Whamcloud - gitweb
LU-14182 lov: cancel layout lock on replay deadlock
[fs/lustre-release.git] / lustre / llite / namei.c
index 8098f27..6814416 100644 (file)
@@ -49,7 +49,8 @@
 
 static int ll_create_it(struct inode *dir, struct dentry *dentry,
                        struct lookup_intent *it,
-                       void *secctx, __u32 secctxlen);
+                       void *secctx, __u32 secctxlen, bool encrypt,
+                       void *encctx, __u32 encctxlen);
 
 /* called from iget5_locked->find_inode() under inode_lock spinlock */
 static int ll_test_inode(struct inode *inode, void *opaque)
@@ -154,26 +155,44 @@ struct inode *ll_iget(struct super_block *sb, ino_t hash,
         RETURN(inode);
 }
 
-static void ll_invalidate_negative_children(struct inode *dir)
+/* mark negative sub file dentries invalid and prune unused dentries */
+static void ll_prune_negative_children(struct inode *dir)
 {
-       struct dentry *dentry, *tmp_subdir;
+       struct dentry *dentry;
+       struct dentry *child;
 
+       ENTRY;
+
+restart:
        spin_lock(&dir->i_lock);
        hlist_for_each_entry(dentry, &dir->i_dentry, d_alias) {
                spin_lock(&dentry->d_lock);
-               if (!list_empty(&dentry->d_subdirs)) {
-                       struct dentry *child;
-
-                       list_for_each_entry_safe(child, tmp_subdir,
-                                                &dentry->d_subdirs,
-                                                d_child) {
-                               if (child->d_inode == NULL)
-                                       d_lustre_invalidate(child, 1);
+               list_for_each_entry(child, &dentry->d_subdirs, d_child) {
+                       if (child->d_inode)
+                               continue;
+
+                       spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED);
+                       __d_lustre_invalidate(child);
+                       if (!ll_d_count(child)) {
+                               dget_dlock(child);
+                               __d_drop(child);
+                               spin_unlock(&child->d_lock);
+                               spin_unlock(&dentry->d_lock);
+                               spin_unlock(&dir->i_lock);
+
+                               CDEBUG(D_DENTRY, "prune negative dentry %pd\n",
+                                      child);
+
+                               dput(child);
+                               goto restart;
                        }
+                       spin_unlock(&child->d_lock);
                }
                spin_unlock(&dentry->d_lock);
        }
        spin_unlock(&dir->i_lock);
+
+       EXIT;
 }
 
 int ll_test_inode_by_fid(struct inode *inode, void *opaque)
@@ -189,17 +208,12 @@ static int ll_dom_lock_cancel(struct inode *inode, struct ldlm_lock *lock)
        int rc;
        ENTRY;
 
-       if (!lli->lli_clob) {
-               /* due to DoM read on open, there may exist pages for Lustre
-                * regular file even though cl_object is not set up yet. */
-               truncate_inode_pages(inode->i_mapping, 0);
-               RETURN(0);
-       }
-
        env = cl_env_get(&refcheck);
        if (IS_ERR(env))
                RETURN(PTR_ERR(env));
 
+       OBD_FAIL_TIMEOUT(OBD_FAIL_LDLM_REPLAY_PAUSE, cfs_fail_val);
+
        /* reach MDC layer to flush data under  the DoM ldlm lock */
        rc = cl_object_flush(env, lli->lli_clob, lock);
        if (rc == -ENODATA) {
@@ -304,7 +318,7 @@ static void ll_lock_cancel_bits(struct ldlm_lock *lock, __u64 to_cancel)
        lli = ll_i2info(inode);
 
        if (bits & MDS_INODELOCK_UPDATE)
-               ll_file_set_flag(lli, LLIF_UPDATE_ATIME);
+               set_bit(LLIF_UPDATE_ATIME, &lli->lli_flags);
 
        if ((bits & MDS_INODELOCK_UPDATE) && S_ISDIR(inode->i_mode)) {
                CDEBUG(D_INODE, "invalidating inode "DFID" lli = %p, "
@@ -349,18 +363,17 @@ static void ll_lock_cancel_bits(struct ldlm_lock *lock, __u64 to_cancel)
                                                        ll_test_inode_by_fid,
                                                        (void *)&lli->lli_pfid);
                        if (master_inode) {
-                               ll_invalidate_negative_children(master_inode);
+                               ll_prune_negative_children(master_inode);
                                iput(master_inode);
                        }
                } else {
-                       ll_invalidate_negative_children(inode);
+                       ll_prune_negative_children(inode);
                }
        }
 
