1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright (c) 2012, 2017 by Delphix. All rights reserved.
25 * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
26 * Copyright 2019 Joyent, Inc.
27 * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
28 * Copyright (c) 2015, STRATO AG, Inc. All rights reserved.
29 * Copyright (c) 2014 Integros [integros.com]
30 * Copyright 2017 Nexenta Systems, Inc.
31 */
32
33/* Portions Copyright 2010 Robert Milkowski */
34
35#include <sys/zfeature.h>
36#include <sys/cred.h>
37#include <sys/zfs_context.h>
38#include <sys/dmu_objset.h>
39#include <sys/dsl_dir.h>
40#include <sys/dsl_dataset.h>
41#include <sys/dsl_prop.h>
42#include <sys/dsl_pool.h>
43#include <sys/dsl_synctask.h>
44#include <sys/dsl_deleg.h>
45#include <sys/dnode.h>
46#include <sys/dbuf.h>
47#include <sys/zvol.h>
48#include <sys/dmu_tx.h>
49#include <sys/zap.h>
50#include <sys/zil.h>
51#include <sys/dmu_impl.h>
52#include <sys/zfs_ioctl.h>
53#include <sys/sa.h>
54#include <sys/zfs_onexit.h>
55#include <sys/dsl_destroy.h>
56#include <sys/vdev.h>
57#include <sys/zfeature.h>
58#include <sys/spa_impl.h>
59#include <sys/dmu_recv.h>
60#include <sys/zfs_project.h>
61#include "zfs_namecheck.h"
62
63/*
64 * Needed to close a window in dnode_move() that allows the objset to be freed
65 * before it can be safely accessed.
66 */
67krwlock_t os_lock;
68
69/*
70 * Tunable to overwrite the maximum number of threads for the parallization
71 * of dmu_objset_find_dp, needed to speed up the import of pools with many
72 * datasets.
73 * Default is 4 times the number of leaf vdevs.
74 */
75int dmu_find_threads = 0;
76
77/*
78 * Backfill lower metadnode objects after this many have been freed.
79 * Backfilling negatively impacts object creation rates, so only do it
80 * if there are enough holes to fill.
81 */
82int dmu_rescan_dnode_threshold = 131072;
83
84static void dmu_objset_find_dp_cb(void *arg);
85
86static void dmu_objset_upgrade(objset_t *os, dmu_objset_upgrade_cb_t cb);
87static void dmu_objset_upgrade_stop(objset_t *os);
88
89void
90dmu_objset_init(void)
91{
92	rw_init(&os_lock, NULL, RW_DEFAULT, NULL);
93}
94
95void
96dmu_objset_fini(void)
97{
98	rw_destroy(&os_lock);
99}
100
101spa_t *
102dmu_objset_spa(objset_t *os)
103{
104	return (os->os_spa);
105}
106
107zilog_t *
108dmu_objset_zil(objset_t *os)
109{
110	return (os->os_zil);
111}
112
113dsl_pool_t *
114dmu_objset_pool(objset_t *os)
115{
116	dsl_dataset_t *ds;
117
118	if ((ds = os->os_dsl_dataset) != NULL && ds->ds_dir)
119		return (ds->ds_dir->dd_pool);
120	else
121		return (spa_get_dsl(os->os_spa));
122}
123
124dsl_dataset_t *
125dmu_objset_ds(objset_t *os)
126{
127	return (os->os_dsl_dataset);
128}
129
130dmu_objset_type_t
131dmu_objset_type(objset_t *os)
132{
133	return (os->os_phys->os_type);
134}
135
136void
137dmu_objset_name(objset_t *os, char *buf)
138{
139	dsl_dataset_name(os->os_dsl_dataset, buf);
140}
141
142uint64_t
143dmu_objset_id(objset_t *os)
144{
145	dsl_dataset_t *ds = os->os_dsl_dataset;
146
147	return (ds ? ds->ds_object : 0);
148}
149
150uint64_t
151dmu_objset_dnodesize(objset_t *os)
152{
153	return (os->os_dnodesize);
154}
155
156zfs_sync_type_t
157dmu_objset_syncprop(objset_t *os)
158{
159	return (os->os_sync);
160}
161
162zfs_logbias_op_t
163dmu_objset_logbias(objset_t *os)
164{
165	return (os->os_logbias);
166}
167
168static void
169checksum_changed_cb(void *arg, uint64_t newval)
170{
171	objset_t *os = arg;
172
173	/*
174	 * Inheritance should have been done by now.
175	 */
176	ASSERT(newval != ZIO_CHECKSUM_INHERIT);
177
178	os->os_checksum = zio_checksum_select(newval, ZIO_CHECKSUM_ON_VALUE);
179}
180
181static void
182compression_changed_cb(void *arg, uint64_t newval)
183{
184	objset_t *os = arg;
185
186	/*
187	 * Inheritance and range checking should have been done by now.
188	 */
189	ASSERT(newval != ZIO_COMPRESS_INHERIT);
190
191	os->os_compress = zio_compress_select(os->os_spa, newval,
192	    ZIO_COMPRESS_ON);
193}
194
195static void
196copies_changed_cb(void *arg, uint64_t newval)
197{
198	objset_t *os = arg;
199
200	/*
201	 * Inheritance and range checking should have been done by now.
202	 */
203	ASSERT(newval > 0);
204	ASSERT(newval <= spa_max_replication(os->os_spa));
205
206	os->os_copies = newval;
207}
208
209static void
210dedup_changed_cb(void *arg, uint64_t newval)
211{
212	objset_t *os = arg;
213	spa_t *spa = os->os_spa;
214	enum zio_checksum checksum;
215
216	/*
217	 * Inheritance should have been done by now.
218	 */
219	ASSERT(newval != ZIO_CHECKSUM_INHERIT);
220
221	checksum = zio_checksum_dedup_select(spa, newval, ZIO_CHECKSUM_OFF);
222
223	os->os_dedup_checksum = checksum & ZIO_CHECKSUM_MASK;
224	os->os_dedup_verify = !!(checksum & ZIO_CHECKSUM_VERIFY);
225}
226
227static void
228primary_cache_changed_cb(void *arg, uint64_t newval)
229{
230	objset_t *os = arg;
231
232	/*
233	 * Inheritance and range checking should have been done by now.
234	 */
235	ASSERT(newval == ZFS_CACHE_ALL || newval == ZFS_CACHE_NONE ||
236	    newval == ZFS_CACHE_METADATA);
237
238	os->os_primary_cache = newval;
239}
240
241static void
242secondary_cache_changed_cb(void *arg, uint64_t newval)
243{
244	objset_t *os = arg;
245
246	/*
247	 * Inheritance and range checking should have been done by now.
248	 */
249	ASSERT(newval == ZFS_CACHE_ALL || newval == ZFS_CACHE_NONE ||
250	    newval == ZFS_CACHE_METADATA);
251
252	os->os_secondary_cache = newval;
253}
254
255static void
256sync_changed_cb(void *arg, uint64_t newval)
257{
258	objset_t *os = arg;
259
260	/*
261	 * Inheritance and range checking should have been done by now.
262	 */
263	ASSERT(newval == ZFS_SYNC_STANDARD || newval == ZFS_SYNC_ALWAYS ||
264	    newval == ZFS_SYNC_DISABLED);
265
266	os->os_sync = newval;
267	if (os->os_zil)
268		zil_set_sync(os->os_zil, newval);
269}
270
271static void
272redundant_metadata_changed_cb(void *arg, uint64_t newval)
273{
274	objset_t *os = arg;
275
276	/*
277	 * Inheritance and range checking should have been done by now.
278	 */
279	ASSERT(newval == ZFS_REDUNDANT_METADATA_ALL ||
280	    newval == ZFS_REDUNDANT_METADATA_MOST);
281
282	os->os_redundant_metadata = newval;
283}
284
285static void
286dnodesize_changed_cb(void *arg, uint64_t newval)
287{
288	objset_t *os = arg;
289
290	switch (newval) {
291	case ZFS_DNSIZE_LEGACY:
292		os->os_dnodesize = DNODE_MIN_SIZE;
293		break;
294	case ZFS_DNSIZE_AUTO:
295		/*
296		 * Choose a dnode size that will work well for most
297		 * workloads if the user specified "auto". Future code
298		 * improvements could dynamically select a dnode size
299		 * based on observed workload patterns.
300		 */
301		os->os_dnodesize = DNODE_MIN_SIZE * 2;
302		break;
303	case ZFS_DNSIZE_1K:
304	case ZFS_DNSIZE_2K:
305	case ZFS_DNSIZE_4K:
306	case ZFS_DNSIZE_8K:
307	case ZFS_DNSIZE_16K:
308		os->os_dnodesize = newval;
309		break;
310	}
311}
312
313static void
314smallblk_changed_cb(void *arg, uint64_t newval)
315{
316	objset_t *os = arg;
317
318	/*
319	 * Inheritance and range checking should have been done by now.
320	 */
321	ASSERT(newval <= SPA_OLD_MAXBLOCKSIZE);
322	ASSERT(ISP2(newval));
323
324	os->os_zpl_special_smallblock = newval;
325}
326
327static void
328logbias_changed_cb(void *arg, uint64_t newval)
329{
330	objset_t *os = arg;
331
332	ASSERT(newval == ZFS_LOGBIAS_LATENCY ||
333	    newval == ZFS_LOGBIAS_THROUGHPUT);
334	os->os_logbias = newval;
335	if (os->os_zil)
336		zil_set_logbias(os->os_zil, newval);
337}
338
339static void
340recordsize_changed_cb(void *arg, uint64_t newval)
341{
342	objset_t *os = arg;
343
344	os->os_recordsize = newval;
345}
346
347void
348dmu_objset_byteswap(void *buf, size_t size)
349{
350	objset_phys_t *osp = buf;
351
352	ASSERT(size == OBJSET_PHYS_SIZE_V1 || size == OBJSET_PHYS_SIZE_V2 ||
353	    size == sizeof (objset_phys_t));
354	dnode_byteswap(&osp->os_meta_dnode);
355	byteswap_uint64_array(&osp->os_zil_header, sizeof (zil_header_t));
356	osp->os_type = BSWAP_64(osp->os_type);
357	osp->os_flags = BSWAP_64(osp->os_flags);
358	if (size >= OBJSET_PHYS_SIZE_V2) {
359		dnode_byteswap(&osp->os_userused_dnode);
360		dnode_byteswap(&osp->os_groupused_dnode);
361		if (size >= sizeof (objset_phys_t))
362			dnode_byteswap(&osp->os_projectused_dnode);
363	}
364}
365
366/*
367 * The hash is a CRC-based hash of the objset_t pointer and the object number.
368 */
369static uint64_t
370dnode_hash(const objset_t *os, uint64_t obj)
371{
372	uintptr_t osv = (uintptr_t)os;
373	uint64_t crc = -1ULL;
374
375	ASSERT(zfs_crc64_table[128] == ZFS_CRC64_POLY);
376	/*
377	 * The low 6 bits of the pointer don't have much entropy, because
378	 * the objset_t is larger than 2^6 bytes long.
379	 */
380	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (osv >> 6)) & 0xFF];
381	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (obj >> 0)) & 0xFF];
382	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (obj >> 8)) & 0xFF];
383	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (obj >> 16)) & 0xFF];
384
385	crc ^= (osv>>14) ^ (obj>>24);
386
387	return (crc);
388}
389
390unsigned int
391dnode_multilist_index_func(multilist_t *ml, void *obj)
392{
393	dnode_t *dn = obj;
394	return (dnode_hash(dn->dn_objset, dn->dn_object) %
395	    multilist_get_num_sublists(ml));
396}
397
398/*
399 * Instantiates the objset_t in-memory structure corresponding to the
400 * objset_phys_t that's pointed to by the specified blkptr_t.
401 */
402int
403dmu_objset_open_impl(spa_t *spa, dsl_dataset_t *ds, blkptr_t *bp,
404    objset_t **osp)
405{
406	objset_t *os;
407	int i, err;
408
409	ASSERT(ds == NULL || MUTEX_HELD(&ds->ds_opening_lock));
410
411#if 0
412	/*
413	 * The $ORIGIN dataset (if it exists) doesn't have an associated
414	 * objset, so there's no reason to open it. The $ORIGIN dataset
415	 * will not exist on pools older than SPA_VERSION_ORIGIN.
