @@ static int unknown_prefix(const char *name)
 #define HIDE_TAG	"hide."
 #define SRCH_TAG	"srch."
 #define TOTL_TAG	"totl."
+#define WORM_TAG	"worm."
 #define TAG_LEN		(sizeof(HIDE_TAG) - 1)

-int scoutfs_xattr_parse_tags(const char *name, unsigned int name_len,
-			     struct scoutfs_xattr_prefix_tags *tgs)
+int scoutfs_xattr_parse_tags(struct super_block *sb, const char *name,
+			     unsigned int name_len, struct scoutfs_xattr_prefix_tags *tgs)
 {
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 	bool found;

 	memset(tgs, 0, sizeof(struct scoutfs_xattr_prefix_tags));
@@ -117,6 +127,9 @@ int scoutfs_xattr_parse_tags(const char *name, unsigned int name_len,
 		} else if (!strncmp(name, TOTL_TAG, TAG_LEN)) {
 			if (++tgs->totl == 0)
 				return -EINVAL;
+		} else if (!strncmp(name, WORM_TAG, TAG_LEN)) {
+			if (++tgs->worm == 0 || sbi->fmt_vers < 2)
+				return -EINVAL;
 		} else {
 			/* only reason to use scoutfs. is tags */
 			if (!found)
@@ -468,7 +481,7 @@ ssize_t scoutfs_getxattr(struct dentry *dentry, const char *name, void *buffer,
 	size_t name_len;
 	int ret;

-	if (unknown_prefix(name))
+	if (unknown_prefix(name, NULL))
 		return -EOPNOTSUPP;

 	name_len = strlen(name);
@@ -524,6 +537,22 @@ void scoutfs_xattr_init_totl_key(struct scoutfs_key *key, u64 *name)
 	key->skxt_c = cpu_to_le64(name[2]);
 }

+/*
+ * Currently only support enabling level1 worm by setting a non-zero
+ * expiration.
+ */
+static int parse_worm_name(const char *name)
+{
+	static const char worm_name[] = "level1_expire";
+	char *last_dot;
+
+	last_dot = strrchr(name, '.');
+	if (!last_dot)
+		return -EINVAL;
+
+	return strcmp(worm_name, last_dot + 1) == 0 ? 0 : -EINVAL;
+}
+
 /*
 * Parse a u64 in any base after null terminating it while forbidding
 * the leading + and trailing \n that kstrotull allows.
@@ -541,6 +570,66 @@ static int parse_totl_u64(const char *s, int len, u64 *res)
 	return kstrtoull(str, 0, res) != 0 ? -EINVAL : 0;
 }

+static int parse_worm_u32(const char *s, int len, u32 *res)
+{
+        u64 tmp;
+        int ret;
+
+        ret = parse_totl_u64(s, len, &tmp);
+        if (ret == 0 && tmp > U32_MAX) {
+                tmp = 0;
+                ret = -EINVAL;
+        }
+
+        *res = tmp;
+        return ret;
+}
+
+static int parse_worm_timespec(struct timespec *ts, const char *name, int name_len)
+{
+	char *delim;
+	u64 sec;
+	u32 nsec;
+	int sec_len;
+	int nsec_len;
+	int ret;
+
+	memset(ts, 0, sizeof(struct scoutfs_timespec));
+
+	if (name_len < 3)
+		return -EINVAL;
+
+	delim = strnchr(name, name_len, '.');
+	if (!delim)
+		return -EINVAL;
+
+	if (delim == name || delim == (name + name_len - 1))
+		return -EINVAL;
+
+	sec_len = delim - name;
+	nsec_len = name_len - (sec_len + 1);
+
+	/* Check to make sure only one '.' */
+	if (strnchr(delim + 1, nsec_len, '.'))
+		return -EINVAL;
+
+	ret = parse_totl_u64(name, sec_len, &sec);
+	if (ret < 0)
+		return ret;
+
+	ret = parse_worm_u32(delim + 1, nsec_len, &nsec);
+	if (ret < 0)
+		return ret;
+
+	if (sec > S64_MAX || nsec >= NSEC_PER_SEC || (sec == 0 && nsec == 0))
+		return -EINVAL;
+
+	ts->tv_sec = sec;
+	ts->tv_nsec = nsec;
+
+	return 0;
+}
+
 /*
 * non-destructive relatively quick parse of the last 3 dotted u64s that
 * make up the name of the xattr total.  -EINVAL is returned if there
@@ -625,23 +714,25 @@ static int scoutfs_xattr_set(struct dentry *dentry, const char *name,
 {
 	struct inode *inode = dentry->d_inode;
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
-	struct super_block *sb = inode->i_sb;
-	const u64 ino = scoutfs_ino(inode);
 	struct scoutfs_xattr_totl_val tval = {0,};
+	struct scoutfs_lock *totl_lock = NULL;
+	struct super_block *sb = inode->i_sb;
 	struct scoutfs_xattr_prefix_tags tgs;
+	const u64 ino = scoutfs_ino(inode);
+	struct timespec worm_ts = {0,};
 	struct scoutfs_xattr *xat = NULL;
 	struct scoutfs_lock *lck = NULL;
-	struct scoutfs_lock *totl_lock = NULL;
 	size_t name_len = strlen(name);
 	struct scoutfs_key totl_key;
 	struct scoutfs_key key;
 	bool undo_srch = false;
 	bool undo_totl = false;
+	bool is_user = false;
 	LIST_HEAD(ind_locks);
-	u8 found_parts;
 	unsigned int xat_bytes_totl;
 	unsigned int xat_bytes;
 	unsigned int val_len;
+	u8 found_parts;
 	u64 ind_seq;
 	u64 total;
 	u64 hash = 0;
@@ -661,16 +752,20 @@ static int scoutfs_xattr_set(struct dentry *dentry, const char *name,
 	    (flags & ~(XATTR_CREATE | XATTR_REPLACE)))
 		return -EINVAL;

