dsl_dir.c revision 277585
1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21/* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>. 24 * All rights reserved. 25 * Copyright (c) 2012, 2014 by Delphix. All rights reserved. 26 * Copyright (c) 2014 Joyent, Inc. All rights reserved. 27 */ 28 29#include <sys/dmu.h> 30#include <sys/dmu_objset.h> 31#include <sys/dmu_tx.h> 32#include <sys/dsl_dataset.h> 33#include <sys/dsl_dir.h> 34#include <sys/dsl_prop.h> 35#include <sys/dsl_synctask.h> 36#include <sys/dsl_deleg.h> 37#include <sys/dmu_impl.h> 38#include <sys/spa.h> 39#include <sys/metaslab.h> 40#include <sys/zap.h> 41#include <sys/zio.h> 42#include <sys/arc.h> 43#include <sys/sunddi.h> 44#include <sys/zvol.h> 45#ifdef _KERNEL 46#include <sys/zfs_vfsops.h> 47#endif 48#include <sys/zfeature.h> 49#include <sys/policy.h> 50#include <sys/zfs_znode.h> 51#include "zfs_namecheck.h" 52#include "zfs_prop.h" 53 54/* 55 * Filesystem and Snapshot Limits 56 * ------------------------------ 57 * 58 * These limits are used to restrict the number of filesystems and/or snapshots 59 * that can be created at a given level in the tree or below. A typical 60 * use-case is with a delegated dataset where the administrator wants to ensure 61 * that a user within the zone is not creating too many additional filesystems 62 * or snapshots, even though they're not exceeding their space quota. 63 * 64 * The filesystem and snapshot counts are stored as extensible properties. This 65 * capability is controlled by a feature flag and must be enabled to be used. 66 * Once enabled, the feature is not active until the first limit is set. At 67 * that point, future operations to create/destroy filesystems or snapshots 68 * will validate and update the counts. 69 * 70 * Because the count properties will not exist before the feature is active, 71 * the counts are updated when a limit is first set on an uninitialized 72 * dsl_dir node in the tree (The filesystem/snapshot count on a node includes 73 * all of the nested filesystems/snapshots. Thus, a new leaf node has a 74 * filesystem count of 0 and a snapshot count of 0. Non-existent filesystem and 75 * snapshot count properties on a node indicate uninitialized counts on that 76 * node.) When first setting a limit on an uninitialized node, the code starts 77 * at the filesystem with the new limit and descends into all sub-filesystems 78 * to add the count properties. 79 * 80 * In practice this is lightweight since a limit is typically set when the 81 * filesystem is created and thus has no children. Once valid, changing the 82 * limit value won't require a re-traversal since the counts are already valid. 83 * When recursively fixing the counts, if a node with a limit is encountered 84 * during the descent, the counts are known to be valid and there is no need to 85 * descend into that filesystem's children. The counts on filesystems above the 86 * one with the new limit will still be uninitialized, unless a limit is 87 * eventually set on one of those filesystems. The counts are always recursively 88 * updated when a limit is set on a dataset, unless there is already a limit. 89 * When a new limit value is set on a filesystem with an existing limit, it is 90 * possible for the new limit to be less than the current count at that level 91 * since a user who can change the limit is also allowed to exceed the limit. 92 * 93 * Once the feature is active, then whenever a filesystem or snapshot is 94 * created, the code recurses up the tree, validating the new count against the 95 * limit at each initialized level. In practice, most levels will not have a 96 * limit set. If there is a limit at any initialized level up the tree, the 97 * check must pass or the creation will fail. Likewise, when a filesystem or 98 * snapshot is destroyed, the counts are recursively adjusted all the way up 99 * the initizized nodes in the tree. Renaming a filesystem into different point 100 * in the tree will first validate, then update the counts on each branch up to 101 * the common ancestor. A receive will also validate the counts and then update 102 * them. 103 * 104 * An exception to the above behavior is that the limit is not enforced if the 105 * user has permission to modify the limit. This is primarily so that 106 * recursive snapshots in the global zone always work. We want to prevent a 107 * denial-of-service in which a lower level delegated dataset could max out its 108 * limit and thus block recursive snapshots from being taken in the global zone. 109 * Because of this, it is possible for the snapshot count to be over the limit 110 * and snapshots taken in the global zone could cause a lower level dataset to 111 * hit or exceed its limit. The administrator taking the global zone recursive 112 * snapshot should be aware of this side-effect and behave accordingly. 113 * For consistency, the filesystem limit is also not enforced if the user can 114 * modify the limit. 115 * 116 * The filesystem and snapshot limits are validated by dsl_fs_ss_limit_check() 117 * and updated by dsl_fs_ss_count_adjust(). A new limit value is setup in 118 * dsl_dir_activate_fs_ss_limit() and the counts are adjusted, if necessary, by 119 * dsl_dir_init_fs_ss_count(). 120 * 121 * There is a special case when we receive a filesystem that already exists. In 122 * this case a temporary clone name of %X is created (see dmu_recv_begin). We 123 * never update the filesystem counts for temporary clones. 124 * 125 * Likewise, we do not update the snapshot counts for temporary snapshots, 126 * such as those created by zfs diff. 127 */ 128 129extern inline dsl_dir_phys_t *dsl_dir_phys(dsl_dir_t *dd); 130 131static uint64_t dsl_dir_space_towrite(dsl_dir_t *dd); 132 133/* ARGSUSED */ 134static void 135dsl_dir_evict(dmu_buf_t *db, void *arg) 136{ 137 dsl_dir_t *dd = arg; 138 dsl_pool_t *dp = dd->dd_pool; 139 int t; 140 141 for (t = 0; t < TXG_SIZE; t++) { 142 ASSERT(!txg_list_member(&dp->dp_dirty_dirs, dd, t)); 143 ASSERT(dd->dd_tempreserved[t] == 0); 144 ASSERT(dd->dd_space_towrite[t] == 0); 145 } 146 147 if (dd->dd_parent) 148 dsl_dir_rele(dd->dd_parent, dd); 149 150 spa_close(dd->dd_pool->dp_spa, dd); 151 152 /* 153 * The props callback list should have been cleaned up by 154 * objset_evict(). 155 */ 156 list_destroy(&dd->dd_prop_cbs); 157 mutex_destroy(&dd->dd_lock); 158 kmem_free(dd, sizeof (dsl_dir_t)); 159} 160 161int 162dsl_dir_hold_obj(dsl_pool_t *dp, uint64_t ddobj, 163 const char *tail, void *tag, dsl_dir_t **ddp) 164{ 165 dmu_buf_t *dbuf; 166 dsl_dir_t *dd; 167 int err; 168 169 ASSERT(dsl_pool_config_held(dp)); 170 171 err = dmu_bonus_hold(dp->dp_meta_objset, ddobj, tag, &dbuf); 172 if (err != 0) 173 return (err); 174 dd = dmu_buf_get_user(dbuf); 175#ifdef ZFS_DEBUG 176 { 177 dmu_object_info_t doi; 178 dmu_object_info_from_db(dbuf, &doi); 179 ASSERT3U(doi.doi_bonus_type, ==, DMU_OT_DSL_DIR); 180 ASSERT3U(doi.doi_bonus_size, >=, sizeof (dsl_dir_phys_t)); 181 } 182#endif 183 if (dd == NULL) { 184 dsl_dir_t *winner; 185 186 dd = kmem_zalloc(sizeof (dsl_dir_t), KM_SLEEP); 187 dd->dd_object = ddobj; 188 dd->dd_dbuf = dbuf; 189 dd->dd_pool = dp; 190 mutex_init(&dd->dd_lock, NULL, MUTEX_DEFAULT, NULL); 191 192 list_create(&dd->dd_prop_cbs, sizeof (dsl_prop_cb_record_t), 193 offsetof(dsl_prop_cb_record_t, cbr_node)); 194 195 dsl_dir_snap_cmtime_update(dd); 196 197 if (dsl_dir_phys(dd)->dd_parent_obj) { 198 err = dsl_dir_hold_obj(dp, 199 dsl_dir_phys(dd)->dd_parent_obj, NULL, dd, 200 &dd->dd_parent); 201 if (err != 0) 202 goto errout; 203 if (tail) { 204#ifdef ZFS_DEBUG 205 uint64_t foundobj; 206 207 err = zap_lookup(dp->dp_meta_objset, 208 dsl_dir_phys(dd->dd_parent)-> 209 dd_child_dir_zapobj, tail, 210 sizeof (foundobj), 1, &foundobj); 211 ASSERT(err || foundobj == ddobj); 212#endif 213 (void) strcpy(dd->dd_myname, tail); 214 } else { 215 err = zap_value_search(dp->dp_meta_objset, 216 dsl_dir_phys(dd->dd_parent)-> 217 dd_child_dir_zapobj, 218 ddobj, 0, dd->dd_myname); 219 } 220 if (err != 0) 221 goto errout; 222 } else { 223 (void) strcpy(dd->dd_myname, spa_name(dp->dp_spa)); 224 } 225 226 if (dsl_dir_is_clone(dd)) { 227 dmu_buf_t *origin_bonus; 228 dsl_dataset_phys_t *origin_phys; 229 230 /* 231 * We can't open the origin dataset, because 232 * that would require opening this dsl_dir. 233 * Just look at its phys directly instead. 