dsl_dir.c revision 307122
1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21/* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>. 24 * All rights reserved. 25 * Copyright (c) 2012, 2014 by Delphix. All rights reserved. 26 * Copyright (c) 2014 Joyent, Inc. All rights reserved. 27 * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved. 28 * Copyright 2015 Nexenta Systems, Inc. All rights reserved. 29 */ 30 31#include <sys/dmu.h> 32#include <sys/dmu_objset.h> 33#include <sys/dmu_tx.h> 34#include <sys/dsl_dataset.h> 35#include <sys/dsl_dir.h> 36#include <sys/dsl_prop.h> 37#include <sys/dsl_synctask.h> 38#include <sys/dsl_deleg.h> 39#include <sys/dmu_impl.h> 40#include <sys/spa.h> 41#include <sys/metaslab.h> 42#include <sys/zap.h> 43#include <sys/zio.h> 44#include <sys/arc.h> 45#include <sys/sunddi.h> 46#include <sys/zvol.h> 47#ifdef _KERNEL 48#include <sys/zfs_vfsops.h> 49#endif 50#include <sys/zfeature.h> 51#include <sys/policy.h> 52#include <sys/zfs_znode.h> 53#include "zfs_namecheck.h" 54#include "zfs_prop.h" 55 56/* 57 * Filesystem and Snapshot Limits 58 * ------------------------------ 59 * 60 * These limits are used to restrict the number of filesystems and/or snapshots 61 * that can be created at a given level in the tree or below. A typical 62 * use-case is with a delegated dataset where the administrator wants to ensure 63 * that a user within the zone is not creating too many additional filesystems 64 * or snapshots, even though they're not exceeding their space quota. 65 * 66 * The filesystem and snapshot counts are stored as extensible properties. This 67 * capability is controlled by a feature flag and must be enabled to be used. 68 * Once enabled, the feature is not active until the first limit is set. At 69 * that point, future operations to create/destroy filesystems or snapshots 70 * will validate and update the counts. 71 * 72 * Because the count properties will not exist before the feature is active, 73 * the counts are updated when a limit is first set on an uninitialized 74 * dsl_dir node in the tree (The filesystem/snapshot count on a node includes 75 * all of the nested filesystems/snapshots. Thus, a new leaf node has a 76 * filesystem count of 0 and a snapshot count of 0. Non-existent filesystem and 77 * snapshot count properties on a node indicate uninitialized counts on that 78 * node.) When first setting a limit on an uninitialized node, the code starts 79 * at the filesystem with the new limit and descends into all sub-filesystems 80 * to add the count properties. 81 * 82 * In practice this is lightweight since a limit is typically set when the 83 * filesystem is created and thus has no children. Once valid, changing the 84 * limit value won't require a re-traversal since the counts are already valid. 85 * When recursively fixing the counts, if a node with a limit is encountered 86 * during the descent, the counts are known to be valid and there is no need to 87 * descend into that filesystem's children. The counts on filesystems above the 88 * one with the new limit will still be uninitialized, unless a limit is 89 * eventually set on one of those filesystems. The counts are always recursively 90 * updated when a limit is set on a dataset, unless there is already a limit. 91 * When a new limit value is set on a filesystem with an existing limit, it is 92 * possible for the new limit to be less than the current count at that level 93 * since a user who can change the limit is also allowed to exceed the limit. 94 * 95 * Once the feature is active, then whenever a filesystem or snapshot is 96 * created, the code recurses up the tree, validating the new count against the 97 * limit at each initialized level. In practice, most levels will not have a 98 * limit set. If there is a limit at any initialized level up the tree, the 99 * check must pass or the creation will fail. Likewise, when a filesystem or 100 * snapshot is destroyed, the counts are recursively adjusted all the way up 101 * the initizized nodes in the tree. Renaming a filesystem into different point 102 * in the tree will first validate, then update the counts on each branch up to 103 * the common ancestor. A receive will also validate the counts and then update 104 * them. 105 * 106 * An exception to the above behavior is that the limit is not enforced if the 107 * user has permission to modify the limit. This is primarily so that 108 * recursive snapshots in the global zone always work. We want to prevent a 109 * denial-of-service in which a lower level delegated dataset could max out its 110 * limit and thus block recursive snapshots from being taken in the global zone. 111 * Because of this, it is possible for the snapshot count to be over the limit 112 * and snapshots taken in the global zone could cause a lower level dataset to 113 * hit or exceed its limit. The administrator taking the global zone recursive 114 * snapshot should be aware of this side-effect and behave accordingly. 115 * For consistency, the filesystem limit is also not enforced if the user can 116 * modify the limit. 117 * 118 * The filesystem and snapshot limits are validated by dsl_fs_ss_limit_check() 119 * and updated by dsl_fs_ss_count_adjust(). A new limit value is setup in 120 * dsl_dir_activate_fs_ss_limit() and the counts are adjusted, if necessary, by 121 * dsl_dir_init_fs_ss_count(). 122 * 123 * There is a special case when we receive a filesystem that already exists. In 124 * this case a temporary clone name of %X is created (see dmu_recv_begin). We 125 * never update the filesystem counts for temporary clones. 126 * 127 * Likewise, we do not update the snapshot counts for temporary snapshots, 128 * such as those created by zfs diff. 129 */ 130 131extern inline dsl_dir_phys_t *dsl_dir_phys(dsl_dir_t *dd); 132 133static uint64_t dsl_dir_space_towrite(dsl_dir_t *dd); 134 135static void 136dsl_dir_evict(void *dbu) 137{ 138 dsl_dir_t *dd = dbu; 139 dsl_pool_t *dp = dd->dd_pool; 140 int t; 141 142 dd->dd_dbuf = NULL; 143 144 for (t = 0; t < TXG_SIZE; t++) { 145 ASSERT(!txg_list_member(&dp->dp_dirty_dirs, dd, t)); 146 ASSERT(dd->dd_tempreserved[t] == 0); 147 ASSERT(dd->dd_space_towrite[t] == 0); 148 } 149 150 if (dd->dd_parent) 151 dsl_dir_async_rele(dd->dd_parent, dd); 152 153 spa_async_close(dd->dd_pool->dp_spa, dd); 154 155 dsl_prop_fini(dd); 156 mutex_destroy(&dd->dd_lock); 157 kmem_free(dd, sizeof (dsl_dir_t)); 158} 159 160int 161dsl_dir_hold_obj(dsl_pool_t *dp, uint64_t ddobj, 162 const char *tail, void *tag, dsl_dir_t **ddp) 163{ 164 dmu_buf_t *dbuf; 165 dsl_dir_t *dd; 166 int err; 167 168 ASSERT(dsl_pool_config_held(dp)); 169 170 err = dmu_bonus_hold(dp->dp_meta_objset, ddobj, tag, &dbuf); 171 if (err != 0) 172 return (err); 173 dd = dmu_buf_get_user(dbuf); 174#ifdef ZFS_DEBUG 175 { 176 dmu_object_info_t doi; 177 dmu_object_info_from_db(dbuf, &doi); 178 ASSERT3U(doi.doi_bonus_type, ==, DMU_OT_DSL_DIR); 179 ASSERT3U(doi.doi_bonus_size, >=, sizeof (dsl_dir_phys_t)); 180 } 181#endif 182 if (dd == NULL) { 183 dsl_dir_t *winner; 184 185 dd = kmem_zalloc(sizeof (dsl_dir_t), KM_SLEEP); 186 dd->dd_object = ddobj; 187 dd->dd_dbuf = dbuf; 188 dd->dd_pool = dp; 189 mutex_init(&dd->dd_lock, NULL, MUTEX_DEFAULT, NULL); 190 dsl_prop_init(dd); 191 192 dsl_dir_snap_cmtime_update(dd); 193 194 if (dsl_dir_phys(dd)->dd_parent_obj) { 195 err = dsl_dir_hold_obj(dp, 196 dsl_dir_phys(dd)->dd_parent_obj, NULL, dd, 197 &dd->dd_parent); 198 if (err != 0) 199 goto errout; 200 if (tail) { 201#ifdef ZFS_DEBUG 202 uint64_t foundobj; 203 204 err = zap_lookup(dp->dp_meta_objset, 205 dsl_dir_phys(dd->dd_parent)-> 206 dd_child_dir_zapobj, tail, 207 sizeof (foundobj), 1, &foundobj); 208 ASSERT(err || foundobj == ddobj); 209#endif 210 (void) strcpy(dd->dd_myname, tail); 211 } else { 212 err = zap_value_search(dp->dp_meta_objset, 213 dsl_dir_phys(dd->dd_parent)-> 214 dd_child_dir_zapobj, 215 ddobj, 0, dd->dd_myname); 216 } 217 if (err != 0) 218 goto errout; 219 } else { 220 (void) strcpy(dd->dd_myname, spa_name(dp->dp_spa)); 221 } 222 223 if (dsl_dir_is_clone(dd)) { 224 dmu_buf_t *origin_bonus; 225 dsl_dataset_phys_t *origin_phys; 226 227 /* 228 * We can't open the origin dataset, because 229 * that would require opening this dsl_dir. 230 * Just look at its phys directly instead. 