Faithful cluster DLM registration — Layer 1: MOUNT holds the standing volume lock (vms-3eb/25e)

src/kernel-core/vms_lock.c

@@ -137,8 +137,8 @@ exec_list_head_t vms_dlm_origin_list;
 exec_lock_t vms_dlm_origin_lock;
 
 static int vms_lock_dlm_origin_getlki(uint32_t lkid, uint32_t *granted_mode,
-                                      uint32_t *requested_mode, char *resnam,
-                                      size_t resnam_len, uint8_t *valblk);
+                                      uint32_t *requested_mode, uint32_t *master_lkid,
+                                      char *resnam, size_t resnam_len, uint8_t *valblk);
 
 /* ================================================================
  * Cluster membership crosses into the executive (rd vms-551,
@@ -1447,6 +1447,41 @@ uint32_t vms_lock_acp_vol_release(struct vms_proc *proc, uint32_t lkid)
     return d.status;
 }
 
+/*
+ * vms_lock_acp_vol_standing - take the STANDING per-volume lock a faithful MOUNT
+ * holds for the WHOLE mount life (vms-25e). Unlike vms_lock_acp_vol_ex (the
+ * transient EX synchronization lock a single on-disk-structure write takes and
+ * immediately drops), this is a NULL-mode (NL) lock held from $MOUNT to
+ * $DISMOUNT. Its purpose is cluster registration, not serialization: it names the
+ * volume in the DLM so the connection manager can register "this node has this
+ * volume mounted" to the coordinator during a directory rebuild -- the standing
+ * F11B$v<label> lock a real VMS node holds and re-registers on join.
+ *
+ * NL asserts PRESENCE, not exclusion: it takes a different resource (F11B$v) than
+ * the XQP's per-write sync lock (F11B$s), holds nothing exclusive, and so can
+ * never block the XQP, another writer, or another cluster node -- deadlock-free
+ * and cluster-safe by construction. Released by vms_lock_acp_vol_release at
+ * $DISMOUNT (or on the holder's rundown). Returns the executive status; on
+ * SS$_NORMAL *lkid_out is the standing lock's handle for later registration.
+ */
+uint32_t vms_lock_acp_vol_standing(struct vms_proc *proc, const char *resnam,
+                                   uint32_t *lkid_out)
+{
+    struct vms_enq_args a;
+
+    if (lkid_out)
+        *lkid_out = 0;
+    memset(&a, 0, sizeof(a));
+    a.lkmode = LCK_K_NLMODE;    /* NL: a presence marker, holds nothing exclusive */
+    a.flags  = LCK_M_SYNC;      /* $ENQW; an NL request grants immediately */
+    strscpy(a.resnam, resnam, sizeof(a.resnam));
+
+    vms_enq_core_ex(proc, &a, NULL);
+    if (a.status == SS__NORMAL && lkid_out)
+        *lkid_out = a.lkid;
+    return a.status;
+}
+
 /*
  * vms_ioctl_convert - Convert lock mode ($ENQ with LCK$M_CONVERT)
  *
@@ -1588,12 +1623,13 @@ long vms_ioctl_getlki(struct vms_proc *proc, unsigned long arg)
          * its origin record carries the status the master's GRANT completed. This
          * makes the NL->EX flip driven by the remote master observable here.
          */
-        uint32_t org_granted = 0, org_requested = 0;
+        uint32_t org_granted = 0, org_requested = 0, org_master = 0;
         if (vms_lock_dlm_origin_getlki(args.lkid, &org_granted, &org_requested,
-                                       args.resnam, sizeof(args.resnam),
+                                       &org_master, args.resnam, sizeof(args.resnam),
                                        args.valblk)) {
             args.granted_mode = org_granted;
             args.requested_mode = org_requested;
+            args.master_lkid = org_master;   /* vms-16c: the master's granted handle, from real origin state */
             args.parent_id = 0;
             /* args.valblk was filled by origin_getlki: the master's LVB the
              * GRANT delivered (rd vms-eeb), or zeros if none -- the read
@@ -2388,8 +2424,8 @@ static uint32_t vms_lock_dlm_xnode_blkast_recv(struct vms_proc *proc,
  * cross-node request's status flip on the REQUESTER node.
  */
 static int vms_lock_dlm_origin_getlki(uint32_t lkid, uint32_t *granted_mode,
-                                      uint32_t *requested_mode, char *resnam,
-                                      size_t resnam_len, uint8_t *valblk)
+                                      uint32_t *requested_mode, uint32_t *master_lkid,
+                                      char *resnam, size_t resnam_len, uint8_t *valblk)
 {
     struct vms_dlm_origin *cur;
     int found = 0;
@@ -2403,6 +2439,8 @@ static int vms_lock_dlm_origin_getlki(uint32_t lkid, uint32_t *granted_mode,
                 *granted_mode = cur->granted_mode;
             if (requested_mode)
                 *requested_mode = cur->requested_mode;
+            if (master_lkid)
+                *master_lkid = cur->master_lkid;   /* the master's granted handle (0 until a real GRANT recorded it) */
             if (resnam && resnam_len)
                 strscpy(resnam, cur->resnam, resnam_len);
             /*
@@ -2480,6 +2518,57 @@ static uint32_t vms_lock_dlm_xnode_rebuild(struct vms_proc *proc,
     return SS__NORMAL;
 }
 