416	 */
417	if (ds != NULL && spa_get_dsl(spa) != NULL &&
418	    spa_get_dsl(spa)->dp_origin_snap != NULL) {
419		ASSERT3P(ds->ds_dir, !=,
420		    spa_get_dsl(spa)->dp_origin_snap->ds_dir);
421	}
422#endif
423
424	os = kmem_zalloc(sizeof (objset_t), KM_SLEEP);
425	os->os_dsl_dataset = ds;
426	os->os_spa = spa;
427	os->os_rootbp = bp;
428	if (!BP_IS_HOLE(os->os_rootbp)) {
429		arc_flags_t aflags = ARC_FLAG_WAIT;
430		zbookmark_phys_t zb;
431		int size;
432		enum zio_flag zio_flags = ZIO_FLAG_CANFAIL;
433		SET_BOOKMARK(&zb, ds ? ds->ds_object : DMU_META_OBJSET,
434		    ZB_ROOT_OBJECT, ZB_ROOT_LEVEL, ZB_ROOT_BLKID);
435
436		if (DMU_OS_IS_L2CACHEABLE(os))
437			aflags |= ARC_FLAG_L2CACHE;
438
439		if (ds != NULL && ds->ds_dir->dd_crypto_obj != 0) {
440			ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
441			ASSERT(BP_IS_AUTHENTICATED(bp));
442			zio_flags |= ZIO_FLAG_RAW;
443		}
444
445		dprintf_bp(os->os_rootbp, "reading %s", "");
446		err = arc_read(NULL, spa, os->os_rootbp,
447		    arc_getbuf_func, &os->os_phys_buf,
448		    ZIO_PRIORITY_SYNC_READ, zio_flags, &aflags, &zb);
449		if (err != 0) {
450			kmem_free(os, sizeof (objset_t));
451			/* convert checksum errors into IO errors */
452			if (err == ECKSUM)
453				err = SET_ERROR(EIO);
454			return (err);
455		}
456
457		if (spa_version(spa) < SPA_VERSION_USERSPACE)
458			size = OBJSET_PHYS_SIZE_V1;
459		else if (!spa_feature_is_enabled(spa,
460		    SPA_FEATURE_PROJECT_QUOTA))
461			size = OBJSET_PHYS_SIZE_V2;
462		else
463			size = sizeof (objset_phys_t);
464
465		/* Increase the blocksize if we are permitted. */
466		if (arc_buf_size(os->os_phys_buf) < size) {
467			arc_buf_t *buf = arc_alloc_buf(spa, &os->os_phys_buf,
468			    ARC_BUFC_METADATA, size);
469			bzero(buf->b_data, size);
470			bcopy(os->os_phys_buf->b_data, buf->b_data,
471			    arc_buf_size(os->os_phys_buf));
472			arc_buf_destroy(os->os_phys_buf, &os->os_phys_buf);
473			os->os_phys_buf = buf;
474		}
475
476		os->os_phys = os->os_phys_buf->b_data;
477		os->os_flags = os->os_phys->os_flags;
478	} else {
479		int size = spa_version(spa) >= SPA_VERSION_USERSPACE ?
480		    sizeof (objset_phys_t) : OBJSET_PHYS_SIZE_V1;
481		os->os_phys_buf = arc_alloc_buf(spa, &os->os_phys_buf,
482		    ARC_BUFC_METADATA, size);
483		os->os_phys = os->os_phys_buf->b_data;
484		bzero(os->os_phys, size);
485	}
486
487	/*
488	 * Note: the changed_cb will be called once before the register
489	 * func returns, thus changing the checksum/compression from the
490	 * default (fletcher2/off).  Snapshots don't need to know about
491	 * checksum/compression/copies.
492	 */
493	if (ds != NULL) {
494		boolean_t needlock = B_FALSE;
495
496		os->os_encrypted = (ds->ds_dir->dd_crypto_obj != 0);
497
498		/*
499		 * Note: it's valid to open the objset if the dataset is
500		 * long-held, in which case the pool_config lock will not
501		 * be held.
502		 */
503		if (!dsl_pool_config_held(dmu_objset_pool(os))) {
504			needlock = B_TRUE;
505			dsl_pool_config_enter(dmu_objset_pool(os), FTAG);
506		}
507
508		err = dsl_prop_register(ds,
509		    zfs_prop_to_name(ZFS_PROP_PRIMARYCACHE),
510		    primary_cache_changed_cb, os);
511		if (err == 0) {
512			err = dsl_prop_register(ds,
513			    zfs_prop_to_name(ZFS_PROP_SECONDARYCACHE),
514			    secondary_cache_changed_cb, os);
515		}
516		if (!ds->ds_is_snapshot) {
517			if (err == 0) {
518				err = dsl_prop_register(ds,
519				    zfs_prop_to_name(ZFS_PROP_CHECKSUM),
520				    checksum_changed_cb, os);
521			}
522			if (err == 0) {
523				err = dsl_prop_register(ds,
524				    zfs_prop_to_name(ZFS_PROP_COMPRESSION),
525				    compression_changed_cb, os);
526			}
527			if (err == 0) {
528				err = dsl_prop_register(ds,
529				    zfs_prop_to_name(ZFS_PROP_COPIES),
530				    copies_changed_cb, os);
531			}
532			if (err == 0) {
533				err = dsl_prop_register(ds,
534				    zfs_prop_to_name(ZFS_PROP_DEDUP),
535				    dedup_changed_cb, os);
536			}
537			if (err == 0) {
538				err = dsl_prop_register(ds,
539				    zfs_prop_to_name(ZFS_PROP_LOGBIAS),
540				    logbias_changed_cb, os);
541			}
542			if (err == 0) {
543				err = dsl_prop_register(ds,
544				    zfs_prop_to_name(ZFS_PROP_SYNC),
545				    sync_changed_cb, os);
546			}
547			if (err == 0) {
548				err = dsl_prop_register(ds,
549				    zfs_prop_to_name(
550				    ZFS_PROP_REDUNDANT_METADATA),
551				    redundant_metadata_changed_cb, os);
552			}
553			if (err == 0) {
554				err = dsl_prop_register(ds,
555				    zfs_prop_to_name(ZFS_PROP_RECORDSIZE),
556				    recordsize_changed_cb, os);
557			}
558			if (err == 0) {
559				err = dsl_prop_register(ds,
560				    zfs_prop_to_name(ZFS_PROP_DNODESIZE),
561				    dnodesize_changed_cb, os);
562			}
563			if (err == 0) {
564				err = dsl_prop_register(ds,
565				    zfs_prop_to_name(
566				    ZFS_PROP_SPECIAL_SMALL_BLOCKS),
567				    smallblk_changed_cb, os);
568			}
569		}
570		if (needlock)
571			dsl_pool_config_exit(dmu_objset_pool(os), FTAG);
572		if (err != 0) {
573			arc_buf_destroy(os->os_phys_buf, &os->os_phys_buf);
574			kmem_free(os, sizeof (objset_t));
575			return (err);
576		}
577	} else {
578		/* It's the meta-objset. */
579		os->os_checksum = ZIO_CHECKSUM_FLETCHER_4;
580		os->os_compress = ZIO_COMPRESS_ON;
581		os->os_encrypted = B_FALSE;
582		os->os_copies = spa_max_replication(spa);
583		os->os_dedup_checksum = ZIO_CHECKSUM_OFF;
584		os->os_dedup_verify = B_FALSE;
585		os->os_logbias = ZFS_LOGBIAS_LATENCY;
586		os->os_sync = ZFS_SYNC_STANDARD;
587		os->os_primary_cache = ZFS_CACHE_ALL;
588		os->os_secondary_cache = ZFS_CACHE_ALL;
589		os->os_dnodesize = DNODE_MIN_SIZE;
590	}
591	/*
592	 * These properties will be filled in by the logic in zfs_get_zplprop()
593	 * when they are queried for the first time.
594	 */
595	os->os_version = OBJSET_PROP_UNINITIALIZED;
596	os->os_normalization = OBJSET_PROP_UNINITIALIZED;
597	os->os_utf8only = OBJSET_PROP_UNINITIALIZED;
598	os->os_casesensitivity = OBJSET_PROP_UNINITIALIZED;
599
600	if (ds == NULL || !ds->ds_is_snapshot)
601		os->os_zil_header = os->os_phys->os_zil_header;
602	os->os_zil = zil_alloc(os, &os->os_zil_header);
603
604	for (i = 0; i < TXG_SIZE; i++) {
605		os->os_dirty_dnodes[i] = multilist_create(sizeof (dnode_t),
606		    offsetof(dnode_t, dn_dirty_link[i]),
607		    dnode_multilist_index_func);
608	}
609	list_create(&os->os_dnodes, sizeof (dnode_t),
610	    offsetof(dnode_t, dn_link));
611	list_create(&os->os_downgraded_dbufs, sizeof (dmu_buf_impl_t),
612	    offsetof(dmu_buf_impl_t, db_link));
613
614	mutex_init(&os->os_lock, NULL, MUTEX_DEFAULT, NULL);
615	mutex_init(&os->os_userused_lock, NULL, MUTEX_DEFAULT, NULL);
616	mutex_init(&os->os_obj_lock, NULL, MUTEX_DEFAULT, NULL);
617	mutex_init(&os->os_user_ptr_lock, NULL, MUTEX_DEFAULT, NULL);
618	os->os_obj_next_percpu_len = boot_ncpus;
619	os->os_obj_next_percpu = kmem_zalloc(os->os_obj_next_percpu_len *
620	    sizeof (os->os_obj_next_percpu[0]), KM_SLEEP);
621
622	dnode_special_open(os, &os->os_phys->os_meta_dnode,
623	    DMU_META_DNODE_OBJECT, &os->os_meta_dnode);
624	if (OBJSET_BUF_HAS_USERUSED(os->os_phys_buf)) {
625		dnode_special_open(os, &os->os_phys->os_userused_dnode,
626		    DMU_USERUSED_OBJECT, &os->os_userused_dnode);
627		dnode_special_open(os, &os->os_phys->os_groupused_dnode,
628		    DMU_GROUPUSED_OBJECT, &os->os_groupused_dnode);
629		if (OBJSET_BUF_HAS_PROJECTUSED(os->os_phys_buf))
630			dnode_special_open(os,
631			    &os->os_phys->os_projectused_dnode,
632			    DMU_PROJECTUSED_OBJECT, &os->os_projectused_dnode);
633	}
634
635	mutex_init(&os->os_upgrade_lock, NULL, MUTEX_DEFAULT, NULL);
636
637	*osp = os;
638	return (0);
639}
640
641int
642dmu_objset_from_ds(dsl_dataset_t *ds, objset_t **osp)
643{
644	int err = 0;
645
646	/*
647	 * We shouldn't be doing anything with dsl_dataset_t's unless the
648	 * pool_config lock is held, or the dataset is long-held.
649	 */
650	ASSERT(dsl_pool_config_held(ds->ds_dir->dd_pool) ||
651	    dsl_dataset_long_held(ds));
652
653	mutex_enter(&ds->ds_opening_lock);
654	if (ds->ds_objset == NULL) {
655		objset_t *os;
656		rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG);
657		err = dmu_objset_open_impl(dsl_dataset_get_spa(ds),
658		    ds, dsl_dataset_get_blkptr(ds), &os);
659		rrw_exit(&ds->ds_bp_rwlock, FTAG);
660
661		if (err == 0) {
662			mutex_enter(&ds->ds_lock);
663			ASSERT(ds->ds_objset == NULL);
664			ds->ds_objset = os;
665			mutex_exit(&ds->ds_lock);
666		}
667	}
668	*osp = ds->ds_objset;
669	mutex_exit(&ds->ds_opening_lock);
670	return (err);
671}
672
673/*
674 * Holds the pool while the objset is held.  Therefore only one objset
675 * can be held at a time.
676 */
677int
678dmu_objset_hold_flags(const char *name, boolean_t decrypt, void *tag,
679    objset_t **osp)
680{
681	dsl_pool_t *dp;
682	dsl_dataset_t *ds;
683	int err;
684	ds_hold_flags_t flags = (decrypt) ? DS_HOLD_FLAG_DECRYPT : 0;
685
686	err = dsl_pool_hold(name, tag, &dp);
687	if (err != 0)
688		return (err);
689	err = dsl_dataset_hold_flags(dp, name, flags, tag, &ds);
690	if (err != 0) {
691		dsl_pool_rele(dp, tag);
692		return (err);
693	}
694
695	err = dmu_objset_from_ds(ds, osp);
696	if (err != 0) {
697		dsl_dataset_rele(ds, tag);
698		dsl_pool_rele(dp, tag);
699	}
700
701	return (err);
702}
703
704int
705dmu_objset_hold(const char *name, void *tag, objset_t **osp)
706{
707	return (dmu_objset_hold_flags(name, B_FALSE, tag, osp));
708}
709
710/* ARGSUSED */
711static int
712dmu_objset_own_impl(dsl_dataset_t *ds, dmu_objset_type_t type,
713    boolean_t readonly, boolean_t decrypt, void *tag, objset_t **osp)
714{
715	int err;
716
717	err = dmu_objset_from_ds(ds, osp);
718	if (err != 0) {
719		return (err);
720	} else if (type != DMU_OST_ANY && type != (*osp)->os_phys->os_type) {
721		return (SET_ERROR(EINVAL));
722	} else if (!readonly && dsl_dataset_is_snapshot(ds)) {
723		return (SET_ERROR(EROFS));
724	} else if (!readonly && decrypt &&
725	    dsl_dir_incompatible_encryption_version(ds->ds_dir)) {
726		return (SET_ERROR(EROFS));
727	}
728
729	/* if we are decrypting, we can now check MACs in os->os_phys_buf */
730	if (decrypt && arc_is_unauthenticated((*osp)->os_phys_buf)) {
731		zbookmark_phys_t zb;
732
733		SET_BOOKMARK(&zb, ds->ds_object, ZB_ROOT_OBJECT,
734		    ZB_ROOT_LEVEL, ZB_ROOT_BLKID);
735		err = arc_untransform((*osp)->os_phys_buf, (*osp)->os_spa,
736		    &zb, B_FALSE);
737		if (err != 0)
738			return (err);
739
740		ASSERT0(arc_is_unauthenticated((*osp)->os_phys_buf));
741	}
742
743	return (0);
744}
745
746/*
747 * dsl_pool must not be held when this is called.