-	if (unknown_prefix(name))
+	if (unknown_prefix(name, &is_user))
 		return -EOPNOTSUPP;

-	if (scoutfs_xattr_parse_tags(name, name_len, &tgs) != 0)
+	if (scoutfs_xattr_parse_tags(sb, name, name_len, &tgs) != 0)
 		return -EINVAL;

-	if ((tgs.hide | tgs.srch | tgs.totl) && !capable(CAP_SYS_ADMIN))
+	if ((tgs.hide | tgs.srch | tgs.totl | tgs.worm) && !capable(CAP_SYS_ADMIN))
 		return -EPERM;

-	if (tgs.totl && ((ret = parse_totl_key(&totl_key, name, name_len)) != 0))
+	if (tgs.worm && !tgs.hide)
+		return -EINVAL;
+
+	if ((tgs.totl && ((ret = parse_totl_key(&totl_key, name, name_len)) != 0)) ||
+	    (tgs.worm && ((ret = parse_worm_name(name)) != 0)))
 		return ret;

 	/* allocate enough to always read an existing xattr's totl */
@@ -691,6 +786,11 @@ static int scoutfs_xattr_set(struct dentry *dentry, const char *name,

 	down_write(&si->xattr_rwsem);

+	if (!S_ISREG(inode->i_mode) && tgs.worm) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
 	/* find an existing xattr to delete, including possible totl value */
 	ret = get_next_xattr(inode, &key, xat, xat_bytes_totl, name, name_len, 0, 0, lck);
 	if (ret < 0 && ret != -ENOENT)
@@ -711,6 +811,12 @@ static int scoutfs_xattr_set(struct dentry *dentry, const char *name,
 		goto unlock;
 	}

+	/* current worm only protects user. xattrs and expiration xattr itself */
+	if (scoutfs_inode_worm_denied(inode) && (is_user || tgs.worm)) {
+		ret = -EACCES;
+		goto unlock;
+	}
+
 	/* s64 count delta if we create or delete */
 	if (tgs.totl)
 		tval.count = cpu_to_le64((u64)!!(value) - (u64)!!(ret != -ENOENT));
@@ -746,9 +852,22 @@ static int scoutfs_xattr_set(struct dentry *dentry, const char *name,
 			ret = parse_totl_u64(value, size, &total);
 			if (ret < 0)
 				goto unlock;
+
+			le64_add_cpu(&tval.total, total);
 		}

-		le64_add_cpu(&tval.total, total);
+		if (tgs.worm) {
+			/* can't set multiple times with different names */
+			scoutfs_inode_get_worm(inode, &worm_ts);
+			if (worm_ts.tv_sec || worm_ts.tv_nsec) {
+				ret = -EINVAL;
+				goto unlock;
+			}
+
+			ret = parse_worm_timespec(&worm_ts, value, size);
+			if (ret < 0)
+				goto unlock;
+		}
 	}

 	if (tgs.totl) {
@@ -800,6 +919,9 @@ retry:
 	if (ret < 0)
 		goto release;

+	if (tgs.worm)
+		scoutfs_inode_set_worm(inode, worm_ts.tv_sec, worm_ts.tv_nsec);
+
 	/* XXX do these want i_mutex or anything? */
 	inode_inc_iversion(inode);
 	inode->i_ctime = CURRENT_TIME;
@@ -889,7 +1011,7 @@ ssize_t scoutfs_list_xattrs(struct inode *inode, char *buffer,
 			break;
 		}

-		is_hidden = scoutfs_xattr_parse_tags(xat->name, xat->name_len,
+		is_hidden = scoutfs_xattr_parse_tags(sb, xat->name, xat->name_len,
 						     &tgs) == 0 && tgs.hide;

 		if (show_hidden == is_hidden) {
@@ -985,8 +1107,7 @@ int scoutfs_xattr_drop(struct super_block *sb, u64 ino,
 		}

 		if (key.skx_part != 0 ||
-		    scoutfs_xattr_parse_tags(xat->name, xat->name_len,
-					     &tgs) != 0)
+		    scoutfs_xattr_parse_tags(sb, xat->name, xat->name_len, &tgs) != 0)
 			memset(&tgs, 0, sizeof(tgs));

 		if (tgs.totl) {
--- a/kmod/src/xattr.h
+++ b/kmod/src/xattr.h
@@ -17,11 +17,12 @@ int scoutfs_xattr_drop(struct super_block *sb, u64 ino,
 struct scoutfs_xattr_prefix_tags {
 	unsigned long hide:1,
 		      srch:1,
-		      totl:1;
+		      totl:1,
+		      worm:1;
 };

