dsl_dir.c revision 265744
1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21/* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>. 24 * All rights reserved. 25 * Copyright (c) 2013 by Delphix. All rights reserved. 26 * Copyright (c) 2014 Joyent, Inc. All rights reserved. 27 */ 28 29#include <sys/dmu.h> 30#include <sys/dmu_objset.h> 31#include <sys/dmu_tx.h> 32#include <sys/dsl_dataset.h> 33#include <sys/dsl_dir.h> 34#include <sys/dsl_prop.h> 35#include <sys/dsl_synctask.h> 36#include <sys/dsl_deleg.h> 37#include <sys/dmu_impl.h> 38#include <sys/spa.h> 39#include <sys/metaslab.h> 40#include <sys/zap.h> 41#include <sys/zio.h> 42#include <sys/arc.h> 43#include <sys/sunddi.h> 44#include <sys/zvol.h> 45#ifdef _KERNEL 46#include <sys/zfs_vfsops.h> 47#endif 48#include <sys/zfeature.h> 49#include <sys/policy.h> 50#include <sys/zfs_znode.h> 51#include "zfs_namecheck.h" 52#include "zfs_prop.h" 53 54/* 55 * Filesystem and Snapshot Limits 56 * ------------------------------ 57 * 58 * These limits are used to restrict the number of filesystems and/or snapshots 59 * that can be created at a given level in the tree or below. A typical 60 * use-case is with a delegated dataset where the administrator wants to ensure 61 * that a user within the zone is not creating too many additional filesystems 62 * or snapshots, even though they're not exceeding their space quota. 63 * 64 * The filesystem and snapshot counts are stored as extensible properties. This 65 * capability is controlled by a feature flag and must be enabled to be used. 66 * Once enabled, the feature is not active until the first limit is set. At 67 * that point, future operations to create/destroy filesystems or snapshots 68 * will validate and update the counts. 69 * 70 * Because the count properties will not exist before the feature is active, 71 * the counts are updated when a limit is first set on an uninitialized 72 * dsl_dir node in the tree (The filesystem/snapshot count on a node includes 73 * all of the nested filesystems/snapshots. Thus, a new leaf node has a 74 * filesystem count of 0 and a snapshot count of 0. Non-existent filesystem and 75 * snapshot count properties on a node indicate uninitialized counts on that 76 * node.) When first setting a limit on an uninitialized node, the code starts 77 * at the filesystem with the new limit and descends into all sub-filesystems 78 * to add the count properties. 79 * 80 * In practice this is lightweight since a limit is typically set when the 81 * filesystem is created and thus has no children. Once valid, changing the 82 * limit value won't require a re-traversal since the counts are already valid. 83 * When recursively fixing the counts, if a node with a limit is encountered 84 * during the descent, the counts are known to be valid and there is no need to 85 * descend into that filesystem's children. The counts on filesystems above the 86 * one with the new limit will still be uninitialized, unless a limit is 87 * eventually set on one of those filesystems. The counts are always recursively 88 * updated when a limit is set on a dataset, unless there is already a limit. 89 * When a new limit value is set on a filesystem with an existing limit, it is 90 * possible for the new limit to be less than the current count at that level 91 * since a user who can change the limit is also allowed to exceed the limit. 92 * 93 * Once the feature is active, then whenever a filesystem or snapshot is 94 * created, the code recurses up the tree, validating the new count against the 95 * limit at each initialized level. In practice, most levels will not have a 96 * limit set. If there is a limit at any initialized level up the tree, the 97 * check must pass or the creation will fail. Likewise, when a filesystem or 98 * snapshot is destroyed, the counts are recursively adjusted all the way up 99 * the initizized nodes in the tree. Renaming a filesystem into different point 100 * in the tree will first validate, then update the counts on each branch up to 101 * the common ancestor. A receive will also validate the counts and then update 102 * them. 103 * 104 * An exception to the above behavior is that the limit is not enforced if the 105 * user has permission to modify the limit. This is primarily so that 106 * recursive snapshots in the global zone always work. We want to prevent a 107 * denial-of-service in which a lower level delegated dataset could max out its 108 * limit and thus block recursive snapshots from being taken in the global zone. 109 * Because of this, it is possible for the snapshot count to be over the limit 110 * and snapshots taken in the global zone could cause a lower level dataset to 111 * hit or exceed its limit. The administrator taking the global zone recursive 112 * snapshot should be aware of this side-effect and behave accordingly. 113 * For consistency, the filesystem limit is also not enforced if the user can 114 * modify the limit. 115 * 116 * The filesystem and snapshot limits are validated by dsl_fs_ss_limit_check() 117 * and updated by dsl_fs_ss_count_adjust(). A new limit value is setup in 118 * dsl_dir_activate_fs_ss_limit() and the counts are adjusted, if necessary, by 119 * dsl_dir_init_fs_ss_count(). 120 * 121 * There is a special case when we receive a filesystem that already exists. In 122 * this case a temporary clone name of %X is created (see dmu_recv_begin). We 123 * never update the filesystem counts for temporary clones. 124 * 125 * Likewise, we do not update the snapshot counts for temporary snapshots, 126 * such as those created by zfs diff. 127 */ 128 129static uint64_t dsl_dir_space_towrite(dsl_dir_t *dd); 130 131/* ARGSUSED */ 132static void 133dsl_dir_evict(dmu_buf_t *db, void *arg) 134{ 135 dsl_dir_t *dd = arg; 136 dsl_pool_t *dp = dd->dd_pool; 137 int t; 138 139 for (t = 0; t < TXG_SIZE; t++) { 140 ASSERT(!txg_list_member(&dp->dp_dirty_dirs, dd, t)); 141 ASSERT(dd->dd_tempreserved[t] == 0); 142 ASSERT(dd->dd_space_towrite[t] == 0); 143 } 144 145 if (dd->dd_parent) 146 dsl_dir_rele(dd->dd_parent, dd); 147 148 spa_close(dd->dd_pool->dp_spa, dd); 149 150 /* 151 * The props callback list should have been cleaned up by 152 * objset_evict(). 153 */ 154 list_destroy(&dd->dd_prop_cbs); 155 mutex_destroy(&dd->dd_lock); 156 kmem_free(dd, sizeof (dsl_dir_t)); 157} 158 159int 160dsl_dir_hold_obj(dsl_pool_t *dp, uint64_t ddobj, 161 const char *tail, void *tag, dsl_dir_t **ddp) 162{ 163 dmu_buf_t *dbuf; 164 dsl_dir_t *dd; 165 int err; 166 167 ASSERT(dsl_pool_config_held(dp)); 168 169 err = dmu_bonus_hold(dp->dp_meta_objset, ddobj, tag, &dbuf); 170 if (err != 0) 171 return (err); 172 dd = dmu_buf_get_user(dbuf); 173#ifdef ZFS_DEBUG 174 { 175 dmu_object_info_t doi; 176 dmu_object_info_from_db(dbuf, &doi); 177 ASSERT3U(doi.doi_bonus_type, ==, DMU_OT_DSL_DIR); 178 ASSERT3U(doi.doi_bonus_size, >=, sizeof (dsl_dir_phys_t)); 179 } 180#endif 181 if (dd == NULL) { 182 dsl_dir_t *winner; 183 184 dd = kmem_zalloc(sizeof (dsl_dir_t), KM_SLEEP); 185 dd->dd_object = ddobj; 186 dd->dd_dbuf = dbuf; 187 dd->dd_pool = dp; 188 dd->dd_phys = dbuf->db_data; 189 mutex_init(&dd->dd_lock, NULL, MUTEX_DEFAULT, NULL); 190 191 list_create(&dd->dd_prop_cbs, sizeof (dsl_prop_cb_record_t), 192 offsetof(dsl_prop_cb_record_t, cbr_node)); 193 194 dsl_dir_snap_cmtime_update(dd); 195 196 if (dd->dd_phys->dd_parent_obj) { 197 err = dsl_dir_hold_obj(dp, dd->dd_phys->dd_parent_obj, 198 NULL, dd, &dd->dd_parent); 199 if (err != 0) 200 goto errout; 201 if (tail) { 202#ifdef ZFS_DEBUG 203 uint64_t foundobj; 204 205 err = zap_lookup(dp->dp_meta_objset, 206 dd->dd_parent->dd_phys->dd_child_dir_zapobj, 207 tail, sizeof (foundobj), 1, &foundobj); 208 ASSERT(err || foundobj == ddobj); 209#endif 210 (void) strcpy(dd->dd_myname, tail); 211 } else { 212 err = zap_value_search(dp->dp_meta_objset, 213 dd->dd_parent->dd_phys->dd_child_dir_zapobj, 214 ddobj, 0, dd->dd_myname); 215 } 216 if (err != 0) 217 goto errout; 218 } else { 219 (void) strcpy(dd->dd_myname, spa_name(dp->dp_spa)); 220 } 221 222 if (dsl_dir_is_clone(dd)) { 223 dmu_buf_t *origin_bonus; 224 dsl_dataset_phys_t *origin_phys; 225 226 /* 227 * We can't open the origin dataset, because 228 * that would require opening this dsl_dir. 229 * Just look at its phys directly instead. 