234 */ 235 err = dmu_bonus_hold(dp->dp_meta_objset, 236 dsl_dir_phys(dd)->dd_origin_obj, FTAG, 237 &origin_bonus); 238 if (err != 0) 239 goto errout; 240 origin_phys = origin_bonus->db_data; 241 dd->dd_origin_txg = 242 origin_phys->ds_creation_txg; 243 dmu_buf_rele(origin_bonus, FTAG); 244 } 245 246 winner = dmu_buf_set_user_ie(dbuf, dd, dsl_dir_evict); 247 if (winner) { 248 if (dd->dd_parent) 249 dsl_dir_rele(dd->dd_parent, dd); 250 mutex_destroy(&dd->dd_lock); 251 kmem_free(dd, sizeof (dsl_dir_t)); 252 dd = winner; 253 } else { 254 spa_open_ref(dp->dp_spa, dd); 255 } 256 } 257 258 /* 259 * The dsl_dir_t has both open-to-close and instantiate-to-evict 260 * holds on the spa. We need the open-to-close holds because 261 * otherwise the spa_refcnt wouldn't change when we open a 262 * dir which the spa also has open, so we could incorrectly 263 * think it was OK to unload/export/destroy the pool. We need 264 * the instantiate-to-evict hold because the dsl_dir_t has a 265 * pointer to the dd_pool, which has a pointer to the spa_t. 266 */ 267 spa_open_ref(dp->dp_spa, tag); 268 ASSERT3P(dd->dd_pool, ==, dp); 269 ASSERT3U(dd->dd_object, ==, ddobj); 270 ASSERT3P(dd->dd_dbuf, ==, dbuf); 271 *ddp = dd; 272 return (0); 273 274errout: 275 if (dd->dd_parent) 276 dsl_dir_rele(dd->dd_parent, dd); 277 mutex_destroy(&dd->dd_lock); 278 kmem_free(dd, sizeof (dsl_dir_t)); 279 dmu_buf_rele(dbuf, tag); 280 return (err); 281} 282 283void 284dsl_dir_rele(dsl_dir_t *dd, void *tag) 285{ 286 dprintf_dd(dd, "%s\n", ""); 287 spa_close(dd->dd_pool->dp_spa, tag); 288 dmu_buf_rele(dd->dd_dbuf, tag); 289} 290 291/* buf must be long enough (MAXNAMELEN + strlen(MOS_DIR_NAME) + 1 should do) */ 292void 293dsl_dir_name(dsl_dir_t *dd, char *buf) 294{ 295 if (dd->dd_parent) { 296 dsl_dir_name(dd->dd_parent, buf); 297 (void) strcat(buf, "/"); 298 } else { 299 buf[0] = '\0'; 300 } 301 if (!MUTEX_HELD(&dd->dd_lock)) { 302 /* 303 * recursive mutex so that we can use 304 * dprintf_dd() with dd_lock held 305 */ 306 mutex_enter(&dd->dd_lock); 307 (void) strcat(buf, dd->dd_myname); 308 mutex_exit(&dd->dd_lock); 309 } else { 310 (void) strcat(buf, dd->dd_myname); 311 } 312} 313 314/* Calculate name length, avoiding all the strcat calls of dsl_dir_name */ 315int 316dsl_dir_namelen(dsl_dir_t *dd) 317{ 318 int result = 0; 319 320 if (dd->dd_parent) { 321 /* parent's name + 1 for the "/" */ 322 result = dsl_dir_namelen(dd->dd_parent) + 1; 323 } 324 325 if (!MUTEX_HELD(&dd->dd_lock)) { 326 /* see dsl_dir_name */ 327 mutex_enter(&dd->dd_lock); 328 result += strlen(dd->dd_myname); 329 mutex_exit(&dd->dd_lock); 330 } else { 331 result += strlen(dd->dd_myname); 332 } 333 334 return (result); 335} 336 337static int 338getcomponent(const char *path, char *component, const char **nextp) 339{ 340 char *p; 341 342 if ((path == NULL) || (path[0] == '\0')) 343 return (SET_ERROR(ENOENT)); 344 /* This would be a good place to reserve some namespace... */ 345 p = strpbrk(path, "/@"); 346 if (p && (p[1] == '/' || p[1] == '@')) { 347 /* two separators in a row */ 348 return (SET_ERROR(EINVAL)); 349 } 350 if (p == NULL || p == path) { 351 /* 352 * if the first thing is an @ or /, it had better be an 353 * @ and it had better not have any more ats or slashes, 354 * and it had better have something after the @. 355 */ 356 if (p != NULL && 357 (p[0] != '@' || strpbrk(path+1, "/@") || p[1] == '\0')) 358 return (SET_ERROR(EINVAL)); 359 if (strlen(path) >= MAXNAMELEN) 360 return (SET_ERROR(ENAMETOOLONG)); 361 (void) strcpy(component, path); 362 p = NULL; 363 } else if (p[0] == '/') { 364 if (p - path >= MAXNAMELEN) 365 return (SET_ERROR(ENAMETOOLONG)); 366 (void) strncpy(component, path, p - path); 367 component[p - path] = '\0'; 368 p++; 369 } else if (p[0] == '@') { 370 /* 371 * if the next separator is an @, there better not be 372 * any more slashes. 373 */ 374 if (strchr(path, '/')) 375 return (SET_ERROR(EINVAL)); 376 if (p - path >= MAXNAMELEN) 377 return (SET_ERROR(ENAMETOOLONG)); 378 (void) strncpy(component, path, p - path); 379 component[p - path] = '\0'; 380 } else { 381 panic("invalid p=%p", (void *)p); 382 } 383 *nextp = p; 384 return (0); 385} 386 387/* 388 * Return the dsl_dir_t, and possibly the last component which couldn't 389 * be found in *tail. The name must be in the specified dsl_pool_t. This 390 * thread must hold the dp_config_rwlock for the pool. Returns NULL if the 391 * path is bogus, or if tail==NULL and we couldn't parse the whole name. 392 * (*tail)[0] == '@' means that the last component is a snapshot. 393 */ 394int 395dsl_dir_hold(dsl_pool_t *dp, const char *name, void *tag, 396 dsl_dir_t **ddp, const char **tailp) 397{ 398 char buf[MAXNAMELEN]; 399 const char *spaname, *next, *nextnext = NULL; 400 int err; 401 dsl_dir_t *dd; 402 uint64_t ddobj; 403 404 err = getcomponent(name, buf, &next); 405 if (err != 0) 406 return (err); 407 408 /* Make sure the name is in the specified pool. */ 409 spaname = spa_name(dp->dp_spa); 410 if (strcmp(buf, spaname) != 0) 411 return (SET_ERROR(EINVAL)); 412 413 ASSERT(dsl_pool_config_held(dp)); 414 415 err = dsl_dir_hold_obj(dp, dp->dp_root_dir_obj, NULL, tag, &dd); 416 if (err != 0) { 417 return (err); 418 } 419 420 while (next != NULL) { 421 dsl_dir_t *child_ds; 422 err = getcomponent(next, buf, &nextnext); 423 if (err != 0) 424 break; 425 ASSERT(next[0] != '\0'); 426 if (next[0] == '@') 427 break; 428 dprintf("looking up %s in obj%lld\n", 429 buf, dsl_dir_phys(dd)->dd_child_dir_zapobj); 430 431 err = zap_lookup(dp->dp_meta_objset, 432 dsl_dir_phys(dd)->dd_child_dir_zapobj, 433 buf, sizeof (ddobj), 1, &ddobj); 434 if (err != 0) { 435 if (err == ENOENT) 436 err = 0; 437 break; 438 } 439 440 err = dsl_dir_hold_obj(dp, ddobj, buf, tag, &child_ds); 441 if (err != 0) 442 break; 443 dsl_dir_rele(dd, tag); 444 dd = child_ds; 445 next = nextnext; 446 } 447 448 if (err != 0) { 449 dsl_dir_rele(dd, tag); 450 return (err); 451 } 452 453 /* 454 * It's an error if there's more than one component left, or 455 * tailp==NULL and there's any component left. 456 */ 457 if (next != NULL && 458 (tailp == NULL || (nextnext && nextnext[0] != '\0'))) { 459 /* bad path name */ 460 dsl_dir_rele(dd, tag); 461 dprintf("next=%p (%s) tail=%p\n", next, next?next:"", tailp); 462 err = SET_ERROR(ENOENT); 463 } 464 if (tailp != NULL) 465 *tailp = next; 466 *ddp = dd; 467 return (err); 468} 469 470/* 471 * If the counts are already initialized for this filesystem and its 472 * descendants then do nothing, otherwise initialize the counts. 473 * 474 * The counts on this filesystem, and those below, may be uninitialized due to 475 * either the use of a pre-existing pool which did not support the 476 * filesystem/snapshot limit feature, or one in which the feature had not yet 477 * been enabled. 478 * 479 * Recursively descend the filesystem tree and update the filesystem/snapshot 480 * counts on each filesystem below, then update the cumulative count on the 481 * current filesystem. If the filesystem already has a count set on it, 482 * then we know that its counts, and the counts on the filesystems below it, 483 * are already correct, so we don't have to update this filesystem. 