        if ((bits & (MDS_INODELOCK_LOOKUP | MDS_INODELOCK_PERM)) &&
-           inode->i_sb->s_root != NULL &&
-           inode != inode->i_sb->s_root->d_inode)
-               ll_invalidate_aliases(inode);
+           !is_root_inode(inode))
+               ll_prune_aliases(inode);
 
        if (bits & (MDS_INODELOCK_LOOKUP | MDS_INODELOCK_PERM))
                forget_all_cached_acls(inode);
@@ -416,8 +429,7 @@ int ll_md_need_convert(struct ldlm_lock *lock)
        /* is lock is too old to be converted? */
        lock_res_and_lock(lock);
        if (ktime_after(ktime_get(),
-                       ktime_add(lock->l_last_used,
-                                 ktime_set(ns->ns_dirty_age_limit, 0)))) {
+                       ktime_add(lock->l_last_used, ns->ns_dirty_age_limit))) {
                unlock_res_and_lock(lock);
                return 0;
        }
@@ -603,6 +615,27 @@ struct dentry *ll_splice_alias(struct inode *inode, struct dentry *de)
        if (rc < 0)
                return ERR_PTR(rc);
        d_add(de, inode);
+
+       /* this needs only to be done for foreign symlink dirs as
+        * DCACHE_SYMLINK_TYPE is already set by d_flags_for_inode()
+        * kernel routine for files with symlink ops (ie, real symlink)
+        */
+       if (inode && S_ISDIR(inode->i_mode) &&
+           ll_sbi_has_foreign_symlink(ll_i2sbi(inode)) &&
+#ifdef HAVE_IOP_GET_LINK
+           inode->i_op->get_link) {
+#else
+           inode->i_op->follow_link) {
+#endif
+               CDEBUG(D_INFO, "%s: inode "DFID": faking foreign dir as a symlink\n",
+                      ll_i2sbi(inode)->ll_fsname, PFID(ll_inode2fid(inode)));
+               spin_lock(&de->d_lock);
+               /* like d_flags_for_inode() already does for files */
+               de->d_flags = (de->d_flags & ~DCACHE_ENTRY_TYPE) |
+                             DCACHE_SYMLINK_TYPE;
+               spin_unlock(&de->d_lock);
+       }
+
        CDEBUG(D_DENTRY, "Add dentry %p inode %p refc %d flags %#x\n",
               de, de->d_inode, ll_d_count(de), de->d_flags);
         return de;
@@ -612,7 +645,8 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                               struct lookup_intent *it,
                               struct inode *parent, struct dentry **de,
                               void *secctx, __u32 secctxlen,
-                              ktime_t kstart)
+                              void *encctx, __u32 encctxlen,
+                              ktime_t kstart, bool encrypt)
 {
        struct inode             *inode = NULL;
        __u64                     bits = 0;
@@ -633,10 +667,41 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                if (rc)
                        RETURN(rc);
 
-               if (it->it_op & IT_OPEN)
-                       ll_dom_finish_open(inode, request, it);
+               /* If encryption context was returned by MDT, put it in
+                * inode now to save an extra getxattr and avoid deadlock.
+                */
+               if (body->mbo_valid & OBD_MD_ENCCTX) {
+                       encctx = req_capsule_server_get(pill, &RMF_FILE_ENCCTX);
+                       encctxlen = req_capsule_get_size(pill,
+                                                        &RMF_FILE_ENCCTX,
+                                                        RCL_SERVER);
+
+                       if (encctxlen) {
+                               CDEBUG(D_SEC,
+                                      "server returned encryption ctx for "DFID"\n",
+                                      PFID(ll_inode2fid(inode)));
+                               rc = ll_xattr_cache_insert(inode,
+                                              LL_XATTR_NAME_ENCRYPTION_CONTEXT,
+                                                          encctx, encctxlen);
+                               if (rc)
+                                       CWARN("%s: cannot set enc ctx for "DFID": rc = %d\n",
+                                             ll_i2sbi(inode)->ll_fsname,
+                                             PFID(ll_inode2fid(inode)), rc);
+                               else if (encrypt) {
+                                       rc = llcrypt_get_encryption_info(inode);
+                                       if (rc)
+                                               CDEBUG(D_SEC,
+                                                "cannot get enc info for "DFID": rc = %d\n",
+                                                PFID(ll_inode2fid(inode)), rc);
+                               }
+                       }
+               }
 
                ll_set_lock_data(ll_i2sbi(parent)->ll_md_exp, inode, it, &bits);
+               /* OPEN can return data if lock has DoM+LAYOUT bits set */
+               if (it->it_op & IT_OPEN &&
+                   bits & MDS_INODELOCK_DOM && bits & MDS_INODELOCK_LAYOUT)
+                       ll_dom_finish_open(inode, request);
 