230 */ 231 err = dmu_bonus_hold(dp->dp_meta_objset, 232 dd->dd_phys->dd_origin_obj, FTAG, &origin_bonus); 233 if (err != 0) 234 goto errout; 235 origin_phys = origin_bonus->db_data; 236 dd->dd_origin_txg = 237 origin_phys->ds_creation_txg; 238 dmu_buf_rele(origin_bonus, FTAG); 239 } 240 241 winner = dmu_buf_set_user_ie(dbuf, dd, &dd->dd_phys, 242 dsl_dir_evict); 243 if (winner) { 244 if (dd->dd_parent) 245 dsl_dir_rele(dd->dd_parent, dd); 246 mutex_destroy(&dd->dd_lock); 247 kmem_free(dd, sizeof (dsl_dir_t)); 248 dd = winner; 249 } else { 250 spa_open_ref(dp->dp_spa, dd); 251 } 252 } 253 254 /* 255 * The dsl_dir_t has both open-to-close and instantiate-to-evict 256 * holds on the spa. We need the open-to-close holds because 257 * otherwise the spa_refcnt wouldn't change when we open a 258 * dir which the spa also has open, so we could incorrectly 259 * think it was OK to unload/export/destroy the pool. We need 260 * the instantiate-to-evict hold because the dsl_dir_t has a 261 * pointer to the dd_pool, which has a pointer to the spa_t. 262 */ 263 spa_open_ref(dp->dp_spa, tag); 264 ASSERT3P(dd->dd_pool, ==, dp); 265 ASSERT3U(dd->dd_object, ==, ddobj); 266 ASSERT3P(dd->dd_dbuf, ==, dbuf); 267 *ddp = dd; 268 return (0); 269 270errout: 271 if (dd->dd_parent) 272 dsl_dir_rele(dd->dd_parent, dd); 273 mutex_destroy(&dd->dd_lock); 274 kmem_free(dd, sizeof (dsl_dir_t)); 275 dmu_buf_rele(dbuf, tag); 276 return (err); 277} 278 279void 280dsl_dir_rele(dsl_dir_t *dd, void *tag) 281{ 282 dprintf_dd(dd, "%s\n", ""); 283 spa_close(dd->dd_pool->dp_spa, tag); 284 dmu_buf_rele(dd->dd_dbuf, tag); 285} 286 287/* buf must be long enough (MAXNAMELEN + strlen(MOS_DIR_NAME) + 1 should do) */ 288void 289dsl_dir_name(dsl_dir_t *dd, char *buf) 290{ 291 if (dd->dd_parent) { 292 dsl_dir_name(dd->dd_parent, buf); 293 (void) strcat(buf, "/"); 294 } else { 295 buf[0] = '\0'; 296 } 297 if (!MUTEX_HELD(&dd->dd_lock)) { 298 /* 299 * recursive mutex so that we can use 300 * dprintf_dd() with dd_lock held 301 */ 302 mutex_enter(&dd->dd_lock); 303 (void) strcat(buf, dd->dd_myname); 304 mutex_exit(&dd->dd_lock); 305 } else { 306 (void) strcat(buf, dd->dd_myname); 307 } 308} 309 310/* Calculate name length, avoiding all the strcat calls of dsl_dir_name */ 311int 312dsl_dir_namelen(dsl_dir_t *dd) 313{ 314 int result = 0; 315 316 if (dd->dd_parent) { 317 /* parent's name + 1 for the "/" */ 318 result = dsl_dir_namelen(dd->dd_parent) + 1; 319 } 320 321 if (!MUTEX_HELD(&dd->dd_lock)) { 322 /* see dsl_dir_name */ 323 mutex_enter(&dd->dd_lock); 324 result += strlen(dd->dd_myname); 325 mutex_exit(&dd->dd_lock); 326 } else { 327 result += strlen(dd->dd_myname); 328 } 329 330 return (result); 331} 332 333static int 334getcomponent(const char *path, char *component, const char **nextp) 335{ 336 char *p; 337 338 if ((path == NULL) || (path[0] == '\0')) 339 return (SET_ERROR(ENOENT)); 340 /* This would be a good place to reserve some namespace... */ 341 p = strpbrk(path, "/@"); 342 if (p && (p[1] == '/' || p[1] == '@')) { 343 /* two separators in a row */ 344 return (SET_ERROR(EINVAL)); 345 } 346 if (p == NULL || p == path) { 347 /* 348 * if the first thing is an @ or /, it had better be an 349 * @ and it had better not have any more ats or slashes, 350 * and it had better have something after the @. 351 */ 352 if (p != NULL && 353 (p[0] != '@' || strpbrk(path+1, "/@") || p[1] == '\0')) 354 return (SET_ERROR(EINVAL)); 355 if (strlen(path) >= MAXNAMELEN) 356 return (SET_ERROR(ENAMETOOLONG)); 357 (void) strcpy(component, path); 358 p = NULL; 359 } else if (p[0] == '/') { 360 if (p - path >= MAXNAMELEN) 361 return (SET_ERROR(ENAMETOOLONG)); 362 (void) strncpy(component, path, p - path); 363 component[p - path] = '\0'; 364 p++; 365 } else if (p[0] == '@') { 366 /* 367 * if the next separator is an @, there better not be 368 * any more slashes. 369 */ 370 if (strchr(path, '/')) 371 return (SET_ERROR(EINVAL)); 372 if (p - path >= MAXNAMELEN) 373 return (SET_ERROR(ENAMETOOLONG)); 374 (void) strncpy(component, path, p - path); 375 component[p - path] = '\0'; 376 } else { 377 panic("invalid p=%p", (void *)p); 378 } 379 *nextp = p; 380 return (0); 381} 382 383/* 384 * Return the dsl_dir_t, and possibly the last component which couldn't 385 * be found in *tail. The name must be in the specified dsl_pool_t. This 386 * thread must hold the dp_config_rwlock for the pool. Returns NULL if the 387 * path is bogus, or if tail==NULL and we couldn't parse the whole name. 388 * (*tail)[0] == '@' means that the last component is a snapshot. 389 */ 390int 391dsl_dir_hold(dsl_pool_t *dp, const char *name, void *tag, 392 dsl_dir_t **ddp, const char **tailp) 393{ 394 char buf[MAXNAMELEN]; 395 const char *spaname, *next, *nextnext = NULL; 396 int err; 397 dsl_dir_t *dd; 398 uint64_t ddobj; 399 400 err = getcomponent(name, buf, &next); 401 if (err != 0) 402 return (err); 403 404 /* Make sure the name is in the specified pool. */ 405 spaname = spa_name(dp->dp_spa); 406 if (strcmp(buf, spaname) != 0) 407 return (SET_ERROR(EINVAL)); 408 409 ASSERT(dsl_pool_config_held(dp)); 410 411 err = dsl_dir_hold_obj(dp, dp->dp_root_dir_obj, NULL, tag, &dd); 412 if (err != 0) { 413 return (err); 414 } 415 416 while (next != NULL) { 417 dsl_dir_t *child_ds; 418 err = getcomponent(next, buf, &nextnext); 419 if (err != 0) 420 break; 421 ASSERT(next[0] != '\0'); 422 if (next[0] == '@') 423 break; 424 dprintf("looking up %s in obj%lld\n", 425 buf, dd->dd_phys->dd_child_dir_zapobj); 426 427 err = zap_lookup(dp->dp_meta_objset, 428 dd->dd_phys->dd_child_dir_zapobj, 429 buf, sizeof (ddobj), 1, &ddobj); 430 if (err != 0) { 431 if (err == ENOENT) 432 err = 0; 433 break; 434 } 435 436 err = dsl_dir_hold_obj(dp, ddobj, buf, tag, &child_ds); 437 if (err != 0) 438 break; 439 dsl_dir_rele(dd, tag); 440 dd = child_ds; 441 next = nextnext; 442 } 443 444 if (err != 0) { 445 dsl_dir_rele(dd, tag); 446 return (err); 447 } 448 449 /* 450 * It's an error if there's more than one component left, or 451 * tailp==NULL and there's any component left. 452 */ 453 if (next != NULL && 454 (tailp == NULL || (nextnext && nextnext[0] != '\0'))) { 455 /* bad path name */ 456 dsl_dir_rele(dd, tag); 457 dprintf("next=%p (%s) tail=%p\n", next, next?next:"", tailp); 458 err = SET_ERROR(ENOENT); 459 } 460 if (tailp != NULL) 461 *tailp = next; 462 *ddp = dd; 463 return (err); 464} 465 466/* 467 * If the counts are already initialized for this filesystem and its 468 * descendants then do nothing, otherwise initialize the counts. 469 * 470 * The counts on this filesystem, and those below, may be uninitialized due to 471 * either the use of a pre-existing pool which did not support the 472 * filesystem/snapshot limit feature, or one in which the feature had not yet 473 * been enabled. 