+/*
+ * vms_lock_dlm_xnode_enq_idempotent - retransmit idempotency for a cross-node
+ * $ENQ (vms-16c). A cluster member (VAX1/VAX2) that never sees a STABLE granted
+ * lock re-sends the same op-01 ENQ. Before this, every re-send ran the full
+ * enqueue core and minted a FRESH master lock record, so the handle OVMX returned
+ * changed on each reply (0x328 -> 0x329 -> 0x32a ...) and the requester could
+ * never correlate a held lock -- it re-requested forever (the measured ~35/sec
+ * storm on LNM$CWLOGICALS + F11B$aSYSDSK1, CN stuck at 2). A real VMS master is
+ * idempotent to a retransmit: the SAME (req_csid, req_lkid) on the same resource,
+ * already granted at a mode that covers the request, returns the SAME master
+ * handle every time.
+ *
+ * Returns 1 and fills req->master_lkid / master_csid / valblk (the caller returns
+ * SS$_NORMAL) when an existing grant satisfies the retransmit; 0 to let the caller
+ * run the full enqueue core -- a genuinely new lock, or an UP-CONVERSION (existing
+ * grant weaker than the request) the core must process for real. Cross-node only
+ * (both ids non-zero); a local $ENQ (both 0) is never deduped here. INV-6: the
+ * handle returned names a REAL existing lock record on the resource's granted
+ * queue -- never a fabricated or defaulted grant.
+ */
+static int vms_lock_dlm_xnode_enq_idempotent(struct vms_dlm_xnode_args *req)
+{
+    struct vms_lock_resource *res;
+    struct vms_lock_entry *lock;
+    int handled = 0;
+
+    if (req->req_csid == 0 || req->req_lkid == 0)
+        return 0;   /* a local ENQ or unidentified requester: never dedup */
+
+    res = resource_find_or_create(req->resnam);
+    if (!res)
+        return 0;   /* let the core report SS$_INSFMEM honestly */
+
+    exec_lock(&res->lock);
+    exec_list_for_each_entry(lock, &res->granted, res_granted) {
+        if (lock->req_csid == req->req_csid &&
+            lock->req_lkid == req->req_lkid &&
+            lock->granted_mode >= req->lkmode) {
+            req->master_lkid = lock->lkid;          /* the SAME stable handle */
+            req->master_csid = vms_local_csid;
+            memcpy(req->valblk, res->valblk, LCK_VALBLK_SIZE);
+            handled = 1;
+            break;
+        }
+    }
+    exec_unlock(&res->lock);
+
+    resource_release(res);
+    return handled;
+}
+
 /*
  * vms_lock_dlm_xnode_dispatch - the cross-node DLM RECEIVE handler
  * (vms-94c transport; DLM epic vms-7fa).
@@ -2553,6 +2642,19 @@ uint32_t vms_lock_dlm_xnode_dispatch(struct vms_proc *proc,
         if (req->resnam[0] == '\0')
             return SS__BADPARAM;
 