231 */ 232 err = dmu_bonus_hold(dp->dp_meta_objset, 233 dsl_dir_phys(dd)->dd_origin_obj, FTAG, 234 &origin_bonus); 235 if (err != 0) 236 goto errout; 237 origin_phys = origin_bonus->db_data; 238 dd->dd_origin_txg = 239 origin_phys->ds_creation_txg; 240 dmu_buf_rele(origin_bonus, FTAG); 241 } 242 243 dmu_buf_init_user(&dd->dd_dbu, dsl_dir_evict, &dd->dd_dbuf); 244 winner = dmu_buf_set_user_ie(dbuf, &dd->dd_dbu); 245 if (winner != NULL) { 246 if (dd->dd_parent) 247 dsl_dir_rele(dd->dd_parent, dd); 248 dsl_prop_fini(dd); 249 mutex_destroy(&dd->dd_lock); 250 kmem_free(dd, sizeof (dsl_dir_t)); 251 dd = winner; 252 } else { 253 spa_open_ref(dp->dp_spa, dd); 254 } 255 } 256 257 /* 258 * The dsl_dir_t has both open-to-close and instantiate-to-evict 259 * holds on the spa. We need the open-to-close holds because 260 * otherwise the spa_refcnt wouldn't change when we open a 261 * dir which the spa also has open, so we could incorrectly 262 * think it was OK to unload/export/destroy the pool. We need 263 * the instantiate-to-evict hold because the dsl_dir_t has a 264 * pointer to the dd_pool, which has a pointer to the spa_t. 265 */ 266 spa_open_ref(dp->dp_spa, tag); 267 ASSERT3P(dd->dd_pool, ==, dp); 268 ASSERT3U(dd->dd_object, ==, ddobj); 269 ASSERT3P(dd->dd_dbuf, ==, dbuf); 270 *ddp = dd; 271 return (0); 272 273errout: 274 if (dd->dd_parent) 275 dsl_dir_rele(dd->dd_parent, dd); 276 dsl_prop_fini(dd); 277 mutex_destroy(&dd->dd_lock); 278 kmem_free(dd, sizeof (dsl_dir_t)); 279 dmu_buf_rele(dbuf, tag); 280 return (err); 281} 282 283void 284dsl_dir_rele(dsl_dir_t *dd, void *tag) 285{ 286 dprintf_dd(dd, "%s\n", ""); 287 spa_close(dd->dd_pool->dp_spa, tag); 288 dmu_buf_rele(dd->dd_dbuf, tag); 289} 290 291/* 292 * Remove a reference to the given dsl dir that is being asynchronously 293 * released. Async releases occur from a taskq performing eviction of 294 * dsl datasets and dirs. This process is identical to a normal release 295 * with the exception of using the async API for releasing the reference on 296 * the spa. 297 */ 298void 299dsl_dir_async_rele(dsl_dir_t *dd, void *tag) 300{ 301 dprintf_dd(dd, "%s\n", ""); 302 spa_async_close(dd->dd_pool->dp_spa, tag); 303 dmu_buf_rele(dd->dd_dbuf, tag); 304} 305 306/* buf must be at least ZFS_MAX_DATASET_NAME_LEN bytes */ 307void 308dsl_dir_name(dsl_dir_t *dd, char *buf) 309{ 310 if (dd->dd_parent) { 311 dsl_dir_name(dd->dd_parent, buf); 312 VERIFY3U(strlcat(buf, "/", ZFS_MAX_DATASET_NAME_LEN), <, 313 ZFS_MAX_DATASET_NAME_LEN); 314 } else { 315 buf[0] = '\0'; 316 } 317 if (!MUTEX_HELD(&dd->dd_lock)) { 318 /* 319 * recursive mutex so that we can use 320 * dprintf_dd() with dd_lock held 321 */ 322 mutex_enter(&dd->dd_lock); 323 VERIFY3U(strlcat(buf, dd->dd_myname, ZFS_MAX_DATASET_NAME_LEN), 324 <, ZFS_MAX_DATASET_NAME_LEN); 325 mutex_exit(&dd->dd_lock); 326 } else { 327 VERIFY3U(strlcat(buf, dd->dd_myname, ZFS_MAX_DATASET_NAME_LEN), 328 <, ZFS_MAX_DATASET_NAME_LEN); 329 } 330} 331 332/* Calculate name length, avoiding all the strcat calls of dsl_dir_name */ 333int 334dsl_dir_namelen(dsl_dir_t *dd) 335{ 336 int result = 0; 337 338 if (dd->dd_parent) { 339 /* parent's name + 1 for the "/" */ 340 result = dsl_dir_namelen(dd->dd_parent) + 1; 341 } 342 343 if (!MUTEX_HELD(&dd->dd_lock)) { 344 /* see dsl_dir_name */ 345 mutex_enter(&dd->dd_lock); 346 result += strlen(dd->dd_myname); 347 mutex_exit(&dd->dd_lock); 348 } else { 349 result += strlen(dd->dd_myname); 350 } 351 352 return (result); 353} 354 355static int 356getcomponent(const char *path, char *component, const char **nextp) 357{ 358 char *p; 359 360 if ((path == NULL) || (path[0] == '\0')) 361 return (SET_ERROR(ENOENT)); 362 /* This would be a good place to reserve some namespace... */ 363 p = strpbrk(path, "/@"); 364 if (p && (p[1] == '/' || p[1] == '@')) { 365 /* two separators in a row */ 366 return (SET_ERROR(EINVAL)); 367 } 368 if (p == NULL || p == path) { 369 /* 370 * if the first thing is an @ or /, it had better be an 371 * @ and it had better not have any more ats or slashes, 372 * and it had better have something after the @. 373 */ 374 if (p != NULL && 375 (p[0] != '@' || strpbrk(path+1, "/@") || p[1] == '\0')) 376 return (SET_ERROR(EINVAL)); 377 if (strlen(path) >= ZFS_MAX_DATASET_NAME_LEN) 378 return (SET_ERROR(ENAMETOOLONG)); 379 (void) strcpy(component, path); 380 p = NULL; 381 } else if (p[0] == '/') { 382 if (p - path >= ZFS_MAX_DATASET_NAME_LEN) 383 return (SET_ERROR(ENAMETOOLONG)); 384 (void) strncpy(component, path, p - path); 385 component[p - path] = '\0'; 386 p++; 387 } else if (p[0] == '@') { 388 /* 389 * if the next separator is an @, there better not be 390 * any more slashes. 391 */ 392 if (strchr(path, '/')) 393 return (SET_ERROR(EINVAL)); 394 if (p - path >= ZFS_MAX_DATASET_NAME_LEN) 395 return (SET_ERROR(ENAMETOOLONG)); 396 (void) strncpy(component, path, p - path); 397 component[p - path] = '\0'; 398 } else { 399 panic("invalid p=%p", (void *)p); 400 } 401 *nextp = p; 402 return (0); 403} 404 405/* 406 * Return the dsl_dir_t, and possibly the last component which couldn't 407 * be found in *tail. The name must be in the specified dsl_pool_t. This 408 * thread must hold the dp_config_rwlock for the pool. Returns NULL if the 409 * path is bogus, or if tail==NULL and we couldn't parse the whole name. 410 * (*tail)[0] == '@' means that the last component is a snapshot. 411 */ 412int 413dsl_dir_hold(dsl_pool_t *dp, const char *name, void *tag, 414 dsl_dir_t **ddp, const char **tailp) 415{ 416 char buf[ZFS_MAX_DATASET_NAME_LEN]; 417 const char *spaname, *next, *nextnext = NULL; 418 int err; 419 dsl_dir_t *dd; 420 uint64_t ddobj; 421 422 err = getcomponent(name, buf, &next); 423 if (err != 0) 424 return (err); 425 426 /* Make sure the name is in the specified pool. */ 427 spaname = spa_name(dp->dp_spa); 428 if (strcmp(buf, spaname) != 0) 429 return (SET_ERROR(EXDEV)); 430 431 ASSERT(dsl_pool_config_held(dp)); 432 433 err = dsl_dir_hold_obj(dp, dp->dp_root_dir_obj, NULL, tag, &dd); 434 if (err != 0) { 435 return (err); 436 } 437 438 while (next != NULL) { 439 dsl_dir_t *child_dd; 440 err = getcomponent(next, buf, &nextnext); 441 if (err != 0) 442 break; 443 ASSERT(next[0] != '\0'); 444 if (next[0] == '@') 445 break; 446 dprintf("looking up %s in obj%lld\n", 447 buf, dsl_dir_phys(dd)->dd_child_dir_zapobj); 448 449 err = zap_lookup(dp->dp_meta_objset, 450 dsl_dir_phys(dd)->dd_child_dir_zapobj, 451 buf, sizeof (ddobj), 1, &ddobj); 452 if (err != 0) { 453 if (err == ENOENT) 454 err = 0; 455 break; 456 } 457 458 err = dsl_dir_hold_obj(dp, ddobj, buf, tag, &child_dd); 459 if (err != 0) 460 break; 461 dsl_dir_rele(dd, tag); 462 dd = child_dd; 463 next = nextnext; 464 } 465 466 if (err != 0) { 467 dsl_dir_rele(dd, tag); 468 return (err); 469 } 470 471 /* 472 * It's an error if there's more than one component left, or 473 * tailp==NULL and there's any component left. 474 */ 475 if (next != NULL && 476 (tailp == NULL || (nextnext && nextnext[0] != '\0'))) { 477 /* bad path name */ 478 dsl_dir_rele(dd, tag); 479 dprintf("next=%p (%s) tail=%p\n", next, next?next:"", tailp); 480 err = SET_ERROR(ENOENT); 481 } 482 if (tailp != NULL) 483 *tailp = next; 484 *ddp = dd; 485 return (err); 486} 487 488/* 489 * If the counts are already initialized for this filesystem and its 490 * descendants then do nothing, otherwise initialize the counts. 