474 * 475 * Recursively descend the filesystem tree and update the filesystem/snapshot 476 * counts on each filesystem below, then update the cumulative count on the 477 * current filesystem. If the filesystem already has a count set on it, 478 * then we know that its counts, and the counts on the filesystems below it, 479 * are already correct, so we don't have to update this filesystem. 480 */ 481static void 482dsl_dir_init_fs_ss_count(dsl_dir_t *dd, dmu_tx_t *tx) 483{ 484 uint64_t my_fs_cnt = 0; 485 uint64_t my_ss_cnt = 0; 486 dsl_pool_t *dp = dd->dd_pool; 487 objset_t *os = dp->dp_meta_objset; 488 zap_cursor_t *zc; 489 zap_attribute_t *za; 490 dsl_dataset_t *ds; 491 492 ASSERT(spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT)); 493 ASSERT(dsl_pool_config_held(dp)); 494 ASSERT(dmu_tx_is_syncing(tx)); 495 496 dsl_dir_zapify(dd, tx); 497 498 /* 499 * If the filesystem count has already been initialized then we 500 * don't need to recurse down any further. 501 */ 502 if (zap_contains(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT) == 0) 503 return; 504 505 zc = kmem_alloc(sizeof (zap_cursor_t), KM_SLEEP); 506 za = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP); 507 508 /* Iterate my child dirs */ 509 for (zap_cursor_init(zc, os, dd->dd_phys->dd_child_dir_zapobj); 510 zap_cursor_retrieve(zc, za) == 0; zap_cursor_advance(zc)) { 511 dsl_dir_t *chld_dd; 512 uint64_t count; 513 514 VERIFY0(dsl_dir_hold_obj(dp, za->za_first_integer, NULL, FTAG, 515 &chld_dd)); 516 517 /* 518 * Ignore hidden ($FREE, $MOS & $ORIGIN) objsets and 519 * temporary datasets. 520 */ 521 if (chld_dd->dd_myname[0] == '$' || 522 chld_dd->dd_myname[0] == '%') { 523 dsl_dir_rele(chld_dd, FTAG); 524 continue; 525 } 526 527 my_fs_cnt++; /* count this child */ 528 529 dsl_dir_init_fs_ss_count(chld_dd, tx); 530 531 VERIFY0(zap_lookup(os, chld_dd->dd_object, 532 DD_FIELD_FILESYSTEM_COUNT, sizeof (count), 1, &count)); 533 my_fs_cnt += count; 534 VERIFY0(zap_lookup(os, chld_dd->dd_object, 535 DD_FIELD_SNAPSHOT_COUNT, sizeof (count), 1, &count)); 536 my_ss_cnt += count; 537 538 dsl_dir_rele(chld_dd, FTAG); 539 } 540 zap_cursor_fini(zc); 541 /* Count my snapshots (we counted children's snapshots above) */ 542 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool, 543 dd->dd_phys->dd_head_dataset_obj, FTAG, &ds)); 544 545 for (zap_cursor_init(zc, os, ds->ds_phys->ds_snapnames_zapobj); 546 zap_cursor_retrieve(zc, za) == 0; 547 zap_cursor_advance(zc)) { 548 /* Don't count temporary snapshots */ 549 if (za->za_name[0] != '%') 550 my_ss_cnt++; 551 } 552 553 dsl_dataset_rele(ds, FTAG); 554 555 kmem_free(zc, sizeof (zap_cursor_t)); 556 kmem_free(za, sizeof (zap_attribute_t)); 557 558 /* we're in a sync task, update counts */ 559 dmu_buf_will_dirty(dd->dd_dbuf, tx); 560 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT, 561 sizeof (my_fs_cnt), 1, &my_fs_cnt, tx)); 562 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT, 563 sizeof (my_ss_cnt), 1, &my_ss_cnt, tx)); 564} 565 566static int 567dsl_dir_actv_fs_ss_limit_check(void *arg, dmu_tx_t *tx) 568{ 569 char *ddname = (char *)arg; 570 dsl_pool_t *dp = dmu_tx_pool(tx); 571 dsl_dataset_t *ds; 572 dsl_dir_t *dd; 573 int error; 574 575 error = dsl_dataset_hold(dp, ddname, FTAG, &ds); 576 if (error != 0) 577 return (error); 578 579 if (!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT)) { 580 dsl_dataset_rele(ds, FTAG); 581 return (SET_ERROR(ENOTSUP)); 582 } 583 584 dd = ds->ds_dir; 585 if (spa_feature_is_active(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT) && 586 dsl_dir_is_zapified(dd) && 587 zap_contains(dp->dp_meta_objset, dd->dd_object, 588 DD_FIELD_FILESYSTEM_COUNT) == 0) { 589 dsl_dataset_rele(ds, FTAG); 590 return (SET_ERROR(EALREADY)); 591 } 592 593 dsl_dataset_rele(ds, FTAG); 594 return (0); 595} 596 597static void 598dsl_dir_actv_fs_ss_limit_sync(void *arg, dmu_tx_t *tx) 599{ 600 char *ddname = (char *)arg; 601 dsl_pool_t *dp = dmu_tx_pool(tx); 602 dsl_dataset_t *ds; 603 spa_t *spa; 604 605 VERIFY0(dsl_dataset_hold(dp, ddname, FTAG, &ds)); 606 607 spa = dsl_dataset_get_spa(ds); 608 609 if (!spa_feature_is_active(spa, SPA_FEATURE_FS_SS_LIMIT)) { 610 /* 611 * Since the feature was not active and we're now setting a 612 * limit, increment the feature-active counter so that the 613 * feature becomes active for the first time. 614 * 615 * We are already in a sync task so we can update the MOS. 616 */ 617 spa_feature_incr(spa, SPA_FEATURE_FS_SS_LIMIT, tx); 618 } 619 620 /* 621 * Since we are now setting a non-UINT64_MAX limit on the filesystem, 622 * we need to ensure the counts are correct. Descend down the tree from 623 * this point and update all of the counts to be accurate. 624 */ 625 dsl_dir_init_fs_ss_count(ds->ds_dir, tx); 626 627 dsl_dataset_rele(ds, FTAG); 628} 629 630/* 631 * Make sure the feature is enabled and activate it if necessary. 632 * Since we're setting a limit, ensure the on-disk counts are valid. 633 * This is only called by the ioctl path when setting a limit value. 634 * 635 * We do not need to validate the new limit, since users who can change the 636 * limit are also allowed to exceed the limit. 637 */ 638int 639dsl_dir_activate_fs_ss_limit(const char *ddname) 640{ 641 int error; 642 643 error = dsl_sync_task(ddname, dsl_dir_actv_fs_ss_limit_check, 644 dsl_dir_actv_fs_ss_limit_sync, (void *)ddname, 0); 645 646 if (error == EALREADY) 647 error = 0; 648 649 return (error); 650} 651 652/* 653 * Used to determine if the filesystem_limit or snapshot_limit should be 654 * enforced. We allow the limit to be exceeded if the user has permission to 655 * write the property value. We pass in the creds that we got in the open 656 * context since we will always be the GZ root in syncing context. We also have 657 * to handle the case where we are allowed to change the limit on the current 658 * dataset, but there may be another limit in the tree above. 659 * 660 * We can never modify these two properties within a non-global zone. In 661 * addition, the other checks are modeled on zfs_secpolicy_write_perms. We 662 * can't use that function since we are already holding the dp_config_rwlock. 663 * In addition, we already have the dd and dealing with snapshots is simplified 664 * in this code. 665 */ 666 667typedef enum { 668 ENFORCE_ALWAYS, 669 ENFORCE_NEVER, 670 ENFORCE_ABOVE 671} enforce_res_t; 672 673static enforce_res_t 674dsl_enforce_ds_ss_limits(dsl_dir_t *dd, zfs_prop_t prop, cred_t *cr) 675{ 676 enforce_res_t enforce = ENFORCE_ALWAYS; 677 uint64_t obj; 678 dsl_dataset_t *ds; 679 uint64_t zoned; 680 681 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT || 682 prop == ZFS_PROP_SNAPSHOT_LIMIT); 683 684#ifdef _KERNEL 685#ifdef __FreeBSD__ 686 if (jailed(cr)) 687#else 688 if (crgetzoneid(cr) != GLOBAL_ZONEID) 689#endif 690 return (ENFORCE_ALWAYS); 691 692 if (secpolicy_zfs(cr) == 0) 693 return (ENFORCE_NEVER); 694#endif 695 696 if ((obj = dd->dd_phys->dd_head_dataset_obj) == 0) 697 return (ENFORCE_ALWAYS); 698 699 ASSERT(dsl_pool_config_held(dd->dd_pool)); 700 701 if (dsl_dataset_hold_obj(dd->dd_pool, obj, FTAG, &ds) != 0) 702 return (ENFORCE_ALWAYS); 703 704 if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL) || zoned) { 705 /* Only root can access zoned fs's from the GZ */ 706 enforce = ENFORCE_ALWAYS; 707 } else { 708 if (dsl_deleg_access_impl(ds, zfs_prop_to_name(prop), cr) == 0) 709 enforce = ENFORCE_ABOVE; 710 } 711 712 dsl_dataset_rele(ds, FTAG); 713 return (enforce); 714} 715 716/* 717 * Check if adding additional child filesystem(s) would exceed any filesystem 718 * limits or adding additional snapshot(s) would exceed any snapshot limits. 