484 */ 485static void 486dsl_dir_init_fs_ss_count(dsl_dir_t *dd, dmu_tx_t *tx) 487{ 488 uint64_t my_fs_cnt = 0; 489 uint64_t my_ss_cnt = 0; 490 dsl_pool_t *dp = dd->dd_pool; 491 objset_t *os = dp->dp_meta_objset; 492 zap_cursor_t *zc; 493 zap_attribute_t *za; 494 dsl_dataset_t *ds; 495 496 ASSERT(spa_feature_is_active(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT)); 497 ASSERT(dsl_pool_config_held(dp)); 498 ASSERT(dmu_tx_is_syncing(tx)); 499 500 dsl_dir_zapify(dd, tx); 501 502 /* 503 * If the filesystem count has already been initialized then we 504 * don't need to recurse down any further. 505 */ 506 if (zap_contains(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT) == 0) 507 return; 508 509 zc = kmem_alloc(sizeof (zap_cursor_t), KM_SLEEP); 510 za = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP); 511 512 /* Iterate my child dirs */ 513 for (zap_cursor_init(zc, os, dsl_dir_phys(dd)->dd_child_dir_zapobj); 514 zap_cursor_retrieve(zc, za) == 0; zap_cursor_advance(zc)) { 515 dsl_dir_t *chld_dd; 516 uint64_t count; 517 518 VERIFY0(dsl_dir_hold_obj(dp, za->za_first_integer, NULL, FTAG, 519 &chld_dd)); 520 521 /* 522 * Ignore hidden ($FREE, $MOS & $ORIGIN) objsets and 523 * temporary datasets. 524 */ 525 if (chld_dd->dd_myname[0] == '$' || 526 chld_dd->dd_myname[0] == '%') { 527 dsl_dir_rele(chld_dd, FTAG); 528 continue; 529 } 530 531 my_fs_cnt++; /* count this child */ 532 533 dsl_dir_init_fs_ss_count(chld_dd, tx); 534 535 VERIFY0(zap_lookup(os, chld_dd->dd_object, 536 DD_FIELD_FILESYSTEM_COUNT, sizeof (count), 1, &count)); 537 my_fs_cnt += count; 538 VERIFY0(zap_lookup(os, chld_dd->dd_object, 539 DD_FIELD_SNAPSHOT_COUNT, sizeof (count), 1, &count)); 540 my_ss_cnt += count; 541 542 dsl_dir_rele(chld_dd, FTAG); 543 } 544 zap_cursor_fini(zc); 545 /* Count my snapshots (we counted children's snapshots above) */ 546 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool, 547 dsl_dir_phys(dd)->dd_head_dataset_obj, FTAG, &ds)); 548 549 for (zap_cursor_init(zc, os, dsl_dataset_phys(ds)->ds_snapnames_zapobj); 550 zap_cursor_retrieve(zc, za) == 0; 551 zap_cursor_advance(zc)) { 552 /* Don't count temporary snapshots */ 553 if (za->za_name[0] != '%') 554 my_ss_cnt++; 555 } 556 zap_cursor_fini(zc); 557 558 dsl_dataset_rele(ds, FTAG); 559 560 kmem_free(zc, sizeof (zap_cursor_t)); 561 kmem_free(za, sizeof (zap_attribute_t)); 562 563 /* we're in a sync task, update counts */ 564 dmu_buf_will_dirty(dd->dd_dbuf, tx); 565 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT, 566 sizeof (my_fs_cnt), 1, &my_fs_cnt, tx)); 567 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT, 568 sizeof (my_ss_cnt), 1, &my_ss_cnt, tx)); 569} 570 571static int 572dsl_dir_actv_fs_ss_limit_check(void *arg, dmu_tx_t *tx) 573{ 574 char *ddname = (char *)arg; 575 dsl_pool_t *dp = dmu_tx_pool(tx); 576 dsl_dataset_t *ds; 577 dsl_dir_t *dd; 578 int error; 579 580 error = dsl_dataset_hold(dp, ddname, FTAG, &ds); 581 if (error != 0) 582 return (error); 583 584 if (!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT)) { 585 dsl_dataset_rele(ds, FTAG); 586 return (SET_ERROR(ENOTSUP)); 587 } 588 589 dd = ds->ds_dir; 590 if (spa_feature_is_active(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT) && 591 dsl_dir_is_zapified(dd) && 592 zap_contains(dp->dp_meta_objset, dd->dd_object, 593 DD_FIELD_FILESYSTEM_COUNT) == 0) { 594 dsl_dataset_rele(ds, FTAG); 595 return (SET_ERROR(EALREADY)); 596 } 597 598 dsl_dataset_rele(ds, FTAG); 599 return (0); 600} 601 602static void 603dsl_dir_actv_fs_ss_limit_sync(void *arg, dmu_tx_t *tx) 604{ 605 char *ddname = (char *)arg; 606 dsl_pool_t *dp = dmu_tx_pool(tx); 607 dsl_dataset_t *ds; 608 spa_t *spa; 609 610 VERIFY0(dsl_dataset_hold(dp, ddname, FTAG, &ds)); 611 612 spa = dsl_dataset_get_spa(ds); 613 614 if (!spa_feature_is_active(spa, SPA_FEATURE_FS_SS_LIMIT)) { 615 /* 616 * Since the feature was not active and we're now setting a 617 * limit, increment the feature-active counter so that the 618 * feature becomes active for the first time. 619 * 620 * We are already in a sync task so we can update the MOS. 621 */ 622 spa_feature_incr(spa, SPA_FEATURE_FS_SS_LIMIT, tx); 623 } 624 625 /* 626 * Since we are now setting a non-UINT64_MAX limit on the filesystem, 627 * we need to ensure the counts are correct. Descend down the tree from 628 * this point and update all of the counts to be accurate. 629 */ 630 dsl_dir_init_fs_ss_count(ds->ds_dir, tx); 631 632 dsl_dataset_rele(ds, FTAG); 633} 634 635/* 636 * Make sure the feature is enabled and activate it if necessary. 637 * Since we're setting a limit, ensure the on-disk counts are valid. 638 * This is only called by the ioctl path when setting a limit value. 639 * 640 * We do not need to validate the new limit, since users who can change the 641 * limit are also allowed to exceed the limit. 642 */ 643int 644dsl_dir_activate_fs_ss_limit(const char *ddname) 645{ 646 int error; 647 648 error = dsl_sync_task(ddname, dsl_dir_actv_fs_ss_limit_check, 649 dsl_dir_actv_fs_ss_limit_sync, (void *)ddname, 0, 650 ZFS_SPACE_CHECK_RESERVED); 651 652 if (error == EALREADY) 653 error = 0; 654 655 return (error); 656} 657 658/* 659 * Used to determine if the filesystem_limit or snapshot_limit should be 660 * enforced. We allow the limit to be exceeded if the user has permission to 661 * write the property value. We pass in the creds that we got in the open 662 * context since we will always be the GZ root in syncing context. We also have 663 * to handle the case where we are allowed to change the limit on the current 664 * dataset, but there may be another limit in the tree above. 665 * 666 * We can never modify these two properties within a non-global zone. In 667 * addition, the other checks are modeled on zfs_secpolicy_write_perms. We 668 * can't use that function since we are already holding the dp_config_rwlock. 669 * In addition, we already have the dd and dealing with snapshots is simplified 670 * in this code. 671 */ 672 673typedef enum { 674 ENFORCE_ALWAYS, 675 ENFORCE_NEVER, 676 ENFORCE_ABOVE 677} enforce_res_t; 678 679static enforce_res_t 680dsl_enforce_ds_ss_limits(dsl_dir_t *dd, zfs_prop_t prop, cred_t *cr) 681{ 682 enforce_res_t enforce = ENFORCE_ALWAYS; 683 uint64_t obj; 684 dsl_dataset_t *ds; 685 uint64_t zoned; 686 687 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT || 688 prop == ZFS_PROP_SNAPSHOT_LIMIT); 689 690#ifdef _KERNEL 691#ifdef __FreeBSD__ 692 if (jailed(cr)) 693#else 694 if (crgetzoneid(cr) != GLOBAL_ZONEID) 695#endif 696 return (ENFORCE_ALWAYS); 697 698 if (secpolicy_zfs(cr) == 0) 699 return (ENFORCE_NEVER); 700#endif 701 702 if ((obj = dsl_dir_phys(dd)->dd_head_dataset_obj) == 0) 703 return (ENFORCE_ALWAYS); 704 705 ASSERT(dsl_pool_config_held(dd->dd_pool)); 706 707 if (dsl_dataset_hold_obj(dd->dd_pool, obj, FTAG, &ds) != 0) 708 return (ENFORCE_ALWAYS); 709 710 if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL) || zoned) { 711 /* Only root can access zoned fs's from the GZ */ 712 enforce = ENFORCE_ALWAYS; 713 } else { 714 if (dsl_deleg_access_impl(ds, zfs_prop_to_name(prop), cr) == 0) 715 enforce = ENFORCE_ABOVE; 716 } 717 718 dsl_dataset_rele(ds, FTAG); 719 return (enforce); 720} 721 722/* 723 * Check if adding additional child filesystem(s) would exceed any filesystem 724 * limits or adding additional snapshot(s) would exceed any snapshot limits. 725 * The prop argument indicates which limit to check. 