748 * Upon successful return, there will be a longhold on the dataset,
749 * and the dsl_pool will not be held.
750 */
751int
752dmu_objset_own(const char *name, dmu_objset_type_t type,
753    boolean_t readonly, boolean_t decrypt, void *tag, objset_t **osp)
754{
755	dsl_pool_t *dp;
756	dsl_dataset_t *ds;
757	int err;
758	ds_hold_flags_t flags = (decrypt) ? DS_HOLD_FLAG_DECRYPT : 0;
759
760	err = dsl_pool_hold(name, FTAG, &dp);
761	if (err != 0)
762		return (err);
763	err = dsl_dataset_own(dp, name, flags, tag, &ds);
764	if (err != 0) {
765		dsl_pool_rele(dp, FTAG);
766		return (err);
767	}
768	err = dmu_objset_own_impl(ds, type, readonly, decrypt, tag, osp);
769	if (err != 0) {
770		dsl_dataset_disown(ds, flags, tag);
771		dsl_pool_rele(dp, FTAG);
772		return (err);
773	}
774
775	/*
776	 * User accounting requires the dataset to be decrypted and rw.
777	 * We also don't begin user accounting during claiming to help
778	 * speed up pool import times and to keep this txg reserved
779	 * completely for recovery work.
780	 */
781	if ((dmu_objset_userobjspace_upgradable(*osp) ||
782	    dmu_objset_projectquota_upgradable(*osp)) &&
783	    !readonly && !dp->dp_spa->spa_claiming &&
784	    (ds->ds_dir->dd_crypto_obj == 0 || decrypt))
785		dmu_objset_id_quota_upgrade(*osp);
786
787	dsl_pool_rele(dp, FTAG);
788	return (0);
789}
790
791int
792dmu_objset_own_obj(dsl_pool_t *dp, uint64_t obj, dmu_objset_type_t type,
793    boolean_t readonly, boolean_t decrypt, void *tag, objset_t **osp)
794{
795	dsl_dataset_t *ds;
796	int err;
797	ds_hold_flags_t flags = (decrypt) ? DS_HOLD_FLAG_DECRYPT : 0;
798
799	err = dsl_dataset_own_obj(dp, obj, flags, tag, &ds);
800	if (err != 0)
801		return (err);
802
803	err = dmu_objset_own_impl(ds, type, readonly, decrypt, tag, osp);
804	if (err != 0) {
805		dsl_dataset_disown(ds, flags, tag);
806		return (err);
807	}
808
809	return (0);
810}
811
812void
813dmu_objset_rele_flags(objset_t *os, boolean_t decrypt, void *tag)
814{
815	ds_hold_flags_t flags = (decrypt) ? DS_HOLD_FLAG_DECRYPT : 0;
816
817	dsl_pool_t *dp = dmu_objset_pool(os);
818	dsl_dataset_rele_flags(os->os_dsl_dataset, flags, tag);
819	dsl_pool_rele(dp, tag);
820}
821
822void
823dmu_objset_rele(objset_t *os, void *tag)
824{
825	dmu_objset_rele_flags(os, B_FALSE, tag);
826}
827
828/*
829 * When we are called, os MUST refer to an objset associated with a dataset
830 * that is owned by 'tag'; that is, is held and long held by 'tag' and ds_owner
831 * == tag.  We will then release and reacquire ownership of the dataset while
832 * holding the pool config_rwlock to avoid intervening namespace or ownership
833 * changes may occur.
834 *
835 * This exists solely to accommodate zfs_ioc_userspace_upgrade()'s desire to
836 * release the hold on its dataset and acquire a new one on the dataset of the
837 * same name so that it can be partially torn down and reconstructed.
838 */
839void
840dmu_objset_refresh_ownership(dsl_dataset_t *ds, dsl_dataset_t **newds,
841    boolean_t decrypt, void *tag)
842{
843	dsl_pool_t *dp;
844	char name[ZFS_MAX_DATASET_NAME_LEN];
845
846	VERIFY3P(ds, !=, NULL);
847	VERIFY3P(ds->ds_owner, ==, tag);
848	VERIFY(dsl_dataset_long_held(ds));
849
850	dsl_dataset_name(ds, name);
851	dp = ds->ds_dir->dd_pool;
852	dsl_pool_config_enter(dp, FTAG);
853
854	dsl_dataset_disown(ds, 0, tag);
855	VERIFY0(dsl_dataset_own(dp, name,
856	    (decrypt) ? DS_HOLD_FLAG_DECRYPT : 0, tag, newds));
857	dsl_pool_config_exit(dp, FTAG);
858}
859
860void
861dmu_objset_disown(objset_t *os, boolean_t decrypt, void *tag)
862{
863	/*
864	 * Stop upgrading thread
865	 */
866	dmu_objset_upgrade_stop(os);
867	dsl_dataset_disown(os->os_dsl_dataset,
868	    (decrypt) ? DS_HOLD_FLAG_DECRYPT : 0, tag);
869}
870
871void
872dmu_objset_evict_dbufs(objset_t *os)
873{
874	dnode_t dn_marker;
875	dnode_t *dn;
876
877	mutex_enter(&os->os_lock);
878	dn = list_head(&os->os_dnodes);
879	while (dn != NULL) {
880		/*
881		 * Skip dnodes without holds.  We have to do this dance
882		 * because dnode_add_ref() only works if there is already a
883		 * hold.  If the dnode has no holds, then it has no dbufs.
884		 */
885		if (dnode_add_ref(dn, FTAG)) {
886			list_insert_after(&os->os_dnodes, dn, &dn_marker);
887			mutex_exit(&os->os_lock);
888
889			dnode_evict_dbufs(dn);
890			dnode_rele(dn, FTAG);
891
892			mutex_enter(&os->os_lock);
893			dn = list_next(&os->os_dnodes, &dn_marker);
894			list_remove(&os->os_dnodes, &dn_marker);
895		} else {
896			dn = list_next(&os->os_dnodes, dn);
897		}
898	}
899	mutex_exit(&os->os_lock);
900
901	if (DMU_USERUSED_DNODE(os) != NULL) {
902		if (DMU_PROJECTUSED_DNODE(os) != NULL)
903			dnode_evict_dbufs(DMU_PROJECTUSED_DNODE(os));
904		dnode_evict_dbufs(DMU_GROUPUSED_DNODE(os));
905		dnode_evict_dbufs(DMU_USERUSED_DNODE(os));
906	}
907	dnode_evict_dbufs(DMU_META_DNODE(os));
908}
909
910/*
911 * Objset eviction processing is split into into two pieces.
912 * The first marks the objset as evicting, evicts any dbufs that
913 * have a refcount of zero, and then queues up the objset for the
914 * second phase of eviction.  Once os->os_dnodes has been cleared by
915 * dnode_buf_pageout()->dnode_destroy(), the second phase is executed.
916 * The second phase closes the special dnodes, dequeues the objset from
917 * the list of those undergoing eviction, and finally frees the objset.
918 *
919 * NOTE: Due to asynchronous eviction processing (invocation of
920 *       dnode_buf_pageout()), it is possible for the meta dnode for the
921 *       objset to have no holds even though os->os_dnodes is not empty.
922 */
923void
924dmu_objset_evict(objset_t *os)
925{
926	dsl_dataset_t *ds = os->os_dsl_dataset;
927
928	for (int t = 0; t < TXG_SIZE; t++)
929		ASSERT(!dmu_objset_is_dirty(os, t));
930
931	if (ds)
932		dsl_prop_unregister_all(ds, os);
933
934	if (os->os_sa)
935		sa_tear_down(os);
936
937	dmu_objset_evict_dbufs(os);
938
939	mutex_enter(&os->os_lock);
940	spa_evicting_os_register(os->os_spa, os);
941	if (list_is_empty(&os->os_dnodes)) {
942		mutex_exit(&os->os_lock);
943		dmu_objset_evict_done(os);
944	} else {
945		mutex_exit(&os->os_lock);
946	}
947
948
949}
950
951void
952dmu_objset_evict_done(objset_t *os)
953{
954	ASSERT3P(list_head(&os->os_dnodes), ==, NULL);
955
956	dnode_special_close(&os->os_meta_dnode);
957	if (DMU_USERUSED_DNODE(os)) {
958		if (DMU_PROJECTUSED_DNODE(os))
959			dnode_special_close(&os->os_projectused_dnode);
960		dnode_special_close(&os->os_userused_dnode);
961		dnode_special_close(&os->os_groupused_dnode);
962	}
963	zil_free(os->os_zil);
964
965	arc_buf_destroy(os->os_phys_buf, &os->os_phys_buf);
966
967	/*
968	 * This is a barrier to prevent the objset from going away in
969	 * dnode_move() until we can safely ensure that the objset is still in
970	 * use. We consider the objset valid before the barrier and invalid
971	 * after the barrier.
972	 */
973	rw_enter(&os_lock, RW_READER);
974	rw_exit(&os_lock);
975
976	kmem_free(os->os_obj_next_percpu,
977	    os->os_obj_next_percpu_len * sizeof (os->os_obj_next_percpu[0]));
978
979	mutex_destroy(&os->os_lock);
980	mutex_destroy(&os->os_userused_lock);
981	mutex_destroy(&os->os_obj_lock);
982	mutex_destroy(&os->os_user_ptr_lock);
983	for (int i = 0; i < TXG_SIZE; i++) {
984		multilist_destroy(os->os_dirty_dnodes[i]);
985	}
986	spa_evicting_os_deregister(os->os_spa, os);
987	kmem_free(os, sizeof (objset_t));
988}
989
990timestruc_t
991dmu_objset_snap_cmtime(objset_t *os)
992{
993	return (dsl_dir_snap_cmtime(os->os_dsl_dataset->ds_dir));
994}
995
996/* ARGSUSED */
997objset_t *
998dmu_objset_create_impl_dnstats(spa_t *spa, dsl_dataset_t *ds, blkptr_t *bp,
999    dmu_objset_type_t type, int levels, int blksz, int ibs, dmu_tx_t *tx)
1000{
1001	objset_t *os;
1002	dnode_t *mdn;
1003
1004	ASSERT(dmu_tx_is_syncing(tx));
1005
1006	if (blksz == 0)
1007		blksz = 1 << DNODE_BLOCK_SHIFT;
1008	if (ibs == 0)
1009		ibs = DN_MAX_INDBLKSHIFT;
1010
1011	if (ds != NULL)
1012		VERIFY0(dmu_objset_from_ds(ds, &os));
1013	else
1014		VERIFY0(dmu_objset_open_impl(spa, NULL, bp, &os));
1015
1016	mdn = DMU_META_DNODE(os);
1017
1018	dnode_allocate(mdn, DMU_OT_DNODE, DNODE_BLOCK_SIZE, DN_MAX_INDBLKSHIFT,
1019	    DMU_OT_NONE, 0, DNODE_MIN_SLOTS, tx);
1020
1021	/*
1022	 * We don't want to have to increase the meta-dnode's nlevels
1023	 * later, because then we could do it in quescing context while
1024	 * we are also accessing it in open context.
1025	 *
1026	 * This precaution is not necessary for the MOS (ds == NULL),
1027	 * because the MOS is only updated in syncing context.
1028	 * This is most fortunate: the MOS is the only objset that
1029	 * needs to be synced multiple times as spa_sync() iterates
1030	 * to convergence, so minimizing its dn_nlevels matters.
1031	 */
1032	if (ds != NULL) {
1033		if (levels == 0) {
1034			levels = 1;
1035
1036			/*
1037			 * Determine the number of levels necessary for the
1038			 * meta-dnode to contain DN_MAX_OBJECT dnodes.  Note
1039			 * that in order to ensure that we do not overflow
1040			 * 64 bits, there has to be a nlevels that gives us a
1041			 * number of blocks > DN_MAX_OBJECT but < 2^64.
1042			 * Therefore, (mdn->dn_indblkshift - SPA_BLKPTRSHIFT)
1043			 * (10) must be less than (64 - log2(DN_MAX_OBJECT))
1044			 * (16).
1045			 */
1046			while ((uint64_t)mdn->dn_nblkptr <<
1047			    (mdn->dn_datablkshift - DNODE_SHIFT + (levels - 1) *
1048			    (mdn->dn_indblkshift - SPA_BLKPTRSHIFT)) <
1049			    DN_MAX_OBJECT)
1050				levels++;
1051		}
1052
1053		mdn->dn_next_nlevels[tx->tx_txg & TXG_MASK] =
1054		    mdn->dn_nlevels = levels;
1055	}
1056
1057	ASSERT(type != DMU_OST_NONE);
1058	ASSERT(type != DMU_OST_ANY);
1059	ASSERT(type < DMU_OST_NUMTYPES);
1060	os->os_phys->os_type = type;
1061
1062	/*
1063	 * Enable user accounting if it is enabled and this is not an
1064	 * encrypted receive.