719 * The prop argument indicates which limit to check. 720 * 721 * Note that all filesystem limits up to the root (or the highest 722 * initialized) filesystem or the given ancestor must be satisfied. 723 */ 724int 725dsl_fs_ss_limit_check(dsl_dir_t *dd, uint64_t delta, zfs_prop_t prop, 726 dsl_dir_t *ancestor, cred_t *cr) 727{ 728 objset_t *os = dd->dd_pool->dp_meta_objset; 729 uint64_t limit, count; 730 char *count_prop; 731 enforce_res_t enforce; 732 int err = 0; 733 734 ASSERT(dsl_pool_config_held(dd->dd_pool)); 735 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT || 736 prop == ZFS_PROP_SNAPSHOT_LIMIT); 737 738 /* 739 * If we're allowed to change the limit, don't enforce the limit 740 * e.g. this can happen if a snapshot is taken by an administrative 741 * user in the global zone (i.e. a recursive snapshot by root). 742 * However, we must handle the case of delegated permissions where we 743 * are allowed to change the limit on the current dataset, but there 744 * is another limit in the tree above. 745 */ 746 enforce = dsl_enforce_ds_ss_limits(dd, prop, cr); 747 if (enforce == ENFORCE_NEVER) 748 return (0); 749 750 /* 751 * e.g. if renaming a dataset with no snapshots, count adjustment 752 * is 0. 753 */ 754 if (delta == 0) 755 return (0); 756 757 if (prop == ZFS_PROP_SNAPSHOT_LIMIT) { 758 /* 759 * We don't enforce the limit for temporary snapshots. This is 760 * indicated by a NULL cred_t argument. 761 */ 762 if (cr == NULL) 763 return (0); 764 765 count_prop = DD_FIELD_SNAPSHOT_COUNT; 766 } else { 767 count_prop = DD_FIELD_FILESYSTEM_COUNT; 768 } 769 770 /* 771 * If an ancestor has been provided, stop checking the limit once we 772 * hit that dir. We need this during rename so that we don't overcount 773 * the check once we recurse up to the common ancestor. 774 */ 775 if (ancestor == dd) 776 return (0); 777 778 /* 779 * If we hit an uninitialized node while recursing up the tree, we can 780 * stop since we know there is no limit here (or above). The counts are 781 * not valid on this node and we know we won't touch this node's counts. 782 */ 783 if (!dsl_dir_is_zapified(dd) || zap_lookup(os, dd->dd_object, 784 count_prop, sizeof (count), 1, &count) == ENOENT) 785 return (0); 786 787 err = dsl_prop_get_dd(dd, zfs_prop_to_name(prop), 8, 1, &limit, NULL, 788 B_FALSE); 789 if (err != 0) 790 return (err); 791 792 /* Is there a limit which we've hit? */ 793 if (enforce == ENFORCE_ALWAYS && (count + delta) > limit) 794 return (SET_ERROR(EDQUOT)); 795 796 if (dd->dd_parent != NULL) 797 err = dsl_fs_ss_limit_check(dd->dd_parent, delta, prop, 798 ancestor, cr); 799 800 return (err); 801} 802 803/* 804 * Adjust the filesystem or snapshot count for the specified dsl_dir_t and all 805 * parents. When a new filesystem/snapshot is created, increment the count on 806 * all parents, and when a filesystem/snapshot is destroyed, decrement the 807 * count. 808 */ 809void 810dsl_fs_ss_count_adjust(dsl_dir_t *dd, int64_t delta, const char *prop, 811 dmu_tx_t *tx) 812{ 813 int err; 814 objset_t *os = dd->dd_pool->dp_meta_objset; 815 uint64_t count; 816 817 ASSERT(dsl_pool_config_held(dd->dd_pool)); 818 ASSERT(dmu_tx_is_syncing(tx)); 819 ASSERT(strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0 || 820 strcmp(prop, DD_FIELD_SNAPSHOT_COUNT) == 0); 821 822 /* 823 * When we receive an incremental stream into a filesystem that already 824 * exists, a temporary clone is created. We don't count this temporary 825 * clone, whose name begins with a '%'. We also ignore hidden ($FREE, 826 * $MOS & $ORIGIN) objsets. 827 */ 828 if ((dd->dd_myname[0] == '%' || dd->dd_myname[0] == '$') && 829 strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0) 830 return; 831 832 /* 833 * e.g. if renaming a dataset with no snapshots, count adjustment is 0 834 */ 835 if (delta == 0) 836 return; 837 838 /* 839 * If we hit an uninitialized node while recursing up the tree, we can 840 * stop since we know the counts are not valid on this node and we 841 * know we shouldn't touch this node's counts. An uninitialized count 842 * on the node indicates that either the feature has not yet been 843 * activated or there are no limits on this part of the tree. 844 */ 845 if (!dsl_dir_is_zapified(dd) || (err = zap_lookup(os, dd->dd_object, 846 prop, sizeof (count), 1, &count)) == ENOENT) 847 return; 848 VERIFY0(err); 849 850 count += delta; 851 /* Use a signed verify to make sure we're not neg. */ 852 VERIFY3S(count, >=, 0); 853 854 VERIFY0(zap_update(os, dd->dd_object, prop, sizeof (count), 1, &count, 855 tx)); 856 857 /* Roll up this additional count into our ancestors */ 858 if (dd->dd_parent != NULL) 859 dsl_fs_ss_count_adjust(dd->dd_parent, delta, prop, tx); 860} 861 862uint64_t 863dsl_dir_create_sync(dsl_pool_t *dp, dsl_dir_t *pds, const char *name, 864 dmu_tx_t *tx) 865{ 866 objset_t *mos = dp->dp_meta_objset; 867 uint64_t ddobj; 868 dsl_dir_phys_t *ddphys; 869 dmu_buf_t *dbuf; 870 871 ddobj = dmu_object_alloc(mos, DMU_OT_DSL_DIR, 0, 872 DMU_OT_DSL_DIR, sizeof (dsl_dir_phys_t), tx); 873 if (pds) { 874 VERIFY(0 == zap_add(mos, pds->dd_phys->dd_child_dir_zapobj, 875 name, sizeof (uint64_t), 1, &ddobj, tx)); 876 } else { 877 /* it's the root dir */ 878 VERIFY(0 == zap_add(mos, DMU_POOL_DIRECTORY_OBJECT, 879 DMU_POOL_ROOT_DATASET, sizeof (uint64_t), 1, &ddobj, tx)); 880 } 881 VERIFY(0 == dmu_bonus_hold(mos, ddobj, FTAG, &dbuf)); 882 dmu_buf_will_dirty(dbuf, tx); 883 ddphys = dbuf->db_data; 884 885 ddphys->dd_creation_time = gethrestime_sec(); 886 if (pds) { 887 ddphys->dd_parent_obj = pds->dd_object; 888 889 /* update the filesystem counts */ 890 dsl_fs_ss_count_adjust(pds, 1, DD_FIELD_FILESYSTEM_COUNT, tx); 891 } 892 ddphys->dd_props_zapobj = zap_create(mos, 893 DMU_OT_DSL_PROPS, DMU_OT_NONE, 0, tx); 894 ddphys->dd_child_dir_zapobj = zap_create(mos, 895 DMU_OT_DSL_DIR_CHILD_MAP, DMU_OT_NONE, 0, tx); 896 if (spa_version(dp->dp_spa) >= SPA_VERSION_USED_BREAKDOWN) 897 ddphys->dd_flags |= DD_FLAG_USED_BREAKDOWN; 898 dmu_buf_rele(dbuf, FTAG); 899 900 return (ddobj); 901} 902 903boolean_t 904dsl_dir_is_clone(dsl_dir_t *dd) 905{ 906 return (dd->dd_phys->dd_origin_obj && 907 (dd->dd_pool->dp_origin_snap == NULL || 908 dd->dd_phys->dd_origin_obj != 909 dd->dd_pool->dp_origin_snap->ds_object)); 910} 911 912void 913dsl_dir_stats(dsl_dir_t *dd, nvlist_t *nv) 914{ 915 mutex_enter(&dd->dd_lock); 916 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USED, 917 dd->dd_phys->dd_used_bytes); 918 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_QUOTA, dd->dd_phys->dd_quota); 919 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_RESERVATION, 920 dd->dd_phys->dd_reserved); 921 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_COMPRESSRATIO, 922 dd->dd_phys->dd_compressed_bytes == 0 ? 