-int scoutfs_xattr_parse_tags(const char *name, unsigned int name_len,
-			     struct scoutfs_xattr_prefix_tags *tgs);
+int scoutfs_xattr_parse_tags(struct super_block *sb, const char *name,
+			     unsigned int name_len, struct scoutfs_xattr_prefix_tags *tgs);

 void scoutfs_xattr_init_totl_key(struct scoutfs_key *key, u64 *name);
 int scoutfs_xattr_combine_totl(void *dst, int dst_len, void *src, int src_len);
--- a/tests/README.md
+++ b/tests/README.md
@@ -112,6 +112,7 @@ used during the test.
 | T\_EX\_META\_DEV | scratch meta bdev    | -f              | /dev/vdd          |
 | T\_EX\_DATA\_DEV | scratch meta bdev    | -e              | /dev/vdc          |
 | T\_M[0-9]        | mount paths          | mounted per run | /mnt/test.[0-9]/  |
+| T\_MODULE        | built kernel module  | created per run | ../kmod/src/..ko  |
 | T\_NR\_MOUNTS    | number of mounts     | -n              | 3                 |
 | T\_O[0-9]        | mount options        | created per run | -o server\_addr=  |
 | T\_QUORUM        | quorum count         | -q              | 2                 |
--- a/tests/funcs/exec.sh
+++ b/tests/funcs/exec.sh
@@ -35,7 +35,7 @@ t_fail()
 t_quiet()
 {
 	echo "# $*" >> "$T_TMPDIR/quiet.log"
-	"$@" > "$T_TMPDIR/quiet.log" 2>&1 || \
+	"$@" >> "$T_TMPDIR/quiet.log" 2>&1 || \
 		t_fail "quiet command failed"
 }

--- a/tests/funcs/filter.sh
+++ b/tests/funcs/filter.sh
@@ -82,5 +82,9 @@ t_filter_dmesg()
 	re="$re|scoutfs .* error .*reading quorum block.*to update event.*"
 	re="$re|scoutfs .* error.*server failed to bind to.*"

+	# format vers back/compat tries bad mounts
+	re="$re|scoutfs .* error.*outside of supported version.*"
+	re="$re|scoutfs .* error.*could not get .*super.*"
+
 	egrep -v "($re)" 
 }
--- a/tests/funcs/fs.sh
+++ b/tests/funcs/fs.sh
@@ -29,13 +29,12 @@ t_mount_rid()
 }

 #
-# Output the "f.$fsid.r.$rid" identifier string for the given mount
-# number, 0 is used by default if none is specified. 
+# Output the "f.$fsid.r.$rid" identifier string for the given path
+# in a mounted scoutfs volume.
 #
-t_ident()
+t_ident_from_mnt()
 {
-	local nr="${1:-0}"
-	local mnt="$(eval echo \$T_M$nr)"
+	local mnt="$1"
 	local fsid
 	local rid

@@ -45,6 +44,38 @@ t_ident()
 	echo "f.${fsid:0:6}.r.${rid:0:6}"
 }

+#
+# Output the "f.$fsid.r.$rid" identifier string for the given mount
+# number, 0 is used by default if none is specified.
+#
+t_ident()
+{
+	local nr="${1:-0}"
+	local mnt="$(eval echo \$T_M$nr)"
+
+	t_ident_from_mnt "$mnt"
+}
+
+#
+# Output the sysfs path for a path in a mounted fs.
+#
+t_sysfs_path_from_ident()
+{
+	local ident="$1"
+
+	echo "/sys/fs/scoutfs/$ident"
+}
+
+#
+# Output the sysfs path for a path in a mounted fs.
+#
+t_sysfs_path_from_mnt()
+{
+	local mnt="$1"
+
+	t_sysfs_path_from_ident $(t_ident_from_mnt $mnt)
+}
+
 #
 # Output the mount's sysfs path, defaulting to mount 0 if none is
 # specified.
@@ -53,7 +84,7 @@ t_sysfs_path()
 {
 	local nr="$1"

-	echo "/sys/fs/scoutfs/$(t_ident $nr)"
+	t_sysfs_path_from_ident $(t_ident $nr)
 }