1065	 */
1066	if (dmu_objset_userused_enabled(os) &&
1067	    (!os->os_encrypted || !dmu_objset_is_receiving(os))) {
1068		os->os_phys->os_flags |= OBJSET_FLAG_USERACCOUNTING_COMPLETE;
1069		if (dmu_objset_userobjused_enabled(os)) {
1070			ds->ds_feature_activation_needed[
1071			    SPA_FEATURE_USEROBJ_ACCOUNTING] = B_TRUE;
1072			os->os_phys->os_flags |=
1073			    OBJSET_FLAG_USEROBJACCOUNTING_COMPLETE;
1074		}
1075		if (dmu_objset_projectquota_enabled(os)) {
1076			ds->ds_feature_activation_needed[
1077			    SPA_FEATURE_PROJECT_QUOTA] = B_TRUE;
1078			os->os_phys->os_flags |=
1079			    OBJSET_FLAG_PROJECTQUOTA_COMPLETE;
1080		}
1081		os->os_flags = os->os_phys->os_flags;
1082	}
1083
1084	dsl_dataset_dirty(ds, tx);
1085
1086	return (os);
1087}
1088
1089/* called from dsl for meta-objset */
1090objset_t *
1091dmu_objset_create_impl(spa_t *spa, dsl_dataset_t *ds, blkptr_t *bp,
1092    dmu_objset_type_t type, dmu_tx_t *tx)
1093{
1094	return (dmu_objset_create_impl_dnstats(spa, ds, bp, type, 0, 0, 0, tx));
1095}
1096
1097typedef struct dmu_objset_create_arg {
1098	const char *doca_name;
1099	cred_t *doca_cred;
1100	void (*doca_userfunc)(objset_t *os, void *arg,
1101	    cred_t *cr, dmu_tx_t *tx);
1102	void *doca_userarg;
1103	dmu_objset_type_t doca_type;
1104	uint64_t doca_flags;
1105	dsl_crypto_params_t *doca_dcp;
1106} dmu_objset_create_arg_t;
1107
1108/*ARGSUSED*/
1109static int
1110dmu_objset_create_check(void *arg, dmu_tx_t *tx)
1111{
1112	dmu_objset_create_arg_t *doca = arg;
1113	dsl_pool_t *dp = dmu_tx_pool(tx);
1114	dsl_dir_t *pdd;
1115	const char *tail;
1116	int error;
1117
1118	if (strchr(doca->doca_name, '@') != NULL)
1119		return (SET_ERROR(EINVAL));
1120
1121	if (strlen(doca->doca_name) >= ZFS_MAX_DATASET_NAME_LEN)
1122		return (SET_ERROR(ENAMETOOLONG));
1123
1124	if (dataset_nestcheck(doca->doca_name) != 0)
1125		return (SET_ERROR(ENAMETOOLONG));
1126
1127	error = dsl_dir_hold(dp, doca->doca_name, FTAG, &pdd, &tail);
1128	if (error != 0)
1129		return (error);
1130	if (tail == NULL) {
1131		dsl_dir_rele(pdd, FTAG);
1132		return (SET_ERROR(EEXIST));
1133	}
1134
1135	error = dmu_objset_create_crypt_check(pdd, doca->doca_dcp, NULL);
1136	if (error != 0) {
1137		dsl_dir_rele(pdd, FTAG);
1138		return (error);
1139	}
1140
1141	error = dsl_fs_ss_limit_check(pdd, 1, ZFS_PROP_FILESYSTEM_LIMIT, NULL,
1142	    doca->doca_cred);
1143
1144	dsl_dir_rele(pdd, FTAG);
1145
1146	return (error);
1147}
1148
1149static void
1150dmu_objset_create_sync(void *arg, dmu_tx_t *tx)
1151{
1152	dmu_objset_create_arg_t *doca = arg;
1153	dsl_pool_t *dp = dmu_tx_pool(tx);
1154	spa_t *spa = dp->dp_spa;
1155	dsl_dir_t *pdd;
1156	const char *tail;
1157	dsl_dataset_t *ds;
1158	uint64_t obj;
1159	blkptr_t *bp;
1160	objset_t *os;
1161	zio_t *rzio;
1162
1163	VERIFY0(dsl_dir_hold(dp, doca->doca_name, FTAG, &pdd, &tail));
1164
1165	obj = dsl_dataset_create_sync(pdd, tail, NULL, doca->doca_flags,
1166	    doca->doca_cred, doca->doca_dcp, tx);
1167
1168	VERIFY0(dsl_dataset_hold_obj_flags(pdd->dd_pool, obj,
1169	    DS_HOLD_FLAG_DECRYPT, FTAG, &ds));
1170	rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG);
1171	bp = dsl_dataset_get_blkptr(ds);
1172	os = dmu_objset_create_impl(spa, ds, bp, doca->doca_type, tx);
1173	rrw_exit(&ds->ds_bp_rwlock, FTAG);
1174
1175	if (doca->doca_userfunc != NULL) {
1176		doca->doca_userfunc(os, doca->doca_userarg,
1177		    doca->doca_cred, tx);
1178	}
1179
1180	/*
1181	 * The doca_userfunc() may write out some data that needs to be
1182	 * encrypted if the dataset is encrypted (specifically the root
1183	 * directory).  This data must be written out before the encryption
1184	 * key mapping is removed by dsl_dataset_rele_flags().  Force the
1185	 * I/O to occur immediately by invoking the relevant sections of
1186	 * dsl_pool_sync().
1187	 */
1188	if (os->os_encrypted) {
1189		dsl_dataset_t *tmpds = NULL;
1190		boolean_t need_sync_done = B_FALSE;
1191
1192		mutex_enter(&ds->ds_lock);
1193		ds->ds_owner = FTAG;
1194		mutex_exit(&ds->ds_lock);
1195
1196		rzio = zio_root(spa, NULL, NULL, ZIO_FLAG_MUSTSUCCEED);
1197		tmpds = txg_list_remove_this(&dp->dp_dirty_datasets, ds,
1198		    tx->tx_txg);
1199		if (tmpds != NULL) {
1200			dsl_dataset_sync(ds, rzio, tx);
1201			need_sync_done = B_TRUE;
1202		}
1203		VERIFY0(zio_wait(rzio));
1204		dmu_objset_do_userquota_updates(os, tx);
1205		taskq_wait(dp->dp_sync_taskq);
1206		if (txg_list_member(&dp->dp_dirty_datasets, ds, tx->tx_txg)) {
1207			ASSERT3P(ds->ds_key_mapping, !=, NULL);
1208			key_mapping_rele(spa, ds->ds_key_mapping, ds);
1209		}
1210
1211		rzio = zio_root(spa, NULL, NULL, ZIO_FLAG_MUSTSUCCEED);
1212		tmpds = txg_list_remove_this(&dp->dp_dirty_datasets, ds,
1213		    tx->tx_txg);
1214		if (tmpds != NULL) {
1215			dmu_buf_rele(ds->ds_dbuf, ds);
1216			dsl_dataset_sync(ds, rzio, tx);
1217		}
1218		VERIFY0(zio_wait(rzio));
1219
1220		if (need_sync_done) {
1221			ASSERT3P(ds->ds_key_mapping, !=, NULL);
1222			key_mapping_rele(spa, ds->ds_key_mapping, ds);
1223			dsl_dataset_sync_done(ds, tx);
1224		}
1225
1226		mutex_enter(&ds->ds_lock);
1227		ds->ds_owner = NULL;
1228		mutex_exit(&ds->ds_lock);
1229	}
1230
1231	spa_history_log_internal_ds(ds, "create", tx, "");
1232	dsl_dataset_rele_flags(ds, DS_HOLD_FLAG_DECRYPT, FTAG);
1233	dsl_dir_rele(pdd, FTAG);
1234}
1235
1236int
1237dmu_objset_create(const char *name, dmu_objset_type_t type, uint64_t flags,
1238    dsl_crypto_params_t *dcp, dmu_objset_create_sync_func_t func, void *arg)
1239{
1240	dmu_objset_create_arg_t doca;
1241	dsl_crypto_params_t tmp_dcp = { 0 };
1242
1243	doca.doca_name = name;
1244	doca.doca_cred = CRED();
1245	doca.doca_flags = flags;
1246	doca.doca_userfunc = func;
1247	doca.doca_userarg = arg;
1248	doca.doca_type = type;
1249
1250	/*
1251	 * Some callers (mostly for testing) do not provide a dcp on their
1252	 * own but various code inside the sync task will require it to be
1253	 * allocated. Rather than adding NULL checks throughout this code
1254	 * or adding dummy dcp's to all of the callers we simply create a
1255	 * dummy one here and use that. This zero dcp will have the same
1256	 * effect as asking for inheritence of all encryption params.
1257	 */
1258	doca.doca_dcp = (dcp != NULL) ? dcp : &tmp_dcp;
1259
1260	return (dsl_sync_task(name,
1261	    dmu_objset_create_check, dmu_objset_create_sync, &doca,
1262	    6, ZFS_SPACE_CHECK_NORMAL));
1263}
1264
1265typedef struct dmu_objset_clone_arg {
1266	const char *doca_clone;
1267	const char *doca_origin;
1268	cred_t *doca_cred;
1269} dmu_objset_clone_arg_t;
1270
1271/*ARGSUSED*/
1272static int
1273dmu_objset_clone_check(void *arg, dmu_tx_t *tx)
1274{
1275	dmu_objset_clone_arg_t *doca = arg;
1276	dsl_dir_t *pdd;
1277	const char *tail;
1278	int error;
1279	dsl_dataset_t *origin;
1280	dsl_pool_t *dp = dmu_tx_pool(tx);
1281
1282	if (strchr(doca->doca_clone, '@') != NULL)
1283		return (SET_ERROR(EINVAL));
1284
1285	if (strlen(doca->doca_clone) >= ZFS_MAX_DATASET_NAME_LEN)
1286		return (SET_ERROR(ENAMETOOLONG));
1287
1288	error = dsl_dir_hold(dp, doca->doca_clone, FTAG, &pdd, &tail);
1289	if (error != 0)
1290		return (error);
1291	if (tail == NULL) {
1292		dsl_dir_rele(pdd, FTAG);
1293		return (SET_ERROR(EEXIST));
1294	}
1295
1296	error = dsl_fs_ss_limit_check(pdd, 1, ZFS_PROP_FILESYSTEM_LIMIT, NULL,
1297	    doca->doca_cred);
1298	if (error != 0) {
1299		dsl_dir_rele(pdd, FTAG);
1300		return (SET_ERROR(EDQUOT));
1301	}
1302
1303	error = dsl_dataset_hold(dp, doca->doca_origin, FTAG, &origin);
1304	if (error != 0) {
1305		dsl_dir_rele(pdd, FTAG);
1306		return (error);
1307	}
1308
1309	/* You can only clone snapshots, not the head datasets. */
1310	if (!origin->ds_is_snapshot) {
1311		dsl_dataset_rele(origin, FTAG);
1312		dsl_dir_rele(pdd, FTAG);
1313		return (SET_ERROR(EINVAL));
1314	}
1315
1316	dsl_dataset_rele(origin, FTAG);
1317	dsl_dir_rele(pdd, FTAG);
1318
1319	return (0);
1320}
1321
1322static void
1323dmu_objset_clone_sync(void *arg, dmu_tx_t *tx)
1324{
1325	dmu_objset_clone_arg_t *doca = arg;
1326	dsl_pool_t *dp = dmu_tx_pool(tx);
1327	dsl_dir_t *pdd;
1328	const char *tail;
1329	dsl_dataset_t *origin, *ds;
1330	uint64_t obj;
1331	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
1332
1333	VERIFY0(dsl_dir_hold(dp, doca->doca_clone, FTAG, &pdd, &tail));
1334	VERIFY0(dsl_dataset_hold(dp, doca->doca_origin, FTAG, &origin));
1335
1336	obj = dsl_dataset_create_sync(pdd, tail, origin, 0,
1337	    doca->doca_cred, NULL, tx);
1338
1339	VERIFY0(dsl_dataset_hold_obj(pdd->dd_pool, obj, FTAG, &ds));
1340	dsl_dataset_name(origin, namebuf);
1341	spa_history_log_internal_ds(ds, "clone", tx,
1342	    "origin=%s (%llu)", namebuf, origin->ds_object);
1343	dsl_dataset_rele(ds, FTAG);
1344	dsl_dataset_rele(origin, FTAG);
1345	dsl_dir_rele(pdd, FTAG);
1346}
1347
1348int
1349dmu_objset_clone(const char *clone, const char *origin)
1350{
1351	dmu_objset_clone_arg_t doca;
1352
1353	doca.doca_clone = clone;
1354	doca.doca_origin = origin;
1355	doca.doca_cred = CRED();
1356
1357	return (dsl_sync_task(clone,
1358	    dmu_objset_clone_check, dmu_objset_clone_sync, &doca,
1359	    6, ZFS_SPACE_CHECK_NORMAL));
1360}
1361
1362static int
1363dmu_objset_remap_indirects_impl(objset_t *os, uint64_t last_removed_txg)
1364{
1365	int error = 0;
1366	uint64_t object = 0;
1367	while ((error = dmu_object_next(os, &object, B_FALSE, 0)) == 0) {
1368		error = dmu_object_remap_indirects(os, object,
1369		    last_removed_txg);
1370		/*
1371		 * If the ZPL removed the object before we managed to dnode_hold
1372		 * it, we would get an ENOENT. If the ZPL declares its intent
1373		 * to remove the object (dnode_free) before we manage to
1374		 * dnode_hold it, we would get an EEXIST. In either case, we
1375		 * want to continue remapping the other objects in the objset;
1376		 * in all other cases, we want to break early.