                /* We used to query real size from OSTs here, but actually
                 * this is not needed. For stat() calls size would be updated
@@ -665,14 +730,17 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                }
 
                if (secctx != NULL && secctxlen != 0) {
-                       inode_lock(inode);
+                       /* no need to protect selinux_inode_setsecurity() by
+                        * inode_lock. Taking it would lead to a client deadlock
+                        * LU-13617
+                        */
                        rc = security_inode_notifysecctx(inode, secctx,
                                                         secctxlen);
-                       inode_unlock(inode);
                        if (rc)
-                               CWARN("cannot set security context for "
-                                     DFID": rc = %d\n",
-                                     PFID(ll_inode2fid(inode)), rc);
+                               CWARN("%s: cannot set security context for "DFID": rc = %d\n",
+                                     ll_i2sbi(inode)->ll_fsname,
+                                     PFID(ll_inode2fid(inode)),
+                                     rc);
                }
        }
 
@@ -689,6 +757,14 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                /* we have lookup look - unhide dentry */
                if (bits & MDS_INODELOCK_LOOKUP)
                        d_lustre_revalidate(*de);
+
+               if (encrypt) {
+                       rc = llcrypt_get_encryption_info(inode);
+                       if (rc)
+                               GOTO(out, rc);
+                       if (!llcrypt_has_encryption_key(inode))
+                               GOTO(out, rc = -ENOKEY);
+               }
        } else if (!it_disposition(it, DISP_OPEN_CREATE)) {
                /*
                 * If file was created on the server, the dentry is revalidated
@@ -736,7 +812,9 @@ out:
 static struct dentry *ll_lookup_it(struct inode *parent, struct dentry *dentry,
                                   struct lookup_intent *it,
                                   void **secctx, __u32 *secctxlen,
-                                  struct pcc_create_attach *pca)
+                                  struct pcc_create_attach *pca,
+                                  bool encrypt,
+                                  void **encctx, __u32 *encctxlen)
 {
        ktime_t kstart = ktime_get();
        struct lookup_intent lookup_it = { .it_op = IT_LOOKUP };
@@ -750,21 +828,20 @@ static struct dentry *ll_lookup_it(struct inode *parent, struct dentry *dentry,
 
        ENTRY;
 
-        if (dentry->d_name.len > ll_i2sbi(parent)->ll_namelen)
-                RETURN(ERR_PTR(-ENAMETOOLONG));
+       if (dentry->d_name.len > ll_i2sbi(parent)->ll_namelen)
+               RETURN(ERR_PTR(-ENAMETOOLONG));
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p), intent=%s\n",
-              dentry->d_name.len, dentry->d_name.name,
-              PFID(ll_inode2fid(parent)), parent, LL_IT2STR(it));
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p), intent=%s\n",
+              dentry, PFID(ll_inode2fid(parent)), parent, LL_IT2STR(it));
 
-        if (d_mountpoint(dentry))
-                CERROR("Tell Peter, lookup on mtpt, it %s\n", LL_IT2STR(it));
+       if (d_mountpoint(dentry))
+               CERROR("Tell Peter, lookup on mtpt, it %s\n", LL_IT2STR(it));
 
        if (it == NULL || it->it_op == IT_GETXATTR)
                it = &lookup_it;
 
        if (it->it_op == IT_GETATTR && dentry_may_statahead(parent, dentry)) {
-               rc = ll_statahead(parent, &dentry, 0);
+               rc = ll_revalidate_statahead(parent, &dentry, 0);
                if (rc == 1)
                        RETURN(dentry == save ? NULL : dentry);
        }
@@ -806,6 +883,20 @@ static struct dentry *ll_lookup_it(struct inode *parent, struct dentry *dentry,
                if (secctxlen != NULL)
                        *secctxlen = 0;
        }
+       if (it->it_op & IT_CREAT && encrypt) {
+               rc = llcrypt_inherit_context(parent, NULL, op_data, false);
+               if (rc)
+                       GOTO(out, retval = ERR_PTR(rc));
+               if (encctx != NULL)
+                       *encctx = op_data->op_file_encctx;
+               if (encctxlen != NULL)
+                       *encctxlen = op_data->op_file_encctx_size;
+       } else {
+               if (encctx != NULL)
+                       *encctx = NULL;
+               if (encctxlen != NULL)
+                       *encctxlen = 0;
+       }
 