726 * 727 * Note that all filesystem limits up to the root (or the highest 728 * initialized) filesystem or the given ancestor must be satisfied. 729 */ 730int 731dsl_fs_ss_limit_check(dsl_dir_t *dd, uint64_t delta, zfs_prop_t prop, 732 dsl_dir_t *ancestor, cred_t *cr) 733{ 734 objset_t *os = dd->dd_pool->dp_meta_objset; 735 uint64_t limit, count; 736 char *count_prop; 737 enforce_res_t enforce; 738 int err = 0; 739 740 ASSERT(dsl_pool_config_held(dd->dd_pool)); 741 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT || 742 prop == ZFS_PROP_SNAPSHOT_LIMIT); 743 744 /* 745 * If we're allowed to change the limit, don't enforce the limit 746 * e.g. this can happen if a snapshot is taken by an administrative 747 * user in the global zone (i.e. a recursive snapshot by root). 748 * However, we must handle the case of delegated permissions where we 749 * are allowed to change the limit on the current dataset, but there 750 * is another limit in the tree above. 751 */ 752 enforce = dsl_enforce_ds_ss_limits(dd, prop, cr); 753 if (enforce == ENFORCE_NEVER) 754 return (0); 755 756 /* 757 * e.g. if renaming a dataset with no snapshots, count adjustment 758 * is 0. 759 */ 760 if (delta == 0) 761 return (0); 762 763 if (prop == ZFS_PROP_SNAPSHOT_LIMIT) { 764 /* 765 * We don't enforce the limit for temporary snapshots. This is 766 * indicated by a NULL cred_t argument. 767 */ 768 if (cr == NULL) 769 return (0); 770 771 count_prop = DD_FIELD_SNAPSHOT_COUNT; 772 } else { 773 count_prop = DD_FIELD_FILESYSTEM_COUNT; 774 } 775 776 /* 777 * If an ancestor has been provided, stop checking the limit once we 778 * hit that dir. We need this during rename so that we don't overcount 779 * the check once we recurse up to the common ancestor. 780 */ 781 if (ancestor == dd) 782 return (0); 783 784 /* 785 * If we hit an uninitialized node while recursing up the tree, we can 786 * stop since we know there is no limit here (or above). The counts are 787 * not valid on this node and we know we won't touch this node's counts. 788 */ 789 if (!dsl_dir_is_zapified(dd) || zap_lookup(os, dd->dd_object, 790 count_prop, sizeof (count), 1, &count) == ENOENT) 791 return (0); 792 793 err = dsl_prop_get_dd(dd, zfs_prop_to_name(prop), 8, 1, &limit, NULL, 794 B_FALSE); 795 if (err != 0) 796 return (err); 797 798 /* Is there a limit which we've hit? */ 799 if (enforce == ENFORCE_ALWAYS && (count + delta) > limit) 800 return (SET_ERROR(EDQUOT)); 801 802 if (dd->dd_parent != NULL) 803 err = dsl_fs_ss_limit_check(dd->dd_parent, delta, prop, 804 ancestor, cr); 805 806 return (err); 807} 808 809/* 810 * Adjust the filesystem or snapshot count for the specified dsl_dir_t and all 811 * parents. When a new filesystem/snapshot is created, increment the count on 812 * all parents, and when a filesystem/snapshot is destroyed, decrement the 813 * count. 814 */ 815void 816dsl_fs_ss_count_adjust(dsl_dir_t *dd, int64_t delta, const char *prop, 817 dmu_tx_t *tx) 818{ 819 int err; 820 objset_t *os = dd->dd_pool->dp_meta_objset; 821 uint64_t count; 822 823 ASSERT(dsl_pool_config_held(dd->dd_pool)); 824 ASSERT(dmu_tx_is_syncing(tx)); 825 ASSERT(strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0 || 826 strcmp(prop, DD_FIELD_SNAPSHOT_COUNT) == 0); 827 828 /* 829 * When we receive an incremental stream into a filesystem that already 830 * exists, a temporary clone is created. We don't count this temporary 831 * clone, whose name begins with a '%'. We also ignore hidden ($FREE, 832 * $MOS & $ORIGIN) objsets. 833 */ 834 if ((dd->dd_myname[0] == '%' || dd->dd_myname[0] == '$') && 835 strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0) 836 return; 837 838 /* 839 * e.g. if renaming a dataset with no snapshots, count adjustment is 0 840 */ 841 if (delta == 0) 842 return; 843 844 /* 845 * If we hit an uninitialized node while recursing up the tree, we can 846 * stop since we know the counts are not valid on this node and we 847 * know we shouldn't touch this node's counts. An uninitialized count 848 * on the node indicates that either the feature has not yet been 849 * activated or there are no limits on this part of the tree. 850 */ 851 if (!dsl_dir_is_zapified(dd) || (err = zap_lookup(os, dd->dd_object, 852 prop, sizeof (count), 1, &count)) == ENOENT) 853 return; 854 VERIFY0(err); 855 856 count += delta; 857 /* Use a signed verify to make sure we're not neg. */ 858 VERIFY3S(count, >=, 0); 859 860 VERIFY0(zap_update(os, dd->dd_object, prop, sizeof (count), 1, &count, 861 tx)); 862 863 /* Roll up this additional count into our ancestors */ 864 if (dd->dd_parent != NULL) 865 dsl_fs_ss_count_adjust(dd->dd_parent, delta, prop, tx); 866} 867 868uint64_t 869dsl_dir_create_sync(dsl_pool_t *dp, dsl_dir_t *pds, const char *name, 870 dmu_tx_t *tx) 871{ 872 objset_t *mos = dp->dp_meta_objset; 873 uint64_t ddobj; 874 dsl_dir_phys_t *ddphys; 875 dmu_buf_t *dbuf; 876 877 ddobj = dmu_object_alloc(mos, DMU_OT_DSL_DIR, 0, 878 DMU_OT_DSL_DIR, sizeof (dsl_dir_phys_t), tx); 879 if (pds) { 880 VERIFY(0 == zap_add(mos, dsl_dir_phys(pds)->dd_child_dir_zapobj, 881 name, sizeof (uint64_t), 1, &ddobj, tx)); 882 } else { 883 /* it's the root dir */ 884 VERIFY(0 == zap_add(mos, DMU_POOL_DIRECTORY_OBJECT, 885 DMU_POOL_ROOT_DATASET, sizeof (uint64_t), 1, &ddobj, tx)); 886 } 887 VERIFY(0 == dmu_bonus_hold(mos, ddobj, FTAG, &dbuf)); 888 dmu_buf_will_dirty(dbuf, tx); 889 ddphys = dbuf->db_data; 890 891 ddphys->dd_creation_time = gethrestime_sec(); 892 if (pds) { 893 ddphys->dd_parent_obj = pds->dd_object; 894 895 /* update the filesystem counts */ 896 dsl_fs_ss_count_adjust(pds, 1, DD_FIELD_FILESYSTEM_COUNT, tx); 897 } 898 ddphys->dd_props_zapobj = zap_create(mos, 899 DMU_OT_DSL_PROPS, DMU_OT_NONE, 0, tx); 900 ddphys->dd_child_dir_zapobj = zap_create(mos, 901 DMU_OT_DSL_DIR_CHILD_MAP, DMU_OT_NONE, 0, tx); 902 if (spa_version(dp->dp_spa) >= SPA_VERSION_USED_BREAKDOWN) 903 ddphys->dd_flags |= DD_FLAG_USED_BREAKDOWN; 904 dmu_buf_rele(dbuf, FTAG); 905 906 return (ddobj); 907} 908 909boolean_t 910dsl_dir_is_clone(dsl_dir_t *dd) 911{ 912 return (dsl_dir_phys(dd)->dd_origin_obj && 913 (dd->dd_pool->dp_origin_snap == NULL || 914 dsl_dir_phys(dd)->dd_origin_obj != 915 dd->dd_pool->dp_origin_snap->ds_object)); 916} 917 918void 919dsl_dir_stats(dsl_dir_t *dd, nvlist_t *nv) 920{ 921 mutex_enter(&dd->dd_lock); 922 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USED, 923 dsl_dir_phys(dd)->dd_used_bytes); 924 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_QUOTA, 925 dsl_dir_phys(dd)->dd_quota); 926 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_RESERVATION, 927 dsl_dir_phys(dd)->dd_reserved); 928 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_COMPRESSRATIO, 929 dsl_dir_phys(dd)->dd_compressed_bytes == 0 ? 