 #
--- a/tests/golden/format-version-forward-back
+++ b/tests/golden/format-version-forward-back
@@ -0,0 +1,4 @@
+== ensuring utils and module for old versions
+== unmounting test fs and removing test module
+== testing combinations of old and new format versions
+== restoring test module and mount
--- a/tests/golden/worm-xattr-unit
+++ b/tests/golden/worm-xattr-unit
@@ -0,0 +1,53 @@
+== worm xattr creation without .hide. fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== worm xattr creation on dir fails
+setfattr: /mnt/test/test/worm-xattr-unit: Invalid argument
+== worm xattr creation
+== get correct parsed timespec value
+== hidden scoutfs xattrs before expire
+== user xattr creation before expire fails
+setfattr: /mnt/test.0/test/worm-xattr-unit/file-1: Permission denied
+== worm xattr deletion before expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Permission denied
+== worm xattr update before expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Permission denied
+== other worm xattr create before expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Permission denied
+== file deletion before expire fails
+rm: cannot remove ‘/mnt/test/test/worm-xattr-unit/file-1’: Permission denied
+== file rename before expire fails
+mv: cannot move ‘/mnt/test/test/worm-xattr-unit/file-1’ to ‘/mnt/test/test/worm-xattr-unit/file-2’: Permission denied
+== file write before expire fails
+date: write error: Permission denied
+== file truncate before expire fails
+truncate: failed to truncate ‘/mnt/test/test/worm-xattr-unit/file-1’ at 0 bytes: Permission denied
+== file inode update before expire fails
+touch: setting times of ‘/mnt/test/test/worm-xattr-unit/file-1’: Permission denied
+== wait until expiration
+== file write after expire
+== file rename after expire
+== other worm xattr create after expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== xattr deletion after expire
+== invalid all zero expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid non integer expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid only dots dots expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid mixed dots secs expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid (u32)(u64) nsecs expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid negative (signed)(u64) secs expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== cleanup
--- a/tests/run-tests.sh
+++ b/tests/run-tests.sh
@@ -342,7 +342,8 @@ if [ -n "$T_INSMOD" ]; then
 	msg "removing and reinserting scoutfs module"
 	test -e /sys/module/scoutfs && cmd rmmod scoutfs
 	cmd modprobe libcrc32c
-	cmd insmod "$T_KMOD/src/scoutfs.ko"
+	T_MODULE="$T_KMOD/src/scoutfs.ko"
+	cmd insmod "$T_MODULE"
 fi