491 * 492 * The counts on this filesystem, and those below, may be uninitialized due to 493 * either the use of a pre-existing pool which did not support the 494 * filesystem/snapshot limit feature, or one in which the feature had not yet 495 * been enabled. 496 * 497 * Recursively descend the filesystem tree and update the filesystem/snapshot 498 * counts on each filesystem below, then update the cumulative count on the 499 * current filesystem. If the filesystem already has a count set on it, 500 * then we know that its counts, and the counts on the filesystems below it, 501 * are already correct, so we don't have to update this filesystem. 502 */ 503static void 504dsl_dir_init_fs_ss_count(dsl_dir_t *dd, dmu_tx_t *tx) 505{ 506 uint64_t my_fs_cnt = 0; 507 uint64_t my_ss_cnt = 0; 508 dsl_pool_t *dp = dd->dd_pool; 509 objset_t *os = dp->dp_meta_objset; 510 zap_cursor_t *zc; 511 zap_attribute_t *za; 512 dsl_dataset_t *ds; 513 514 ASSERT(spa_feature_is_active(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT)); 515 ASSERT(dsl_pool_config_held(dp)); 516 ASSERT(dmu_tx_is_syncing(tx)); 517 518 dsl_dir_zapify(dd, tx); 519 520 /* 521 * If the filesystem count has already been initialized then we 522 * don't need to recurse down any further. 523 */ 524 if (zap_contains(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT) == 0) 525 return; 526 527 zc = kmem_alloc(sizeof (zap_cursor_t), KM_SLEEP); 528 za = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP); 529 530 /* Iterate my child dirs */ 531 for (zap_cursor_init(zc, os, dsl_dir_phys(dd)->dd_child_dir_zapobj); 532 zap_cursor_retrieve(zc, za) == 0; zap_cursor_advance(zc)) { 533 dsl_dir_t *chld_dd; 534 uint64_t count; 535 536 VERIFY0(dsl_dir_hold_obj(dp, za->za_first_integer, NULL, FTAG, 537 &chld_dd)); 538 539 /* 540 * Ignore hidden ($FREE, $MOS & $ORIGIN) objsets and 541 * temporary datasets. 542 */ 543 if (chld_dd->dd_myname[0] == '$' || 544 chld_dd->dd_myname[0] == '%') { 545 dsl_dir_rele(chld_dd, FTAG); 546 continue; 547 } 548 549 my_fs_cnt++; /* count this child */ 550 551 dsl_dir_init_fs_ss_count(chld_dd, tx); 552 553 VERIFY0(zap_lookup(os, chld_dd->dd_object, 554 DD_FIELD_FILESYSTEM_COUNT, sizeof (count), 1, &count)); 555 my_fs_cnt += count; 556 VERIFY0(zap_lookup(os, chld_dd->dd_object, 557 DD_FIELD_SNAPSHOT_COUNT, sizeof (count), 1, &count)); 558 my_ss_cnt += count; 559 560 dsl_dir_rele(chld_dd, FTAG); 561 } 562 zap_cursor_fini(zc); 563 /* Count my snapshots (we counted children's snapshots above) */ 564 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool, 565 dsl_dir_phys(dd)->dd_head_dataset_obj, FTAG, &ds)); 566 567 for (zap_cursor_init(zc, os, dsl_dataset_phys(ds)->ds_snapnames_zapobj); 568 zap_cursor_retrieve(zc, za) == 0; 569 zap_cursor_advance(zc)) { 570 /* Don't count temporary snapshots */ 571 if (za->za_name[0] != '%') 572 my_ss_cnt++; 573 } 574 zap_cursor_fini(zc); 575 576 dsl_dataset_rele(ds, FTAG); 577 578 kmem_free(zc, sizeof (zap_cursor_t)); 579 kmem_free(za, sizeof (zap_attribute_t)); 580 581 /* we're in a sync task, update counts */ 582 dmu_buf_will_dirty(dd->dd_dbuf, tx); 583 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT, 584 sizeof (my_fs_cnt), 1, &my_fs_cnt, tx)); 585 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT, 586 sizeof (my_ss_cnt), 1, &my_ss_cnt, tx)); 587} 588 589static int 590dsl_dir_actv_fs_ss_limit_check(void *arg, dmu_tx_t *tx) 591{ 592 char *ddname = (char *)arg; 593 dsl_pool_t *dp = dmu_tx_pool(tx); 594 dsl_dataset_t *ds; 595 dsl_dir_t *dd; 596 int error; 597 598 error = dsl_dataset_hold(dp, ddname, FTAG, &ds); 599 if (error != 0) 600 return (error); 601 602 if (!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT)) { 603 dsl_dataset_rele(ds, FTAG); 604 return (SET_ERROR(ENOTSUP)); 605 } 606 607 dd = ds->ds_dir; 608 if (spa_feature_is_active(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT) && 609 dsl_dir_is_zapified(dd) && 610 zap_contains(dp->dp_meta_objset, dd->dd_object, 611 DD_FIELD_FILESYSTEM_COUNT) == 0) { 612 dsl_dataset_rele(ds, FTAG); 613 return (SET_ERROR(EALREADY)); 614 } 615 616 dsl_dataset_rele(ds, FTAG); 617 return (0); 618} 619 620static void 621dsl_dir_actv_fs_ss_limit_sync(void *arg, dmu_tx_t *tx) 622{ 623 char *ddname = (char *)arg; 624 dsl_pool_t *dp = dmu_tx_pool(tx); 625 dsl_dataset_t *ds; 626 spa_t *spa; 627 628 VERIFY0(dsl_dataset_hold(dp, ddname, FTAG, &ds)); 629 630 spa = dsl_dataset_get_spa(ds); 631 632 if (!spa_feature_is_active(spa, SPA_FEATURE_FS_SS_LIMIT)) { 633 /* 634 * Since the feature was not active and we're now setting a 635 * limit, increment the feature-active counter so that the 636 * feature becomes active for the first time. 637 * 638 * We are already in a sync task so we can update the MOS. 639 */ 640 spa_feature_incr(spa, SPA_FEATURE_FS_SS_LIMIT, tx); 641 } 642 643 /* 644 * Since we are now setting a non-UINT64_MAX limit on the filesystem, 645 * we need to ensure the counts are correct. Descend down the tree from 646 * this point and update all of the counts to be accurate. 647 */ 648 dsl_dir_init_fs_ss_count(ds->ds_dir, tx); 649 650 dsl_dataset_rele(ds, FTAG); 651} 652 653/* 654 * Make sure the feature is enabled and activate it if necessary. 655 * Since we're setting a limit, ensure the on-disk counts are valid. 656 * This is only called by the ioctl path when setting a limit value. 657 * 658 * We do not need to validate the new limit, since users who can change the 659 * limit are also allowed to exceed the limit. 660 */ 661int 662dsl_dir_activate_fs_ss_limit(const char *ddname) 663{ 664 int error; 665 666 error = dsl_sync_task(ddname, dsl_dir_actv_fs_ss_limit_check, 667 dsl_dir_actv_fs_ss_limit_sync, (void *)ddname, 0, 668 ZFS_SPACE_CHECK_RESERVED); 669 670 if (error == EALREADY) 671 error = 0; 672 673 return (error); 674} 675 676/* 677 * Used to determine if the filesystem_limit or snapshot_limit should be 678 * enforced. We allow the limit to be exceeded if the user has permission to 679 * write the property value. We pass in the creds that we got in the open 680 * context since we will always be the GZ root in syncing context. We also have 681 * to handle the case where we are allowed to change the limit on the current 682 * dataset, but there may be another limit in the tree above. 683 * 684 * We can never modify these two properties within a non-global zone. In 685 * addition, the other checks are modeled on zfs_secpolicy_write_perms. We 686 * can't use that function since we are already holding the dp_config_rwlock. 687 * In addition, we already have the dd and dealing with snapshots is simplified 688 * in this code. 689 */ 690 691typedef enum { 692 ENFORCE_ALWAYS, 693 ENFORCE_NEVER, 694 ENFORCE_ABOVE 695} enforce_res_t; 696 697static enforce_res_t 698dsl_enforce_ds_ss_limits(dsl_dir_t *dd, zfs_prop_t prop, cred_t *cr) 699{ 700 enforce_res_t enforce = ENFORCE_ALWAYS; 701 uint64_t obj; 702 dsl_dataset_t *ds; 703 uint64_t zoned; 704 705 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT || 706 prop == ZFS_PROP_SNAPSHOT_LIMIT); 707 708#ifdef _KERNEL 709#ifdef __FreeBSD__ 710 if (jailed(cr)) 711#else 712 if (crgetzoneid(cr) != GLOBAL_ZONEID) 713#endif 714 return (ENFORCE_ALWAYS); 715 716 if (secpolicy_zfs(cr) == 0) 717 return (ENFORCE_NEVER); 718#endif 719 720 if ((obj = dsl_dir_phys(dd)->dd_head_dataset_obj) == 0) 721 return (ENFORCE_ALWAYS); 722 723 ASSERT(dsl_pool_config_held(dd->dd_pool)); 724 725 if (dsl_dataset_hold_obj(dd->dd_pool, obj, FTAG, &ds) != 0) 726 return (ENFORCE_ALWAYS); 727 728 if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL) || zoned) { 729 /* Only root can access zoned fs's from the GZ */ 730 enforce = ENFORCE_ALWAYS; 731 } else { 732 if (dsl_deleg_access_impl(ds, zfs_prop_to_name(prop), cr) == 0) 733 enforce = ENFORCE_ABOVE; 734 } 735 736 dsl_dataset_rele(ds, FTAG); 737 return (enforce); 738} 739 740/* 741 * Check if adding additional child filesystem(s) would exceed any filesystem 742 * limits or adding additional snapshot(s) would exceed any snapshot limits. 