100 : 930 (dsl_dir_phys(dd)->dd_uncompressed_bytes * 100 / 931 dsl_dir_phys(dd)->dd_compressed_bytes)); 932 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_LOGICALUSED, 933 dsl_dir_phys(dd)->dd_uncompressed_bytes); 934 if (dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN) { 935 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDSNAP, 936 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_SNAP]); 937 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDDS, 938 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_HEAD]); 939 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDREFRESERV, 940 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_REFRSRV]); 941 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDCHILD, 942 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_CHILD] + 943 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_CHILD_RSRV]); 944 } 945 mutex_exit(&dd->dd_lock); 946 947 if (dsl_dir_is_zapified(dd)) { 948 uint64_t count; 949 objset_t *os = dd->dd_pool->dp_meta_objset; 950 951 if (zap_lookup(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT, 952 sizeof (count), 1, &count) == 0) { 953 dsl_prop_nvlist_add_uint64(nv, 954 ZFS_PROP_FILESYSTEM_COUNT, count); 955 } 956 if (zap_lookup(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT, 957 sizeof (count), 1, &count) == 0) { 958 dsl_prop_nvlist_add_uint64(nv, 959 ZFS_PROP_SNAPSHOT_COUNT, count); 960 } 961 } 962 963 if (dsl_dir_is_clone(dd)) { 964 dsl_dataset_t *ds; 965 char buf[MAXNAMELEN]; 966 967 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool, 968 dsl_dir_phys(dd)->dd_origin_obj, FTAG, &ds)); 969 dsl_dataset_name(ds, buf); 970 dsl_dataset_rele(ds, FTAG); 971 dsl_prop_nvlist_add_string(nv, ZFS_PROP_ORIGIN, buf); 972 } 973} 974 975void 976dsl_dir_dirty(dsl_dir_t *dd, dmu_tx_t *tx) 977{ 978 dsl_pool_t *dp = dd->dd_pool; 979 980 ASSERT(dsl_dir_phys(dd)); 981 982 if (txg_list_add(&dp->dp_dirty_dirs, dd, tx->tx_txg)) { 983 /* up the hold count until we can be written out */ 984 dmu_buf_add_ref(dd->dd_dbuf, dd); 985 } 986} 987 988static int64_t 989parent_delta(dsl_dir_t *dd, uint64_t used, int64_t delta) 990{ 991 uint64_t old_accounted = MAX(used, dsl_dir_phys(dd)->dd_reserved); 992 uint64_t new_accounted = 993 MAX(used + delta, dsl_dir_phys(dd)->dd_reserved); 994 return (new_accounted - old_accounted); 995} 996 997void 998dsl_dir_sync(dsl_dir_t *dd, dmu_tx_t *tx) 999{ 1000 ASSERT(dmu_tx_is_syncing(tx)); 1001 1002 mutex_enter(&dd->dd_lock); 1003 ASSERT0(dd->dd_tempreserved[tx->tx_txg&TXG_MASK]); 1004 dprintf_dd(dd, "txg=%llu towrite=%lluK\n", tx->tx_txg, 1005 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] / 1024); 1006 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] = 0; 1007 mutex_exit(&dd->dd_lock); 1008 1009 /* release the hold from dsl_dir_dirty */ 1010 dmu_buf_rele(dd->dd_dbuf, dd); 1011} 1012 1013static uint64_t 1014dsl_dir_space_towrite(dsl_dir_t *dd) 1015{ 1016 uint64_t space = 0; 1017 int i; 1018 1019 ASSERT(MUTEX_HELD(&dd->dd_lock)); 1020 1021 for (i = 0; i < TXG_SIZE; i++) { 1022 space += dd->dd_space_towrite[i&TXG_MASK]; 1023 ASSERT3U(dd->dd_space_towrite[i&TXG_MASK], >=, 0); 1024 } 1025 return (space); 1026} 1027 1028/* 1029 * How much space would dd have available if ancestor had delta applied 1030 * to it? If ondiskonly is set, we're only interested in what's 1031 * on-disk, not estimated pending changes. 1032 */ 1033uint64_t 1034dsl_dir_space_available(dsl_dir_t *dd, 1035 dsl_dir_t *ancestor, int64_t delta, int ondiskonly) 1036{ 1037 uint64_t parentspace, myspace, quota, used; 1038 1039 /* 1040 * If there are no restrictions otherwise, assume we have 1041 * unlimited space available. 1042 */ 1043 quota = UINT64_MAX; 1044 parentspace = UINT64_MAX; 1045 1046 if (dd->dd_parent != NULL) { 1047 parentspace = dsl_dir_space_available(dd->dd_parent, 1048 ancestor, delta, ondiskonly); 1049 } 1050 1051 mutex_enter(&dd->dd_lock); 1052 if (dsl_dir_phys(dd)->dd_quota != 0) 1053 quota = dsl_dir_phys(dd)->dd_quota; 1054 used = dsl_dir_phys(dd)->dd_used_bytes; 1055 if (!ondiskonly) 1056 used += dsl_dir_space_towrite(dd); 1057 1058 if (dd->dd_parent == NULL) { 1059 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, FALSE); 1060 quota = MIN(quota, poolsize); 1061 } 1062 1063 if (dsl_dir_phys(dd)->dd_reserved > used && parentspace != UINT64_MAX) { 1064 /* 1065 * We have some space reserved, in addition to what our 1066 * parent gave us. 1067 */ 1068 parentspace += dsl_dir_phys(dd)->dd_reserved - used; 1069 } 1070 1071 if (dd == ancestor) { 1072 ASSERT(delta <= 0); 1073 ASSERT(used >= -delta); 1074 used += delta; 1075 if (parentspace != UINT64_MAX) 1076 parentspace -= delta; 1077 } 1078 1079 if (used > quota) { 1080 /* over quota */ 1081 myspace = 0; 1082 } else { 1083 /* 1084 * the lesser of the space provided by our parent and 1085 * the space left in our quota 1086 */ 1087 myspace = MIN(parentspace, quota - used); 1088 } 1089 1090 mutex_exit(&dd->dd_lock); 1091 1092 return (myspace); 1093} 1094 1095struct tempreserve { 1096 list_node_t tr_node; 1097 dsl_dir_t *tr_ds; 1098 uint64_t tr_size; 1099}; 1100 1101static int 1102dsl_dir_tempreserve_impl(dsl_dir_t *dd, uint64_t asize, boolean_t netfree, 1103 boolean_t ignorequota, boolean_t checkrefquota, list_t *tr_list, 1104 dmu_tx_t *tx, boolean_t first) 1105{ 1106 uint64_t txg = tx->tx_txg; 1107 uint64_t est_inflight, used_on_disk, quota, parent_rsrv; 1108 uint64_t deferred = 0; 1109 struct tempreserve *tr; 1110 int retval = EDQUOT; 1111 int txgidx = txg & TXG_MASK; 1112 int i; 1113 uint64_t ref_rsrv = 0; 1114 1115 ASSERT3U(txg, !=, 0); 1116 ASSERT3S(asize, >, 0); 1117 1118 mutex_enter(&dd->dd_lock); 1119 1120 /* 1121 * Check against the dsl_dir's quota. We don't add in the delta 1122 * when checking for over-quota because they get one free hit. 1123 */ 1124 est_inflight = dsl_dir_space_towrite(dd); 1125 for (i = 0; i < TXG_SIZE; i++) 1126 est_inflight += dd->dd_tempreserved[i]; 1127 used_on_disk = dsl_dir_phys(dd)->dd_used_bytes; 1128 1129 /* 1130 * On the first iteration, fetch the dataset's used-on-disk and 1131 * refreservation values. Also, if checkrefquota is set, test if 1132 * allocating this space would exceed the dataset's refquota. 1133 */ 1134 if (first && tx->tx_objset) { 1135 int error; 1136 dsl_dataset_t *ds = tx->tx_objset->os_dsl_dataset; 1137 1138 error = dsl_dataset_check_quota(ds, checkrefquota, 1139 asize, est_inflight, &used_on_disk, &ref_rsrv); 1140 if (error) { 1141 mutex_exit(&dd->dd_lock); 1142 return (error); 1143 } 1144 } 1145 1146 /* 1147 * If this transaction will result in a net free of space, 1148 * we want to let it through. 1149 */ 1150 if (ignorequota || netfree || dsl_dir_phys(dd)->dd_quota == 0) 1151 quota = UINT64_MAX; 1152 else 1153 quota = dsl_dir_phys(dd)->dd_quota; 1154 1155 /* 1156 * Adjust the quota against the actual pool size at the root 1157 * minus any outstanding deferred frees. 1158 * To ensure that it's possible to remove files from a full 1159 * pool without inducing transient overcommits, we throttle 1160 * netfree transactions against a quota that is slightly larger, 1161 * but still within the pool's allocation slop. In cases where 1162 * we're very close to full, this will allow a steady trickle of 1163 * removes to get through. 1164 */ 1165 if (dd->dd_parent == NULL) { 1166 spa_t *spa = dd->dd_pool->dp_spa; 1167 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, netfree); 1168 deferred = metaslab_class_get_deferred(spa_normal_class(spa)); 1169 if (poolsize - deferred < quota) { 1170 quota = poolsize - deferred; 1171 retval = ENOSPC; 1172 } 1173 } 1174 1175 /* 1176 * If they are requesting more space, and our current estimate 1177 * is over quota, they get to try again unless the actual 1178 * on-disk is over quota and there are no pending changes (which 1179 * may free up space for us). 1180 */ 1181 if (used_on_disk + est_inflight >= quota) { 1182 if (est_inflight > 0 || used_on_disk < quota || 1183 (retval == ENOSPC && used_on_disk < quota + deferred)) 1184 retval = ERESTART; 1185 dprintf_dd(dd, "failing: used=%lluK inflight = %lluK " 1186 "quota=%lluK tr=%lluK err=%d\n", 1187 used_on_disk>>10, est_inflight>>10, 1188 quota>>10, asize>>10, retval); 1189 mutex_exit(&dd->dd_lock); 1190 return (SET_ERROR(retval)); 1191 } 1192 1193 /* We need to up our estimated delta before dropping dd_lock */ 1194 dd->dd_tempreserved[txgidx] += asize; 1195 1196 parent_rsrv = parent_delta(dd, used_on_disk + est_inflight, 1197 asize - ref_rsrv); 1198 mutex_exit(&dd->dd_lock); 1199 1200 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP); 1201 tr->tr_ds = dd; 1202 tr->tr_size = asize; 1203 list_insert_tail(tr_list, tr); 1204 1205 /* see if it's OK with our parent */ 1206 if (dd->dd_parent && parent_rsrv) { 1207 boolean_t ismos = (dsl_dir_phys(dd)->dd_head_dataset_obj == 0); 1208 1209 return (dsl_dir_tempreserve_impl(dd->dd_parent, 1210 parent_rsrv, netfree, ismos, TRUE, tr_list, tx, FALSE)); 1211 } else { 1212 return (0); 1213 } 1214} 1215 1216/* 1217 * Reserve space in this dsl_dir, to be used in this tx's txg. 1218 * After the space has been dirtied (and dsl_dir_willuse_space() 1219 * has been called), the reservation should be canceled, using 1220 * dsl_dir_tempreserve_clear(). 