1377		 */
1378		if (error != 0 && error != ENOENT && error != EEXIST) {
1379			break;
1380		}
1381	}
1382	if (error == ESRCH) {
1383		error = 0;
1384	}
1385	return (error);
1386}
1387
1388int
1389dmu_objset_remap_indirects(const char *fsname)
1390{
1391	int error = 0;
1392	objset_t *os = NULL;
1393	uint64_t last_removed_txg;
1394	uint64_t remap_start_txg;
1395	dsl_dir_t *dd;
1396
1397	error = dmu_objset_hold(fsname, FTAG, &os);
1398	if (error != 0) {
1399		return (error);
1400	}
1401	dd = dmu_objset_ds(os)->ds_dir;
1402
1403	if (!spa_feature_is_enabled(dmu_objset_spa(os),
1404	    SPA_FEATURE_OBSOLETE_COUNTS)) {
1405		dmu_objset_rele(os, FTAG);
1406		return (SET_ERROR(ENOTSUP));
1407	}
1408
1409	if (dsl_dataset_is_snapshot(dmu_objset_ds(os))) {
1410		dmu_objset_rele(os, FTAG);
1411		return (SET_ERROR(EINVAL));
1412	}
1413
1414	/*
1415	 * If there has not been a removal, we're done.
1416	 */
1417	last_removed_txg = spa_get_last_removal_txg(dmu_objset_spa(os));
1418	if (last_removed_txg == -1ULL) {
1419		dmu_objset_rele(os, FTAG);
1420		return (0);
1421	}
1422
1423	/*
1424	 * If we have remapped since the last removal, we're done.
1425	 */
1426	if (dsl_dir_is_zapified(dd)) {
1427		uint64_t last_remap_txg;
1428		if (zap_lookup(spa_meta_objset(dmu_objset_spa(os)),
1429		    dd->dd_object, DD_FIELD_LAST_REMAP_TXG,
1430		    sizeof (last_remap_txg), 1, &last_remap_txg) == 0 &&
1431		    last_remap_txg > last_removed_txg) {
1432			dmu_objset_rele(os, FTAG);
1433			return (0);
1434		}
1435	}
1436
1437	dsl_dataset_long_hold(dmu_objset_ds(os), FTAG);
1438	dsl_pool_rele(dmu_objset_pool(os), FTAG);
1439
1440	remap_start_txg = spa_last_synced_txg(dmu_objset_spa(os));
1441	error = dmu_objset_remap_indirects_impl(os, last_removed_txg);
1442	if (error == 0) {
1443		/*
1444		 * We update the last_remap_txg to be the start txg so that
1445		 * we can guarantee that every block older than last_remap_txg
1446		 * that can be remapped has been remapped.
1447		 */
1448		error = dsl_dir_update_last_remap_txg(dd, remap_start_txg);
1449	}
1450
1451	dsl_dataset_long_rele(dmu_objset_ds(os), FTAG);
1452	dsl_dataset_rele(dmu_objset_ds(os), FTAG);
1453
1454	return (error);
1455}
1456
1457int
1458dmu_objset_snapshot_one(const char *fsname, const char *snapname)
1459{
1460	int err;
1461	char *longsnap = kmem_asprintf("%s@%s", fsname, snapname);
1462	nvlist_t *snaps = fnvlist_alloc();
1463
1464	fnvlist_add_boolean(snaps, longsnap);
1465	strfree(longsnap);
1466	err = dsl_dataset_snapshot(snaps, NULL, NULL);
1467	fnvlist_free(snaps);
1468	return (err);
1469}
1470
1471static void
1472dmu_objset_upgrade_task_cb(void *data)
1473{
1474	objset_t *os = data;
1475
1476	mutex_enter(&os->os_upgrade_lock);
1477	os->os_upgrade_status = EINTR;
1478	if (!os->os_upgrade_exit) {
1479		mutex_exit(&os->os_upgrade_lock);
1480
1481		os->os_upgrade_status = os->os_upgrade_cb(os);
1482		mutex_enter(&os->os_upgrade_lock);
1483	}
1484	os->os_upgrade_exit = B_TRUE;
1485	os->os_upgrade_id = 0;
1486	mutex_exit(&os->os_upgrade_lock);
1487}
1488
1489static void
1490dmu_objset_upgrade(objset_t *os, dmu_objset_upgrade_cb_t cb)
1491{
1492	if (os->os_upgrade_id != 0)
1493		return;
1494
1495	mutex_enter(&os->os_upgrade_lock);
1496	if (os->os_upgrade_id == 0 && os->os_upgrade_status == 0) {
1497		os->os_upgrade_exit = B_FALSE;
1498		os->os_upgrade_cb = cb;
1499		os->os_upgrade_id = taskq_dispatch(
1500		    os->os_spa->spa_upgrade_taskq,
1501		    dmu_objset_upgrade_task_cb, os, TQ_SLEEP);
1502		if (os->os_upgrade_id == 0)
1503			os->os_upgrade_status = ENOMEM;
1504	}
1505	mutex_exit(&os->os_upgrade_lock);
1506}
1507
1508static void
1509dmu_objset_upgrade_stop(objset_t *os)
1510{
1511	mutex_enter(&os->os_upgrade_lock);
1512	os->os_upgrade_exit = B_TRUE;
1513	if (os->os_upgrade_id != 0) {
1514		os->os_upgrade_id = 0;
1515		mutex_exit(&os->os_upgrade_lock);
1516
1517		taskq_wait(os->os_spa->spa_upgrade_taskq);
1518	} else {
1519		mutex_exit(&os->os_upgrade_lock);
1520	}
1521}
1522
1523static void
1524dmu_objset_sync_dnodes(multilist_sublist_t *list, dmu_tx_t *tx)
1525{
1526	dnode_t *dn;
1527
1528	while ((dn = multilist_sublist_head(list)) != NULL) {
1529		ASSERT(dn->dn_object != DMU_META_DNODE_OBJECT);
1530		ASSERT(dn->dn_dbuf->db_data_pending);
1531		/*
1532		 * Initialize dn_zio outside dnode_sync() because the
1533		 * meta-dnode needs to set it outside dnode_sync().
1534		 */
1535		dn->dn_zio = dn->dn_dbuf->db_data_pending->dr_zio;
1536		ASSERT(dn->dn_zio);
1537
1538		ASSERT3U(dn->dn_nlevels, <=, DN_MAX_LEVELS);
1539		multilist_sublist_remove(list, dn);
1540
1541		/*
1542		 * If we are not doing useraccounting (os_synced_dnodes == NULL)
1543		 * we are done with this dnode for this txg. Unset dn_dirty_txg
1544		 * if later txgs aren't dirtying it so that future holders do
1545		 * not get a stale value. Otherwise, we will do this in
1546		 * userquota_updates_task() when processing has completely
1547		 * finished for this txg.
1548		 */
1549		multilist_t *newlist = dn->dn_objset->os_synced_dnodes;
1550		if (newlist != NULL) {
1551			(void) dnode_add_ref(dn, newlist);
1552			multilist_insert(newlist, dn);
1553		} else {
1554			mutex_enter(&dn->dn_mtx);
1555			if (dn->dn_dirty_txg == tx->tx_txg)
1556				dn->dn_dirty_txg = 0;
1557			mutex_exit(&dn->dn_mtx);
1558		}
1559
1560		dnode_sync(dn, tx);
1561	}
1562}
1563
1564/* ARGSUSED */
1565static void
1566dmu_objset_write_ready(zio_t *zio, arc_buf_t *abuf, void *arg)
1567{
1568	blkptr_t *bp = zio->io_bp;
1569	objset_t *os = arg;
1570	dnode_phys_t *dnp = &os->os_phys->os_meta_dnode;
1571	uint64_t fill = 0;
1572
1573	ASSERT(!BP_IS_EMBEDDED(bp));
1574	ASSERT3U(BP_GET_TYPE(bp), ==, DMU_OT_OBJSET);
1575
1576	/*
1577	 * Update rootbp fill count: it should be the number of objects
1578	 * allocated in the object set (not counting the "special"
1579	 * objects that are stored in the objset_phys_t -- the meta
1580	 * dnode and user/group/project accounting objects).
1581	 */
1582	for (int i = 0; i < dnp->dn_nblkptr; i++)
1583		fill += BP_GET_FILL(&dnp->dn_blkptr[i]);
1584
1585	BP_SET_FILL(bp, fill);
1586
1587	if (os->os_dsl_dataset != NULL)
1588		rrw_enter(&os->os_dsl_dataset->ds_bp_rwlock, RW_WRITER, FTAG);
1589	*os->os_rootbp = *bp;
1590	if (os->os_dsl_dataset != NULL)
1591		rrw_exit(&os->os_dsl_dataset->ds_bp_rwlock, FTAG);
1592}
1593
1594/* ARGSUSED */
1595static void
1596dmu_objset_write_done(zio_t *zio, arc_buf_t *abuf, void *arg)
1597{
1598	blkptr_t *bp = zio->io_bp;
1599	blkptr_t *bp_orig = &zio->io_bp_orig;
1600	objset_t *os = arg;
1601
1602	if (zio->io_flags & ZIO_FLAG_IO_REWRITE) {
1603		ASSERT(BP_EQUAL(bp, bp_orig));
1604	} else {
1605		dsl_dataset_t *ds = os->os_dsl_dataset;
1606		dmu_tx_t *tx = os->os_synctx;
1607
1608		(void) dsl_dataset_block_kill(ds, bp_orig, tx, B_TRUE);
1609		dsl_dataset_block_born(ds, bp, tx);
1610	}
1611	kmem_free(bp, sizeof (*bp));
1612}
1613
1614typedef struct sync_dnodes_arg {
1615	multilist_t *sda_list;
1616	int sda_sublist_idx;
1617	multilist_t *sda_newlist;
1618	dmu_tx_t *sda_tx;
1619} sync_dnodes_arg_t;
1620
1621static void
1622sync_dnodes_task(void *arg)
1623{
1624	sync_dnodes_arg_t *sda = arg;
1625
1626	multilist_sublist_t *ms =
1627	    multilist_sublist_lock(sda->sda_list, sda->sda_sublist_idx);
1628
1629	dmu_objset_sync_dnodes(ms, sda->sda_tx);
1630
1631	multilist_sublist_unlock(ms);
1632
1633	kmem_free(sda, sizeof (*sda));
1634}
1635
1636
1637/* called from dsl */
1638void
1639dmu_objset_sync(objset_t *os, zio_t *pio, dmu_tx_t *tx)
1640{
1641	int txgoff;
1642	zbookmark_phys_t zb;
1643	zio_prop_t zp;
1644	zio_t *zio;
1645	list_t *list;
1646	dbuf_dirty_record_t *dr;
1647	blkptr_t *blkptr_copy = kmem_alloc(sizeof (*os->os_rootbp), KM_SLEEP);
1648	*blkptr_copy = *os->os_rootbp;
1649
1650	dprintf_ds(os->os_dsl_dataset, "txg=%llu\n", tx->tx_txg);
1651
1652	ASSERT(dmu_tx_is_syncing(tx));
1653	/* XXX the write_done callback should really give us the tx... */
1654	os->os_synctx = tx;
1655
1656	if (os->os_dsl_dataset == NULL) {
1657		/*
1658		 * This is the MOS.  If we have upgraded,
1659		 * spa_max_replication() could change, so reset
1660		 * os_copies here.
1661		 */
1662		os->os_copies = spa_max_replication(os->os_spa);
1663	}
1664
1665	/*
1666	 * Create the root block IO
1667	 */
1668	SET_BOOKMARK(&zb, os->os_dsl_dataset ?
1669	    os->os_dsl_dataset->ds_object : DMU_META_OBJSET,
1670	    ZB_ROOT_OBJECT, ZB_ROOT_LEVEL, ZB_ROOT_BLKID);
1671	arc_release(os->os_phys_buf, &os->os_phys_buf);
1672
1673	dmu_write_policy(os, NULL, 0, 0, &zp);
1674
1675	/*
1676	 * If we are either claiming the ZIL or doing a raw receive, write
1677	 * out the os_phys_buf raw. Neither of these actions will effect the
1678	 * MAC at this point.