100 : 923 (dd->dd_phys->dd_uncompressed_bytes * 100 / 924 dd->dd_phys->dd_compressed_bytes)); 925 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_LOGICALUSED, 926 dd->dd_phys->dd_uncompressed_bytes); 927 if (dd->dd_phys->dd_flags & DD_FLAG_USED_BREAKDOWN) { 928 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDSNAP, 929 dd->dd_phys->dd_used_breakdown[DD_USED_SNAP]); 930 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDDS, 931 dd->dd_phys->dd_used_breakdown[DD_USED_HEAD]); 932 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDREFRESERV, 933 dd->dd_phys->dd_used_breakdown[DD_USED_REFRSRV]); 934 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDCHILD, 935 dd->dd_phys->dd_used_breakdown[DD_USED_CHILD] + 936 dd->dd_phys->dd_used_breakdown[DD_USED_CHILD_RSRV]); 937 } 938 mutex_exit(&dd->dd_lock); 939 940 if (dsl_dir_is_zapified(dd)) { 941 uint64_t count; 942 objset_t *os = dd->dd_pool->dp_meta_objset; 943 944 if (zap_lookup(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT, 945 sizeof (count), 1, &count) == 0) { 946 dsl_prop_nvlist_add_uint64(nv, 947 ZFS_PROP_FILESYSTEM_COUNT, count); 948 } 949 if (zap_lookup(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT, 950 sizeof (count), 1, &count) == 0) { 951 dsl_prop_nvlist_add_uint64(nv, 952 ZFS_PROP_SNAPSHOT_COUNT, count); 953 } 954 } 955 956 if (dsl_dir_is_clone(dd)) { 957 dsl_dataset_t *ds; 958 char buf[MAXNAMELEN]; 959 960 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool, 961 dd->dd_phys->dd_origin_obj, FTAG, &ds)); 962 dsl_dataset_name(ds, buf); 963 dsl_dataset_rele(ds, FTAG); 964 dsl_prop_nvlist_add_string(nv, ZFS_PROP_ORIGIN, buf); 965 } 966} 967 968void 969dsl_dir_dirty(dsl_dir_t *dd, dmu_tx_t *tx) 970{ 971 dsl_pool_t *dp = dd->dd_pool; 972 973 ASSERT(dd->dd_phys); 974 975 if (txg_list_add(&dp->dp_dirty_dirs, dd, tx->tx_txg)) { 976 /* up the hold count until we can be written out */ 977 dmu_buf_add_ref(dd->dd_dbuf, dd); 978 } 979} 980 981static int64_t 982parent_delta(dsl_dir_t *dd, uint64_t used, int64_t delta) 983{ 984 uint64_t old_accounted = MAX(used, dd->dd_phys->dd_reserved); 985 uint64_t new_accounted = MAX(used + delta, dd->dd_phys->dd_reserved); 986 return (new_accounted - old_accounted); 987} 988 989void 990dsl_dir_sync(dsl_dir_t *dd, dmu_tx_t *tx) 991{ 992 ASSERT(dmu_tx_is_syncing(tx)); 993 994 mutex_enter(&dd->dd_lock); 995 ASSERT0(dd->dd_tempreserved[tx->tx_txg&TXG_MASK]); 996 dprintf_dd(dd, "txg=%llu towrite=%lluK\n", tx->tx_txg, 997 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] / 1024); 998 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] = 0; 999 mutex_exit(&dd->dd_lock); 1000 1001 /* release the hold from dsl_dir_dirty */ 1002 dmu_buf_rele(dd->dd_dbuf, dd); 1003} 1004 1005static uint64_t 1006dsl_dir_space_towrite(dsl_dir_t *dd) 1007{ 1008 uint64_t space = 0; 1009 int i; 1010 1011 ASSERT(MUTEX_HELD(&dd->dd_lock)); 1012 1013 for (i = 0; i < TXG_SIZE; i++) { 1014 space += dd->dd_space_towrite[i&TXG_MASK]; 1015 ASSERT3U(dd->dd_space_towrite[i&TXG_MASK], >=, 0); 1016 } 1017 return (space); 1018} 1019 1020/* 1021 * How much space would dd have available if ancestor had delta applied 1022 * to it? If ondiskonly is set, we're only interested in what's 1023 * on-disk, not estimated pending changes. 1024 */ 1025uint64_t 1026dsl_dir_space_available(dsl_dir_t *dd, 1027 dsl_dir_t *ancestor, int64_t delta, int ondiskonly) 1028{ 1029 uint64_t parentspace, myspace, quota, used; 1030 1031 /* 1032 * If there are no restrictions otherwise, assume we have 1033 * unlimited space available. 1034 */ 1035 quota = UINT64_MAX; 1036 parentspace = UINT64_MAX; 1037 1038 if (dd->dd_parent != NULL) { 1039 parentspace = dsl_dir_space_available(dd->dd_parent, 1040 ancestor, delta, ondiskonly); 1041 } 1042 1043 mutex_enter(&dd->dd_lock); 1044 if (dd->dd_phys->dd_quota != 0) 1045 quota = dd->dd_phys->dd_quota; 1046 used = dd->dd_phys->dd_used_bytes; 1047 if (!ondiskonly) 1048 used += dsl_dir_space_towrite(dd); 1049 1050 if (dd->dd_parent == NULL) { 1051 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, FALSE); 1052 quota = MIN(quota, poolsize); 1053 } 1054 1055 if (dd->dd_phys->dd_reserved > used && parentspace != UINT64_MAX) { 1056 /* 1057 * We have some space reserved, in addition to what our 1058 * parent gave us. 1059 */ 1060 parentspace += dd->dd_phys->dd_reserved - used; 1061 } 1062 1063 if (dd == ancestor) { 1064 ASSERT(delta <= 0); 1065 ASSERT(used >= -delta); 1066 used += delta; 1067 if (parentspace != UINT64_MAX) 1068 parentspace -= delta; 1069 } 1070 1071 if (used > quota) { 1072 /* over quota */ 1073 myspace = 0; 1074 } else { 1075 /* 1076 * the lesser of the space provided by our parent and 1077 * the space left in our quota 1078 */ 1079 myspace = MIN(parentspace, quota - used); 1080 } 1081 1082 mutex_exit(&dd->dd_lock); 1083 1084 return (myspace); 1085} 1086 1087struct tempreserve { 1088 list_node_t tr_node; 1089 dsl_dir_t *tr_ds; 1090 uint64_t tr_size; 1091}; 1092 1093static int 1094dsl_dir_tempreserve_impl(dsl_dir_t *dd, uint64_t asize, boolean_t netfree, 1095 boolean_t ignorequota, boolean_t checkrefquota, list_t *tr_list, 1096 dmu_tx_t *tx, boolean_t first) 1097{ 1098 uint64_t txg = tx->tx_txg; 1099 uint64_t est_inflight, used_on_disk, quota, parent_rsrv; 1100 uint64_t deferred = 0; 1101 struct tempreserve *tr; 1102 int retval = EDQUOT; 1103 int txgidx = txg & TXG_MASK; 1104 int i; 1105 uint64_t ref_rsrv = 0; 1106 1107 ASSERT3U(txg, !=, 0); 1108 ASSERT3S(asize, >, 0); 1109 1110 mutex_enter(&dd->dd_lock); 1111 1112 /* 1113 * Check against the dsl_dir's quota. We don't add in the delta 1114 * when checking for over-quota because they get one free hit. 1115 */ 1116 est_inflight = dsl_dir_space_towrite(dd); 1117 for (i = 0; i < TXG_SIZE; i++) 1118 est_inflight += dd->dd_tempreserved[i]; 1119 used_on_disk = dd->dd_phys->dd_used_bytes; 1120 1121 /* 1122 * On the first iteration, fetch the dataset's used-on-disk and 1123 * refreservation values. Also, if checkrefquota is set, test if 1124 * allocating this space would exceed the dataset's refquota. 1125 */ 1126 if (first && tx->tx_objset) { 1127 int error; 1128 dsl_dataset_t *ds = tx->tx_objset->os_dsl_dataset; 1129 1130 error = dsl_dataset_check_quota(ds, checkrefquota, 1131 asize, est_inflight, &used_on_disk, &ref_rsrv); 1132 if (error) { 1133 mutex_exit(&dd->dd_lock); 1134 return (error); 1135 } 1136 } 1137 1138 /* 1139 * If this transaction will result in a net free of space, 1140 * we want to let it through. 1141 */ 1142 if (ignorequota || netfree || dd->dd_phys->dd_quota == 0) 1143 quota = UINT64_MAX; 1144 else 1145 quota = dd->dd_phys->dd_quota; 1146 1147 /* 1148 * Adjust the quota against the actual pool size at the root 1149 * minus any outstanding deferred frees. 1150 * To ensure that it's possible to remove files from a full 1151 * pool without inducing transient overcommits, we throttle 1152 * netfree transactions against a quota that is slightly larger, 1153 * but still within the pool's allocation slop. In cases where 1154 * we're very close to full, this will allow a steady trickle of 1155 * removes to get through. 1156 */ 1157 if (dd->dd_parent == NULL) { 1158 spa_t *spa = dd->dd_pool->dp_spa; 1159 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, netfree); 1160 deferred = metaslab_class_get_deferred(spa_normal_class(spa)); 1161 if (poolsize - deferred < quota) { 1162 quota = poolsize - deferred; 1163 retval = ENOSPC; 1164 } 1165 } 1166 1167 /* 1168 * If they are requesting more space, and our current estimate 1169 * is over quota, they get to try again unless the actual 1170 * on-disk is over quota and there are no pending changes (which 1171 * may free up space for us). 