743 * The prop argument indicates which limit to check. 744 * 745 * Note that all filesystem limits up to the root (or the highest 746 * initialized) filesystem or the given ancestor must be satisfied. 747 */ 748int 749dsl_fs_ss_limit_check(dsl_dir_t *dd, uint64_t delta, zfs_prop_t prop, 750 dsl_dir_t *ancestor, cred_t *cr) 751{ 752 objset_t *os = dd->dd_pool->dp_meta_objset; 753 uint64_t limit, count; 754 char *count_prop; 755 enforce_res_t enforce; 756 int err = 0; 757 758 ASSERT(dsl_pool_config_held(dd->dd_pool)); 759 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT || 760 prop == ZFS_PROP_SNAPSHOT_LIMIT); 761 762 /* 763 * If we're allowed to change the limit, don't enforce the limit 764 * e.g. this can happen if a snapshot is taken by an administrative 765 * user in the global zone (i.e. a recursive snapshot by root). 766 * However, we must handle the case of delegated permissions where we 767 * are allowed to change the limit on the current dataset, but there 768 * is another limit in the tree above. 769 */ 770 enforce = dsl_enforce_ds_ss_limits(dd, prop, cr); 771 if (enforce == ENFORCE_NEVER) 772 return (0); 773 774 /* 775 * e.g. if renaming a dataset with no snapshots, count adjustment 776 * is 0. 777 */ 778 if (delta == 0) 779 return (0); 780 781 if (prop == ZFS_PROP_SNAPSHOT_LIMIT) { 782 /* 783 * We don't enforce the limit for temporary snapshots. This is 784 * indicated by a NULL cred_t argument. 785 */ 786 if (cr == NULL) 787 return (0); 788 789 count_prop = DD_FIELD_SNAPSHOT_COUNT; 790 } else { 791 count_prop = DD_FIELD_FILESYSTEM_COUNT; 792 } 793 794 /* 795 * If an ancestor has been provided, stop checking the limit once we 796 * hit that dir. We need this during rename so that we don't overcount 797 * the check once we recurse up to the common ancestor. 798 */ 799 if (ancestor == dd) 800 return (0); 801 802 /* 803 * If we hit an uninitialized node while recursing up the tree, we can 804 * stop since we know there is no limit here (or above). The counts are 805 * not valid on this node and we know we won't touch this node's counts. 806 */ 807 if (!dsl_dir_is_zapified(dd) || zap_lookup(os, dd->dd_object, 808 count_prop, sizeof (count), 1, &count) == ENOENT) 809 return (0); 810 811 err = dsl_prop_get_dd(dd, zfs_prop_to_name(prop), 8, 1, &limit, NULL, 812 B_FALSE); 813 if (err != 0) 814 return (err); 815 816 /* Is there a limit which we've hit? */ 817 if (enforce == ENFORCE_ALWAYS && (count + delta) > limit) 818 return (SET_ERROR(EDQUOT)); 819 820 if (dd->dd_parent != NULL) 821 err = dsl_fs_ss_limit_check(dd->dd_parent, delta, prop, 822 ancestor, cr); 823 824 return (err); 825} 826 827/* 828 * Adjust the filesystem or snapshot count for the specified dsl_dir_t and all 829 * parents. When a new filesystem/snapshot is created, increment the count on 830 * all parents, and when a filesystem/snapshot is destroyed, decrement the 831 * count. 832 */ 833void 834dsl_fs_ss_count_adjust(dsl_dir_t *dd, int64_t delta, const char *prop, 835 dmu_tx_t *tx) 836{ 837 int err; 838 objset_t *os = dd->dd_pool->dp_meta_objset; 839 uint64_t count; 840 841 ASSERT(dsl_pool_config_held(dd->dd_pool)); 842 ASSERT(dmu_tx_is_syncing(tx)); 843 ASSERT(strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0 || 844 strcmp(prop, DD_FIELD_SNAPSHOT_COUNT) == 0); 845 846 /* 847 * When we receive an incremental stream into a filesystem that already 848 * exists, a temporary clone is created. We don't count this temporary 849 * clone, whose name begins with a '%'. We also ignore hidden ($FREE, 850 * $MOS & $ORIGIN) objsets. 851 */ 852 if ((dd->dd_myname[0] == '%' || dd->dd_myname[0] == '$') && 853 strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0) 854 return; 855 856 /* 857 * e.g. if renaming a dataset with no snapshots, count adjustment is 0 858 */ 859 if (delta == 0) 860 return; 861 862 /* 863 * If we hit an uninitialized node while recursing up the tree, we can 864 * stop since we know the counts are not valid on this node and we 865 * know we shouldn't touch this node's counts. An uninitialized count 866 * on the node indicates that either the feature has not yet been 867 * activated or there are no limits on this part of the tree. 868 */ 869 if (!dsl_dir_is_zapified(dd) || (err = zap_lookup(os, dd->dd_object, 870 prop, sizeof (count), 1, &count)) == ENOENT) 871 return; 872 VERIFY0(err); 873 874 count += delta; 875 /* Use a signed verify to make sure we're not neg. */ 876 VERIFY3S(count, >=, 0); 877 878 VERIFY0(zap_update(os, dd->dd_object, prop, sizeof (count), 1, &count, 879 tx)); 880 881 /* Roll up this additional count into our ancestors */ 882 if (dd->dd_parent != NULL) 883 dsl_fs_ss_count_adjust(dd->dd_parent, delta, prop, tx); 884} 885 886uint64_t 887dsl_dir_create_sync(dsl_pool_t *dp, dsl_dir_t *pds, const char *name, 888 dmu_tx_t *tx) 889{ 890 objset_t *mos = dp->dp_meta_objset; 891 uint64_t ddobj; 892 dsl_dir_phys_t *ddphys; 893 dmu_buf_t *dbuf; 894 895 ddobj = dmu_object_alloc(mos, DMU_OT_DSL_DIR, 0, 896 DMU_OT_DSL_DIR, sizeof (dsl_dir_phys_t), tx); 897 if (pds) { 898 VERIFY(0 == zap_add(mos, dsl_dir_phys(pds)->dd_child_dir_zapobj, 899 name, sizeof (uint64_t), 1, &ddobj, tx)); 900 } else { 901 /* it's the root dir */ 902 VERIFY(0 == zap_add(mos, DMU_POOL_DIRECTORY_OBJECT, 903 DMU_POOL_ROOT_DATASET, sizeof (uint64_t), 1, &ddobj, tx)); 904 } 905 VERIFY(0 == dmu_bonus_hold(mos, ddobj, FTAG, &dbuf)); 906 dmu_buf_will_dirty(dbuf, tx); 907 ddphys = dbuf->db_data; 908 909 ddphys->dd_creation_time = gethrestime_sec(); 910 if (pds) { 911 ddphys->dd_parent_obj = pds->dd_object; 912 913 /* update the filesystem counts */ 914 dsl_fs_ss_count_adjust(pds, 1, DD_FIELD_FILESYSTEM_COUNT, tx); 915 } 916 ddphys->dd_props_zapobj = zap_create(mos, 917 DMU_OT_DSL_PROPS, DMU_OT_NONE, 0, tx); 918 ddphys->dd_child_dir_zapobj = zap_create(mos, 919 DMU_OT_DSL_DIR_CHILD_MAP, DMU_OT_NONE, 0, tx); 920 if (spa_version(dp->dp_spa) >= SPA_VERSION_USED_BREAKDOWN) 921 ddphys->dd_flags |= DD_FLAG_USED_BREAKDOWN; 922 dmu_buf_rele(dbuf, FTAG); 923 924 return (ddobj); 925} 926 927boolean_t 928dsl_dir_is_clone(dsl_dir_t *dd) 929{ 930 return (dsl_dir_phys(dd)->dd_origin_obj && 931 (dd->dd_pool->dp_origin_snap == NULL || 932 dsl_dir_phys(dd)->dd_origin_obj != 933 dd->dd_pool->dp_origin_snap->ds_object)); 934} 935 936void 937dsl_dir_stats(dsl_dir_t *dd, nvlist_t *nv) 938{ 939 mutex_enter(&dd->dd_lock); 940 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USED, 941 dsl_dir_phys(dd)->dd_used_bytes); 942 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_QUOTA, 943 dsl_dir_phys(dd)->dd_quota); 944 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_RESERVATION, 945 dsl_dir_phys(dd)->dd_reserved); 946 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_COMPRESSRATIO, 947 dsl_dir_phys(dd)->dd_compressed_bytes == 0 ? 