1679	 */
1680	if (os->os_raw_receive ||
1681	    os->os_next_write_raw[tx->tx_txg & TXG_MASK]) {
1682		ASSERT(os->os_encrypted);
1683		arc_convert_to_raw(os->os_phys_buf,
1684		    os->os_dsl_dataset->ds_object, ZFS_HOST_BYTEORDER,
1685		    DMU_OT_OBJSET, NULL, NULL, NULL);
1686	}
1687
1688	zio = arc_write(pio, os->os_spa, tx->tx_txg,
1689	    blkptr_copy, os->os_phys_buf, DMU_OS_IS_L2CACHEABLE(os),
1690	    &zp, dmu_objset_write_ready, NULL, NULL, dmu_objset_write_done,
1691	    os, ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_MUSTSUCCEED, &zb);
1692
1693	/*
1694	 * Sync special dnodes - the parent IO for the sync is the root block
1695	 */
1696	DMU_META_DNODE(os)->dn_zio = zio;
1697	dnode_sync(DMU_META_DNODE(os), tx);
1698
1699	os->os_phys->os_flags = os->os_flags;
1700
1701	if (DMU_USERUSED_DNODE(os) &&
1702	    DMU_USERUSED_DNODE(os)->dn_type != DMU_OT_NONE) {
1703		DMU_USERUSED_DNODE(os)->dn_zio = zio;
1704		dnode_sync(DMU_USERUSED_DNODE(os), tx);
1705		DMU_GROUPUSED_DNODE(os)->dn_zio = zio;
1706		dnode_sync(DMU_GROUPUSED_DNODE(os), tx);
1707	}
1708
1709	if (DMU_PROJECTUSED_DNODE(os) &&
1710	    DMU_PROJECTUSED_DNODE(os)->dn_type != DMU_OT_NONE) {
1711		DMU_PROJECTUSED_DNODE(os)->dn_zio = zio;
1712		dnode_sync(DMU_PROJECTUSED_DNODE(os), tx);
1713	}
1714
1715	txgoff = tx->tx_txg & TXG_MASK;
1716
1717	if (dmu_objset_userused_enabled(os) &&
1718	    (!os->os_encrypted || !dmu_objset_is_receiving(os))) {
1719		/*
1720		 * We must create the list here because it uses the
1721		 * dn_dirty_link[] of this txg.  But it may already
1722		 * exist because we call dsl_dataset_sync() twice per txg.
1723		 */
1724		if (os->os_synced_dnodes == NULL) {
1725			os->os_synced_dnodes =
1726			    multilist_create(sizeof (dnode_t),
1727			    offsetof(dnode_t, dn_dirty_link[txgoff]),
1728			    dnode_multilist_index_func);
1729		} else {
1730			ASSERT3U(os->os_synced_dnodes->ml_offset, ==,
1731			    offsetof(dnode_t, dn_dirty_link[txgoff]));
1732		}
1733	}
1734
1735	for (int i = 0;
1736	    i < multilist_get_num_sublists(os->os_dirty_dnodes[txgoff]); i++) {
1737		sync_dnodes_arg_t *sda = kmem_alloc(sizeof (*sda), KM_SLEEP);
1738		sda->sda_list = os->os_dirty_dnodes[txgoff];
1739		sda->sda_sublist_idx = i;
1740		sda->sda_tx = tx;
1741		(void) taskq_dispatch(dmu_objset_pool(os)->dp_sync_taskq,
1742		    sync_dnodes_task, sda, 0);
1743		/* callback frees sda */
1744	}
1745	taskq_wait(dmu_objset_pool(os)->dp_sync_taskq);
1746
1747	list = &DMU_META_DNODE(os)->dn_dirty_records[txgoff];
1748	while ((dr = list_head(list)) != NULL) {
1749		ASSERT0(dr->dr_dbuf->db_level);
1750		list_remove(list, dr);
1751		if (dr->dr_zio)
1752			zio_nowait(dr->dr_zio);
1753	}
1754
1755	/* Enable dnode backfill if enough objects have been freed. */
1756	if (os->os_freed_dnodes >= dmu_rescan_dnode_threshold) {
1757		os->os_rescan_dnodes = B_TRUE;
1758		os->os_freed_dnodes = 0;
1759	}
1760
1761	/*
1762	 * Free intent log blocks up to this tx.
1763	 */
1764	zil_sync(os->os_zil, tx);
1765	os->os_phys->os_zil_header = os->os_zil_header;
1766	zio_nowait(zio);
1767}
1768
1769boolean_t
1770dmu_objset_is_dirty(objset_t *os, uint64_t txg)
1771{
1772	return (!multilist_is_empty(os->os_dirty_dnodes[txg & TXG_MASK]));
1773}
1774
1775static objset_used_cb_t *used_cbs[DMU_OST_NUMTYPES];
1776
1777void
1778dmu_objset_register_type(dmu_objset_type_t ost, objset_used_cb_t *cb)
1779{
1780	used_cbs[ost] = cb;
1781}
1782
1783boolean_t
1784dmu_objset_userused_enabled(objset_t *os)
1785{
1786	return (spa_version(os->os_spa) >= SPA_VERSION_USERSPACE &&
1787	    used_cbs[os->os_phys->os_type] != NULL &&
1788	    DMU_USERUSED_DNODE(os) != NULL);
1789}
1790
1791boolean_t
1792dmu_objset_userobjused_enabled(objset_t *os)
1793{
1794	return (dmu_objset_userused_enabled(os) &&
1795	    spa_feature_is_enabled(os->os_spa, SPA_FEATURE_USEROBJ_ACCOUNTING));
1796}
1797
1798boolean_t
1799dmu_objset_projectquota_enabled(objset_t *os)
1800{
1801	return (used_cbs[os->os_phys->os_type] != NULL &&
1802	    DMU_PROJECTUSED_DNODE(os) != NULL &&
1803	    spa_feature_is_enabled(os->os_spa, SPA_FEATURE_PROJECT_QUOTA));
1804}
1805
1806typedef struct userquota_node {
1807	/* must be in the first field, see userquota_update_cache() */
1808	char		uqn_id[20 + DMU_OBJACCT_PREFIX_LEN];
1809	int64_t		uqn_delta;
1810	avl_node_t	uqn_node;
1811} userquota_node_t;
1812
1813typedef struct userquota_cache {
1814	avl_tree_t uqc_user_deltas;
1815	avl_tree_t uqc_group_deltas;
1816	avl_tree_t uqc_project_deltas;
1817} userquota_cache_t;
1818
1819static int
1820userquota_compare(const void *l, const void *r)
1821{
1822	const userquota_node_t *luqn = l;
1823	const userquota_node_t *ruqn = r;
1824	int rv;
1825
1826	/*
1827	 * NB: can only access uqn_id because userquota_update_cache() doesn't
1828	 * pass in an entire userquota_node_t.
1829	 */
1830	rv = strcmp(luqn->uqn_id, ruqn->uqn_id);
1831
1832	return (AVL_ISIGN(rv));
1833}
1834
1835static void
1836do_userquota_cacheflush(objset_t *os, userquota_cache_t *cache, dmu_tx_t *tx)
1837{
1838	void *cookie;
1839	userquota_node_t *uqn;
1840
1841	ASSERT(dmu_tx_is_syncing(tx));
1842
1843	cookie = NULL;
1844	while ((uqn = avl_destroy_nodes(&cache->uqc_user_deltas,
1845	    &cookie)) != NULL) {
1846		/*
1847		 * os_userused_lock protects against concurrent calls to
1848		 * zap_increment_int().  It's needed because zap_increment_int()
1849		 * is not thread-safe (i.e. not atomic).
1850		 */
1851		mutex_enter(&os->os_userused_lock);
1852		VERIFY0(zap_increment(os, DMU_USERUSED_OBJECT,
1853		    uqn->uqn_id, uqn->uqn_delta, tx));
1854		mutex_exit(&os->os_userused_lock);
1855		kmem_free(uqn, sizeof (*uqn));
1856	}
1857	avl_destroy(&cache->uqc_user_deltas);
1858
1859	cookie = NULL;
1860	while ((uqn = avl_destroy_nodes(&cache->uqc_group_deltas,
1861	    &cookie)) != NULL) {
1862		mutex_enter(&os->os_userused_lock);
1863		VERIFY0(zap_increment(os, DMU_GROUPUSED_OBJECT,
1864		    uqn->uqn_id, uqn->uqn_delta, tx));
1865		mutex_exit(&os->os_userused_lock);
1866		kmem_free(uqn, sizeof (*uqn));
1867	}
1868	avl_destroy(&cache->uqc_group_deltas);
1869
1870	if (dmu_objset_projectquota_enabled(os)) {
1871		cookie = NULL;
1872		while ((uqn = avl_destroy_nodes(&cache->uqc_project_deltas,
1873		    &cookie)) != NULL) {
1874			mutex_enter(&os->os_userused_lock);
1875			VERIFY0(zap_increment(os, DMU_PROJECTUSED_OBJECT,
1876			    uqn->uqn_id, uqn->uqn_delta, tx));
1877			mutex_exit(&os->os_userused_lock);
1878			kmem_free(uqn, sizeof (*uqn));
1879		}
1880		avl_destroy(&cache->uqc_project_deltas);
1881	}
1882}
1883
1884static void
1885userquota_update_cache(avl_tree_t *avl, const char *id, int64_t delta)
1886{
1887	userquota_node_t *uqn;
1888	avl_index_t idx;
1889
1890	ASSERT(strlen(id) < sizeof (uqn->uqn_id));
1891	/*
1892	 * Use id directly for searching because uqn_id is the first field of
1893	 * userquota_node_t and fields after uqn_id won't be accessed in
1894	 * avl_find().
1895	 */
1896	uqn = avl_find(avl, (const void *)id, &idx);
1897	if (uqn == NULL) {
1898		uqn = kmem_zalloc(sizeof (*uqn), KM_SLEEP);
1899		(void) strlcpy(uqn->uqn_id, id, sizeof (uqn->uqn_id));
1900		avl_insert(avl, uqn, idx);
1901	}
1902	uqn->uqn_delta += delta;
1903}
1904
1905static void
1906do_userquota_update(objset_t *os, userquota_cache_t *cache, uint64_t used,
1907    uint64_t flags, uint64_t user, uint64_t group, uint64_t project,
1908    boolean_t subtract)
1909{
1910	if ((flags & DNODE_FLAG_USERUSED_ACCOUNTED)) {
1911		int64_t delta = DNODE_MIN_SIZE + used;
1912		char name[20];
1913
1914		if (subtract)
1915			delta = -delta;
1916
1917		(void) sprintf(name, "%llx", (longlong_t)user);
1918		userquota_update_cache(&cache->uqc_user_deltas, name, delta);
1919
1920		(void) sprintf(name, "%llx", (longlong_t)group);
1921		userquota_update_cache(&cache->uqc_group_deltas, name, delta);
1922
1923		if (dmu_objset_projectquota_enabled(os)) {
1924			(void) sprintf(name, "%llx", (longlong_t)project);
1925			userquota_update_cache(&cache->uqc_project_deltas,
1926			    name, delta);
1927		}
1928	}
1929}
1930
1931static void
1932do_userobjquota_update(objset_t *os, userquota_cache_t *cache, uint64_t flags,
1933    uint64_t user, uint64_t group, uint64_t project, boolean_t subtract)
1934{
1935	if (flags & DNODE_FLAG_USEROBJUSED_ACCOUNTED) {
1936		char name[20 + DMU_OBJACCT_PREFIX_LEN];
1937		int delta = subtract ? -1 : 1;
1938
1939		(void) snprintf(name, sizeof (name), DMU_OBJACCT_PREFIX "%llx",
1940		    (longlong_t)user);
1941		userquota_update_cache(&cache->uqc_user_deltas, name, delta);
1942
1943		(void) snprintf(name, sizeof (name), DMU_OBJACCT_PREFIX "%llx",
1944		    (longlong_t)group);
1945		userquota_update_cache(&cache->uqc_group_deltas, name, delta);
1946
1947		if (dmu_objset_projectquota_enabled(os)) {
1948			(void) snprintf(name, sizeof (name),
1949			    DMU_OBJACCT_PREFIX "%llx", (longlong_t)project);
1950			userquota_update_cache(&cache->uqc_project_deltas,
1951			    name, delta);
1952		}
1953	}
1954}
1955
1956typedef struct userquota_updates_arg {
1957	objset_t *uua_os;
1958	int uua_sublist_idx;
1959	dmu_tx_t *uua_tx;
1960} userquota_updates_arg_t;
1961
1962static void
1963userquota_updates_task(void *arg)
1964{
1965	userquota_updates_arg_t *uua = arg;
1966	objset_t *os = uua->uua_os;
1967	dmu_tx_t *tx = uua->uua_tx;
1968	dnode_t *dn;
1969	userquota_cache_t cache = { 0 };
1970
1971	multilist_sublist_t *list =
1972	    multilist_sublist_lock(os->os_synced_dnodes, uua->uua_sublist_idx);
1973
1974	ASSERT(multilist_sublist_head(list) == NULL ||
1975	    dmu_objset_userused_enabled(os));
1976	avl_create(&cache.uqc_user_deltas, userquota_compare,
1977	    sizeof (userquota_node_t), offsetof(userquota_node_t, uqn_node));
1978	avl_create(&cache.uqc_group_deltas, userquota_compare,
1979	    sizeof (userquota_node_t), offsetof(userquota_node_t, uqn_node));
1980	if (dmu_objset_projectquota_enabled(os))
1981		avl_create(&cache.uqc_project_deltas, userquota_compare,
1982		    sizeof (userquota_node_t), offsetof(userquota_node_t,
1983		    uqn_node));
1984
1985	while ((dn = multilist_sublist_head(list)) != NULL) {
1986		int flags;
1987		ASSERT(!DMU_OBJECT_IS_SPECIAL(dn->dn_object));
1988		ASSERT(dn->dn_phys->dn_type == DMU_OT_NONE ||
1989		    dn->dn_phys->dn_flags &
1990		    DNODE_FLAG_USERUSED_ACCOUNTED);
1991
1992		flags = dn->dn_id_flags;
1993		ASSERT(flags);
1994		if (flags & DN_ID_OLD_EXIST)  {
1995			do_userquota_update(os, &cache, dn->dn_oldused,
1996			    dn->dn_oldflags, dn->dn_olduid, dn->dn_oldgid,
1997			    dn->dn_oldprojid, B_TRUE);
1998			do_userobjquota_update(os, &cache, dn->dn_oldflags,
1999			    dn->dn_olduid, dn->dn_oldgid,
2000			    dn->dn_oldprojid, B_TRUE);
2001		}
2002		if (flags & DN_ID_NEW_EXIST) {
2003			do_userquota_update(os, &cache,
2004			    DN_USED_BYTES(dn->dn_phys), dn->dn_phys->dn_flags,
2005			    dn->dn_newuid, dn->dn_newgid,
2006			    dn->dn_newprojid, B_FALSE);
2007			do_userobjquota_update(os, &cache,
2008			    dn->dn_phys->dn_flags, dn->dn_newuid, dn->dn_newgid,
2009			    dn->dn_newprojid, B_FALSE);
2010		}
2011
2012		mutex_enter(&dn->dn_mtx);
2013		dn->dn_oldused = 0;
2014		dn->dn_oldflags = 0;
2015		if (dn->dn_id_flags & DN_ID_NEW_EXIST) {
2016			dn->dn_olduid = dn->dn_newuid;
2017			dn->dn_oldgid = dn->dn_newgid;
2018			dn->dn_oldprojid = dn->dn_newprojid;
2019			dn->dn_id_flags |= DN_ID_OLD_EXIST;
2020			if (dn->dn_bonuslen == 0)
2021				dn->dn_id_flags |= DN_ID_CHKED_SPILL;
2022			else
2023				dn->dn_id_flags |= DN_ID_CHKED_BONUS;
2024		}
2025		dn->dn_id_flags &= ~(DN_ID_NEW_EXIST);
2026		if (dn->dn_dirty_txg == spa_syncing_txg(os->os_spa))
2027			dn->dn_dirty_txg = 0;
2028		mutex_exit(&dn->dn_mtx);
2029
2030		multilist_sublist_remove(list, dn);
2031		dnode_rele(dn, os->os_synced_dnodes);
2032	}
2033	do_userquota_cacheflush(os, &cache, tx);
2034	multilist_sublist_unlock(list);
2035	kmem_free(uua, sizeof (*uua));
2036}
2037
2038void
2039dmu_objset_do_userquota_updates(objset_t *os, dmu_tx_t *tx)
2040{
2041	if (!dmu_objset_userused_enabled(os))
2042		return;
2043
2044	/*
2045	 * If this is a raw receive just return and handle accounting
2046	 * later when we have the keys loaded. We also don't do user
2047	 * accounting during claiming since the datasets are not owned
2048	 * for the duration of claiming and this txg should only be
2049	 * used for recovery.