1221 */ 1222int 1223dsl_dir_tempreserve_space(dsl_dir_t *dd, uint64_t lsize, uint64_t asize, 1224 uint64_t fsize, uint64_t usize, void **tr_cookiep, dmu_tx_t *tx) 1225{ 1226 int err; 1227 list_t *tr_list; 1228 1229 if (asize == 0) { 1230 *tr_cookiep = NULL; 1231 return (0); 1232 } 1233 1234 tr_list = kmem_alloc(sizeof (list_t), KM_SLEEP); 1235 list_create(tr_list, sizeof (struct tempreserve), 1236 offsetof(struct tempreserve, tr_node)); 1237 ASSERT3S(asize, >, 0); 1238 ASSERT3S(fsize, >=, 0); 1239 1240 err = arc_tempreserve_space(lsize, tx->tx_txg); 1241 if (err == 0) { 1242 struct tempreserve *tr; 1243 1244 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP); 1245 tr->tr_size = lsize; 1246 list_insert_tail(tr_list, tr); 1247 } else { 1248 if (err == EAGAIN) { 1249 /* 1250 * If arc_memory_throttle() detected that pageout 1251 * is running and we are low on memory, we delay new 1252 * non-pageout transactions to give pageout an 1253 * advantage. 1254 * 1255 * It is unfortunate to be delaying while the caller's 1256 * locks are held. 1257 */ 1258 txg_delay(dd->dd_pool, tx->tx_txg, 1259 MSEC2NSEC(10), MSEC2NSEC(10)); 1260 err = SET_ERROR(ERESTART); 1261 } 1262 } 1263 1264 if (err == 0) { 1265 err = dsl_dir_tempreserve_impl(dd, asize, fsize >= asize, 1266 FALSE, asize > usize, tr_list, tx, TRUE); 1267 } 1268 1269 if (err != 0) 1270 dsl_dir_tempreserve_clear(tr_list, tx); 1271 else 1272 *tr_cookiep = tr_list; 1273 1274 return (err); 1275} 1276 1277/* 1278 * Clear a temporary reservation that we previously made with 1279 * dsl_dir_tempreserve_space(). 1280 */ 1281void 1282dsl_dir_tempreserve_clear(void *tr_cookie, dmu_tx_t *tx) 1283{ 1284 int txgidx = tx->tx_txg & TXG_MASK; 1285 list_t *tr_list = tr_cookie; 1286 struct tempreserve *tr; 1287 1288 ASSERT3U(tx->tx_txg, !=, 0); 1289 1290 if (tr_cookie == NULL) 1291 return; 1292 1293 while ((tr = list_head(tr_list)) != NULL) { 1294 if (tr->tr_ds) { 1295 mutex_enter(&tr->tr_ds->dd_lock); 1296 ASSERT3U(tr->tr_ds->dd_tempreserved[txgidx], >=, 1297 tr->tr_size); 1298 tr->tr_ds->dd_tempreserved[txgidx] -= tr->tr_size; 1299 mutex_exit(&tr->tr_ds->dd_lock); 1300 } else { 1301 arc_tempreserve_clear(tr->tr_size); 1302 } 1303 list_remove(tr_list, tr); 1304 kmem_free(tr, sizeof (struct tempreserve)); 1305 } 1306 1307 kmem_free(tr_list, sizeof (list_t)); 1308} 1309 1310/* 1311 * This should be called from open context when we think we're going to write 1312 * or free space, for example when dirtying data. Be conservative; it's okay 1313 * to write less space or free more, but we don't want to write more or free 1314 * less than the amount specified. 1315 */ 1316void 1317dsl_dir_willuse_space(dsl_dir_t *dd, int64_t space, dmu_tx_t *tx) 1318{ 1319 int64_t parent_space; 1320 uint64_t est_used; 1321 1322 mutex_enter(&dd->dd_lock); 1323 if (space > 0) 1324 dd->dd_space_towrite[tx->tx_txg & TXG_MASK] += space; 1325 1326 est_used = dsl_dir_space_towrite(dd) + dsl_dir_phys(dd)->dd_used_bytes; 1327 parent_space = parent_delta(dd, est_used, space); 1328 mutex_exit(&dd->dd_lock); 1329 1330 /* Make sure that we clean up dd_space_to* */ 1331 dsl_dir_dirty(dd, tx); 1332 1333 /* XXX this is potentially expensive and unnecessary... */ 1334 if (parent_space && dd->dd_parent) 1335 dsl_dir_willuse_space(dd->dd_parent, parent_space, tx); 1336} 1337 1338/* call from syncing context when we actually write/free space for this dd */ 1339void 1340dsl_dir_diduse_space(dsl_dir_t *dd, dd_used_t type, 1341 int64_t used, int64_t compressed, int64_t uncompressed, dmu_tx_t *tx) 1342{ 1343 int64_t accounted_delta; 1344 1345 /* 1346 * dsl_dataset_set_refreservation_sync_impl() calls this with 1347 * dd_lock held, so that it can atomically update 1348 * ds->ds_reserved and the dsl_dir accounting, so that 1349 * dsl_dataset_check_quota() can see dataset and dir accounting 1350 * consistently. 1351 */ 1352 boolean_t needlock = !MUTEX_HELD(&dd->dd_lock); 1353 1354 ASSERT(dmu_tx_is_syncing(tx)); 1355 ASSERT(type < DD_USED_NUM); 1356 1357 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1358 1359 if (needlock) 1360 mutex_enter(&dd->dd_lock); 1361 accounted_delta = 1362 parent_delta(dd, dsl_dir_phys(dd)->dd_used_bytes, used); 1363 ASSERT(used >= 0 || dsl_dir_phys(dd)->dd_used_bytes >= -used); 1364 ASSERT(compressed >= 0 || 1365 dsl_dir_phys(dd)->dd_compressed_bytes >= -compressed); 1366 ASSERT(uncompressed >= 0 || 1367 dsl_dir_phys(dd)->dd_uncompressed_bytes >= -uncompressed); 1368 dsl_dir_phys(dd)->dd_used_bytes += used; 1369 dsl_dir_phys(dd)->dd_uncompressed_bytes += uncompressed; 1370 dsl_dir_phys(dd)->dd_compressed_bytes += compressed; 1371 1372 if (dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN) { 1373 ASSERT(used > 0 || 1374 dsl_dir_phys(dd)->dd_used_breakdown[type] >= -used); 1375 dsl_dir_phys(dd)->dd_used_breakdown[type] += used; 1376#ifdef DEBUG 1377 dd_used_t t; 1378 uint64_t u = 0; 1379 for (t = 0; t < DD_USED_NUM; t++) 1380 u += dsl_dir_phys(dd)->dd_used_breakdown[t]; 1381 ASSERT3U(u, ==, dsl_dir_phys(dd)->dd_used_bytes); 1382#endif 1383 } 1384 if (needlock) 1385 mutex_exit(&dd->dd_lock); 1386 1387 if (dd->dd_parent != NULL) { 1388 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD, 1389 accounted_delta, compressed, uncompressed, tx); 1390 dsl_dir_transfer_space(dd->dd_parent, 1391 used - accounted_delta, 1392 DD_USED_CHILD_RSRV, DD_USED_CHILD, tx); 1393 } 1394} 1395 1396void 1397dsl_dir_transfer_space(dsl_dir_t *dd, int64_t delta, 1398 dd_used_t oldtype, dd_used_t newtype, dmu_tx_t *tx) 1399{ 1400 ASSERT(dmu_tx_is_syncing(tx)); 1401 ASSERT(oldtype < DD_USED_NUM); 1402 ASSERT(newtype < DD_USED_NUM); 1403 1404 if (delta == 0 || 1405 !(dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN)) 1406 return; 1407 1408 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1409 mutex_enter(&dd->dd_lock); 1410 ASSERT(delta > 0 ? 1411 dsl_dir_phys(dd)->dd_used_breakdown[oldtype] >= delta : 1412 dsl_dir_phys(dd)->dd_used_breakdown[newtype] >= -delta); 1413 ASSERT(dsl_dir_phys(dd)->dd_used_bytes >= ABS(delta)); 1414 dsl_dir_phys(dd)->dd_used_breakdown[oldtype] -= delta; 1415 dsl_dir_phys(dd)->dd_used_breakdown[newtype] += delta; 1416 mutex_exit(&dd->dd_lock); 1417} 1418 1419typedef struct dsl_dir_set_qr_arg { 1420 const char *ddsqra_name; 1421 zprop_source_t ddsqra_source; 1422 uint64_t ddsqra_value; 1423} dsl_dir_set_qr_arg_t; 1424 1425static int 1426dsl_dir_set_quota_check(void *arg, dmu_tx_t *tx) 1427{ 1428 dsl_dir_set_qr_arg_t *ddsqra = arg; 1429 dsl_pool_t *dp = dmu_tx_pool(tx); 1430 dsl_dataset_t *ds; 1431 int error; 1432 uint64_t towrite, newval; 1433 1434 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds); 1435 if (error != 0) 1436 return (error); 1437 1438 error = dsl_prop_predict(ds->ds_dir, "quota", 1439 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval); 1440 if (error != 0) { 1441 dsl_dataset_rele(ds, FTAG); 1442 return (error); 1443 } 1444 1445 if (newval == 0) { 1446 dsl_dataset_rele(ds, FTAG); 1447 return (0); 1448 } 1449 1450 mutex_enter(&ds->ds_dir->dd_lock); 