100 : 948 (dsl_dir_phys(dd)->dd_uncompressed_bytes * 100 / 949 dsl_dir_phys(dd)->dd_compressed_bytes)); 950 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_LOGICALUSED, 951 dsl_dir_phys(dd)->dd_uncompressed_bytes); 952 if (dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN) { 953 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDSNAP, 954 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_SNAP]); 955 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDDS, 956 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_HEAD]); 957 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDREFRESERV, 958 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_REFRSRV]); 959 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDCHILD, 960 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_CHILD] + 961 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_CHILD_RSRV]); 962 } 963 mutex_exit(&dd->dd_lock); 964 965 if (dsl_dir_is_zapified(dd)) { 966 uint64_t count; 967 objset_t *os = dd->dd_pool->dp_meta_objset; 968 969 if (zap_lookup(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT, 970 sizeof (count), 1, &count) == 0) { 971 dsl_prop_nvlist_add_uint64(nv, 972 ZFS_PROP_FILESYSTEM_COUNT, count); 973 } 974 if (zap_lookup(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT, 975 sizeof (count), 1, &count) == 0) { 976 dsl_prop_nvlist_add_uint64(nv, 977 ZFS_PROP_SNAPSHOT_COUNT, count); 978 } 979 } 980 981 if (dsl_dir_is_clone(dd)) { 982 dsl_dataset_t *ds; 983 char buf[ZFS_MAX_DATASET_NAME_LEN]; 984 985 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool, 986 dsl_dir_phys(dd)->dd_origin_obj, FTAG, &ds)); 987 dsl_dataset_name(ds, buf); 988 dsl_dataset_rele(ds, FTAG); 989 dsl_prop_nvlist_add_string(nv, ZFS_PROP_ORIGIN, buf); 990 } 991} 992 993void 994dsl_dir_dirty(dsl_dir_t *dd, dmu_tx_t *tx) 995{ 996 dsl_pool_t *dp = dd->dd_pool; 997 998 ASSERT(dsl_dir_phys(dd)); 999 1000 if (txg_list_add(&dp->dp_dirty_dirs, dd, tx->tx_txg)) { 1001 /* up the hold count until we can be written out */ 1002 dmu_buf_add_ref(dd->dd_dbuf, dd); 1003 } 1004} 1005 1006static int64_t 1007parent_delta(dsl_dir_t *dd, uint64_t used, int64_t delta) 1008{ 1009 uint64_t old_accounted = MAX(used, dsl_dir_phys(dd)->dd_reserved); 1010 uint64_t new_accounted = 1011 MAX(used + delta, dsl_dir_phys(dd)->dd_reserved); 1012 return (new_accounted - old_accounted); 1013} 1014 1015void 1016dsl_dir_sync(dsl_dir_t *dd, dmu_tx_t *tx) 1017{ 1018 ASSERT(dmu_tx_is_syncing(tx)); 1019 1020 mutex_enter(&dd->dd_lock); 1021 ASSERT0(dd->dd_tempreserved[tx->tx_txg&TXG_MASK]); 1022 dprintf_dd(dd, "txg=%llu towrite=%lluK\n", tx->tx_txg, 1023 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] / 1024); 1024 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] = 0; 1025 mutex_exit(&dd->dd_lock); 1026 1027 /* release the hold from dsl_dir_dirty */ 1028 dmu_buf_rele(dd->dd_dbuf, dd); 1029} 1030 1031static uint64_t 1032dsl_dir_space_towrite(dsl_dir_t *dd) 1033{ 1034 uint64_t space = 0; 1035 int i; 1036 1037 ASSERT(MUTEX_HELD(&dd->dd_lock)); 1038 1039 for (i = 0; i < TXG_SIZE; i++) { 1040 space += dd->dd_space_towrite[i&TXG_MASK]; 1041 ASSERT3U(dd->dd_space_towrite[i&TXG_MASK], >=, 0); 1042 } 1043 return (space); 1044} 1045 1046/* 1047 * How much space would dd have available if ancestor had delta applied 1048 * to it? If ondiskonly is set, we're only interested in what's 1049 * on-disk, not estimated pending changes. 1050 */ 1051uint64_t 1052dsl_dir_space_available(dsl_dir_t *dd, 1053 dsl_dir_t *ancestor, int64_t delta, int ondiskonly) 1054{ 1055 uint64_t parentspace, myspace, quota, used; 1056 1057 /* 1058 * If there are no restrictions otherwise, assume we have 1059 * unlimited space available. 1060 */ 1061 quota = UINT64_MAX; 1062 parentspace = UINT64_MAX; 1063 1064 if (dd->dd_parent != NULL) { 1065 parentspace = dsl_dir_space_available(dd->dd_parent, 1066 ancestor, delta, ondiskonly); 1067 } 1068 1069 mutex_enter(&dd->dd_lock); 1070 if (dsl_dir_phys(dd)->dd_quota != 0) 1071 quota = dsl_dir_phys(dd)->dd_quota; 1072 used = dsl_dir_phys(dd)->dd_used_bytes; 1073 if (!ondiskonly) 1074 used += dsl_dir_space_towrite(dd); 1075 1076 if (dd->dd_parent == NULL) { 1077 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, FALSE); 1078 quota = MIN(quota, poolsize); 1079 } 1080 1081 if (dsl_dir_phys(dd)->dd_reserved > used && parentspace != UINT64_MAX) { 1082 /* 1083 * We have some space reserved, in addition to what our 1084 * parent gave us. 1085 */ 1086 parentspace += dsl_dir_phys(dd)->dd_reserved - used; 1087 } 1088 1089 if (dd == ancestor) { 1090 ASSERT(delta <= 0); 1091 ASSERT(used >= -delta); 1092 used += delta; 1093 if (parentspace != UINT64_MAX) 1094 parentspace -= delta; 1095 } 1096 1097 if (used > quota) { 1098 /* over quota */ 1099 myspace = 0; 1100 } else { 1101 /* 1102 * the lesser of the space provided by our parent and 1103 * the space left in our quota 1104 */ 1105 myspace = MIN(parentspace, quota - used); 1106 } 1107 1108 mutex_exit(&dd->dd_lock); 1109 1110 return (myspace); 1111} 1112 1113struct tempreserve { 1114 list_node_t tr_node; 1115 dsl_dir_t *tr_ds; 1116 uint64_t tr_size; 1117}; 1118 1119static int 1120dsl_dir_tempreserve_impl(dsl_dir_t *dd, uint64_t asize, boolean_t netfree, 1121 boolean_t ignorequota, boolean_t checkrefquota, list_t *tr_list, 1122 dmu_tx_t *tx, boolean_t first) 1123{ 1124 uint64_t txg = tx->tx_txg; 1125 uint64_t est_inflight, used_on_disk, quota, parent_rsrv; 1126 uint64_t deferred = 0; 1127 struct tempreserve *tr; 1128 int retval = EDQUOT; 1129 int txgidx = txg & TXG_MASK; 1130 int i; 1131 uint64_t ref_rsrv = 0; 1132 1133 ASSERT3U(txg, !=, 0); 1134 ASSERT3S(asize, >, 0); 1135 1136 mutex_enter(&dd->dd_lock); 1137 1138 /* 1139 * Check against the dsl_dir's quota. We don't add in the delta 1140 * when checking for over-quota because they get one free hit. 1141 */ 1142 est_inflight = dsl_dir_space_towrite(dd); 1143 for (i = 0; i < TXG_SIZE; i++) 1144 est_inflight += dd->dd_tempreserved[i]; 1145 used_on_disk = dsl_dir_phys(dd)->dd_used_bytes; 1146 1147 /* 1148 * On the first iteration, fetch the dataset's used-on-disk and 1149 * refreservation values. Also, if checkrefquota is set, test if 1150 * allocating this space would exceed the dataset's refquota. 1151 */ 1152 if (first && tx->tx_objset) { 1153 int error; 1154 dsl_dataset_t *ds = tx->tx_objset->os_dsl_dataset; 1155 1156 error = dsl_dataset_check_quota(ds, checkrefquota, 1157 asize, est_inflight, &used_on_disk, &ref_rsrv); 1158 if (error) { 1159 mutex_exit(&dd->dd_lock); 1160 return (error); 1161 } 1162 } 1163 1164 /* 1165 * If this transaction will result in a net free of space, 1166 * we want to let it through. 1167 */ 1168 if (ignorequota || netfree || dsl_dir_phys(dd)->dd_quota == 0) 1169 quota = UINT64_MAX; 1170 else 1171 quota = dsl_dir_phys(dd)->dd_quota; 1172 1173 /* 1174 * Adjust the quota against the actual pool size at the root 1175 * minus any outstanding deferred frees. 1176 * To ensure that it's possible to remove files from a full 1177 * pool without inducing transient overcommits, we throttle 1178 * netfree transactions against a quota that is slightly larger, 1179 * but still within the pool's allocation slop. In cases where 1180 * we're very close to full, this will allow a steady trickle of 1181 * removes to get through. 1182 */ 1183 if (dd->dd_parent == NULL) { 1184 spa_t *spa = dd->dd_pool->dp_spa; 1185 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, netfree); 1186 deferred = metaslab_class_get_deferred(spa_normal_class(spa)); 1187 if (poolsize - deferred < quota) { 1188 quota = poolsize - deferred; 1189 retval = ENOSPC; 1190 } 1191 } 1192 1193 /* 1194 * If they are requesting more space, and our current estimate 1195 * is over quota, they get to try again unless the actual 1196 * on-disk is over quota and there are no pending changes (which 1197 * may free up space for us). 