        /* ask for security context upon intent */
        if (it->it_op & (IT_LOOKUP | IT_GETATTR | IT_OPEN)) {
@@ -886,18 +977,20 @@ static struct dentry *ll_lookup_it(struct inode *parent, struct dentry *dentry,
        rc = ll_lookup_it_finish(req, it, parent, &dentry,
                                 secctx != NULL ? *secctx : NULL,
                                 secctxlen != NULL ? *secctxlen : 0,
-                               kstart);
-        if (rc != 0) {
-                ll_intent_release(it);
-                GOTO(out, retval = ERR_PTR(rc));
-        }
-
-        if ((it->it_op & IT_OPEN) && dentry->d_inode &&
-            !S_ISREG(dentry->d_inode->i_mode) &&
-            !S_ISDIR(dentry->d_inode->i_mode)) {
-                ll_release_openhandle(dentry, it);
-        }
-        ll_lookup_finish_locks(it, dentry);
+                                encctx != NULL ? *encctx : NULL,
+                                encctxlen != NULL ? *encctxlen : 0,
+                                kstart, encrypt);
+       if (rc != 0) {
+               ll_intent_release(it);
+               GOTO(out, retval = ERR_PTR(rc));
+       }
+
+       if ((it->it_op & IT_OPEN) && dentry->d_inode &&
+           !S_ISREG(dentry->d_inode->i_mode) &&
+           !S_ISDIR(dentry->d_inode->i_mode)) {
+               ll_release_openhandle(dentry, it);
+       }
+       ll_lookup_finish_locks(it, dentry);
 
        GOTO(out, retval = (dentry == save) ? NULL : dentry);
 
@@ -909,6 +1002,14 @@ out:
                        op_data->op_file_secctx = NULL;
                        op_data->op_file_secctx_size = 0;
                }
+               if (encctx != NULL && encctxlen != NULL &&
+                   it->it_op & IT_CREAT && encrypt) {
+                       /* caller needs enc ctx info, so reset it in op_data to
+                        * prevent it from being freed
+                        */
+                       op_data->op_file_encctx = NULL;
+                       op_data->op_file_encctx_size = 0;
+               }
                ll_finish_md_op_data(op_data);
        }
 
@@ -925,9 +1026,8 @@ static struct dentry *ll_lookup_nd(struct inode *parent, struct dentry *dentry,
        struct lookup_intent *itp, it = { .it_op = IT_GETATTR };
        struct dentry *de;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p), flags=%u\n",
-              dentry->d_name.len, dentry->d_name.name,
-              PFID(ll_inode2fid(parent)), parent, flags);
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p), flags=%u\n",
+              dentry, PFID(ll_inode2fid(parent)), parent, flags);
 
        /*
         * Optimize away (CREATE && !OPEN). Let .create handle the race.
@@ -942,7 +1042,8 @@ static struct dentry *ll_lookup_nd(struct inode *parent, struct dentry *dentry,
                itp = NULL;
        else
                itp = &it;
-       de = ll_lookup_it(parent, dentry, itp, NULL, NULL, NULL);
+       de = ll_lookup_it(parent, dentry, itp, NULL, NULL, NULL, false,
+                         NULL, NULL);
 
        if (itp != NULL)
                ll_intent_release(itp);
@@ -983,15 +1084,17 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
        long long lookup_flags = LOOKUP_OPEN;
        void *secctx = NULL;
        __u32 secctxlen = 0;
-       struct ll_sb_info *sbi;
+       void *encctx = NULL;
+       __u32 encctxlen = 0;
+       struct ll_sb_info *sbi = NULL;
        struct pcc_create_attach pca = { NULL, NULL };
+       bool encrypt = false;
        int rc = 0;
        ENTRY;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p), file %p,"
-                          "open_flags %x, mode %x opened %d\n",
-              dentry->d_name.len, dentry->d_name.name,
-              PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
+       CDEBUG(D_VFSTRACE,
+              "VFS Op:name=%pd, dir="DFID"(%p), file %p, open_flags %x, mode %x opened %d\n",
+              dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
               ll_is_opened(opened, file));
 
        /* Only negative dentries enter here */
@@ -1040,8 +1143,25 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
        it->it_flags = (open_flags & ~O_ACCMODE) | OPEN_FMODE(open_flags);
        it->it_flags &= ~MDS_OPEN_FL_INTERNAL;
 