+        /*
+         * Retransmit idempotency (vms-16c). An already-granted cross-node lock
+         * (same req_csid + req_lkid, mode still covered) returns its EXISTING
+         * master handle -- a STABLE handle the requester correlates -- instead of
+         * minting a fresh record per re-send. Without this the returned handle
+         * changed on every retransmit and the member re-requested forever. A
+         * genuinely new lock or an up-conversion returns 0 here and runs the core.
+         */
+        if (vms_lock_dlm_xnode_enq_idempotent(req)) {
+            req->queued = 0;
+            return SS__NORMAL;
+        }
+
         /*
          * Marshal the decoded cross-node $ENQ into the single-node lock manager
          * on this (the mastering) node, in CROSS-NODE mode (xn): the lock is held

src/kernel-core/vmsfs_acp.c

@@ -104,6 +104,16 @@ struct vms_acp_volume {
      */
     uint32_t         ibmap_lbn;         /* hm2_ibmaplbn: index-bitmap base LBN */
     uint32_t         maxfiles;          /* hm2_maxfiles: index-file capacity */
+    /*
+     * The STANDING volume lock a faithful MOUNT holds for the whole mount life
+     * (vms-25e): a real VMS MOUNT holds the per-volume "F11B$v<label>" lock from
+     * $MOUNT to $DISMOUNT -- the cluster-wide marker that this node has the volume
+     * mounted, which the connection manager registers during a directory rebuild.
+     * Taken at publish, released at $DISMOUNT. 0 = not held (acquire failed or the
+     * node has no DLM); the volume is still mounted -- the standing lock is a
+     * cluster-registration facility, never a gate on the mount itself.
+     */
+    uint32_t         vol_lkid;          /* standing F11B$v<label> lock handle, 0 if unheld */
 };
 
 /*
@@ -267,20 +277,27 @@ static struct vms_acp_volume *acp_vol_find_locked(const char *devnam)
 }
 
 /*
- * acp_vol_resnam - the per-volume synchronization RESOURCE NAME for the ACP's
- * DLM write lock (vms-233, design §4.7). Derived from the ODS-2 volume LABEL so
- * a clustered / MSCP-served volume computes the SAME resource name on every node
- * that serves it -- the DLM resource is the cluster-wide write sync point. The
- * namespace prefix follows VMS's public files-lock naming ("F11B$s..."); the
- * exact resource string is an OVMX design choice, not a claim of VMS byte-wire
- * fidelity (Rule 8). An unlabelled volume falls back to its backing device
- * numbers so it still serializes locally. Host-neutral (fixed-width fields, no
- * long/pointer/sizeof) -- kernel-core portable for the Alpha/VAX cross-check.
+ * acp_vol_resnam_kind - the per-volume Files-11 DLM RESOURCE NAME "F11B$<kind><label>"
+ * for one of the per-volume locks (vms-233, design §4.7). `kind` selects which:
+ *   's' -- the XQP volume-SYNCHRONIZATION lock, taken transiently per on-disk-
+ *          structure write (vms_lock_acp_vol_ex); the original single use.
+ *   'v' -- the standing VOLUME lock a faithful MOUNT holds for the whole mount
+ *          life (vms-25e), the cluster-wide "this volume is mounted here" marker
+ *          the connection manager registers during a directory rebuild.
+ *   'a' -- the volume-ALLOCATION lock.
+ * Derived from the ODS-2 volume LABEL so a clustered / MSCP-served volume computes
+ * the SAME resource name on every node that serves it -- the DLM resource is the
+ * cluster-wide sync point. The namespace follows VMS's public files-lock naming
+ * ("F11B$..."); the exact string is an OVMX design choice, not a claim of VMS
+ * byte-wire fidelity (Rule 8). An unlabelled volume falls back to its backing
+ * device numbers so it still serializes locally. Host-neutral (fixed-width fields,
+ * no long/pointer/sizeof) -- kernel-core portable for the Alpha/VAX cross-check.
  */
-static void acp_vol_resnam(const struct vms_acp_volume *vol, char *out, size_t outsz)
+static void acp_vol_resnam_kind(const struct vms_acp_volume *vol, char kind,
+                                char *out, size_t outsz)
 {
     size_t n = 0;
-    static const char pfx[] = "F11B$s";
+    const char pfx[7] = { 'F', '1', '1', 'B', '$', kind, '\0' };
     size_t i;
 