1172 */ 1173 if (used_on_disk + est_inflight >= quota) { 1174 if (est_inflight > 0 || used_on_disk < quota || 1175 (retval == ENOSPC && used_on_disk < quota + deferred)) 1176 retval = ERESTART; 1177 dprintf_dd(dd, "failing: used=%lluK inflight = %lluK " 1178 "quota=%lluK tr=%lluK err=%d\n", 1179 used_on_disk>>10, est_inflight>>10, 1180 quota>>10, asize>>10, retval); 1181 mutex_exit(&dd->dd_lock); 1182 return (SET_ERROR(retval)); 1183 } 1184 1185 /* We need to up our estimated delta before dropping dd_lock */ 1186 dd->dd_tempreserved[txgidx] += asize; 1187 1188 parent_rsrv = parent_delta(dd, used_on_disk + est_inflight, 1189 asize - ref_rsrv); 1190 mutex_exit(&dd->dd_lock); 1191 1192 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP); 1193 tr->tr_ds = dd; 1194 tr->tr_size = asize; 1195 list_insert_tail(tr_list, tr); 1196 1197 /* see if it's OK with our parent */ 1198 if (dd->dd_parent && parent_rsrv) { 1199 boolean_t ismos = (dd->dd_phys->dd_head_dataset_obj == 0); 1200 1201 return (dsl_dir_tempreserve_impl(dd->dd_parent, 1202 parent_rsrv, netfree, ismos, TRUE, tr_list, tx, FALSE)); 1203 } else { 1204 return (0); 1205 } 1206} 1207 1208/* 1209 * Reserve space in this dsl_dir, to be used in this tx's txg. 1210 * After the space has been dirtied (and dsl_dir_willuse_space() 1211 * has been called), the reservation should be canceled, using 1212 * dsl_dir_tempreserve_clear(). 1213 */ 1214int 1215dsl_dir_tempreserve_space(dsl_dir_t *dd, uint64_t lsize, uint64_t asize, 1216 uint64_t fsize, uint64_t usize, void **tr_cookiep, dmu_tx_t *tx) 1217{ 1218 int err; 1219 list_t *tr_list; 1220 1221 if (asize == 0) { 1222 *tr_cookiep = NULL; 1223 return (0); 1224 } 1225 1226 tr_list = kmem_alloc(sizeof (list_t), KM_SLEEP); 1227 list_create(tr_list, sizeof (struct tempreserve), 1228 offsetof(struct tempreserve, tr_node)); 1229 ASSERT3S(asize, >, 0); 1230 ASSERT3S(fsize, >=, 0); 1231 1232 err = arc_tempreserve_space(lsize, tx->tx_txg); 1233 if (err == 0) { 1234 struct tempreserve *tr; 1235 1236 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP); 1237 tr->tr_size = lsize; 1238 list_insert_tail(tr_list, tr); 1239 } else { 1240 if (err == EAGAIN) { 1241 /* 1242 * If arc_memory_throttle() detected that pageout 1243 * is running and we are low on memory, we delay new 1244 * non-pageout transactions to give pageout an 1245 * advantage. 1246 * 1247 * It is unfortunate to be delaying while the caller's 1248 * locks are held. 1249 */ 1250 txg_delay(dd->dd_pool, tx->tx_txg, 1251 MSEC2NSEC(10), MSEC2NSEC(10)); 1252 err = SET_ERROR(ERESTART); 1253 } 1254 } 1255 1256 if (err == 0) { 1257 err = dsl_dir_tempreserve_impl(dd, asize, fsize >= asize, 1258 FALSE, asize > usize, tr_list, tx, TRUE); 1259 } 1260 1261 if (err != 0) 1262 dsl_dir_tempreserve_clear(tr_list, tx); 1263 else 1264 *tr_cookiep = tr_list; 1265 1266 return (err); 1267} 1268 1269/* 1270 * Clear a temporary reservation that we previously made with 1271 * dsl_dir_tempreserve_space(). 1272 */ 1273void 1274dsl_dir_tempreserve_clear(void *tr_cookie, dmu_tx_t *tx) 1275{ 1276 int txgidx = tx->tx_txg & TXG_MASK; 1277 list_t *tr_list = tr_cookie; 1278 struct tempreserve *tr; 1279 1280 ASSERT3U(tx->tx_txg, !=, 0); 1281 1282 if (tr_cookie == NULL) 1283 return; 1284 1285 while ((tr = list_head(tr_list)) != NULL) { 1286 if (tr->tr_ds) { 1287 mutex_enter(&tr->tr_ds->dd_lock); 1288 ASSERT3U(tr->tr_ds->dd_tempreserved[txgidx], >=, 1289 tr->tr_size); 1290 tr->tr_ds->dd_tempreserved[txgidx] -= tr->tr_size; 1291 mutex_exit(&tr->tr_ds->dd_lock); 1292 } else { 1293 arc_tempreserve_clear(tr->tr_size); 1294 } 1295 list_remove(tr_list, tr); 1296 kmem_free(tr, sizeof (struct tempreserve)); 1297 } 1298 1299 kmem_free(tr_list, sizeof (list_t)); 1300} 1301 1302/* 1303 * This should be called from open context when we think we're going to write 1304 * or free space, for example when dirtying data. Be conservative; it's okay 1305 * to write less space or free more, but we don't want to write more or free 1306 * less than the amount specified. 1307 */ 1308void 1309dsl_dir_willuse_space(dsl_dir_t *dd, int64_t space, dmu_tx_t *tx) 1310{ 1311 int64_t parent_space; 1312 uint64_t est_used; 1313 1314 mutex_enter(&dd->dd_lock); 1315 if (space > 0) 1316 dd->dd_space_towrite[tx->tx_txg & TXG_MASK] += space; 1317 1318 est_used = dsl_dir_space_towrite(dd) + dd->dd_phys->dd_used_bytes; 1319 parent_space = parent_delta(dd, est_used, space); 1320 mutex_exit(&dd->dd_lock); 1321 1322 /* Make sure that we clean up dd_space_to* */ 1323 dsl_dir_dirty(dd, tx); 1324 1325 /* XXX this is potentially expensive and unnecessary... */ 1326 if (parent_space && dd->dd_parent) 1327 dsl_dir_willuse_space(dd->dd_parent, parent_space, tx); 1328} 1329 1330/* call from syncing context when we actually write/free space for this dd */ 1331void 1332dsl_dir_diduse_space(dsl_dir_t *dd, dd_used_t type, 1333 int64_t used, int64_t compressed, int64_t uncompressed, dmu_tx_t *tx) 1334{ 1335 int64_t accounted_delta; 1336 1337 /* 1338 * dsl_dataset_set_refreservation_sync_impl() calls this with 1339 * dd_lock held, so that it can atomically update 1340 * ds->ds_reserved and the dsl_dir accounting, so that 1341 * dsl_dataset_check_quota() can see dataset and dir accounting 1342 * consistently. 1343 */ 1344 boolean_t needlock = !MUTEX_HELD(&dd->dd_lock); 1345 1346 ASSERT(dmu_tx_is_syncing(tx)); 1347 ASSERT(type < DD_USED_NUM); 1348 1349 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1350 1351 if (needlock) 1352 mutex_enter(&dd->dd_lock); 1353 accounted_delta = parent_delta(dd, dd->dd_phys->dd_used_bytes, used); 1354 ASSERT(used >= 0 || dd->dd_phys->dd_used_bytes >= -used); 1355 ASSERT(compressed >= 0 || 1356 dd->dd_phys->dd_compressed_bytes >= -compressed); 1357 ASSERT(uncompressed >= 0 || 1358 dd->dd_phys->dd_uncompressed_bytes >= -uncompressed); 1359 dd->dd_phys->dd_used_bytes += used; 1360 dd->dd_phys->dd_uncompressed_bytes += uncompressed; 1361 dd->dd_phys->dd_compressed_bytes += compressed; 1362 1363 if (dd->dd_phys->dd_flags & DD_FLAG_USED_BREAKDOWN) { 1364 ASSERT(used > 0 || 1365 dd->dd_phys->dd_used_breakdown[type] >= -used); 1366 dd->dd_phys->dd_used_breakdown[type] += used; 1367#ifdef DEBUG 1368 dd_used_t t; 1369 uint64_t u = 0; 1370 for (t = 0; t < DD_USED_NUM; t++) 1371 u += dd->dd_phys->dd_used_breakdown[t]; 1372 ASSERT3U(u, ==, dd->dd_phys->dd_used_bytes); 1373#endif 1374 } 1375 if (needlock) 1376 mutex_exit(&dd->dd_lock); 1377 1378 if (dd->dd_parent != NULL) { 1379 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD, 1380 accounted_delta, compressed, uncompressed, tx); 1381 dsl_dir_transfer_space(dd->dd_parent, 1382 used - accounted_delta, 1383 DD_USED_CHILD_RSRV, DD_USED_CHILD, tx); 1384 } 1385} 1386 1387void 1388dsl_dir_transfer_space(dsl_dir_t *dd, int64_t delta, 1389 dd_used_t oldtype, dd_used_t newtype, dmu_tx_t *tx) 1390{ 1391 ASSERT(dmu_tx_is_syncing(tx)); 1392 ASSERT(oldtype < DD_USED_NUM); 1393 ASSERT(newtype < DD_USED_NUM); 1394 1395 if (delta == 0 || !(dd->dd_phys->dd_flags & DD_FLAG_USED_BREAKDOWN)) 1396 return; 1397 1398 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1399 mutex_enter(&dd->dd_lock); 1400 ASSERT(delta > 0 ? 