1198 */ 1199 if (used_on_disk + est_inflight >= quota) { 1200 if (est_inflight > 0 || used_on_disk < quota || 1201 (retval == ENOSPC && used_on_disk < quota + deferred)) 1202 retval = ERESTART; 1203 dprintf_dd(dd, "failing: used=%lluK inflight = %lluK " 1204 "quota=%lluK tr=%lluK err=%d\n", 1205 used_on_disk>>10, est_inflight>>10, 1206 quota>>10, asize>>10, retval); 1207 mutex_exit(&dd->dd_lock); 1208 return (SET_ERROR(retval)); 1209 } 1210 1211 /* We need to up our estimated delta before dropping dd_lock */ 1212 dd->dd_tempreserved[txgidx] += asize; 1213 1214 parent_rsrv = parent_delta(dd, used_on_disk + est_inflight, 1215 asize - ref_rsrv); 1216 mutex_exit(&dd->dd_lock); 1217 1218 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP); 1219 tr->tr_ds = dd; 1220 tr->tr_size = asize; 1221 list_insert_tail(tr_list, tr); 1222 1223 /* see if it's OK with our parent */ 1224 if (dd->dd_parent && parent_rsrv) { 1225 boolean_t ismos = (dsl_dir_phys(dd)->dd_head_dataset_obj == 0); 1226 1227 return (dsl_dir_tempreserve_impl(dd->dd_parent, 1228 parent_rsrv, netfree, ismos, TRUE, tr_list, tx, FALSE)); 1229 } else { 1230 return (0); 1231 } 1232} 1233 1234/* 1235 * Reserve space in this dsl_dir, to be used in this tx's txg. 1236 * After the space has been dirtied (and dsl_dir_willuse_space() 1237 * has been called), the reservation should be canceled, using 1238 * dsl_dir_tempreserve_clear(). 1239 */ 1240int 1241dsl_dir_tempreserve_space(dsl_dir_t *dd, uint64_t lsize, uint64_t asize, 1242 uint64_t fsize, uint64_t usize, void **tr_cookiep, dmu_tx_t *tx) 1243{ 1244 int err; 1245 list_t *tr_list; 1246 1247 if (asize == 0) { 1248 *tr_cookiep = NULL; 1249 return (0); 1250 } 1251 1252 tr_list = kmem_alloc(sizeof (list_t), KM_SLEEP); 1253 list_create(tr_list, sizeof (struct tempreserve), 1254 offsetof(struct tempreserve, tr_node)); 1255 ASSERT3S(asize, >, 0); 1256 ASSERT3S(fsize, >=, 0); 1257 1258 err = arc_tempreserve_space(lsize, tx->tx_txg); 1259 if (err == 0) { 1260 struct tempreserve *tr; 1261 1262 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP); 1263 tr->tr_size = lsize; 1264 list_insert_tail(tr_list, tr); 1265 } else { 1266 if (err == EAGAIN) { 1267 /* 1268 * If arc_memory_throttle() detected that pageout 1269 * is running and we are low on memory, we delay new 1270 * non-pageout transactions to give pageout an 1271 * advantage. 1272 * 1273 * It is unfortunate to be delaying while the caller's 1274 * locks are held. 1275 */ 1276 txg_delay(dd->dd_pool, tx->tx_txg, 1277 MSEC2NSEC(10), MSEC2NSEC(10)); 1278 err = SET_ERROR(ERESTART); 1279 } 1280 } 1281 1282 if (err == 0) { 1283 err = dsl_dir_tempreserve_impl(dd, asize, fsize >= asize, 1284 FALSE, asize > usize, tr_list, tx, TRUE); 1285 } 1286 1287 if (err != 0) 1288 dsl_dir_tempreserve_clear(tr_list, tx); 1289 else 1290 *tr_cookiep = tr_list; 1291 1292 return (err); 1293} 1294 1295/* 1296 * Clear a temporary reservation that we previously made with 1297 * dsl_dir_tempreserve_space(). 1298 */ 1299void 1300dsl_dir_tempreserve_clear(void *tr_cookie, dmu_tx_t *tx) 1301{ 1302 int txgidx = tx->tx_txg & TXG_MASK; 1303 list_t *tr_list = tr_cookie; 1304 struct tempreserve *tr; 1305 1306 ASSERT3U(tx->tx_txg, !=, 0); 1307 1308 if (tr_cookie == NULL) 1309 return; 1310 1311 while ((tr = list_head(tr_list)) != NULL) { 1312 if (tr->tr_ds) { 1313 mutex_enter(&tr->tr_ds->dd_lock); 1314 ASSERT3U(tr->tr_ds->dd_tempreserved[txgidx], >=, 1315 tr->tr_size); 1316 tr->tr_ds->dd_tempreserved[txgidx] -= tr->tr_size; 1317 mutex_exit(&tr->tr_ds->dd_lock); 1318 } else { 1319 arc_tempreserve_clear(tr->tr_size); 1320 } 1321 list_remove(tr_list, tr); 1322 kmem_free(tr, sizeof (struct tempreserve)); 1323 } 1324 1325 kmem_free(tr_list, sizeof (list_t)); 1326} 1327 1328/* 1329 * This should be called from open context when we think we're going to write 1330 * or free space, for example when dirtying data. Be conservative; it's okay 1331 * to write less space or free more, but we don't want to write more or free 1332 * less than the amount specified. 1333 */ 1334void 1335dsl_dir_willuse_space(dsl_dir_t *dd, int64_t space, dmu_tx_t *tx) 1336{ 1337 int64_t parent_space; 1338 uint64_t est_used; 1339 1340 mutex_enter(&dd->dd_lock); 1341 if (space > 0) 1342 dd->dd_space_towrite[tx->tx_txg & TXG_MASK] += space; 1343 1344 est_used = dsl_dir_space_towrite(dd) + dsl_dir_phys(dd)->dd_used_bytes; 1345 parent_space = parent_delta(dd, est_used, space); 1346 mutex_exit(&dd->dd_lock); 1347 1348 /* Make sure that we clean up dd_space_to* */ 1349 dsl_dir_dirty(dd, tx); 1350 1351 /* XXX this is potentially expensive and unnecessary... */ 1352 if (parent_space && dd->dd_parent) 1353 dsl_dir_willuse_space(dd->dd_parent, parent_space, tx); 1354} 1355 1356/* call from syncing context when we actually write/free space for this dd */ 1357void 1358dsl_dir_diduse_space(dsl_dir_t *dd, dd_used_t type, 1359 int64_t used, int64_t compressed, int64_t uncompressed, dmu_tx_t *tx) 1360{ 1361 int64_t accounted_delta; 1362 1363 /* 1364 * dsl_dataset_set_refreservation_sync_impl() calls this with 1365 * dd_lock held, so that it can atomically update 1366 * ds->ds_reserved and the dsl_dir accounting, so that 1367 * dsl_dataset_check_quota() can see dataset and dir accounting 1368 * consistently. 1369 */ 1370 boolean_t needlock = !MUTEX_HELD(&dd->dd_lock); 1371 1372 ASSERT(dmu_tx_is_syncing(tx)); 1373 ASSERT(type < DD_USED_NUM); 1374 1375 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1376 1377 if (needlock) 1378 mutex_enter(&dd->dd_lock); 1379 accounted_delta = 1380 parent_delta(dd, dsl_dir_phys(dd)->dd_used_bytes, used); 1381 ASSERT(used >= 0 || dsl_dir_phys(dd)->dd_used_bytes >= -used); 1382 ASSERT(compressed >= 0 || 1383 dsl_dir_phys(dd)->dd_compressed_bytes >= -compressed); 1384 ASSERT(uncompressed >= 0 || 1385 dsl_dir_phys(dd)->dd_uncompressed_bytes >= -uncompressed); 1386 dsl_dir_phys(dd)->dd_used_bytes += used; 1387 dsl_dir_phys(dd)->dd_uncompressed_bytes += uncompressed; 1388 dsl_dir_phys(dd)->dd_compressed_bytes += compressed; 1389 1390 if (dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN) { 1391 ASSERT(used > 0 || 1392 dsl_dir_phys(dd)->dd_used_breakdown[type] >= -used); 1393 dsl_dir_phys(dd)->dd_used_breakdown[type] += used; 1394#ifdef DEBUG 1395 dd_used_t t; 1396 uint64_t u = 0; 1397 for (t = 0; t < DD_USED_NUM; t++) 1398 u += dsl_dir_phys(dd)->dd_used_breakdown[t]; 1399 ASSERT3U(u, ==, dsl_dir_phys(dd)->dd_used_bytes); 1400#endif 1401 } 1402 if (needlock) 1403 mutex_exit(&dd->dd_lock); 1404 1405 if (dd->dd_parent != NULL) { 1406 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD, 1407 accounted_delta, compressed, uncompressed, tx); 1408 dsl_dir_transfer_space(dd->dd_parent, 1409 used - accounted_delta, 1410 DD_USED_CHILD_RSRV, DD_USED_CHILD, NULL); 1411 } 1412} 1413 1414void 1415dsl_dir_transfer_space(dsl_dir_t *dd, int64_t delta, 1416 dd_used_t oldtype, dd_used_t newtype, dmu_tx_t *tx) 1417{ 1418 ASSERT(tx == NULL || dmu_tx_is_syncing(tx)); 1419 ASSERT(oldtype < DD_USED_NUM); 1420 ASSERT(newtype < DD_USED_NUM); 1421 1422 if (delta == 0 || 1423 !(dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN)) 1424 return; 1425 1426 if (tx != NULL) 1427 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1428 mutex_enter(&dd->dd_lock); 1429 ASSERT(delta > 0 ? 