+       if (ll_sbi_has_encrypt(ll_i2sbi(dir)) && IS_ENCRYPTED(dir)) {
+               /* in case of create, this is going to be a regular file because
+                * we set S_IFREG bit on it->it_create_mode above
+                */
+               rc = llcrypt_get_encryption_info(dir);
+               if (rc)
+                       GOTO(out_release, rc);
+               if (open_flags & O_CREAT) {
+                       if (!llcrypt_has_encryption_key(dir))
+                               GOTO(out_release, rc = -ENOKEY);
+                       encrypt = true;
+               }
+       }
+
+       OBD_FAIL_TIMEOUT(OBD_FAIL_LLITE_CREATE_FILE_PAUSE2, cfs_fail_val);
+
        /* Dentry added to dcache tree in ll_lookup_it */
-       de = ll_lookup_it(dir, dentry, it, &secctx, &secctxlen, &pca);
+       de = ll_lookup_it(dir, dentry, it, &secctx, &secctxlen, &pca, encrypt,
+                         &encctx, &encctxlen);
        if (IS_ERR(de))
                rc = PTR_ERR(de);
        else if (de != NULL)
@@ -1052,8 +1172,10 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
        if (!rc) {
                if (it_disposition(it, DISP_OPEN_CREATE)) {
                        /* Dentry instantiated in ll_create_it. */
-                       rc = ll_create_it(dir, dentry, it, secctx, secctxlen);
+                       rc = ll_create_it(dir, dentry, it, secctx, secctxlen,
+                                         encrypt, encctx, encctxlen);
                        security_release_secctx(secctx, secctxlen);
+                       llcrypt_free_ctx(encctx, encctxlen);
                        if (rc) {
                                /* We dget in ll_splice_alias. */
                                if (de != NULL)
@@ -1084,9 +1206,20 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
                         * already created PCC copy.
                         */
                        pcc_create_attach_cleanup(dir->i_sb, &pca);
+
+                       if (open_flags & O_CREAT && encrypt &&
+                           dentry->d_inode) {
+                               rc = ll_set_encflags(dentry->d_inode, encctx,
+                                                    encctxlen, true);
+                               llcrypt_free_ctx(encctx, encctxlen);
+                               if (rc)
+                                       GOTO(out_release, rc);
+                       }
                }
 
-               if (dentry->d_inode && it_disposition(it, DISP_OPEN_OPEN)) {
+               /* check also if a foreign file is openable */
+               if (dentry->d_inode && it_disposition(it, DISP_OPEN_OPEN) &&
+                   ll_foreign_is_openable(dentry, open_flags)) {
                        /* Open dentry. */
                        if (S_ISFIFO(dentry->d_inode->i_mode)) {
                                /* We cannot call open here as it might
@@ -1165,16 +1298,16 @@ static struct inode *ll_create_node(struct inode *dir, struct lookup_intent *it)
  */
 static int ll_create_it(struct inode *dir, struct dentry *dentry,
                        struct lookup_intent *it,
-                       void *secctx, __u32 secctxlen)
+                       void *secctx, __u32 secctxlen, bool encrypt,
+                       void *encctx, __u32 encctxlen)
 {
        struct inode *inode;
        __u64 bits = 0;
        int rc = 0;
        ENTRY;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p), intent=%s\n",
-              dentry->d_name.len, dentry->d_name.name,
-              PFID(ll_inode2fid(dir)), dir, LL_IT2STR(it));
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p), intent=%s\n",
+              dentry, PFID(ll_inode2fid(dir)), dir, LL_IT2STR(it));
 
        rc = it_open_error(DISP_OPEN_CREATE, it);
        if (rc)
@@ -1186,18 +1319,26 @@ static int ll_create_it(struct inode *dir, struct dentry *dentry,
 
        if ((ll_i2sbi(inode)->ll_flags & LL_SBI_FILE_SECCTX) &&
            secctx != NULL) {
-               inode_lock(inode);
                /* must be done before d_instantiate, because it calls
                 * security_d_instantiate, which means a getxattr if security
                 * context is not set yet */
+               /* no need to protect selinux_inode_setsecurity() by
+                * inode_lock. Taking it would lead to a client deadlock
+                * LU-13617
+                */
                rc = security_inode_notifysecctx(inode, secctx, secctxlen);
-               inode_unlock(inode);
                if (rc)
                        RETURN(rc);
        }
 
        d_instantiate(dentry, inode);
 
+       if (encrypt) {
+               rc = ll_set_encflags(inode, encctx, encctxlen, true);
+               if (rc)
+                       RETURN(rc);
+       }
+
        if (!(ll_i2sbi(inode)->ll_flags & LL_SBI_FILE_SECCTX)) {
                rc = ll_inode_init_security(dentry, inode, dir);
                if (rc)
@@ -1235,16 +1376,17 @@ static int ll_new_node(struct inode *dir, struct dentry *dchild,
                       const char *tgt, umode_t mode, int rdev, __u32 opc)
 {
        struct qstr *name = &dchild->d_name;
-        struct ptlrpc_request *request = NULL;
-        struct md_op_data *op_data;
-        struct inode *inode = NULL;
-        struct ll_sb_info *sbi = ll_i2sbi(dir);
-        int tgt_len = 0;
-        int err;
+       struct ptlrpc_request *request = NULL;
+       struct md_op_data *op_data = NULL;
+       struct inode *inode = NULL;
+       struct ll_sb_info *sbi = ll_i2sbi(dir);
+       int tgt_len = 0;
+       bool encrypt = false;
+       int err;
 