1401 dd->dd_phys->dd_used_breakdown[oldtype] >= delta : 1402 dd->dd_phys->dd_used_breakdown[newtype] >= -delta); 1403 ASSERT(dd->dd_phys->dd_used_bytes >= ABS(delta)); 1404 dd->dd_phys->dd_used_breakdown[oldtype] -= delta; 1405 dd->dd_phys->dd_used_breakdown[newtype] += delta; 1406 mutex_exit(&dd->dd_lock); 1407} 1408 1409typedef struct dsl_dir_set_qr_arg { 1410 const char *ddsqra_name; 1411 zprop_source_t ddsqra_source; 1412 uint64_t ddsqra_value; 1413} dsl_dir_set_qr_arg_t; 1414 1415static int 1416dsl_dir_set_quota_check(void *arg, dmu_tx_t *tx) 1417{ 1418 dsl_dir_set_qr_arg_t *ddsqra = arg; 1419 dsl_pool_t *dp = dmu_tx_pool(tx); 1420 dsl_dataset_t *ds; 1421 int error; 1422 uint64_t towrite, newval; 1423 1424 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds); 1425 if (error != 0) 1426 return (error); 1427 1428 error = dsl_prop_predict(ds->ds_dir, "quota", 1429 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval); 1430 if (error != 0) { 1431 dsl_dataset_rele(ds, FTAG); 1432 return (error); 1433 } 1434 1435 if (newval == 0) { 1436 dsl_dataset_rele(ds, FTAG); 1437 return (0); 1438 } 1439 1440 mutex_enter(&ds->ds_dir->dd_lock); 1441 /* 1442 * If we are doing the preliminary check in open context, and 1443 * there are pending changes, then don't fail it, since the 1444 * pending changes could under-estimate the amount of space to be 1445 * freed up. 1446 */ 1447 towrite = dsl_dir_space_towrite(ds->ds_dir); 1448 if ((dmu_tx_is_syncing(tx) || towrite == 0) && 1449 (newval < ds->ds_dir->dd_phys->dd_reserved || 1450 newval < ds->ds_dir->dd_phys->dd_used_bytes + towrite)) { 1451 error = SET_ERROR(ENOSPC); 1452 } 1453 mutex_exit(&ds->ds_dir->dd_lock); 1454 dsl_dataset_rele(ds, FTAG); 1455 return (error); 1456} 1457 1458static void 1459dsl_dir_set_quota_sync(void *arg, dmu_tx_t *tx) 1460{ 1461 dsl_dir_set_qr_arg_t *ddsqra = arg; 1462 dsl_pool_t *dp = dmu_tx_pool(tx); 1463 dsl_dataset_t *ds; 1464 uint64_t newval; 1465 1466 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds)); 1467 1468 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) { 1469 dsl_prop_set_sync_impl(ds, zfs_prop_to_name(ZFS_PROP_QUOTA), 1470 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1, 1471 &ddsqra->ddsqra_value, tx); 1472 1473 VERIFY0(dsl_prop_get_int_ds(ds, 1474 zfs_prop_to_name(ZFS_PROP_QUOTA), &newval)); 1475 } else { 1476 newval = ddsqra->ddsqra_value; 1477 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld", 1478 zfs_prop_to_name(ZFS_PROP_QUOTA), (longlong_t)newval); 1479 } 1480 1481 dmu_buf_will_dirty(ds->ds_dir->dd_dbuf, tx); 1482 mutex_enter(&ds->ds_dir->dd_lock); 1483 ds->ds_dir->dd_phys->dd_quota = newval; 1484 mutex_exit(&ds->ds_dir->dd_lock); 1485 dsl_dataset_rele(ds, FTAG); 1486} 1487 1488int 1489dsl_dir_set_quota(const char *ddname, zprop_source_t source, uint64_t quota) 1490{ 1491 dsl_dir_set_qr_arg_t ddsqra; 1492 1493 ddsqra.ddsqra_name = ddname; 1494 ddsqra.ddsqra_source = source; 1495 ddsqra.ddsqra_value = quota; 1496 1497 return (dsl_sync_task(ddname, dsl_dir_set_quota_check, 1498 dsl_dir_set_quota_sync, &ddsqra, 0)); 1499} 1500 1501int 1502dsl_dir_set_reservation_check(void *arg, dmu_tx_t *tx) 1503{ 1504 dsl_dir_set_qr_arg_t *ddsqra = arg; 1505 dsl_pool_t *dp = dmu_tx_pool(tx); 1506 dsl_dataset_t *ds; 1507 dsl_dir_t *dd; 1508 uint64_t newval, used, avail; 1509 int error; 1510 1511 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds); 1512 if (error != 0) 1513 return (error); 1514 dd = ds->ds_dir; 1515 1516 /* 1517 * If we are doing the preliminary check in open context, the 1518 * space estimates may be inaccurate. 1519 */ 1520 if (!dmu_tx_is_syncing(tx)) { 1521 dsl_dataset_rele(ds, FTAG); 1522 return (0); 1523 } 1524 1525 error = dsl_prop_predict(ds->ds_dir, 1526 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1527 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval); 1528 if (error != 0) { 1529 dsl_dataset_rele(ds, FTAG); 1530 return (error); 1531 } 1532 1533 mutex_enter(&dd->dd_lock); 1534 used = dd->dd_phys->dd_used_bytes; 1535 mutex_exit(&dd->dd_lock); 1536 1537 if (dd->dd_parent) { 1538 avail = dsl_dir_space_available(dd->dd_parent, 1539 NULL, 0, FALSE); 1540 } else { 1541 avail = dsl_pool_adjustedsize(dd->dd_pool, B_FALSE) - used; 1542 } 1543 1544 if (MAX(used, newval) > MAX(used, dd->dd_phys->dd_reserved)) { 1545 uint64_t delta = MAX(used, newval) - 1546 MAX(used, dd->dd_phys->dd_reserved); 1547 1548 if (delta > avail || 1549 (dd->dd_phys->dd_quota > 0 && 1550 newval > dd->dd_phys->dd_quota)) 1551 error = SET_ERROR(ENOSPC); 1552 } 1553 1554 dsl_dataset_rele(ds, FTAG); 1555 return (error); 1556} 1557 1558void 1559dsl_dir_set_reservation_sync_impl(dsl_dir_t *dd, uint64_t value, dmu_tx_t *tx) 1560{ 1561 uint64_t used; 1562 int64_t delta; 1563 1564 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1565 1566 mutex_enter(&dd->dd_lock); 1567 used = dd->dd_phys->dd_used_bytes; 1568 delta = MAX(used, value) - MAX(used, dd->dd_phys->dd_reserved); 1569 dd->dd_phys->dd_reserved = value; 1570 1571 if (dd->dd_parent != NULL) { 1572 /* Roll up this additional usage into our ancestors */ 1573 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV, 1574 delta, 0, 0, tx); 1575 } 1576 mutex_exit(&dd->dd_lock); 1577} 1578 1579static void 1580dsl_dir_set_reservation_sync(void *arg, dmu_tx_t *tx) 1581{ 1582 dsl_dir_set_qr_arg_t *ddsqra = arg; 1583 dsl_pool_t *dp = dmu_tx_pool(tx); 1584 dsl_dataset_t *ds; 1585 uint64_t newval; 1586 1587 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds)); 1588 1589 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) { 1590 dsl_prop_set_sync_impl(ds, 1591 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1592 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1, 1593 &ddsqra->ddsqra_value, tx); 1594 1595 VERIFY0(dsl_prop_get_int_ds(ds, 1596 zfs_prop_to_name(ZFS_PROP_RESERVATION), &newval)); 1597 } else { 1598 newval = ddsqra->ddsqra_value; 1599 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld", 1600 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1601 (longlong_t)newval); 1602 } 1603 1604 dsl_dir_set_reservation_sync_impl(ds->ds_dir, newval, tx); 1605 dsl_dataset_rele(ds, FTAG); 1606} 1607 1608int 1609dsl_dir_set_reservation(const char *ddname, zprop_source_t source, 1610 uint64_t reservation) 1611{ 1612 dsl_dir_set_qr_arg_t ddsqra; 1613 1614 ddsqra.ddsqra_name = ddname; 1615 ddsqra.ddsqra_source = source; 1616 ddsqra.ddsqra_value = reservation; 1617 1618 return (dsl_sync_task(ddname, dsl_dir_set_reservation_check, 1619 dsl_dir_set_reservation_sync, &ddsqra, 0)); 1620} 1621 1622static dsl_dir_t * 1623closest_common_ancestor(dsl_dir_t *ds1, dsl_dir_t *ds2) 1624{ 1625 for (; ds1; ds1 = ds1->dd_parent) { 1626 dsl_dir_t *dd; 1627 for (dd = ds2; dd; dd = dd->dd_parent) { 1628 if (ds1 == dd) 1629 return (dd); 1630 } 1631 } 1632 return (NULL); 1633} 1634 1635/* 1636 * If delta is applied to dd, how much of that delta would be applied to 1637 * ancestor? Syncing context only. 1638 */ 1639static int64_t 1640would_change(dsl_dir_t *dd, int64_t delta, dsl_dir_t *ancestor) 1641{ 1642 if (dd == ancestor) 1643 return (delta); 1644 1645 mutex_enter(&dd->dd_lock); 1646 delta = parent_delta(dd, dd->dd_phys->dd_used_bytes, delta); 1647 mutex_exit(&dd->dd_lock); 1648 return (would_change(dd->dd_parent, delta, ancestor)); 1649} 1650 1651typedef struct dsl_dir_rename_arg { 1652 const char *ddra_oldname; 1653 const char *ddra_newname; 1654 cred_t *ddra_cred; 1655} dsl_dir_rename_arg_t; 1656 1657/* ARGSUSED */ 1658static int 1659dsl_valid_rename(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg) 1660{ 1661 int *deltap = arg; 1662 char namebuf[MAXNAMELEN]; 1663 1664 dsl_dataset_name(ds, namebuf); 1665 1666 if (strlen(namebuf) + *deltap >= MAXNAMELEN) 1667 return (SET_ERROR(ENAMETOOLONG)); 1668 return (0); 1669} 1670 1671static int 1672dsl_dir_rename_check(void *arg, dmu_tx_t *tx) 1673{ 1674 dsl_dir_rename_arg_t *ddra = arg; 1675 dsl_pool_t *dp = dmu_tx_pool(tx); 1676 dsl_dir_t *dd, *newparent; 1677 const char *mynewname; 1678 int error; 1679 int delta = strlen(ddra->ddra_newname) - strlen(ddra->ddra_oldname); 1680 1681 /* target dir should exist */ 1682 error = dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL); 1683 if (error != 0) 1684 return (error); 1685 1686 /* new parent should exist */ 1687 error = dsl_dir_hold(dp, ddra->ddra_newname, FTAG, 1688 &newparent, &mynewname); 1689 if (error != 0) { 1690 dsl_dir_rele(dd, FTAG); 1691 return (error); 1692 } 1693 1694 /* can't rename to different pool */ 1695 if (dd->dd_pool != newparent->dd_pool) { 1696 dsl_dir_rele(newparent, FTAG); 1697 dsl_dir_rele(dd, FTAG); 1698 return (SET_ERROR(ENXIO)); 1699 } 1700 1701 /* new name should not already exist */ 1702 if (mynewname == NULL) { 1703 dsl_dir_rele(newparent, FTAG); 1704 dsl_dir_rele(dd, FTAG); 1705 return (SET_ERROR(EEXIST)); 1706 } 1707 1708 /* if the name length is growing, validate child name lengths */ 1709 if (delta > 0) { 1710 error = dmu_objset_find_dp(dp, dd->dd_object, dsl_valid_rename, 1711 &delta, DS_FIND_CHILDREN | DS_FIND_SNAPSHOTS); 1712 if (error != 0) { 1713 dsl_dir_rele(newparent, FTAG); 1714 dsl_dir_rele(dd, FTAG); 1715 return (error); 1716 } 1717 } 1718 1719 if (dmu_tx_is_syncing(tx)) { 1720 if (spa_feature_is_enabled(dp->dp_spa, 1721 SPA_FEATURE_FS_SS_LIMIT)) { 1722 /* 1723 * Although this is the check function and we don't 1724 * normally make on-disk changes in check functions, 1725 * we need to do that here. 1726 * 1727 * Ensure this portion of the tree's counts have been 1728 * initialized in case the new parent has limits set. 1729 */ 1730 dsl_dir_init_fs_ss_count(dd, tx); 1731 } 1732 } 1733 1734 if (newparent != dd->dd_parent) { 1735 /* is there enough space? */ 1736 uint64_t myspace = 1737 MAX(dd->dd_phys->dd_used_bytes, dd->dd_phys->dd_reserved); 1738 objset_t *os = dd->dd_pool->dp_meta_objset; 1739 uint64_t fs_cnt = 0; 1740 uint64_t ss_cnt = 0; 1741 1742 if (dsl_dir_is_zapified(dd)) { 1743 int err; 1744 1745 err = zap_lookup(os, dd->dd_object, 1746 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1, 1747 &fs_cnt); 1748 if (err != ENOENT && err != 0) 1749 return (err); 1750 1751 /* 1752 * have to add 1 for the filesystem itself that we're 1753 * moving 1754 */ 1755 fs_cnt++; 1756 1757 err = zap_lookup(os, dd->dd_object, 1758 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1, 1759 &ss_cnt); 1760 if (err != ENOENT && err != 0) 1761 return (err); 1762 } 1763 1764 /* no rename into our descendant */ 1765 if (closest_common_ancestor(dd, newparent) == dd) { 1766 dsl_dir_rele(newparent, FTAG); 1767 dsl_dir_rele(dd, FTAG); 1768 return (SET_ERROR(EINVAL)); 1769 } 1770 1771 error = dsl_dir_transfer_possible(dd->dd_parent, 1772 newparent, fs_cnt, ss_cnt, myspace, ddra->ddra_cred); 1773 if (error != 0) { 1774 dsl_dir_rele(newparent, FTAG); 1775 dsl_dir_rele(dd, FTAG); 1776 return (error); 1777 } 1778 } 1779 1780 dsl_dir_rele(newparent, FTAG); 1781 dsl_dir_rele(dd, FTAG); 1782 return (0); 1783} 1784 1785static void 1786dsl_dir_rename_sync(void *arg, dmu_tx_t *tx) 1787{ 1788 dsl_dir_rename_arg_t *ddra = arg; 1789 dsl_pool_t *dp = dmu_tx_pool(tx); 1790 dsl_dir_t *dd, *newparent; 1791 const char *mynewname; 1792 int error; 1793 objset_t *mos = dp->dp_meta_objset; 1794 1795 VERIFY0(dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL)); 1796 VERIFY0(dsl_dir_hold(dp, ddra->ddra_newname, FTAG, &newparent, 1797 &mynewname)); 1798 1799 /* Log this before we change the name. */ 1800 spa_history_log_internal_dd(dd, "rename", tx, 1801 "-> %s", ddra->ddra_newname); 1802 1803 if (newparent != dd->dd_parent) { 1804 objset_t *os = dd->dd_pool->dp_meta_objset; 1805 uint64_t fs_cnt = 0; 1806 uint64_t ss_cnt = 0; 1807 1808 /* 1809 * We already made sure the dd counts were initialized in the 1810 * check function. 1811 */ 1812 if (spa_feature_is_enabled(dp->dp_spa, 1813 SPA_FEATURE_FS_SS_LIMIT)) { 1814 VERIFY0(zap_lookup(os, dd->dd_object, 1815 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1, 1816 &fs_cnt)); 1817 /* add 1 for the filesystem itself that we're moving */ 1818 fs_cnt++; 1819 1820 VERIFY0(zap_lookup(os, dd->dd_object, 1821 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1, 1822 &ss_cnt)); 1823 } 1824 1825 dsl_fs_ss_count_adjust(dd->dd_parent, -fs_cnt, 1826 DD_FIELD_FILESYSTEM_COUNT, tx); 1827 dsl_fs_ss_count_adjust(newparent, fs_cnt, 1828 DD_FIELD_FILESYSTEM_COUNT, tx); 1829 1830 dsl_fs_ss_count_adjust(dd->dd_parent, -ss_cnt, 1831 DD_FIELD_SNAPSHOT_COUNT, tx); 1832 dsl_fs_ss_count_adjust(newparent, ss_cnt, 1833 DD_FIELD_SNAPSHOT_COUNT, tx); 1834 1835 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD, 1836 -dd->dd_phys->dd_used_bytes, 1837 -dd->dd_phys->dd_compressed_bytes, 1838 -dd->dd_phys->dd_uncompressed_bytes, tx); 1839 dsl_dir_diduse_space(newparent, DD_USED_CHILD, 1840 dd->dd_phys->dd_used_bytes, 1841 dd->dd_phys->dd_compressed_bytes, 1842 dd->dd_phys->dd_uncompressed_bytes, tx); 1843 1844 if (dd->dd_phys->dd_reserved > dd->dd_phys->dd_used_bytes) { 1845 uint64_t unused_rsrv = dd->dd_phys->dd_reserved - 1846 dd->dd_phys->dd_used_bytes; 1847 1848 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV, 1849 -unused_rsrv, 0, 0, tx); 1850 dsl_dir_diduse_space(newparent, DD_USED_CHILD_RSRV, 1851 unused_rsrv, 0, 0, tx); 1852 } 1853 } 1854 1855 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1856 1857 /* remove from old parent zapobj */ 1858 error = zap_remove(mos, dd->dd_parent->dd_phys->dd_child_dir_zapobj, 1859 dd->dd_myname, tx); 1860 ASSERT0(error); 1861 1862 (void) strcpy(dd->dd_myname, mynewname); 1863 dsl_dir_rele(dd->dd_parent, dd); 1864 dd->dd_phys->dd_parent_obj = newparent->dd_object; 1865 VERIFY0(dsl_dir_hold_obj(dp, 1866 newparent->dd_object, NULL, dd, &dd->dd_parent)); 1867 1868 /* add to new parent zapobj */ 1869 VERIFY0(zap_add(mos, newparent->dd_phys->dd_child_dir_zapobj, 1870 dd->dd_myname, 8, 1, &dd->dd_object, tx)); 1871 1872#ifdef __FreeBSD__ 1873#ifdef _KERNEL 1874 zfsvfs_update_fromname(ddra->ddra_oldname, ddra->ddra_newname); 1875 zvol_rename_minors(ddra->ddra_oldname, ddra->ddra_newname); 1876#endif 1877#endif 1878 1879 dsl_prop_notify_all(dd); 1880 1881 dsl_dir_rele(newparent, FTAG); 1882 dsl_dir_rele(dd, FTAG); 1883} 1884 1885int 1886dsl_dir_rename(const char *oldname, const char *newname) 1887{ 1888 dsl_dir_rename_arg_t ddra; 1889 1890 ddra.ddra_oldname = oldname; 1891 ddra.ddra_newname = newname; 1892 ddra.ddra_cred = CRED(); 1893 1894 return (dsl_sync_task(oldname, 1895 dsl_dir_rename_check, dsl_dir_rename_sync, &ddra, 3)); 1896} 1897 1898int 1899dsl_dir_transfer_possible(dsl_dir_t *sdd, dsl_dir_t *tdd, 1900 uint64_t fs_cnt, uint64_t ss_cnt, uint64_t space, cred_t *cr) 1901{ 1902 dsl_dir_t *ancestor; 1903 int64_t adelta; 1904 uint64_t avail; 1905 int err; 1906 1907 ancestor = closest_common_ancestor(sdd, tdd); 1908 adelta = would_change(sdd, -space, ancestor); 1909 avail = dsl_dir_space_available(tdd, ancestor, adelta, FALSE); 1910 if (avail < space) 1911 return (SET_ERROR(ENOSPC)); 1912 1913 err = dsl_fs_ss_limit_check(tdd, fs_cnt, ZFS_PROP_FILESYSTEM_LIMIT, 1914 ancestor, cr); 1915 if (err != 0) 1916 return (err); 1917 err = dsl_fs_ss_limit_check(tdd, ss_cnt, ZFS_PROP_SNAPSHOT_LIMIT, 1918 ancestor, cr); 1919 if (err != 0) 1920 return (err); 1921 1922 return (0); 1923} 1924 1925timestruc_t 1926dsl_dir_snap_cmtime(dsl_dir_t *dd) 1927{ 1928 timestruc_t t; 1929 1930 mutex_enter(&dd->dd_lock); 1931 t = dd->dd_snap_cmtime; 1932 mutex_exit(&dd->dd_lock); 1933 1934 return (t); 1935} 1936 1937void 1938dsl_dir_snap_cmtime_update(dsl_dir_t *dd) 1939{ 1940 timestruc_t t; 1941 1942 gethrestime(&t); 1943 mutex_enter(&dd->dd_lock); 1944 dd->dd_snap_cmtime = t; 1945 mutex_exit(&dd->dd_lock); 1946} 1947 1948void 1949dsl_dir_zapify(dsl_dir_t *dd, dmu_tx_t *tx) 1950{ 1951 objset_t *mos = dd->dd_pool->dp_meta_objset; 1952 dmu_object_zapify(mos, dd->dd_object, DMU_OT_DSL_DIR, tx); 1953} 1954 1955boolean_t 1956dsl_dir_is_zapified(dsl_dir_t *dd) 1957{ 1958 dmu_object_info_t doi; 1959 1960 dmu_object_info_from_db(dd->dd_dbuf, &doi); 1961 return (doi.doi_type == DMU_OTN_ZAP_METADATA); 1962} 1963