2050	 */
2051	if (os->os_encrypted && dmu_objset_is_receiving(os))
2052		return;
2053
2054	if (tx->tx_txg <= os->os_spa->spa_claim_max_txg)
2055		return;
2056
2057	/* Allocate the user/group/project used objects if necessary. */
2058	if (DMU_USERUSED_DNODE(os)->dn_type == DMU_OT_NONE) {
2059		VERIFY0(zap_create_claim(os,
2060		    DMU_USERUSED_OBJECT,
2061		    DMU_OT_USERGROUP_USED, DMU_OT_NONE, 0, tx));
2062		VERIFY0(zap_create_claim(os,
2063		    DMU_GROUPUSED_OBJECT,
2064		    DMU_OT_USERGROUP_USED, DMU_OT_NONE, 0, tx));
2065	}
2066
2067	if (dmu_objset_projectquota_enabled(os) &&
2068	    DMU_PROJECTUSED_DNODE(os)->dn_type == DMU_OT_NONE) {
2069		VERIFY0(zap_create_claim(os, DMU_PROJECTUSED_OBJECT,
2070		    DMU_OT_USERGROUP_USED, DMU_OT_NONE, 0, tx));
2071	}
2072
2073	for (int i = 0;
2074	    i < multilist_get_num_sublists(os->os_synced_dnodes); i++) {
2075		userquota_updates_arg_t *uua =
2076		    kmem_alloc(sizeof (*uua), KM_SLEEP);
2077		uua->uua_os = os;
2078		uua->uua_sublist_idx = i;
2079		uua->uua_tx = tx;
2080		/* note: caller does taskq_wait() */
2081		(void) taskq_dispatch(dmu_objset_pool(os)->dp_sync_taskq,
2082		    userquota_updates_task, uua, 0);
2083		/* callback frees uua */
2084	}
2085}
2086
2087/*
2088 * Returns a pointer to data to find uid/gid from
2089 *
2090 * If a dirty record for transaction group that is syncing can't
2091 * be found then NULL is returned.  In the NULL case it is assumed
2092 * the uid/gid aren't changing.
2093 */
2094static void *
2095dmu_objset_userquota_find_data(dmu_buf_impl_t *db, dmu_tx_t *tx)
2096{
2097	dbuf_dirty_record_t *dr, **drp;
2098	void *data;
2099
2100	if (db->db_dirtycnt == 0)
2101		return (db->db.db_data);  /* Nothing is changing */
2102
2103	for (drp = &db->db_last_dirty; (dr = *drp) != NULL; drp = &dr->dr_next)
2104		if (dr->dr_txg == tx->tx_txg)
2105			break;
2106
2107	if (dr == NULL) {
2108		data = NULL;
2109	} else {
2110		dnode_t *dn;
2111
2112		DB_DNODE_ENTER(dr->dr_dbuf);
2113		dn = DB_DNODE(dr->dr_dbuf);
2114
2115		if (dn->dn_bonuslen == 0 &&
2116		    dr->dr_dbuf->db_blkid == DMU_SPILL_BLKID)
2117			data = dr->dt.dl.dr_data->b_data;
2118		else
2119			data = dr->dt.dl.dr_data;
2120
2121		DB_DNODE_EXIT(dr->dr_dbuf);
2122	}
2123
2124	return (data);
2125}
2126
2127void
2128dmu_objset_userquota_get_ids(dnode_t *dn, boolean_t before, dmu_tx_t *tx)
2129{
2130	objset_t *os = dn->dn_objset;
2131	void *data = NULL;
2132	dmu_buf_impl_t *db = NULL;
2133	uint64_t *user = NULL;
2134	uint64_t *group = NULL;
2135	uint64_t *project = NULL;
2136	int flags = dn->dn_id_flags;
2137	int error;
2138	boolean_t have_spill = B_FALSE;
2139
2140	if (!dmu_objset_userused_enabled(dn->dn_objset))
2141		return;
2142
2143	/*
2144	 * Raw receives introduce a problem with user accounting. Raw
2145	 * receives cannot update the user accounting info because the
2146	 * user ids and the sizes are encrypted. To guarantee that we
2147	 * never end up with bad user accounting, we simply disable it
2148	 * during raw receives. We also disable this for normal receives
2149	 * so that an incremental raw receive may be done on top of an
2150	 * existing non-raw receive.
2151	 */
2152	if (os->os_encrypted && dmu_objset_is_receiving(os))
2153		return;
2154
2155	if (before && (flags & (DN_ID_CHKED_BONUS|DN_ID_OLD_EXIST|
2156	    DN_ID_CHKED_SPILL)))
2157		return;
2158
2159	if (before && dn->dn_bonuslen != 0)
2160		data = DN_BONUS(dn->dn_phys);
2161	else if (!before && dn->dn_bonuslen != 0) {
2162		if (dn->dn_bonus) {
2163			db = dn->dn_bonus;
2164			mutex_enter(&db->db_mtx);
2165			data = dmu_objset_userquota_find_data(db, tx);
2166		} else {
2167			data = DN_BONUS(dn->dn_phys);
2168		}
2169	} else if (dn->dn_bonuslen == 0 && dn->dn_bonustype == DMU_OT_SA) {
2170			int rf = 0;
2171
2172			if (RW_WRITE_HELD(&dn->dn_struct_rwlock))
2173				rf |= DB_RF_HAVESTRUCT;
2174			error = dmu_spill_hold_by_dnode(dn,
2175			    rf | DB_RF_MUST_SUCCEED,
2176			    FTAG, (dmu_buf_t **)&db);
2177			ASSERT(error == 0);
2178			mutex_enter(&db->db_mtx);
2179			data = (before) ? db->db.db_data :
2180			    dmu_objset_userquota_find_data(db, tx);
2181			have_spill = B_TRUE;
2182	} else {
2183		mutex_enter(&dn->dn_mtx);
2184		dn->dn_id_flags |= DN_ID_CHKED_BONUS;
2185		mutex_exit(&dn->dn_mtx);
2186		return;
2187	}
2188
2189	if (before) {
2190		ASSERT(data);
2191		user = &dn->dn_olduid;
2192		group = &dn->dn_oldgid;
2193		project = &dn->dn_oldprojid;
2194	} else if (data) {
2195		user = &dn->dn_newuid;
2196		group = &dn->dn_newgid;
2197		project = &dn->dn_newprojid;
2198	}
2199
2200	/*
2201	 * Must always call the callback in case the object
2202	 * type has changed and that type isn't an object type to track
2203	 */
2204	error = used_cbs[os->os_phys->os_type](dn->dn_bonustype, data,
2205	    user, group, project);
2206
2207	/*
2208	 * Preserve existing uid/gid when the callback can't determine
2209	 * what the new uid/gid are and the callback returned EEXIST.
2210	 * The EEXIST error tells us to just use the existing uid/gid.
2211	 * If we don't know what the old values are then just assign
2212	 * them to 0, since that is a new file  being created.
2213	 */
2214	if (!before && data == NULL && error == EEXIST) {
2215		if (flags & DN_ID_OLD_EXIST) {
2216			dn->dn_newuid = dn->dn_olduid;
2217			dn->dn_newgid = dn->dn_oldgid;
2218			dn->dn_newgid = dn->dn_oldprojid;
2219		} else {
2220			dn->dn_newuid = 0;
2221			dn->dn_newgid = 0;
2222			dn->dn_newprojid = ZFS_DEFAULT_PROJID;
2223		}
2224		error = 0;
2225	}
2226
2227	if (db)
2228		mutex_exit(&db->db_mtx);
2229
2230	mutex_enter(&dn->dn_mtx);
2231	if (error == 0 && before)
2232		dn->dn_id_flags |= DN_ID_OLD_EXIST;
2233	if (error == 0 && !before)
2234		dn->dn_id_flags |= DN_ID_NEW_EXIST;
2235
2236	if (have_spill) {
2237		dn->dn_id_flags |= DN_ID_CHKED_SPILL;
2238	} else {
2239		dn->dn_id_flags |= DN_ID_CHKED_BONUS;
2240	}
2241	mutex_exit(&dn->dn_mtx);
2242	if (have_spill)
2243		dmu_buf_rele((dmu_buf_t *)db, FTAG);
2244}
2245
2246boolean_t
2247dmu_objset_userspace_present(objset_t *os)
2248{
2249	return (os->os_phys->os_flags &
2250	    OBJSET_FLAG_USERACCOUNTING_COMPLETE);
2251}
2252
2253boolean_t
2254dmu_objset_userobjspace_present(objset_t *os)
2255{
2256	return (os->os_phys->os_flags &
2257	    OBJSET_FLAG_USEROBJACCOUNTING_COMPLETE);
2258}
2259
2260boolean_t
2261dmu_objset_projectquota_present(objset_t *os)
2262{
2263	return (os->os_phys->os_flags &
2264	    OBJSET_FLAG_PROJECTQUOTA_COMPLETE);
2265}
2266
2267static int
2268dmu_objset_space_upgrade(objset_t *os)
2269{
2270	uint64_t obj;
2271	int err = 0;
2272
2273	/*
2274	 * We simply need to mark every object dirty, so that it will be
2275	 * synced out and now accounted.  If this is called
2276	 * concurrently, or if we already did some work before crashing,
2277	 * that's fine, since we track each object's accounted state
2278	 * independently.
2279	 */
2280
2281	for (obj = 0; err == 0; err = dmu_object_next(os, &obj, FALSE, 0)) {
2282		dmu_tx_t *tx;
2283		dmu_buf_t *db;
2284		int objerr;
2285
2286		mutex_enter(&os->os_upgrade_lock);
2287		if (os->os_upgrade_exit)
2288			err = SET_ERROR(EINTR);
2289		mutex_exit(&os->os_upgrade_lock);
2290		if (err != 0)
2291			return (err);
2292
2293		/*
2294		 * The following is only valid on Linux since we cannot send
2295		 * a signal to a kernel thread on illumos (because we have no
2296		 * lwp and never return to user-land).