-        ENTRY;
-        if (unlikely(tgt != NULL))
-                tgt_len = strlen(tgt) + 1;
+       ENTRY;
+       if (unlikely(tgt != NULL))
+               tgt_len = strlen(tgt) + 1;
 
 again:
        op_data = ll_prep_md_op_data(NULL, dir, NULL, name->name,
@@ -1261,6 +1403,24 @@ again:
                        GOTO(err_exit, err);
        }
 
+       if (ll_sbi_has_encrypt(sbi) &&
+           ((IS_ENCRYPTED(dir) &&
+           (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) ||
+           (unlikely(llcrypt_dummy_context_enabled(dir)) && S_ISDIR(mode)))) {
+               err = llcrypt_get_encryption_info(dir);
+               if (err)
+                       GOTO(err_exit, err);
+               if (!llcrypt_has_encryption_key(dir))
+                       GOTO(err_exit, err = -ENOKEY);
+               encrypt = true;
+       }
+
+       if (encrypt) {
+               err = llcrypt_inherit_context(dir, NULL, op_data, false);
+               if (err)
+                       GOTO(err_exit, err);
+       }
+
        err = md_create(sbi->ll_md_exp, op_data, tgt, tgt_len, mode,
                        from_kuid(&init_user_ns, current_fsuid()),
                        from_kgid(&init_user_ns, current_fsgid()),
@@ -1339,20 +1499,29 @@ again:
                GOTO(err_exit, err);
 
        if (sbi->ll_flags & LL_SBI_FILE_SECCTX) {
-               inode_lock(inode);
                /* must be done before d_instantiate, because it calls
                 * security_d_instantiate, which means a getxattr if security
                 * context is not set yet */
+               /* no need to protect selinux_inode_setsecurity() by
+                * inode_lock. Taking it would lead to a client deadlock
+                * LU-13617
+                */
                err = security_inode_notifysecctx(inode,
                                                  op_data->op_file_secctx,
                                                  op_data->op_file_secctx_size);
-               inode_unlock(inode);
                if (err)
                        GOTO(err_exit, err);
        }
 
        d_instantiate(dchild, inode);
 
+       if (encrypt) {
+               err = ll_set_encflags(inode, op_data->op_file_encctx,
+                                     op_data->op_file_encctx_size, true);
+               if (err)
+                       GOTO(err_exit, err);
+       }
+
        if (!(sbi->ll_flags & LL_SBI_FILE_SECCTX)) {
                err = ll_inode_init_security(dchild, inode, dir);
                if (err)
@@ -1367,20 +1536,18 @@ err_exit:
        if (!IS_ERR_OR_NULL(op_data))
                ll_finish_md_op_data(op_data);
 
-       return err;
+       RETURN(err);
 }
 
 static int ll_mknod(struct inode *dir, struct dentry *dchild, umode_t mode,
                    dev_t rdev)
 {
-       struct qstr *name = &dchild->d_name;
        ktime_t kstart = ktime_get();
        int err;
        ENTRY;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p) mode %o dev %x\n",
-              name->len, name->name, PFID(ll_inode2fid(dir)), dir,
-              mode, rdev);
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p) mode %o dev %x\n",
+              dchild, PFID(ll_inode2fid(dir)), dir, mode, rdev);
 
        if (!IS_POSIXACL(dir) || !exp_connect_umask(ll_i2mdexp(dir)))
                mode &= ~current_umask();
@@ -1422,17 +1589,16 @@ static int ll_create_nd(struct inode *dir, struct dentry *dentry,
 
        CFS_FAIL_TIMEOUT(OBD_FAIL_LLITE_CREATE_FILE_PAUSE, cfs_fail_val);
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p), "
-                          "flags=%u, excl=%d\n", dentry->d_name.len,
-              dentry->d_name.name, PFID(ll_inode2fid(dir)),
-              dir, mode, want_excl);
+       CDEBUG(D_VFSTRACE,
+              "VFS Op:name=%pd, dir="DFID"(%p), flags=%u, excl=%d\n",
+              dentry, PFID(ll_inode2fid(dir)), dir, mode, want_excl);
 