     for (i = 0; pfx[i] != '\0' && n + 1 < outsz; i++)
@@ -310,6 +327,14 @@ static void acp_vol_resnam(const struct vms_acp_volume *vol, char *out, size_t o
     out[n < outsz ? n : outsz - 1] = '\0';
 }
 
+/* acp_vol_resnam - the XQP volume-SYNC resource name ("F11B$s<label>"), the
+ * original per-write serialization lock. Thin wrapper over acp_vol_resnam_kind
+ * so the transient-lock call sites read unchanged. */
+static void acp_vol_resnam(const struct vms_acp_volume *vol, char *out, size_t outsz)
+{
+    acp_vol_resnam_kind(vol, 's', out, outsz);
+}
+
 /* Caller holds proc->chan_lock. */
 static struct vms_acp_chan *acp_chan_find_locked(struct vms_proc *proc, uint32_t chan)
 {
@@ -682,6 +707,23 @@ long vms_ioctl_acp_mount(struct vms_proc *proc, unsigned long arg)
     exec_list_add_tail(&vol->list, &vms_acp_vol_list);
     exec_unlock(&vms_acp_vol_lock);
 
+    /*
+     * vms-25e: take the STANDING volume lock a faithful MOUNT holds for the whole
+     * mount life -- the cluster-registration presence marker the connection
+     * manager registers to the coordinator on join. Enqueued AFTER dropping
+     * vms_acp_vol_lock (the enqueue may take DLM locks; never hold the table lock
+     * across it). Best-effort: a failure (no DLM backend) leaves vol_lkid 0 and
+     * the volume is mounted regardless -- the standing lock is a cluster facility,
+     * NEVER a gate on the mount itself (INV-6: honest omission on failure). Owned
+     * by the mounting process; for the PID-1-mounted system disk that is the
+     * node's life.
+     */
+    {
+        char vresnam[32];
+        acp_vol_resnam_kind(vol, 'v', vresnam, sizeof(vresnam));
+        vms_lock_acp_vol_standing(proc, vresnam, &vol->vol_lkid);
+    }
+
     args.status = SS__NORMAL;
 
 out:
@@ -705,7 +747,6 @@ long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg)
     char devnam[VMS_DEVNAM_SIZE];
     uint32_t status;
 
-    (void)proc;
     memset(&args, 0, sizeof(args));
     if (exec_copyin(&args, (const void *)arg, sizeof(args)))
         return -EFAULT;
@@ -731,6 +772,14 @@ long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg)
     }
     exec_list_del(&vol->list);
     exec_unlock(&vms_acp_vol_lock);
+    /*
+     * vms-25e: drop the standing volume lock this mount held (no-op if unheld).
+     * Best-effort, outside the table lock (the DEQ may touch DLM state). The lock
+     * was taken by the MOUNTING process; if a different process dismounts, the DEQ
+     * may not match and the holder's rundown ($DEQ-on-exit) is the backstop -- for
+     * the PID-1-mounted system disk, dismount and rundown are both PID 1.
+     */
+    vms_lock_acp_vol_release(proc, vol->vol_lkid);
     exec_free(vol);
 
     args.status = SS__NORMAL;
@@ -741,6 +790,50 @@ long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg)
     return 0;
 }
 