 nr_globs=${#T_TRACE_GLOB[@]}
--- a/tests/sequence
+++ b/tests/sequence
@@ -9,9 +9,11 @@ fallocate.sh
 setattr_more.sh
 offline-extent-waiting.sh
 move-blocks.sh
+format-version-forward-back.sh
 enospc.sh
 srch-basic-functionality.sh
 simple-xattr-unit.sh
+worm-xattr-unit.sh
 totl-xattr-tag.sh
 lock-refleak.sh
 lock-shrink-consistency.sh
--- a/tests/tests/format-version-forward-back.sh
+++ b/tests/tests/format-version-forward-back.sh
@@ -0,0 +1,179 @@
+#
+# Test our basic ability to work with different format versions.
+#
+# The current code being tested has a range of supported format
+# versions.   For each of the older supported format versions we have a
+# git hash of the commit before the next greater version was introduced.
+# We build versions of the scoutfs utility and kernel module for the
+# last commit in tree that had a lesser supported version as its max
+# supported version.   We use those binaries to test forward and back
+# compat as new and old code works with a persistent volume with a given
+# format version.
+#
+
+mount_has_format_version()
+{
+	local mnt="$1"
+	local vers="$2"
+	local sysfs_fmt_vers="$(t_sysfs_path_from_mnt $SCR)/format_version"
+
+	test "$(cat $sysfs_fmt_vers)" == "$vers"
+}
+
+SCR="/mnt/scoutfs.scratch"
+
+MIN=$(modinfo $T_MODULE | awk '($1 == "scoutfs_format_version_min:"){print $2}')
+MAX=$(modinfo $T_MODULE | awk '($1 == "scoutfs_format_version_max:"){print $2}')
+
+echo "min: $MIN max: $MAX" > "$T_TMP.log"
+
+test "$MIN" -gt 0 -a "$MAX" -gt 0 -a "$MIN" -le "$MAX" || \
+	t_fail "parsed bad versions, min: $MIN max: $MAX"
+
+test "$MIN" == "$MAX" && \
+	t_skip "only one supported format version: $MIN"
+
+# prepare dir and wipe any weird old partial state
+builds="$T_RESULTS/format_version_builds"
+mkdir -p "$builds"
+
+echo "== ensuring utils and module for old versions"
+declare -A commits
+commits[1]=730a84a
+for vers in $(seq $MIN $((MAX - 1))); do
+	dir="$builds/$vers"
+	platform=$(uname -rp)
+	buildmark="$dir/buildmark"
+	commit="${commits[$vers]}"
+
+	test -n "$commit" || \
+		t_fail "no commit for vers $vers"
+
+	# have our files for this version
+	test "$(cat $buildmark 2>&1)" == "$platform" && \
+		continue
+
+	# build as one big sequence of commands that can return failure
+	(
+		set -o pipefail
+
+		rm -rf $dir							&&
+		mkdir -p $dir/building						&&
+		cd "$T_TESTS/.."						&&
+		git archive --format=tar "$commit" | tar -C "$dir/building" -xf - &&
+		cd -								&&
+		find $dir							&&
+		make -C "$dir/building"						&&
+		mv $dir/building/utils/src/scoutfs $dir				&&
+		mv $dir/building/kmod/src/scoutfs.ko $dir			&&
+		rm -rf $dir/building						&&
+		echo "$platform" > $buildmark					&&
+		find $dir							&&
+		cat $buildmark
+	) >> "$T_TMP.log" 2>&1 || t_fail "version $vers build failed"
+done
+
+echo "== unmounting test fs and removing test module"
+t_quiet t_umount_all
+t_quiet rmmod scoutfs
+
+echo "== testing combinations of old and new format versions"
+mkdir -p "$SCR"
+for vers in $(seq $MIN $((MAX - 1))); do
+	old_scoutfs="$builds/$vers/scoutfs"
+	old_module="$builds/$vers/scoutfs.ko"
+
+	echo "mkfs $vers" >> "$T_TMP.log"
+	t_quiet $old_scoutfs mkfs -f -Q 0,127.0.0.1,53000 "$T_EX_META_DEV" "$T_EX_DATA_DEV" \
+		|| t_fail "mkfs $vers failed"
+
+	echo "mount $vers with $vers" >> "$T_TMP.log"
+	t_quiet insmod $old_module
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$vers"
+
+	echo "creating files in $vers" >> "$T_TMP.log"
+	t_quiet touch "$SCR/file-"{1,2,3}
+	stat "$SCR"/file-* > "$T_TMP.stat" || \
+		t_fail "stat in $vers failed"
+
+	echo "remounting $vers fs with $MAX" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+	insmod "$T_MODULE"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$vers"
+
+	echo "verifying stat in $vers with $MAX" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "keep/update/del existing, create new in $vers" >> "$T_TMP.log"
+	t_quiet touch "$SCR/file-2"
+	t_quiet rm -f "$SCR/file-3"
+	t_quiet touch "$SCR/file-4"
+	stat "$SCR"/file-* > "$T_TMP.stat" || \
+		t_fail "stat in $vers failed"
+
+	echo "remounting $vers fs with $vers" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+	insmod "$old_module"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$vers"
+
+	echo "verifying stat in $vers with $vers" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "changing format vers to $MAX" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+	t_quiet scoutfs change-format-version -F -V $MAX $T_EX_META_DEV "$T_EX_DATA_DEV"
+
+	echo "mount fs $MAX with old $vers should fail" >> "$T_TMP.log"
+	insmod "$old_module"
+	mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR" >> "$T_TMP.log" 2>&1
+	if [ "$?" == "0" ]; then
+		umount "$SCR"
+		t_fail "old code ver $vers able to mount new ver $MAX"
+	fi
+
+	echo "remounting $MAX fs with $MAX" >> "$T_TMP.log"
+	rmmod scoutfs
+	insmod "$T_MODULE"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$MAX"
+
+	echo "verifying stat in $MAX with $MAX" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "keep/update/del existing, create new in $MAX" >> "$T_TMP.log"
+	t_quiet touch "$SCR/file-2"
+	t_quiet rm -f "$SCR/file-4"
+	t_quiet touch "$SCR/file-5"
+	stat "$SCR"/file-* > "$T_TMP.stat" || \
+		t_fail "stat in $MAX failed"
+
+	echo "remounting $MAX fs with $MAX again" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$MAX"
+
+	echo "verifying stat in $MAX with $MAX again" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "done with old vers $vers" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+done
+
+echo "== restoring test module and mount"
+insmod "$T_MODULE"
+t_mount_all
+
+t_pass
--- a/tests/tests/worm-xattr-unit.sh
+++ b/tests/tests/worm-xattr-unit.sh
@@ -0,0 +1,97 @@
+t_require_commands touch rm setfattr
+
+touch "$T_D0/file-1"
+SECS=$(date '+%s')
+NSECS=$(date '+%N')
+DELAY=10
+EXP=$((SECS + DELAY))
+
+echo "== worm xattr creation without .hide. fails"
+setfattr -n scoutfs.worm.level1_expire -v $EXP.$NSECS "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== worm xattr creation on dir fails"
+setfattr -n scoutfs.hide.worm.level1_expire -v $EXP.$NSECS "$T_D0" 2>&1 | t_filter_fs
+
+echo "== worm xattr creation"
+setfattr -n scoutfs.hide.worm.level1_expire -v $EXP.$NSECS "$T_D0/file-1"
+
+echo "== get correct parsed timespec value"
+diff -u --ignore-all-space <(echo "$EXP.$NSECS") <(getfattr --absolute-names --only-values -n scoutfs.hide.worm.level1_expire -m - "$T_D0/file-1")
+
+echo "== hidden scoutfs xattrs before expire"
+setfattr -n scoutfs.hide.srch.worm_test -v val "$T_D0/file-1"
+
+echo "== user xattr creation before expire fails"
+setfattr -n user.worm_test -v val "$T_D0/file-1"
+
+echo "== worm xattr deletion before expire fails"
+setfattr -x scoutfs.hide.worm.level1_expire "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== worm xattr update before expire fails"
+setfattr -n scoutfs.hide.worm.level1_expire -v $SECS.$NSECS "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== other worm xattr create before expire fails"
+setfattr -n scoutfs.hide.worm.other.level1_expire -v 123.456 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== file deletion before expire fails"
+rm -f "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== file rename before expire fails"
+mv $T_D0/file-1 $T_D0/file-2 2>&1 | t_filter_fs
+
+echo "== file write before expire fails"
+date >> $T_D0/file-1
+
+echo "== file truncate before expire fails"
+truncate -s 0 $T_D0/file-1 2>&1 | t_filter_fs
+
+echo "== file inode update before expire fails"
+touch $T_D0/file-1 2>&1 | t_filter_fs
+
+echo "== wait until expiration"
+sleep $((DELAY + 1))
+
+echo "== file write after expire"
+date >> $T_D0/file-1
+
+echo "== file rename after expire"
+mv $T_D0/file-1 $T_D0/file-2
+mv $T_D0/file-2 $T_D0/file-1
+
+echo "== other worm xattr create after expire fails"
+setfattr -n scoutfs.hide.worm.other.level1_expire -v 123.456 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== xattr deletion after expire"
+setfattr -x scoutfs.hide.worm.level1_expire "$T_D0/file-1"
+
+echo "== invalid all zero expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 0.0 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid non integer expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v a.a "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid only dots dots expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v . "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .. "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v ... "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid mixed dots secs expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 11 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .11 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 11. "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .11. "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .1.1. "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid (u32)(u64) nsecs expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 1.1000000000 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 1.4294967296 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 1.18446744073709551615 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid negative (signed)(u64) secs expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 9223372036854775808.1 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 18446744073709551615.1 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== cleanup"
+rm -f "$T_D0/file-1"
+
+t_pass
--- a/utils/man/scoutfs.5
+++ b/utils/man/scoutfs.5
@@ -212,6 +212,38 @@ name, total value, and a count of contributing attributes can be read
 with the
 .IB READ_XATTR_TOTALS
 ioctl.
+.TP
+.B .worm.
+Attributes with the .worm. flag are used to control WORM (write once,
+read many) access restrictions, typically used to comply with operational
+regulations.  The only currently supported mechanism is controlled by a
+single .worm. attribute whose name ends in ".level1_expire".  Additional
+levels with different enfrocement policies may be added and would be
+controlled by different attributes.
+.sp
+The level1 policy is enabled by setting an attribute on a file that
+contains the .worm. tag and whose name ends in ".level1_expire".  The
+attribute name must also include the .hide. tag.  As with other scoutfs
+tagged attributes, the name may include any other string between the
+tags and the final required suffix.  Only one level1 expiration
+attribute may be set at a time.
+.sp
+The value of the attribute contains a string representing the kernel
+time at which the policy enforcement will expire.  The time is formated
+as "seconds.nanoseconds" in GMT.  The attribute must be set with the
+CAP_SYS_ADMIN capability, perhaps via the root user.  Setting an
+expiration value of "0.0" will always fail.  The policy can only be set
+on regular files.
+.sp
+The file is protected once the expiration attribute is set and can not
+be modified until the expiration time has passed.  The file data, its
+inode fields, directory entries that link to its inode, untrusted
+"user." attributes, and non-hidden scoutfs attributes are all protected
+and modification attempts will fail with with permission denied.
+Trusted system-level attributes like "security." and hidden scoutfs
+attributes may still be modified to support ongoing archiving
+operations.  The worm attribute itself can not be modified once it is
+set and can only be removed once the expiration time has passed.
 .RE