        /* Using mknod(2) to create a regular file is designed to not recognize
         * volatile file name, so we use ll_mknod() here. */
        rc = ll_mknod(dir, dentry, mode, 0);
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, unhashed %d\n",
-              dentry->d_name.len, dentry->d_name.name, d_unhashed(dentry));
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, unhashed %d\n",
+              dentry, d_unhashed(dentry));
 
        if (!rc)
                ll_stats_ops_tally(ll_i2sbi(dir), LPROC_LL_CREATE,
@@ -1444,14 +1610,12 @@ static int ll_create_nd(struct inode *dir, struct dentry *dentry,
 static int ll_symlink(struct inode *dir, struct dentry *dchild,
                      const char *oldpath)
 {
-       struct qstr *name = &dchild->d_name;
        ktime_t kstart = ktime_get();
        int err;
        ENTRY;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p), target=%.*s\n",
-              name->len, name->name, PFID(ll_inode2fid(dir)),
-              dir, 3000, oldpath);
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p), target=%.*s\n",
+              dchild, PFID(ll_inode2fid(dir)), dir, 3000, oldpath);
 
        err = ll_new_node(dir, dchild, oldpath, S_IFLNK | S_IRWXUGO, 0,
                          LUSTRE_OPC_SYMLINK);
@@ -1475,9 +1639,14 @@ static int ll_link(struct dentry *old_dentry, struct inode *dir,
        int err;
 
        ENTRY;
-       CDEBUG(D_VFSTRACE, "VFS Op: inode="DFID"(%p), dir="DFID"(%p), "
-              "target=%.*s\n", PFID(ll_inode2fid(src)), src,
-              PFID(ll_inode2fid(dir)), dir, name->len, name->name);
+       CDEBUG(D_VFSTRACE,
+              "VFS Op: inode="DFID"(%p), dir="DFID"(%p), target=%pd\n",
+              PFID(ll_inode2fid(src)), src,
+              PFID(ll_inode2fid(dir)), dir, new_dentry);
+
+       err = llcrypt_prepare_link(old_dentry, dir, new_dentry);
+       if (err)
+               RETURN(err);
 
        op_data = ll_prep_md_op_data(NULL, src, dir, name->name, name->len,
                                     0, LUSTRE_OPC_ANY, NULL);
@@ -1500,13 +1669,12 @@ out:
 
 static int ll_mkdir(struct inode *dir, struct dentry *dchild, umode_t mode)
 {
-       struct qstr *name = &dchild->d_name;
        ktime_t kstart = ktime_get();
        int err;
        ENTRY;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p)\n",
-              name->len, name->name, PFID(ll_inode2fid(dir)), dir);
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p)\n",
+              dchild, PFID(ll_inode2fid(dir)), dir);
 
        if (!IS_POSIXACL(dir) || !exp_connect_umask(ll_i2mdexp(dir)))
                mode &= ~current_umask();
@@ -1531,16 +1699,20 @@ static int ll_rmdir(struct inode *dir, struct dentry *dchild)
 
        ENTRY;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p)\n",
-              name->len, name->name, PFID(ll_inode2fid(dir)), dir);
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p)\n",
+              dchild, PFID(ll_inode2fid(dir)), dir);
 
        if (unlikely(d_mountpoint(dchild)))
                 RETURN(-EBUSY);
 
-        op_data = ll_prep_md_op_data(NULL, dir, NULL, name->name, name->len,
-                                     S_IFDIR, LUSTRE_OPC_ANY, NULL);
-        if (IS_ERR(op_data))
-                RETURN(PTR_ERR(op_data));
+       /* some foreign dir may not be allowed to be removed */
+       if (!ll_foreign_is_removable(dchild, false))
+               RETURN(-EPERM);
+
+       op_data = ll_prep_md_op_data(NULL, dir, NULL, name->name, name->len,
+                                    S_IFDIR, LUSTRE_OPC_ANY, NULL);
+       if (IS_ERR(op_data))
+               RETURN(PTR_ERR(op_data));
 
        if (dchild->d_inode != NULL)
                op_data->op_fid3 = *ll_inode2fid(dchild->d_inode);
@@ -1548,13 +1720,25 @@ static int ll_rmdir(struct inode *dir, struct dentry *dchild)
        op_data->op_fid2 = op_data->op_fid3;
        rc = md_unlink(ll_i2sbi(dir)->ll_md_exp, op_data, &request);
        ll_finish_md_op_data(op_data);
-       if (!rc)
-               ll_update_times(request, dir);
+       if (!rc) {
+               struct mdt_body *body;
 
