snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/server/filer_grpc_server_posix_lock.go

@@ -0,0 +1,248 @@
+package weed_server
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer/posixlock"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+const (
+	// posixLockSessionTTL is how long a mount's lease survives without a
+	// keepalive before its locks are reaped; posixLockSweepInterval is how often
+	// each filer checks. The mount renews well within the TTL.
+	posixLockSessionTTL    = 15 * time.Second
+	posixLockSweepInterval = 5 * time.Second
+	// posixCoolingProbeTimeout bounds the dual-read probe to the prior owner so a
+	// slow peer can't stall a non-blocking lock call during the cooling window.
+	posixCoolingProbeTimeout = 2 * time.Second
+	// posixLockWarmup is how long after a (re)start the owner defers would-be
+	// grants while mounts re-assert their held locks, so it does not double-grant
+	// a lock its fresh, still-empty state has not yet rebuilt. Must exceed the
+	// mount keepalive interval and stay below the TTL.
+	posixLockWarmup = 10 * time.Second
+)
+
+// startPosixLockSweeper periodically reaps the locks of leased sessions (mounts)
+// that stopped sending keepalives. Sessions that never renew are never reaped, so
+// this is inert until mounts run with -posixLock.
+func (fs *FilerServer) startPosixLockSweeper() {
+	fs.posixLockReadyAt.Store(time.Now().UnixNano())
+	fs.posixLockSweeperStop = make(chan struct{})
+	go func() {
+		ticker := time.NewTicker(posixLockSweepInterval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-fs.posixLockSweeperStop:
+				return
+			case <-ticker.C:
+				if reaped := fs.posixLocks.ReapExpired(posixLockSessionTTL); len(reaped) > 0 {
+					glog.V(2).Infof("posix lock: reaped %d expired session(s): %v", len(reaped), reaped)
+				}
+			}
+		}
+	}()
+}
+
+// PosixLock applies one advisory lock operation against the in-memory lock table
+// of the inode's owner filer. The owner is resolved from req.Key on the same
+// ring the gateway and DLM use; a non-owner filer forwards the request one hop
+// (is_moved bounds it), so the owner's table stays the single authority even when
+// the caller's ring view is stale. Blocking (SetLkw) is the caller's job — this
+// is strictly non-blocking try/release/query.
+func (fs *FilerServer) PosixLock(ctx context.Context, req *filer_pb.PosixLockRequest) (*filer_pb.PosixLockResponse, error) {
+	if req.Key == "" {
+		return &filer_pb.PosixLockResponse{}, fmt.Errorf("key is required")
+	}
+	if req.Lock == nil {
+		return &filer_pb.PosixLockResponse{}, fmt.Errorf("lock is required")
+	}
+
+	if !req.IsMoved && fs.filer.Dlm != nil {
+		if owner := fs.filer.Dlm.LockRing.GetPrimary(req.Key); owner != "" && owner != fs.option.Host {
+			forwarded := &filer_pb.PosixLockRequest{
+				Key:     req.Key,
+				IsMoved: true,
+				Op:      req.Op,
+				Lock:    req.Lock,
+				Locks:   req.Locks,
+			}
+			glog.V(4).InfofCtx(ctx, "PosixLock %s op=%v: forwarding to owner %s", req.Key, req.Op, owner)
+			var resp *filer_pb.PosixLockResponse
+			err := pb.WithFilerClient(false, 0, owner, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+				var e error
+				resp, e = client.PosixLock(ctx, forwarded)
+				return e
+			})
+			if err != nil {
+				return &filer_pb.PosixLockResponse{}, err
+			}
+			return resp, nil
+		}
+	}
+
+	lk := posixlock.Range{
+		Start:   req.Lock.GetStart(),
+		End:     req.Lock.GetEnd(),
+		Type:    req.Lock.GetType(),
+		Sid:     req.Lock.GetSid(),
+		Owner:   req.Lock.GetOwner(),
+		Pid:     req.Lock.GetPid(),
+		IsFlock: req.Lock.GetIsFlock(),
+	}
+
+	resp := &filer_pb.PosixLockResponse{}
+	switch req.Op {
+	case filer_pb.PosixLockOp_TRY_LOCK:
+		// A fresh owner's state may be incomplete (post-restart warm-up, or a ring
+		// change whose previous owner can't be reached): report a known conflict,
+		// else defer the grant so the client retries rather than risk a
+		// double-grant. A deferred grant becomes EAGAIN for non-blocking SetLk and
+		// a retry for the blocking SetLkw poll — never a spurious grant.
+		if !req.CoolingProbe {
+			if c, deferGrant := fs.posixCoolingOrWarmup(ctx, req.Key, lk); c != nil {
+				resp.HasConflict = true
+				resp.Conflict = c
+				break
+			} else if deferGrant {
+				break
+			}
+		}
+		if c, granted := fs.posixLocks.TryLock(req.Key, lk); granted {
+			resp.Granted = true
+		} else {
+			resp.HasConflict = true
+			resp.Conflict = posixRangeToPb(c)
+		}
+	case filer_pb.PosixLockOp_UNLOCK:
+		fs.posixLocks.Unlock(req.Key, lk)
+	case filer_pb.PosixLockOp_GET_LK:
+		// A query is best-effort: report a known conflict but never defer.