 .SH FORMAT VERSION
@@ -292,6 +324,20 @@ The version that a mount is using is shown in the
 file in the mount's sysfs directory, typically
 .I /sys/fs/scoutfs/f.FSID.r.RID/
 .RE
+.sp
+The defined format versions are:
+.RS
+.TP
+.sp
+.B 1
+Initial format version.
+.TP
+.B 2
+Added level1 WORM file protection for regular files.  The
+".level1_expire" worm tagged extended attribute was added and the inode
+item size was increased to store the parsed expiration time from the
+extended attribute.
+.RE

 .SH CORRUPTION DETECTION
 A
--- a/utils/man/scoutfs.8
+++ b/utils/man/scoutfs.8
@@ -597,7 +597,7 @@ format.
 .PD

 .TP
-.BI "print {-S|--skip-likely-huge} META-DEVICE"
+.BI "print META-DEVICE"
 .sp
 Prints out all of the metadata in the file system.  This makes no effort
 to ensure that the structures are consistent as they're traversed and
@@ -607,20 +607,6 @@ output.
 .PD 0
 .TP
 .sp
-.B "-S, --skip-likely-huge"
-Skip printing structures that are likely to be very large.  The
-structures that are skipped tend to be global and whose size tends to be
-related to the size of the volume.   Examples of skipped structures include
-the global fs items, srch files, and metadata and data
-allocators.  Similar structures that are not skipped are related to the
-number of mounts and are maintained at a relatively reasonable size.
-These include per-mount log trees, srch files, allocators, and the
-metadata allocators used by server commits.
-.sp
-Skipping the larger structures limits the print output to a relatively
-constant size rather than being a large multiple of the used metadata
-space of the volume making the output much more useful for inspection.
-.TP
 .B "META-DEVICE"
 The path to the metadata device for the filesystem whose metadata will be
 printed.  Since this command reads via the host's buffer cache, it may not
--- a/utils/src/change_format_version.c
+++ b/utils/src/change_format_version.c
@@ -119,6 +119,16 @@ static int do_change_fmt_vers(struct change_fmt_vers_args *args)
 		goto out;
 	}