-       ptlrpc_req_finished(request);
-       if (!rc)
+               ll_update_times(request, dir);
                ll_stats_ops_tally(ll_i2sbi(dir), LPROC_LL_RMDIR,
                                   ktime_us_delta(ktime_get(), kstart));
+
+               /*
+                * The server puts attributes in on the last unlink, use them
+                * to update the link count so the inode can be freed
+                * immediately.
+                */
+               body = req_capsule_server_get(&request->rq_pill, &RMF_MDT_BODY);
+               if (body->mbo_valid & OBD_MD_FLNLINK)
+                       set_nlink(dchild->d_inode, body->mbo_nlink);
+       }
+
+       ptlrpc_req_finished(request);
+
        RETURN(rc);
 }
 
@@ -1600,8 +1784,8 @@ static int ll_unlink(struct inode *dir, struct dentry *dchild)
 
        ENTRY;
 
-       CDEBUG(D_VFSTRACE, "VFS Op:name=%.*s, dir="DFID"(%p)\n",
-              name->len, name->name, PFID(ll_inode2fid(dir)), dir);
+       CDEBUG(D_VFSTRACE, "VFS Op:name=%pd, dir="DFID"(%p)\n",
+              dchild, PFID(ll_inode2fid(dir)), dir);
 
        /*
         * XXX: unlink bind mountpoint maybe call to here,
@@ -1610,6 +1794,10 @@ static int ll_unlink(struct inode *dir, struct dentry *dchild)
        if (unlikely(d_mountpoint(dchild)))
                RETURN(-EBUSY);
 
+       /* some foreign file/dir may not be allowed to be unlinked */
+       if (!ll_foreign_is_removable(dchild, false))
+               RETURN(-EPERM);
+
        op_data = ll_prep_md_op_data(NULL, dir, NULL, name->name, name->len, 0,
                                     LUSTRE_OPC_ANY, NULL);
        if (IS_ERR(op_data))
@@ -1658,6 +1846,7 @@ static int ll_rename(struct inode *src, struct dentry *src_dchild,
        struct ll_sb_info *sbi = ll_i2sbi(src);
        struct md_op_data *op_data;
        ktime_t kstart = ktime_get();
+       umode_t mode = 0;
        int err;
        ENTRY;
 
@@ -1666,24 +1855,37 @@ static int ll_rename(struct inode *src, struct dentry *src_dchild,
                return -EINVAL;
 #endif
 
-       CDEBUG(D_VFSTRACE, "VFS Op:oldname=%.*s, src_dir="DFID
-              "(%p), newname=%.*s, tgt_dir="DFID"(%p)\n",
-              src_name->len, src_name->name,
-              PFID(ll_inode2fid(src)), src, tgt_name->len,
-              tgt_name->name, PFID(ll_inode2fid(tgt)), tgt);
+       CDEBUG(D_VFSTRACE,
+              "VFS Op:oldname=%pd, src_dir="DFID"(%p), newname=%pd, tgt_dir="DFID"(%p)\n",
+              src_dchild, PFID(ll_inode2fid(src)), src,
+              tgt_dchild, PFID(ll_inode2fid(tgt)), tgt);
 
        if (unlikely(d_mountpoint(src_dchild) || d_mountpoint(tgt_dchild)))
                RETURN(-EBUSY);
 
-       op_data = ll_prep_md_op_data(NULL, src, tgt, NULL, 0, 0,
+#ifdef HAVE_IOPS_RENAME_WITH_FLAGS
+       err = llcrypt_prepare_rename(src, src_dchild, tgt, tgt_dchild, flags);
+#else
+       err = llcrypt_prepare_rename(src, src_dchild, tgt, tgt_dchild, 0);
+#endif
+       if (err)
+               RETURN(err);
+
+       if (src_dchild->d_inode)
+               mode = src_dchild->d_inode->i_mode;
+
+       if (tgt_dchild->d_inode)
+               mode = tgt_dchild->d_inode->i_mode;
+
+       op_data = ll_prep_md_op_data(NULL, src, tgt, NULL, 0, mode,
                                     LUSTRE_OPC_ANY, NULL);
        if (IS_ERR(op_data))
                RETURN(PTR_ERR(op_data));
 
-       if (src_dchild->d_inode != NULL)
+       if (src_dchild->d_inode)
                op_data->op_fid3 = *ll_inode2fid(src_dchild->d_inode);
 
-       if (tgt_dchild->d_inode != NULL)
+       if (tgt_dchild->d_inode)
                op_data->op_fid4 = *ll_inode2fid(tgt_dchild->d_inode);
 
        err = md_rename(sbi->ll_md_exp, op_data,