1430 dsl_dir_phys(dd)->dd_used_breakdown[oldtype] >= delta : 1431 dsl_dir_phys(dd)->dd_used_breakdown[newtype] >= -delta); 1432 ASSERT(dsl_dir_phys(dd)->dd_used_bytes >= ABS(delta)); 1433 dsl_dir_phys(dd)->dd_used_breakdown[oldtype] -= delta; 1434 dsl_dir_phys(dd)->dd_used_breakdown[newtype] += delta; 1435 mutex_exit(&dd->dd_lock); 1436} 1437 1438typedef struct dsl_dir_set_qr_arg { 1439 const char *ddsqra_name; 1440 zprop_source_t ddsqra_source; 1441 uint64_t ddsqra_value; 1442} dsl_dir_set_qr_arg_t; 1443 1444static int 1445dsl_dir_set_quota_check(void *arg, dmu_tx_t *tx) 1446{ 1447 dsl_dir_set_qr_arg_t *ddsqra = arg; 1448 dsl_pool_t *dp = dmu_tx_pool(tx); 1449 dsl_dataset_t *ds; 1450 int error; 1451 uint64_t towrite, newval; 1452 1453 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds); 1454 if (error != 0) 1455 return (error); 1456 1457 error = dsl_prop_predict(ds->ds_dir, "quota", 1458 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval); 1459 if (error != 0) { 1460 dsl_dataset_rele(ds, FTAG); 1461 return (error); 1462 } 1463 1464 if (newval == 0) { 1465 dsl_dataset_rele(ds, FTAG); 1466 return (0); 1467 } 1468 1469 mutex_enter(&ds->ds_dir->dd_lock); 1470 /* 1471 * If we are doing the preliminary check in open context, and 1472 * there are pending changes, then don't fail it, since the 1473 * pending changes could under-estimate the amount of space to be 1474 * freed up. 1475 */ 1476 towrite = dsl_dir_space_towrite(ds->ds_dir); 1477 if ((dmu_tx_is_syncing(tx) || towrite == 0) && 1478 (newval < dsl_dir_phys(ds->ds_dir)->dd_reserved || 1479 newval < dsl_dir_phys(ds->ds_dir)->dd_used_bytes + towrite)) { 1480 error = SET_ERROR(ENOSPC); 1481 } 1482 mutex_exit(&ds->ds_dir->dd_lock); 1483 dsl_dataset_rele(ds, FTAG); 1484 return (error); 1485} 1486 1487static void 1488dsl_dir_set_quota_sync(void *arg, dmu_tx_t *tx) 1489{ 1490 dsl_dir_set_qr_arg_t *ddsqra = arg; 1491 dsl_pool_t *dp = dmu_tx_pool(tx); 1492 dsl_dataset_t *ds; 1493 uint64_t newval; 1494 1495 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds)); 1496 1497 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) { 1498 dsl_prop_set_sync_impl(ds, zfs_prop_to_name(ZFS_PROP_QUOTA), 1499 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1, 1500 &ddsqra->ddsqra_value, tx); 1501 1502 VERIFY0(dsl_prop_get_int_ds(ds, 1503 zfs_prop_to_name(ZFS_PROP_QUOTA), &newval)); 1504 } else { 1505 newval = ddsqra->ddsqra_value; 1506 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld", 1507 zfs_prop_to_name(ZFS_PROP_QUOTA), (longlong_t)newval); 1508 } 1509 1510 dmu_buf_will_dirty(ds->ds_dir->dd_dbuf, tx); 1511 mutex_enter(&ds->ds_dir->dd_lock); 1512 dsl_dir_phys(ds->ds_dir)->dd_quota = newval; 1513 mutex_exit(&ds->ds_dir->dd_lock); 1514 dsl_dataset_rele(ds, FTAG); 1515} 1516 1517int 1518dsl_dir_set_quota(const char *ddname, zprop_source_t source, uint64_t quota) 1519{ 1520 dsl_dir_set_qr_arg_t ddsqra; 1521 1522 ddsqra.ddsqra_name = ddname; 1523 ddsqra.ddsqra_source = source; 1524 ddsqra.ddsqra_value = quota; 1525 1526 return (dsl_sync_task(ddname, dsl_dir_set_quota_check, 1527 dsl_dir_set_quota_sync, &ddsqra, 0, ZFS_SPACE_CHECK_NONE)); 1528} 1529 1530int 1531dsl_dir_set_reservation_check(void *arg, dmu_tx_t *tx) 1532{ 1533 dsl_dir_set_qr_arg_t *ddsqra = arg; 1534 dsl_pool_t *dp = dmu_tx_pool(tx); 1535 dsl_dataset_t *ds; 1536 dsl_dir_t *dd; 1537 uint64_t newval, used, avail; 1538 int error; 1539 1540 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds); 1541 if (error != 0) 1542 return (error); 1543 dd = ds->ds_dir; 1544 1545 /* 1546 * If we are doing the preliminary check in open context, the 1547 * space estimates may be inaccurate. 1548 */ 1549 if (!dmu_tx_is_syncing(tx)) { 1550 dsl_dataset_rele(ds, FTAG); 1551 return (0); 1552 } 1553 1554 error = dsl_prop_predict(ds->ds_dir, 1555 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1556 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval); 1557 if (error != 0) { 1558 dsl_dataset_rele(ds, FTAG); 1559 return (error); 1560 } 1561 1562 mutex_enter(&dd->dd_lock); 1563 used = dsl_dir_phys(dd)->dd_used_bytes; 1564 mutex_exit(&dd->dd_lock); 1565 1566 if (dd->dd_parent) { 1567 avail = dsl_dir_space_available(dd->dd_parent, 1568 NULL, 0, FALSE); 1569 } else { 1570 avail = dsl_pool_adjustedsize(dd->dd_pool, B_FALSE) - used; 1571 } 1572 1573 if (MAX(used, newval) > MAX(used, dsl_dir_phys(dd)->dd_reserved)) { 1574 uint64_t delta = MAX(used, newval) - 1575 MAX(used, dsl_dir_phys(dd)->dd_reserved); 1576 1577 if (delta > avail || 1578 (dsl_dir_phys(dd)->dd_quota > 0 && 1579 newval > dsl_dir_phys(dd)->dd_quota)) 1580 error = SET_ERROR(ENOSPC); 1581 } 1582 1583 dsl_dataset_rele(ds, FTAG); 1584 return (error); 1585} 1586 1587void 1588dsl_dir_set_reservation_sync_impl(dsl_dir_t *dd, uint64_t value, dmu_tx_t *tx) 1589{ 1590 uint64_t used; 1591 int64_t delta; 1592 1593 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1594 1595 mutex_enter(&dd->dd_lock); 1596 used = dsl_dir_phys(dd)->dd_used_bytes; 1597 delta = MAX(used, value) - MAX(used, dsl_dir_phys(dd)->dd_reserved); 1598 dsl_dir_phys(dd)->dd_reserved = value; 1599 1600 if (dd->dd_parent != NULL) { 1601 /* Roll up this additional usage into our ancestors */ 1602 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV, 1603 delta, 0, 0, tx); 1604 } 1605 mutex_exit(&dd->dd_lock); 1606} 1607 1608static void 1609dsl_dir_set_reservation_sync(void *arg, dmu_tx_t *tx) 1610{ 1611 dsl_dir_set_qr_arg_t *ddsqra = arg; 1612 dsl_pool_t *dp = dmu_tx_pool(tx); 1613 dsl_dataset_t *ds; 1614 uint64_t newval; 1615 1616 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds)); 1617 1618 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) { 1619 dsl_prop_set_sync_impl(ds, 1620 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1621 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1, 1622 &ddsqra->ddsqra_value, tx); 1623 1624 VERIFY0(dsl_prop_get_int_ds(ds, 1625 zfs_prop_to_name(ZFS_PROP_RESERVATION), &newval)); 1626 } else { 1627 newval = ddsqra->ddsqra_value; 1628 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld", 1629 zfs_prop_to_name(ZFS_PROP_RESERVATION), 1630 (longlong_t)newval); 1631 } 1632 1633 dsl_dir_set_reservation_sync_impl(ds->ds_dir, newval, tx); 1634 dsl_dataset_rele(ds, FTAG); 1635} 1636 1637int 1638dsl_dir_set_reservation(const char *ddname, zprop_source_t source, 1639 uint64_t reservation) 1640{ 1641 dsl_dir_set_qr_arg_t ddsqra; 1642 1643 ddsqra.ddsqra_name = ddname; 1644 ddsqra.ddsqra_source = source; 1645 ddsqra.ddsqra_value = reservation; 1646 1647 return (dsl_sync_task(ddname, dsl_dir_set_reservation_check, 1648 dsl_dir_set_reservation_sync, &ddsqra, 0, ZFS_SPACE_CHECK_NONE)); 1649} 1650 1651static dsl_dir_t * 1652closest_common_ancestor(dsl_dir_t *ds1, dsl_dir_t *ds2) 1653{ 1654 for (; ds1; ds1 = ds1->dd_parent) { 1655 dsl_dir_t *dd; 1656 for (dd = ds2; dd; dd = dd->dd_parent) { 1657 if (ds1 == dd) 1658 return (dd); 1659 } 1660 } 1661 return (NULL); 1662} 1663 1664/* 1665 * If delta is applied to dd, how much of that delta would be applied to 1666 * ancestor? Syncing context only. 1667 */ 1668static int64_t 1669would_change(dsl_dir_t *dd, int64_t delta, dsl_dir_t *ancestor) 1670{ 1671 if (dd == ancestor) 1672 return (delta); 1673 1674 mutex_enter(&dd->dd_lock); 1675 delta = parent_delta(dd, dsl_dir_phys(dd)->dd_used_bytes, delta); 1676 mutex_exit(&dd->dd_lock); 1677 return (would_change(dd->dd_parent, delta, ancestor)); 1678} 1679 1680typedef struct dsl_dir_rename_arg { 1681 const char *ddra_oldname; 1682 const char *ddra_newname; 1683 cred_t *ddra_cred; 1684} dsl_dir_rename_arg_t; 1685 1686/* ARGSUSED */ 1687static int 1688dsl_valid_rename(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg) 1689{ 1690 int *deltap = arg; 1691 char namebuf[ZFS_MAX_DATASET_NAME_LEN]; 1692 1693 dsl_dataset_name(ds, namebuf); 1694 1695 if (strlen(namebuf) + *deltap >= ZFS_MAX_DATASET_NAME_LEN) 1696 return (SET_ERROR(ENAMETOOLONG)); 1697 return (0); 1698} 1699 1700static int 1701dsl_dir_rename_check(void *arg, dmu_tx_t *tx) 1702{ 1703 dsl_dir_rename_arg_t *ddra = arg; 1704 dsl_pool_t *dp = dmu_tx_pool(tx); 1705 dsl_dir_t *dd, *newparent; 1706 const char *mynewname; 1707 int error; 1708 int delta = strlen(ddra->ddra_newname) - strlen(ddra->ddra_oldname); 1709 1710 /* target dir should exist */ 1711 error = dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL); 1712 if (error != 0) 1713 return (error); 1714 1715 /* new parent should exist */ 1716 error = dsl_dir_hold(dp, ddra->ddra_newname, FTAG, 1717 &newparent, &mynewname); 1718 if (error != 0) { 1719 dsl_dir_rele(dd, FTAG); 1720 return (error); 1721 } 1722 1723 /* can't rename to different pool */ 1724 if (dd->dd_pool != newparent->dd_pool) { 1725 