1451 /* 1452 * If we are doing the preliminary check in open context, and 1453 * there are pending changes, then don't fail it, since the 1454 * pending changes could under-estimate the amount of space to be 1455 * freed up. 1456 */ 1457 towrite = dsl_dir_space_towrite(ds->ds_dir); 1458 if ((dmu_tx_is_syncing(tx) || towrite == 0) && 1459 (newval < dsl_dir_phys(ds->ds_dir)->dd_reserved || 1460 newval < dsl_dir_phys(ds->ds_dir)->dd_used_bytes + towrite)) { 1461 error = SET_ERROR(ENOSPC); 1462 } 1463 mutex_exit(&ds->ds_dir->dd_lock); 1464 dsl_dataset_rele(ds, FTAG); 1465 return (error); 1466} 1467 1468static void 1469dsl_dir_set_quota_sync(void *arg, dmu_tx_t *tx) 1470{ 1471 dsl_dir_set_qr_arg_t *ddsqra = arg; 1472 dsl_pool_t *dp = dmu_tx_pool(tx); 1473 dsl_dataset_t *ds; 1474 uint64_t newval; 1475 1476 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds)); 1477 1478 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) { 1479 dsl_prop_set_sync_impl(ds, zfs_prop_to_name(ZFS_PROP_QUOTA), 1480 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1, 1481 &ddsqra->ddsqra_value, tx); 1482 1483 VERIFY0(dsl_prop_get_int_ds(ds, 1484 zfs_prop_to_name(ZFS_PROP_QUOTA), &newval)); 1485 } else { 1486 newval = ddsqra->ddsqra_value; 1487 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld", 1488 zfs_prop_to_name(ZFS_PROP_QUOTA), (longlong_t)newval); 1489 } 1490 1491 dmu_buf_will_dirty(ds->ds_dir->dd_dbuf, tx); 1492 mutex_enter(&ds->ds_dir->dd_lock); 1493 dsl_dir_phys(ds->ds_dir)->dd_quota = newval; 1494 mutex_exit(&ds->ds_dir->dd_lock); 1495 dsl_dataset_rele(ds, FTAG); 1496} 1497 1498int 1499dsl_dir_set_quota(const char *ddname, zprop_source_t source, uint64_t quota) 1500{ 1501 dsl_dir_set_qr_arg_t ddsqra; 1502 1503 ddsqra.ddsqra_name = ddname; 1504 ddsqra.ddsqra_source = source; 1505 ddsqra.ddsqra_value = quota; 1506 1507 return (dsl_sync_task(ddname, dsl_dir_set_quota_check, 1508 dsl_dir_set_quota_sync, &ddsqra, 0, ZFS_SPACE_CHECK_NONE)); 1509} 1510 1511int 1512dsl_dir_set_reservation_check(void *arg, dmu_tx_t *tx) 1513{ 1514 dsl_dir_set_qr_arg_t *ddsqra = arg; 1515 dsl_pool_t *dp = dmu_tx_pool(tx); 1516 dsl_dataset_t *ds; 1517 dsl_dir_t *dd; 1518 uint64_t newval, used, avail; 1519 int error; 1520 1521 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds); 1522 if (error != 0) 1523 return (error); 1524 dd = ds->ds_dir; 1525 1526 /* 1527 * If we are doing the preliminary check in open context, the 1528 * space estimates may be inaccurate. 1529 */ 1530 if (!dmu_tx_is_syncing(tx)) { 1531 dsl_dataset_rele(ds, FTAG); 1532 return (0); 1533 } 1534 1535 error = dsl_prop_predict(ds->ds_dir, 1536 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1537 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval); 1538 if (error != 0) { 1539 dsl_dataset_rele(ds, FTAG); 1540 return (error); 1541 } 1542 1543 mutex_enter(&dd->dd_lock); 1544 used = dsl_dir_phys(dd)->dd_used_bytes; 1545 mutex_exit(&dd->dd_lock); 1546 1547 if (dd->dd_parent) { 1548 avail = dsl_dir_space_available(dd->dd_parent, 1549 NULL, 0, FALSE); 1550 } else { 1551 avail = dsl_pool_adjustedsize(dd->dd_pool, B_FALSE) - used; 1552 } 1553 1554 if (MAX(used, newval) > MAX(used, dsl_dir_phys(dd)->dd_reserved)) { 1555 uint64_t delta = MAX(used, newval) - 1556 MAX(used, dsl_dir_phys(dd)->dd_reserved); 1557 1558 if (delta > avail || 1559 (dsl_dir_phys(dd)->dd_quota > 0 && 1560 newval > dsl_dir_phys(dd)->dd_quota)) 1561 error = SET_ERROR(ENOSPC); 1562 } 1563 1564 dsl_dataset_rele(ds, FTAG); 1565 return (error); 1566} 1567 1568void 1569dsl_dir_set_reservation_sync_impl(dsl_dir_t *dd, uint64_t value, dmu_tx_t *tx) 1570{ 1571 uint64_t used; 1572 int64_t delta; 1573 1574 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1575 1576 mutex_enter(&dd->dd_lock); 1577 used = dsl_dir_phys(dd)->dd_used_bytes; 1578 delta = MAX(used, value) - MAX(used, dsl_dir_phys(dd)->dd_reserved); 1579 dsl_dir_phys(dd)->dd_reserved = value; 1580 1581 if (dd->dd_parent != NULL) { 1582 /* Roll up this additional usage into our ancestors */ 1583 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV, 1584 delta, 0, 0, tx); 1585 } 1586 mutex_exit(&dd->dd_lock); 1587} 1588 1589static void 1590dsl_dir_set_reservation_sync(void *arg, dmu_tx_t *tx) 1591{ 1592 dsl_dir_set_qr_arg_t *ddsqra = arg; 1593 dsl_pool_t *dp = dmu_tx_pool(tx); 1594 dsl_dataset_t *ds; 1595 uint64_t newval; 1596 1597 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds)); 1598 1599 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) { 1600 dsl_prop_set_sync_impl(ds, 1601 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1602 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1, 1603 &ddsqra->ddsqra_value, tx); 1604 1605 VERIFY0(dsl_prop_get_int_ds(ds, 1606 zfs_prop_to_name(ZFS_PROP_RESERVATION), &newval)); 1607 } else { 1608 newval = ddsqra->ddsqra_value; 1609 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld", 1610 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1611 (longlong_t)newval); 1612 } 1613 1614 dsl_dir_set_reservation_sync_impl(ds->ds_dir, newval, tx); 1615 dsl_dataset_rele(ds, FTAG); 1616} 1617 1618int 1619dsl_dir_set_reservation(const char *ddname, zprop_source_t source, 1620 uint64_t reservation) 1621{ 1622 dsl_dir_set_qr_arg_t ddsqra; 1623 1624 ddsqra.ddsqra_name = ddname; 1625 ddsqra.ddsqra_source = source; 1626 ddsqra.ddsqra_value = reservation; 1627 1628 return (dsl_sync_task(ddname, dsl_dir_set_reservation_check, 1629 dsl_dir_set_reservation_sync, &ddsqra, 0, ZFS_SPACE_CHECK_NONE)); 1630} 1631 1632static dsl_dir_t * 1633closest_common_ancestor(dsl_dir_t *ds1, dsl_dir_t *ds2) 1634{ 1635 for (; ds1; ds1 = ds1->dd_parent) { 1636 dsl_dir_t *dd; 1637 for (dd = ds2; dd; dd = dd->dd_parent) { 1638 if (ds1 == dd) 1639 return (dd); 1640 } 1641 } 1642 return (NULL); 1643} 1644 1645/* 1646 * If delta is applied to dd, how much of that delta would be applied to 1647 * ancestor? Syncing context only. 1648 */ 1649static int64_t 1650would_change(dsl_dir_t *dd, int64_t delta, dsl_dir_t *ancestor) 1651{ 1652 if (dd == ancestor) 1653 return (delta); 1654 1655 mutex_enter(&dd->dd_lock); 1656 delta = parent_delta(dd, dsl_dir_phys(dd)->dd_used_bytes, delta); 1657 mutex_exit(&dd->dd_lock); 1658 return (would_change(dd->dd_parent, delta, ancestor)); 1659} 1660 1661typedef struct dsl_dir_rename_arg { 1662 const char *ddra_oldname; 1663 const char *ddra_newname; 1664 cred_t *ddra_cred; 1665} dsl_dir_rename_arg_t; 1666 1667/* ARGSUSED */ 1668static int 1669dsl_valid_rename(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg) 1670{ 1671 int *deltap = arg; 1672 char namebuf[MAXNAMELEN]; 1673 1674 dsl_dataset_name(ds, namebuf); 1675 1676 if (strlen(namebuf) + *deltap >= MAXNAMELEN) 1677 return (SET_ERROR(ENAMETOOLONG)); 1678 return (0); 1679} 1680 1681static int 1682dsl_dir_rename_check(void *arg, dmu_tx_t *tx) 1683{ 1684 dsl_dir_rename_arg_t *ddra = arg; 1685 dsl_pool_t *dp = dmu_tx_pool(tx); 1686 dsl_dir_t *dd, *newparent; 1687 const char *mynewname; 1688 int error; 1689 int delta = strlen(ddra->ddra_newname) - strlen(ddra->ddra_oldname); 1690 1691 /* target dir should exist */ 1692 error = dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL); 1693 if (error != 0) 1694 return (error); 1695 1696 /* new parent should exist */ 1697 error = dsl_dir_hold(dp, ddra->ddra_newname, FTAG, 1698 &newparent, &mynewname); 1699 if (error != 0) { 1700 dsl_dir_rele(dd, FTAG); 1701 return (error); 1702 } 1703 1704 /* can't rename to different pool */ 1705 if (dd->dd_pool != newparent->dd_pool) { 1706 dsl_dir_rele(newparent, FTAG); 1707 dsl_dir_rele(dd, FTAG); 1708 return (SET_ERROR(ENXIO)); 1709 } 1710 1711 /* new name should not already