+	if (le64_to_cpu(meta_super->fmt_vers) > args->fmt_vers ||
+	    le64_to_cpu(data_super->fmt_vers) > args->fmt_vers) {
+		ret = -EPERM;
+		printf("Downgrade of Meta Format Version: %llu and Data Format Version: %llu to Format Version: %llu is not allowed\n",
+		       le64_to_cpu(meta_super->fmt_vers),
+		       le64_to_cpu(data_super->fmt_vers),
+		       args->fmt_vers);
+		goto out;
+	}
+
 	if (le64_to_cpu(meta_super->fmt_vers) != args->fmt_vers) {
 		meta_super->fmt_vers = cpu_to_le64(args->fmt_vers);

--- a/utils/src/mkfs.c
+++ b/utils/src/mkfs.c
@@ -262,7 +262,10 @@ static int do_mkfs(struct mkfs_args *args)
 	inode.ctime.nsec = inode.atime.nsec;
 	inode.mtime.sec = inode.atime.sec;
 	inode.mtime.nsec = inode.atime.nsec;
-	btree_append_item(bt, &key, &inode, sizeof(inode));
+	if (args->fmt_vers == 1)
+		btree_append_item(bt, &key, &inode, SCOUTFS_INODE_FMT_V1_BYTES);
+	else
+		btree_append_item(bt, &key, &inode, SCOUTFS_INODE_FMT_V2_BYTES);

 	ret = write_block(meta_fd, SCOUTFS_BLOCK_MAGIC_BTREE, fsid, 1, blkno,
 			  SCOUTFS_BLOCK_LG_SHIFT, &bt->hdr);
--- a/utils/src/print.c
+++ b/utils/src/print.c
@@ -8,7 +8,6 @@
 #include <errno.h>
 #include <string.h>
 #include <stdarg.h>
-#include <stdbool.h>
 #include <ctype.h>
 #include <uuid/uuid.h>
 #include <sys/socket.h>
@@ -70,6 +69,12 @@ static void print_inode(struct scoutfs_key *key, void *val, int val_len)
 	       le32_to_cpu(inode->ctime.nsec),
 	       le64_to_cpu(inode->mtime.sec),
 	       le32_to_cpu(inode->mtime.nsec));
+
+	if (val_len == SCOUTFS_INODE_FMT_V2_BYTES) {
+		printf("      worm_level1_expire %llu.%08u\n",
+		       le64_to_cpu(inode->worm_level1_expire.sec),
+		       le32_to_cpu(inode->worm_level1_expire.nsec));
+	}
 }

 static void print_orphan(struct scoutfs_key *key, void *val, int val_len)
@@ -990,10 +995,9 @@ static void print_super_block(struct scoutfs_super_block *super, u64 blkno)

 struct print_args {
 	char *meta_device;
-	bool skip_likely_huge;
 };

-static int print_volume(int fd, struct print_args *args)
+static int print_volume(int fd)
 {
 	struct scoutfs_super_block *super = NULL;
 	struct print_recursion_args pa;
@@ -1043,26 +1047,23 @@ static int print_volume(int fd, struct print_args *args)
 			ret = err;
 	}

-	if (!args->skip_likely_huge) {
-		for (i = 0; i < array_size(super->meta_alloc); i++) {
-			snprintf(str, sizeof(str), "meta_alloc[%u]", i);
-			err = print_btree(fd, super, str, &super->meta_alloc[i].root,
-					  print_alloc_item, NULL);
-			if (err && !ret)
-				ret = err;
-		}
-
-		err = print_btree(fd, super, "data_alloc", &super->data_alloc.root,
+	for (i = 0; i < array_size(super->meta_alloc); i++) {
+		snprintf(str, sizeof(str), "meta_alloc[%u]", i);
+		err = print_btree(fd, super, str, &super->meta_alloc[i].root,
 				  print_alloc_item, NULL);
 		if (err && !ret)
 			ret = err;
 	}

+	err = print_btree(fd, super, "data_alloc", &super->data_alloc.root,
+			  print_alloc_item, NULL);
+	if (err && !ret)
+		ret = err;
+
 	err = print_btree(fd, super, "srch_root", &super->srch_root,
 			  print_srch_root_item, NULL);
 	if (err && !ret)
 		ret = err;
-
 	err = print_btree(fd, super, "logs_root", &super->logs_root,
 			  print_log_trees_item, NULL);
 	if (err && !ret)
@@ -1070,23 +1071,19 @@ static int print_volume(int fd, struct print_args *args)

 	pa.super = super;
 	pa.fd = fd;
-	if (!args->skip_likely_huge) {
-		err = print_btree_leaf_items(fd, super, &super->srch_root.ref,
-					     print_srch_root_files, &pa);
-		if (err && !ret)
-			ret = err;
-	}
+	err = print_btree_leaf_items(fd, super, &super->srch_root.ref,
+				     print_srch_root_files, &pa);
+	if (err && !ret)
+		ret = err;
 	err = print_btree_leaf_items(fd, super, &super->logs_root.ref,
 				     print_log_trees_roots, &pa);
 	if (err && !ret)
 		ret = err;