dsl_dir_rele(newparent, FTAG); 1726 dsl_dir_rele(dd, FTAG); 1727 return (SET_ERROR(EXDEV)); 1728 } 1729 1730 /* new name should not already exist */ 1731 if (mynewname == NULL) { 1732 dsl_dir_rele(newparent, FTAG); 1733 dsl_dir_rele(dd, FTAG); 1734 return (SET_ERROR(EEXIST)); 1735 } 1736 1737 /* if the name length is growing, validate child name lengths */ 1738 if (delta > 0) { 1739 error = dmu_objset_find_dp(dp, dd->dd_object, dsl_valid_rename, 1740 &delta, DS_FIND_CHILDREN | DS_FIND_SNAPSHOTS); 1741 if (error != 0) { 1742 dsl_dir_rele(newparent, FTAG); 1743 dsl_dir_rele(dd, FTAG); 1744 return (error); 1745 } 1746 } 1747 1748 if (dmu_tx_is_syncing(tx)) { 1749 if (spa_feature_is_active(dp->dp_spa, 1750 SPA_FEATURE_FS_SS_LIMIT)) { 1751 /* 1752 * Although this is the check function and we don't 1753 * normally make on-disk changes in check functions, 1754 * we need to do that here. 1755 * 1756 * Ensure this portion of the tree's counts have been 1757 * initialized in case the new parent has limits set. 1758 */ 1759 dsl_dir_init_fs_ss_count(dd, tx); 1760 } 1761 } 1762 1763 if (newparent != dd->dd_parent) { 1764 /* is there enough space? */ 1765 uint64_t myspace = 1766 MAX(dsl_dir_phys(dd)->dd_used_bytes, 1767 dsl_dir_phys(dd)->dd_reserved); 1768 objset_t *os = dd->dd_pool->dp_meta_objset; 1769 uint64_t fs_cnt = 0; 1770 uint64_t ss_cnt = 0; 1771 1772 if (dsl_dir_is_zapified(dd)) { 1773 int err; 1774 1775 err = zap_lookup(os, dd->dd_object, 1776 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1, 1777 &fs_cnt); 1778 if (err != ENOENT && err != 0) { 1779 dsl_dir_rele(newparent, FTAG); 1780 dsl_dir_rele(dd, FTAG); 1781 return (err); 1782 } 1783 1784 /* 1785 * have to add 1 for the filesystem itself that we're 1786 * moving 1787 */ 1788 fs_cnt++; 1789 1790 err = zap_lookup(os, dd->dd_object, 1791 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1, 1792 &ss_cnt); 1793 if (err != ENOENT && err != 0) { 1794 dsl_dir_rele(newparent, FTAG); 1795 dsl_dir_rele(dd, FTAG); 1796 return (err); 1797 } 1798 } 1799 1800 /* no rename into our descendant */ 1801 if (closest_common_ancestor(dd, newparent) == dd) { 1802 dsl_dir_rele(newparent, FTAG); 1803 dsl_dir_rele(dd, FTAG); 1804 return (SET_ERROR(EINVAL)); 1805 } 1806 1807 error = dsl_dir_transfer_possible(dd->dd_parent, 1808 newparent, fs_cnt, ss_cnt, myspace, ddra->ddra_cred); 1809 if (error != 0) { 1810 dsl_dir_rele(newparent, FTAG); 1811 dsl_dir_rele(dd, FTAG); 1812 return (error); 1813 } 1814 } 1815 1816 dsl_dir_rele(newparent, FTAG); 1817 dsl_dir_rele(dd, FTAG); 1818 return (0); 1819} 1820 1821static void 1822dsl_dir_rename_sync(void *arg, dmu_tx_t *tx) 1823{ 1824 dsl_dir_rename_arg_t *ddra = arg; 1825 dsl_pool_t *dp = dmu_tx_pool(tx); 1826 dsl_dir_t *dd, *newparent; 1827 const char *mynewname; 1828 int error; 1829 objset_t *mos = dp->dp_meta_objset; 1830 1831 VERIFY0(dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL)); 1832 VERIFY0(dsl_dir_hold(dp, ddra->ddra_newname, FTAG, &newparent, 1833 &mynewname)); 1834 1835 /* Log this before we change the name. */ 1836 spa_history_log_internal_dd(dd, "rename", tx, 1837 "-> %s", ddra->ddra_newname); 1838 1839 if (newparent != dd->dd_parent) { 1840 objset_t *os = dd->dd_pool->dp_meta_objset; 1841 uint64_t fs_cnt = 0; 1842 uint64_t ss_cnt = 0; 1843 1844 /* 1845 * We already made sure the dd counts were initialized in the 1846 * check function. 1847 */ 1848 if (spa_feature_is_active(dp->dp_spa, 1849 SPA_FEATURE_FS_SS_LIMIT)) { 1850 VERIFY0(zap_lookup(os, dd->dd_object, 1851 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1, 1852 &fs_cnt)); 1853 /* add 1 for the filesystem itself that we're moving */ 1854 fs_cnt++; 1855 1856 VERIFY0(zap_lookup(os, dd->dd_object, 1857 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1, 1858 &ss_cnt)); 1859 } 1860 1861 dsl_fs_ss_count_adjust(dd->dd_parent, -fs_cnt, 1862 DD_FIELD_FILESYSTEM_COUNT, tx); 1863 dsl_fs_ss_count_adjust(newparent, fs_cnt, 1864 DD_FIELD_FILESYSTEM_COUNT, tx); 1865 1866 dsl_fs_ss_count_adjust(dd->dd_parent, -ss_cnt, 1867 DD_FIELD_SNAPSHOT_COUNT, tx); 1868 dsl_fs_ss_count_adjust(newparent, ss_cnt, 1869 DD_FIELD_SNAPSHOT_COUNT, tx); 1870 1871 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD, 1872 -dsl_dir_phys(dd)->dd_used_bytes, 1873 -dsl_dir_phys(dd)->dd_compressed_bytes, 1874 -dsl_dir_phys(dd)->dd_uncompressed_bytes, tx); 1875 dsl_dir_diduse_space(newparent, DD_USED_CHILD, 1876 dsl_dir_phys(dd)->dd_used_bytes, 1877 dsl_dir_phys(dd)->dd_compressed_bytes, 1878 dsl_dir_phys(dd)->dd_uncompressed_bytes, tx); 1879 1880 if (dsl_dir_phys(dd)->dd_reserved > 1881 dsl_dir_phys(dd)->dd_used_bytes) { 1882 uint64_t unused_rsrv = dsl_dir_phys(dd)->dd_reserved - 1883 dsl_dir_phys(dd)->dd_used_bytes; 1884 1885 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV, 1886 -unused_rsrv, 0, 0, tx); 1887 dsl_dir_diduse_space(newparent, DD_USED_CHILD_RSRV, 1888 unused_rsrv, 0, 0, tx); 1889 } 1890 } 1891 1892 dmu_buf_will_dirty(dd->dd_dbuf, tx); 1893 1894 /* remove from old parent zapobj */ 1895 error = zap_remove(mos, 1896 dsl_dir_phys(dd->dd_parent)->dd_child_dir_zapobj, 1897 dd->dd_myname, tx); 1898 ASSERT0(error); 1899 1900 (void) strcpy(dd->dd_myname, mynewname); 1901 dsl_dir_rele(dd->dd_parent, dd); 1902 dsl_dir_phys(dd)->dd_parent_obj = newparent->dd_object; 1903 VERIFY0(dsl_dir_hold_obj(dp, 1904 newparent->dd_object, NULL, dd, &dd->dd_parent)); 1905 1906 /* add to new parent zapobj */ 1907 VERIFY0(zap_add(mos, dsl_dir_phys(newparent)->dd_child_dir_zapobj, 1908 dd->dd_myname, 8, 1, &dd->dd_object, tx)); 1909 1910#ifdef __FreeBSD__ 1911#ifdef _KERNEL 1912 zfsvfs_update_fromname(ddra->ddra_oldname, ddra->ddra_newname); 1913 zvol_rename_minors(ddra->ddra_oldname, ddra->ddra_newname); 1914#endif 1915#endif 1916 1917 dsl_prop_notify_all(dd); 1918 1919 dsl_dir_rele(newparent, FTAG); 1920 dsl_dir_rele(dd, FTAG); 1921} 1922 1923int 1924dsl_dir_rename(const char *oldname, const char *newname) 1925{ 1926 dsl_dir_rename_arg_t ddra; 1927 1928 ddra.ddra_oldname = oldname; 1929 ddra.ddra_newname = newname; 1930 ddra.ddra_cred = CRED(); 1931 1932 return (dsl_sync_task(oldname, 1933 dsl_dir_rename_check, dsl_dir_rename_sync, &ddra, 1934 3, ZFS_SPACE_CHECK_RESERVED)); 1935} 1936 1937int 1938dsl_dir_transfer_possible(dsl_dir_t *sdd, dsl_dir_t *tdd, 1939 uint64_t fs_cnt, uint64_t ss_cnt, uint64_t space, cred_t *cr) 1940{ 1941 dsl_dir_t *ancestor; 1942 int64_t adelta; 1943 uint64_t avail; 1944 int err; 1945 1946 ancestor = closest_common_ancestor(sdd, tdd); 1947 adelta = would_change(sdd, -space, ancestor); 1948 avail = dsl_dir_space_available(tdd, ancestor, adelta, FALSE); 1949 if (avail < space) 1950 return (SET_ERROR(ENOSPC)); 1951 1952 err = dsl_fs_ss_limit_check(tdd, fs_cnt, ZFS_PROP_FILESYSTEM_LIMIT, 1953 ancestor, cr); 1954 if (err != 0) 1955 return (err); 1956 err = dsl_fs_ss_limit_check(tdd, ss_cnt, ZFS_PROP_SNAPSHOT_LIMIT, 1957 ancestor, cr); 1958 if (err != 0) 1959 return (err); 1960 1961 return (0); 1962} 1963 1964timestruc_t 1965dsl_dir_snap_cmtime(dsl_dir_t *dd) 1966{ 1967 timestruc_t t; 1968 1969 mutex_enter(&dd->dd_lock); 1970 t = dd->dd_snap_cmtime; 1971 mutex_exit(&dd->dd_lock); 1972 1973 return (t); 1974} 1975 1976void 1977dsl_dir_snap_cmtime_update(dsl_dir_t *dd) 1978{ 1979 timestruc_t t; 1980 1981 gethrestime(&t); 1982 mutex_enter(&dd->dd_lock); 1983 dd->dd_snap_cmtime = t; 1984 mutex_exit(&dd->dd_lock); 1985} 1986 1987void 1988dsl_dir_zapify(dsl_dir_t *dd, dmu_tx_t *tx) 1989{ 1990 objset_t *mos = dd->dd_pool->dp_meta_objset; 1991 dmu_object_zapify(mos, dd->dd_object, DMU_OT_DSL_DIR, tx); 1992} 1993 1994boolean_t 1995dsl_dir_is_zapified(dsl_dir_t *dd) 1996{ 1997 dmu_object_info_t doi; 1998 1999 dmu_object_info_from_db(dd->dd_dbuf, &doi); 2000 return (doi.doi_type == DMU_OTN_ZAP_METADATA); 2001} 2002