exist */ 1712 if (mynewname == NULL) { 1713 dsl_dir_rele(newparent, FTAG); 1714 dsl_dir_rele(dd, FTAG); 1715 return (SET_ERROR(EEXIST)); 1716 } 1717 1718 /* if the name length is growing, validate child name lengths */ 1719 if (delta > 0) { 1720 error = dmu_objset_find_dp(dp, dd->dd_object, dsl_valid_rename, 1721 &delta, DS_FIND_CHILDREN | DS_FIND_SNAPSHOTS); 1722 if (error != 0) { 1723 dsl_dir_rele(newparent, FTAG); 1724 dsl_dir_rele(dd, FTAG); 1725 return (error); 1726 } 1727 } 1728 1729 if (dmu_tx_is_syncing(tx)) { 1730 if (spa_feature_is_active(dp->dp_spa, 1731 SPA_FEATURE_FS_SS_LIMIT)) { 1732 /* 1733 * Although this is the check function and we don't 1734 * normally make on-disk changes in check functions, 1735 * we need to do that here. 1736 * 1737 * Ensure this portion of the tree's counts have been 1738 * initialized in case the new parent has limits set. 1739 */ 1740 dsl_dir_init_fs_ss_count(dd, tx); 1741 } 1742 } 1743 1744 if (newparent != dd->dd_parent) { 1745 /* is there enough space? */ 1746 uint64_t myspace = 1747 MAX(dsl_dir_phys(dd)->dd_used_bytes, 1748 dsl_dir_phys(dd)->dd_reserved); 1749 objset_t *os = dd->dd_pool->dp_meta_objset; 1750 uint64_t fs_cnt = 0; 1751 uint64_t ss_cnt = 0; 1752 1753 if (dsl_dir_is_zapified(dd)) { 1754 int err; 1755 1756 err = zap_lookup(os, dd->dd_object, 1757 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1, 1758 &fs_cnt); 1759 if (err != ENOENT && err != 0) { 1760 dsl_dir_rele(newparent, FTAG); 1761 dsl_dir_rele(dd, FTAG); 1762 return (err); 1763 } 1764 1765 /* 1766 * have to add 1 for the filesystem itself that we're 1767 * moving 1768 */ 1769 fs_cnt++; 1770 1771 err = zap_lookup(os, dd->dd_object, 1772 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1, 1773 &ss_cnt); 1774 if (err != ENOENT && err != 0) { 1775 dsl_dir_rele(newparent, FTAG); 1776 dsl_dir_rele(dd, FTAG); 1777 return (err); 1778 } 1779 } 1780 1781 /* no rename into our descendant */ 1782 if (closest_common_ancestor(dd, newparent) == dd) { 1783 dsl_dir_rele(newparent, FTAG); 1784 dsl_dir_rele(dd, FTAG); 1785 return (SET_ERROR(EINVAL)); 1786 } 1787 1788 error = dsl_dir_transfer_possible(dd->dd_parent, 1789 newparent, fs_cnt, ss_cnt, myspace, ddra->ddra_cred); 1790 if (error != 0) { 1791 dsl_dir_rele(newparent, FTAG); 1792 dsl_dir_rele(dd, FTAG); 1793 return (error); 1794 } 1795 } 1796 1797 dsl_dir_rele(newparent, FTAG); 1798 dsl_dir_rele(dd, FTAG); 1799 return (0); 1800} 1801 1802static void 1803dsl_dir_rename_sync(void *arg, dmu_tx_t *tx) 1804{ 1805 dsl_dir_rename_arg_t *ddra = arg; 1806 dsl_pool_t *dp = dmu_tx_pool(tx); 1807 dsl_dir_t *dd, *newparent; 1808 const char *mynewname; 1809 int error; 1810 objset_t *mos = dp->dp_meta_objset; 1811 1812 VERIFY0(dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL)); 1813 VERIFY0(dsl_dir_hold(dp, ddra->ddra_newname, FTAG, &newparent, 1814 &mynewname)); 1815 1816 /* Log this before we change the name. */ 1817 spa_history_log_internal_dd(dd, "rename", tx, 1818 "-> %s", ddra->ddra_newname); 1819 1820 if (newparent != dd->dd_parent) { 1821 objset_t *os = dd->dd_pool->dp_meta_objset; 1822 uint64_t fs_cnt = 0; 1823 uint64_t ss_cnt = 0; 1824 1825 /* 1826 * We already made sure the dd counts were initialized in the 1827 * check function. 1828 */ 1829 if (spa_feature_is_active(dp->dp_spa, 1830 SPA_FEATURE_FS_SS_LIMIT)) { 1831 VERIFY0(zap_lookup(os, dd->dd_object, 1832 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1, 1833 &fs_cnt)); 1834 /* add 1 for the filesystem itself that we're moving */ 1835 fs_cnt++; 1836 1837 VERIFY0(zap_lookup(os, dd->dd_object, 1838 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1, 1839 &ss_cnt)); 1840 } 1841 1842 dsl_fs_ss_count_adjust(dd->dd_parent, -fs_cnt, 1843 DD_FIELD_FILESYSTEM_COUNT, tx); 1844 dsl_fs_ss_count_adjust(newparent, fs_cnt, 1845 DD_FIELD_FILESYSTEM_COUNT, tx); 1846 1847 dsl_fs_ss_count_adjust(dd->dd_parent, -ss_cnt, 1848 DD_FIELD_SNAPSHOT_COUNT, tx); 1849 dsl_fs_ss_count_adjust(newparent, ss_cnt, 1850 DD_FIELD_SNAPSHOT_COUNT, tx); 1851 1852 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD, 1853 -dsl_dir_phys(dd)->dd_used_bytes, 1854 -dsl_dir_phys(dd)->dd_compressed_bytes, 1855 -dsl_dir_phys(dd)->dd_uncompressed_bytes, tx); 1856 dsl_dir_diduse_space(newparent, DD_USED_CHILD, 1857 dsl_dir_phys(dd)->dd_used_bytes, 1858 dsl_dir_phys(dd)->dd_compressed_bytes, 1859 dsl_dir_phys(dd)->dd_uncompressed_bytes, tx); 1860 1861 if (dsl_dir_phys(dd)->dd_reserved > 1862 dsl_dir_phys(dd)->dd_used_bytes) { 1863 uint64_t unused_rsrv = dsl_dir_phys(dd)->dd_reserved - 1864 dsl_dir_phys(dd)->dd_used_bytes; 1865 1866 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV, 1867 -unused_rsrv, 0, 0, tx); 1868 dsl_dir_diduse_space(newparent, DD_USED_CHILD_RSRV, 1869 unused_rsrv, 0, 0, tx); 1870 } 1871 } 1872 1873 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1874 1875 /* remove from old parent zapobj */ 1876 error = zap_remove(mos, 1877 dsl_dir_phys(dd->dd_parent)->dd_child_dir_zapobj, 1878 dd->dd_myname, tx); 1879 ASSERT0(error); 1880 1881 (void) strcpy(dd->dd_myname, mynewname); 1882 dsl_dir_rele(dd->dd_parent, dd); 1883 dsl_dir_phys(dd)->dd_parent_obj = newparent->dd_object; 1884 VERIFY0(dsl_dir_hold_obj(dp, 1885 newparent->dd_object, NULL, dd, &dd->dd_parent)); 1886 1887 /* add to new parent zapobj */ 1888 VERIFY0(zap_add(mos, dsl_dir_phys(newparent)->dd_child_dir_zapobj, 1889 dd->dd_myname, 8, 1, &dd->dd_object, tx)); 1890 1891#ifdef __FreeBSD__ 1892#ifdef _KERNEL 1893 zfsvfs_update_fromname(ddra->ddra_oldname, ddra->ddra_newname); 1894 zvol_rename_minors(ddra->ddra_oldname, ddra->ddra_newname); 1895#endif 1896#endif 1897 1898 dsl_prop_notify_all(dd); 1899 1900 dsl_dir_rele(newparent, FTAG); 1901 dsl_dir_rele(dd, FTAG); 1902} 1903 1904int 1905dsl_dir_rename(const char *oldname, const char *newname) 1906{ 1907 dsl_dir_rename_arg_t ddra; 1908 1909 ddra.ddra_oldname = oldname; 1910 ddra.ddra_newname = newname; 1911 ddra.ddra_cred = CRED(); 1912 1913 return (dsl_sync_task(oldname, 1914 dsl_dir_rename_check, dsl_dir_rename_sync, &ddra, 1915 3, ZFS_SPACE_CHECK_RESERVED)); 1916} 1917 1918int 1919dsl_dir_transfer_possible(dsl_dir_t *sdd, dsl_dir_t *tdd, 1920 uint64_t fs_cnt, uint64_t ss_cnt, uint64_t space, cred_t *cr) 1921{ 1922 dsl_dir_t *ancestor; 1923 int64_t adelta; 1924 uint64_t avail; 1925 int err; 1926 1927 ancestor = closest_common_ancestor(sdd, tdd); 1928 adelta = would_change(sdd, -space, ancestor); 1929 avail = dsl_dir_space_available(tdd, ancestor, adelta, FALSE); 1930 if (avail < space) 1931 return (SET_ERROR(ENOSPC)); 1932 1933 err = dsl_fs_ss_limit_check(tdd, fs_cnt, ZFS_PROP_FILESYSTEM_LIMIT, 1934 ancestor, cr); 1935 if (err != 0) 1936 return (err); 1937 err = dsl_fs_ss_limit_check(tdd, ss_cnt, ZFS_PROP_SNAPSHOT_LIMIT, 1938 ancestor, cr); 1939 if (err != 0) 1940 return (err); 1941 1942 return (0); 1943} 1944 1945timestruc_t 1946dsl_dir_snap_cmtime(dsl_dir_t *dd) 1947{ 1948 timestruc_t t; 1949 1950 mutex_enter(&dd->dd_lock); 1951 t = dd->dd_snap_cmtime; 1952 mutex_exit(&dd->dd_lock); 1953 1954 return (t); 1955} 1956 1957void 1958dsl_dir_snap_cmtime_update(dsl_dir_t *dd) 1959{ 1960 timestruc_t t; 1961 1962 gethrestime(&t); 1963 mutex_enter(&dd->dd_lock); 1964 dd->dd_snap_cmtime = t; 1965 mutex_exit(&dd->dd_lock); 1966} 1967 1968void 1969dsl_dir_zapify(dsl_dir_t *dd, dmu_tx_t *tx) 1970{ 1971 objset_t *mos = dd->dd_pool->dp_meta_objset; 1972 dmu_object_zapify(mos, dd->dd_object, DMU_OT_DSL_DIR, tx); 1973} 1974 1975boolean_t 1976dsl_dir_is_zapified(dsl_dir_t *dd) 1977{ 1978 dmu_object_info_t doi; 1979 1980 dmu_object_info_from_db(dd->dd_dbuf, &doi); 1981 return (doi.doi_type == DMU_OTN_ZAP_METADATA); 1982} 1983