+/*
+ * vms_ioctl_dlm_enum_standing - enumerate this node's STANDING cluster-registrable
+ * system locks (vms-1f4). These are the locks the executive holds for the node's
+ * LIFE that the connection manager (scsd) registers to the coordinator during a
+ * directory rebuild: today the per-volume F11B$v<label> lock a MOUNT holds
+ * (vms-25e), one entry per mounted volume that genuinely holds it (vol_lkid != 0).
+ * Each entry carries the resource name and this node's LOCAL lock handle -- the
+ * op-0x01 requester lkid scsd puts on the wire.
+ *
+ * INV-6: a READ of REAL lock state. count is exactly the number of standing locks
+ * the executive genuinely holds; a volume whose best-effort acquire failed
+ * (vol_lkid == 0) contributes nothing. Never a fabricated lock. The enqueue lock
+ * is dropped before copyout (copyout may fault); the table lock is held only
+ * across the in-memory walk.
+ */
+long vms_ioctl_dlm_enum_standing(struct vms_proc *proc, unsigned long arg)
+{
+    struct vms_dlm_enum_standing_args args;
+    struct vms_acp_volume *vol;
+
+    (void)proc;
+    memset(&args, 0, sizeof(args));
+
+    exec_lock(&vms_acp_vol_lock);
+    exec_list_for_each_entry(vol, &vms_acp_vol_list, list) {
+        if (vol->vol_lkid == 0)
+            continue;                   /* no standing lock held (best-effort acquire failed) */
+        args.total++;
+        if (args.count < VMS_DLM_ENUM_STANDING_MAX) {
+            struct vms_dlm_standing_ent *e = &args.ent[args.count];
+            acp_vol_resnam_kind(vol, 'v', e->resnam, sizeof(e->resnam));
+            e->lkid = vol->vol_lkid;
+            e->mode = LCK_K_NLMODE;      /* the volume presence lock is held at NL */
+            args.count++;
+        }
+    }
+    exec_unlock(&vms_acp_vol_lock);
+    args.status = SS__NORMAL;
+
+    if (exec_copyout((void *)arg, &args, sizeof(args)))
+        return -EFAULT;
+    return 0;
+}
+
 /*
  * $ASSIGN a FILE-CLASS channel to a mounted ODS-2 volume (design §4.2). The
  * channel is the executive's -- bound to the mounted volume, drawn from the

src/kernel-netbsd/vms_internal.h

@@ -820,6 +820,13 @@ long vms_ioctl_getlki(struct vms_proc *proc, unsigned long arg);
 uint32_t vms_lock_acp_vol_ex(struct vms_proc *proc, const char *resnam,
                              uint32_t *lkid_out);
 uint32_t vms_lock_acp_vol_release(struct vms_proc *proc, uint32_t lkid);
+/* The STANDING per-volume lock a faithful MOUNT holds for the whole mount life
+ * (vms-25e): an NL-mode $ENQ on the F11B$v<label> resource, held from $MOUNT to
+ * $DISMOUNT as the cluster-registration presence marker. Released with
+ * vms_lock_acp_vol_release. Mirror of the src/kernel/vms_internal.h decl (#928:
+ * kernel-core lock ops must be declared in BOTH the Linux and NetBSD headers). */
+uint32_t vms_lock_acp_vol_standing(struct vms_proc *proc, const char *resnam,
+                                   uint32_t *lkid_out);
 long vms_ioctl_get_resmaster(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_dlm_member_depart(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_dlm_get_granted(struct vms_proc *proc, unsigned long arg);
@@ -866,6 +873,11 @@ void vms_acp_init(void);
 void vms_acp_cleanup(void);
 long vms_ioctl_acp_mount(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg);
+/* Enumerate this node's standing cluster-registrable system locks (vms-1f4): one
+ * entry (resname + local lkid + mode) per mounted volume holding its F11B$v lock.
+ * A READ of real lock state for scsd's directory-rebuild registration. Mirror of
+ * the src/kernel/vms_internal.h decl (#928: kernel-core ops in BOTH headers). */
+long vms_ioctl_dlm_enum_standing(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_assign(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_access(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_deaccess(struct vms_proc *proc, unsigned long arg);