-	if (!args->skip_likely_huge) {
-		err = print_btree(fd, super, "fs_root", &super->fs_root,
-				  print_fs_item, NULL);
-		if (err && !ret)
-			ret = err;
-	}
+	err = print_btree(fd, super, "fs_root", &super->fs_root,
+			  print_fs_item, NULL);
+	if (err && !ret)
+		ret = err;

 out:
 	free(super);
@@ -1107,7 +1104,7 @@ static int do_print(struct print_args *args)
 		return ret;
 	}

-	ret = print_volume(fd, args);
+	ret = print_volume(fd);
 	close(fd);
 	return ret;
 };
@@ -1117,9 +1114,6 @@ static int parse_opt(int key, char *arg, struct argp_state *state)
 	struct print_args *args = state->input;

 	switch (key) {
-	case 'S':
-		args->skip_likely_huge = true;
-		break;
 	case ARGP_KEY_ARG:
 		if (!args->meta_device)
 			args->meta_device = strdup_or_error(state, arg);
@@ -1137,13 +1131,8 @@ static int parse_opt(int key, char *arg, struct argp_state *state)
 	return 0;
 }

-static struct argp_option options[] = {
-	{ "skip-likely-huge", 'S', NULL, 0, "Skip large structures to minimize output size"},
-	{ NULL }
-};
-
 static struct argp argp = {
-	options,
+	NULL,
 	parse_opt,
 	"META-DEV",
 	"Print metadata structures"
Author	SHA1	Message	Date
Zach Brown	1731daf402	Add format-version back/forward compat test Signed-off-by: Zach Brown <zab@versity.com> Signed-off-by: Bryant G. Duffy-Ly <bduffyly@versity.com>	2022-05-13 10:16:30 -07:00
Zach Brown	449b71a015	t_quiet appends command output The t_quiet test command execution helper was constantly truncating the quiet.log with the output of each command. It was meant to show each command and its output as they're run. Signed-off-by: Zach Brown <zab@versity.com>	2022-05-13 10:16:30 -07:00
Zach Brown	21385dc0fb	Add fs test functions for mounted paths We have some fs functions which return info based on the test mount nr as the test has setup. This refactors those a bit to also provide some of the info when the caller has a path in a given mount. This will let tests work with scratch mounts a little more easily. Signed-off-by: Zach Brown <zab@versity.com> Signed-off-by: Bryant G. Duffy-Ly <bduffyly@versity.com>	2022-05-13 10:16:30 -07:00
Zach Brown	dae7d29559	Add T_MODULE for tests Signed-off-by: Zach Brown <zab@versity.com>	2022-05-13 10:16:30 -07:00
Bryant G. Duffy-Ly	a423ac90f5	Add unit tests for worm Signed-off-by: Bryant G. Duffy-Ly <bduffyly@versity.com> [zab@versity.com: added test cases, reorganized a little] Signed-off-by: Zach Brown <zab@versity.com>	2022-05-13 10:16:02 -07:00
Bryant G. Duffy-Ly	4c46a834f8	Add level1 worm support Add the first level of worm support. "level1" adds protection for regular files by setting an expiration time in the value of a known scoutfs tagged extended attribute. The set of protections are meant to avoid the simplest accidental modification of files while still allowing some file metadata modifications to support archiving. This is the first case of extending the inode size and format version so there is a reasonable amount of code in here that is related to dealing with combinations of format versions and sizes between the persistent device and code. Signed-off-by: Bryant G. Duffy-Ly <bduffyly@versity.com> [zab@versity.com: fixed bugs, dropped _bits and versions, docs, reworded] Signed-off-by: Zach Brown <zab@versity.com>	2022-05-13 10:16:02 -07:00
Bryant G. Duffy-Ly	e7b22e19d2	Increment format version Increment format version to 2 and also prevent downgrade Signed-off-by: Bryant G. Duffy-Ly <bduffyly@versity.com>	2022-05-13 10:12:17 -07:00
Bryant G. Duffy-Ly	2fbc135a48	Initial support for different inode sizes We're about to increase the inode size and increment the format version. Inode reading and writing has to handle different valid inode sizes as allowed by the format version. This is the initial skeletal work that later patches which really increase the inode size will further refine to add the specific known sizes and format versions. Signed-off-by: Bryant G. Duffy-Ly <bduffyly@versity.com> [zab@versity.com: reworded description, reworked to use _within] Signed-off-by: Zach Brown <zab@versity.com>	2022-05-13 10:09:38 -07:00
Zach Brown	4ea4bad1c6	Add scoutfs_item_lookup_within Add a lookup variant that returns an error if the item value is larger than the caller's value buffer size, rather than truncating and returning the truncated size. Signed-off-by: Zach Brown <zab@versity.com>	2022-05-13 10:09:38 -07:00