+		if !req.CoolingProbe {
+			if c, _ := fs.posixCoolingOrWarmup(ctx, req.Key, lk); c != nil {
+				resp.HasConflict = true
+				resp.Conflict = c
+				break
+			}
+		}
+		if c, found := fs.posixLocks.GetLk(req.Key, lk); found {
+			resp.HasConflict = true
+			resp.Conflict = posixRangeToPb(c)
+		}
+	case filer_pb.PosixLockOp_RELEASE_POSIX_OWNER:
+		fs.posixLocks.ReleasePosixOwner(req.Key, lk.Sid, lk.Owner)
+	case filer_pb.PosixLockOp_RELEASE_FLOCK_OWNER:
+		fs.posixLocks.ReleaseFlockOwner(req.Key, lk.Sid, lk.Owner)
+	case filer_pb.PosixLockOp_KEEP_ALIVE:
+		// A re-assertion carries the mount's held locks on this key so the owner
+		// can rebuild its in-memory state after an ownership change or restart; a
+		// bare keepalive just renews the lease.
+		if len(req.Locks) > 0 {
+			held := make([]posixlock.Range, 0, len(req.Locks))
+			for _, l := range req.Locks {
+				held = append(held, posixRangeFromPb(l))
+			}
+			if conflicts := fs.posixLocks.Reassert(req.Key, lk.Sid, held); len(conflicts) > 0 {
+				glog.Warningf("posix reassert %s sid %d: %d lock(s) lost to another session: %+v", req.Key, lk.Sid, len(conflicts), conflicts)
+			}
+		} else {
+			fs.posixLocks.Renew(lk.Sid)
+		}
+	default:
+		return &filer_pb.PosixLockResponse{}, fmt.Errorf("unknown posix lock op %v", req.Op)
+	}
+	return resp, nil
+}
+
+// posixWarmingUp reports whether this filer is still within posixLockWarmup of
+// when it began serving POSIX locks. The zero readyAt (e.g. in tests) is never
+// warming up.
+func (fs *FilerServer) posixWarmingUp() bool {
+	readyAt := fs.posixLockReadyAt.Load()
+	return readyAt != 0 && time.Since(time.Unix(0, readyAt)) < posixLockWarmup
+}
+
+// posixCoolingOrWarmup decides whether a fresh owner can trust its local state
+// for key before granting. It returns a known blocking lock (conflict != nil),
+// or asks the caller to defer the grant (deferGrant) when the state may be
+// incomplete and no conflict can be confirmed. It returns (nil, false) when the
+// owner is authoritative and should consult its local table.
+//
+//   - Warm-up: just after a (re)start the owner is still rebuilding from
+//     re-assertions, so only a locally-visible conflict is trustworthy; a
+//     would-be grant is deferred.
+//   - Ring change (cooling window): the previous owner may still hold a lock this
+//     owner hasn't rebuilt. Ask it (marked cooling_probe so it answers locally
+//     without recursing), under a short deadline so a slow peer can't stall the
+//     non-blocking lock path. If it is unreachable — typically because it
+//     crashed, which caused the change — we cannot confirm, so we defer rather
+//     than risk a double-grant; re-assertion rebuilds this owner before the
+//     window ends.
+func (fs *FilerServer) posixCoolingOrWarmup(ctx context.Context, key string, lk posixlock.Range) (conflict *filer_pb.PosixLockRange, deferGrant bool) {
+	if fs.posixWarmingUp() {
+		if c, found := fs.posixLocks.GetLk(key, lk); found {
+			return posixRangeToPb(c), false
+		}
+		return nil, true
+	}
+	if fs.filer.Dlm == nil {
+		return nil, false
+	}
+	prior := fs.filer.Dlm.LockRing.PriorOwner(key)
+	if prior == "" || prior == fs.option.Host {
+		return nil, false
+	}
+	probeCtx, cancel := context.WithTimeout(ctx, posixCoolingProbeTimeout)
+	defer cancel()
+	var resp *filer_pb.PosixLockResponse
+	err := pb.WithFilerClient(false, 0, prior, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+		var e error
+		resp, e = client.PosixLock(probeCtx, &filer_pb.PosixLockRequest{
+			Key:          key,
+			IsMoved:      true,
+			CoolingProbe: true,
+			Op:           filer_pb.PosixLockOp_GET_LK,
+			Lock:         posixRangeToPb(lk),
+		})
+		return e
+	})
+	if err != nil {
+		// Cannot confirm — defer rather than risk a double-grant (the prior owner
+		// likely crashed; re-assertion rebuilds this owner before the window ends).
+		glog.V(2).InfofCtx(ctx, "posix cooling probe %s -> %s: %v (deferring)", key, prior, err)
+		return nil, true
+	}
+	if resp.GetHasConflict() {
+		return resp.GetConflict(), false
+	}
+	return nil, false
+}
+
+func posixRangeFromPb(l *filer_pb.PosixLockRange) posixlock.Range {
+	return posixlock.Range{
+		Start:   l.GetStart(),
+		End:     l.GetEnd(),
+		Type:    l.GetType(),
+		Sid:     l.GetSid(),
+		Owner:   l.GetOwner(),
+		Pid:     l.GetPid(),
+		IsFlock: l.GetIsFlock(),
+	}
+}
+
+func posixRangeToPb(r posixlock.Range) *filer_pb.PosixLockRange {
+	return &filer_pb.PosixLockRange{
+		Start:   r.Start,
+		End:     r.End,
+		Type:    r.Type,
+		Sid:     r.Sid,
+		Owner:   r.Owner,
+		Pid:     r.Pid,
+		IsFlock: r.IsFlock,
+	}
+}