2297		 *
2298		 * if (issig(JUSTLOOKING) && issig(FORREAL))
2299		 *    return (SET_ERROR(EINTR));
2300		 */
2301
2302		objerr = dmu_bonus_hold(os, obj, FTAG, &db);
2303		if (objerr != 0)
2304			continue;
2305		tx = dmu_tx_create(os);
2306		dmu_tx_hold_bonus(tx, obj);
2307		objerr = dmu_tx_assign(tx, TXG_WAIT);
2308		if (objerr != 0) {
2309			dmu_tx_abort(tx);
2310			continue;
2311		}
2312		dmu_buf_will_dirty(db, tx);
2313		dmu_buf_rele(db, FTAG);
2314		dmu_tx_commit(tx);
2315	}
2316	return (0);
2317}
2318
2319int
2320dmu_objset_userspace_upgrade(objset_t *os)
2321{
2322	int err = 0;
2323
2324	if (dmu_objset_userspace_present(os))
2325		return (0);
2326	if (dmu_objset_is_snapshot(os))
2327		return (SET_ERROR(EINVAL));
2328	if (!dmu_objset_userused_enabled(os))
2329		return (SET_ERROR(ENOTSUP));
2330
2331	err = dmu_objset_space_upgrade(os);
2332	if (err)
2333		return (err);
2334
2335	os->os_flags |= OBJSET_FLAG_USERACCOUNTING_COMPLETE;
2336	txg_wait_synced(dmu_objset_pool(os), 0);
2337	return (0);
2338}
2339
2340static int
2341dmu_objset_id_quota_upgrade_cb(objset_t *os)
2342{
2343	int err = 0;
2344
2345	if (dmu_objset_userobjspace_present(os) &&
2346	    dmu_objset_projectquota_present(os))
2347		return (0);
2348	if (dmu_objset_is_snapshot(os))
2349		return (SET_ERROR(EINVAL));
2350	if (!dmu_objset_userobjused_enabled(os))
2351		return (SET_ERROR(ENOTSUP));
2352	if (!dmu_objset_projectquota_enabled(os) &&
2353	    dmu_objset_userobjspace_present(os))
2354		return (SET_ERROR(ENOTSUP));
2355
2356	dmu_objset_ds(os)->ds_feature_activation_needed[
2357	    SPA_FEATURE_USEROBJ_ACCOUNTING] = B_TRUE;
2358	if (dmu_objset_projectquota_enabled(os))
2359		dmu_objset_ds(os)->ds_feature_activation_needed[
2360		    SPA_FEATURE_PROJECT_QUOTA] = B_TRUE;
2361
2362	err = dmu_objset_space_upgrade(os);
2363	if (err)
2364		return (err);
2365
2366	os->os_flags |= OBJSET_FLAG_USEROBJACCOUNTING_COMPLETE;
2367	if (dmu_objset_projectquota_enabled(os))
2368		os->os_flags |= OBJSET_FLAG_PROJECTQUOTA_COMPLETE;
2369
2370	txg_wait_synced(dmu_objset_pool(os), 0);
2371	return (0);
2372}
2373
2374void
2375dmu_objset_id_quota_upgrade(objset_t *os)
2376{
2377	dmu_objset_upgrade(os, dmu_objset_id_quota_upgrade_cb);
2378}
2379
2380boolean_t
2381dmu_objset_userobjspace_upgradable(objset_t *os)
2382{
2383	return (dmu_objset_type(os) == DMU_OST_ZFS &&
2384	    !dmu_objset_is_snapshot(os) &&
2385	    dmu_objset_userobjused_enabled(os) &&
2386	    !dmu_objset_userobjspace_present(os) &&
2387	    spa_writeable(dmu_objset_spa(os)));
2388}
2389
2390boolean_t
2391dmu_objset_projectquota_upgradable(objset_t *os)
2392{
2393	return (dmu_objset_type(os) == DMU_OST_ZFS &&
2394	    !dmu_objset_is_snapshot(os) &&
2395	    dmu_objset_projectquota_enabled(os) &&
2396	    !dmu_objset_projectquota_present(os) &&
2397	    spa_writeable(dmu_objset_spa(os)));
2398}
2399
2400void
2401dmu_objset_space(objset_t *os, uint64_t *refdbytesp, uint64_t *availbytesp,
2402    uint64_t *usedobjsp, uint64_t *availobjsp)
2403{
2404	dsl_dataset_space(os->os_dsl_dataset, refdbytesp, availbytesp,
2405	    usedobjsp, availobjsp);
2406}
2407
2408uint64_t
2409dmu_objset_fsid_guid(objset_t *os)
2410{
2411	return (dsl_dataset_fsid_guid(os->os_dsl_dataset));
2412}
2413
2414void
2415dmu_objset_fast_stat(objset_t *os, dmu_objset_stats_t *stat)
2416{
2417	stat->dds_type = os->os_phys->os_type;
2418	if (os->os_dsl_dataset)
2419		dsl_dataset_fast_stat(os->os_dsl_dataset, stat);
2420}
2421
2422void
2423dmu_objset_stats(objset_t *os, nvlist_t *nv)
2424{
2425	ASSERT(os->os_dsl_dataset ||
2426	    os->os_phys->os_type == DMU_OST_META);
2427
2428	if (os->os_dsl_dataset != NULL)
2429		dsl_dataset_stats(os->os_dsl_dataset, nv);
2430
2431	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_TYPE,
2432	    os->os_phys->os_type);
2433	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USERACCOUNTING,
2434	    dmu_objset_userspace_present(os));
2435}
2436
2437int
2438dmu_objset_is_snapshot(objset_t *os)
2439{
2440	if (os->os_dsl_dataset != NULL)
2441		return (os->os_dsl_dataset->ds_is_snapshot);
2442	else
2443		return (B_FALSE);
2444}
2445
2446int
2447dmu_snapshot_realname(objset_t *os, char *name, char *real, int maxlen,
2448    boolean_t *conflict)
2449{
2450	dsl_dataset_t *ds = os->os_dsl_dataset;
2451	uint64_t ignored;
2452
2453	if (dsl_dataset_phys(ds)->ds_snapnames_zapobj == 0)
2454		return (SET_ERROR(ENOENT));
2455
2456	return (zap_lookup_norm(ds->ds_dir->dd_pool->dp_meta_objset,
2457	    dsl_dataset_phys(ds)->ds_snapnames_zapobj, name, 8, 1, &ignored,
2458	    MT_NORMALIZE, real, maxlen, conflict));
2459}
2460
2461int
2462dmu_snapshot_list_next(objset_t *os, int namelen, char *name,
2463    uint64_t *idp, uint64_t *offp, boolean_t *case_conflict)
2464{
2465	dsl_dataset_t *ds = os->os_dsl_dataset;
2466	zap_cursor_t cursor;
2467	zap_attribute_t attr;
2468
2469	ASSERT(dsl_pool_config_held(dmu_objset_pool(os)));
2470
2471	if (dsl_dataset_phys(ds)->ds_snapnames_zapobj == 0)
2472		return (SET_ERROR(ENOENT));
2473
2474	zap_cursor_init_serialized(&cursor,
2475	    ds->ds_dir->dd_pool->dp_meta_objset,
2476	    dsl_dataset_phys(ds)->ds_snapnames_zapobj, *offp);
2477
2478	if (zap_cursor_retrieve(&cursor, &attr) != 0) {
2479		zap_cursor_fini(&cursor);
2480		return (SET_ERROR(ENOENT));
2481	}
2482
2483	if (strlen(attr.za_name) + 1 > namelen) {
2484		zap_cursor_fini(&cursor);
2485		return (SET_ERROR(ENAMETOOLONG));
2486	}
2487
2488	(void) strcpy(name, attr.za_name);
2489	if (idp)
2490		*idp = attr.za_first_integer;
2491	if (case_conflict)
2492		*case_conflict = attr.za_normalization_conflict;
2493	zap_cursor_advance(&cursor);
2494	*offp = zap_cursor_serialize(&cursor);
2495	zap_cursor_fini(&cursor);
2496
2497	return (0);
2498}
2499
2500int
2501dmu_dir_list_next(objset_t *os, int namelen, char *name,
2502    uint64_t *idp, uint64_t *offp)
2503{
2504	dsl_dir_t *dd = os->os_dsl_dataset->ds_dir;
2505	zap_cursor_t cursor;
2506	zap_attribute_t attr;
2507
2508	/* there is no next dir on a snapshot! */
2509	if (os->os_dsl_dataset->ds_object !=
2510	    dsl_dir_phys(dd)->dd_head_dataset_obj)
2511		return (SET_ERROR(ENOENT));
2512
2513	zap_cursor_init_serialized(&cursor,
2514	    dd->dd_pool->dp_meta_objset,
2515	    dsl_dir_phys(dd)->dd_child_dir_zapobj, *offp);
2516
2517	if (zap_cursor_retrieve(&cursor, &attr) != 0) {
2518		zap_cursor_fini(&cursor);
2519		return (SET_ERROR(ENOENT));
2520	}
2521
2522	if (strlen(attr.za_name) + 1 > namelen) {
2523		zap_cursor_fini(&cursor);
2524		return (SET_ERROR(ENAMETOOLONG));
2525	}
2526
2527	(void) strcpy(name, attr.za_name);
2528	if (idp)
2529		*idp = attr.za_first_integer;
2530	zap_cursor_advance(&cursor);
2531	*offp = zap_cursor_serialize(&cursor);
2532	zap_cursor_fini(&cursor);
2533
2534	return (0);
2535}
2536
2537typedef struct dmu_objset_find_ctx {
2538	taskq_t		*dc_tq;
2539	dsl_pool_t	*dc_dp;
2540	uint64_t	dc_ddobj;
2541	char		*dc_ddname; /* last component of ddobj's name */
2542	int		(*dc_func)(dsl_pool_t *, dsl_dataset_t *, void *);
2543	void		*dc_arg;
2544	int		dc_flags;
2545	kmutex_t	*dc_error_lock;
2546	int		*dc_error;
2547} dmu_objset_find_ctx_t;
2548
2549static void
2550dmu_objset_find_dp_impl(dmu_objset_find_ctx_t *dcp)
2551{
2552	dsl_pool_t *dp = dcp->dc_dp;
2553	dsl_dir_t *dd;
2554	dsl_dataset_t *ds;
2555	zap_cursor_t zc;
2556	zap_attribute_t *attr;
2557	uint64_t thisobj;
2558	int err = 0;
2559
2560	/* don't process if there already was an error */
2561	if (*dcp->dc_error != 0)
2562		goto out;
2563
2564	/*
2565	 * Note: passing the name (dc_ddname) here is optional, but it
2566	 * improves performance because we don't need to call
2567	 * zap_value_search() to determine the name.
2568	 */
2569	err = dsl_dir_hold_obj(dp, dcp->dc_ddobj, dcp->dc_ddname, FTAG, &dd);
2570	if (err != 0)
2571		goto out;
2572
2573	/* Don't visit hidden ($MOS & $ORIGIN) objsets. */
2574	if (dd->dd_myname[0] == '$') {
2575		dsl_dir_rele(dd, FTAG);
2576		goto out;
2577	}
2578
2579	thisobj = dsl_dir_phys(dd)->dd_head_dataset_obj;
2580	attr = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP);
2581
2582	/*
2583	 * Iterate over all children.
2584	 */
2585	if (dcp->dc_flags & DS_FIND_CHILDREN) {
2586		for (zap_cursor_init(&zc, dp->dp_meta_objset,
2587		    dsl_dir_phys(dd)->dd_child_dir_zapobj);
2588		    zap_cursor_retrieve(&zc, attr) == 0;
2589		    (void) zap_cursor_advance(&zc)) {
2590			ASSERT3U(attr->za_integer_length, ==,
2591			    sizeof (uint64_t));
2592			ASSERT3U(attr->za_num_integers, ==, 1);
2593
2594			dmu_objset_find_ctx_t *child_dcp =
2595			    kmem_alloc(sizeof (*child_dcp), KM_SLEEP);
2596			*child_dcp = *dcp;
2597			child_dcp->dc_ddobj = attr->za_first_integer;
2598			child_dcp->dc_ddname = spa_strdup(attr->za_name);
2599			if (dcp->dc_tq != NULL)
2600				(void) taskq_dispatch(dcp->dc_tq,
2601				    dmu_objset_find_dp_cb, child_dcp, TQ_SLEEP);
2602			else
2603				dmu_objset_find_dp_impl(child_dcp);
2604		}
2605		zap_cursor_fini(&zc);
2606	}
2607
2608	/*
2609	 * Iterate over all snapshots.
2610	 */
2611	if (dcp->dc_flags & DS_FIND_SNAPSHOTS) {
2612		dsl_dataset_t *ds;
2613		err = dsl_dataset_hold_obj(dp, thisobj, FTAG, &ds);
2614
2615		if (err == 0) {
2616			uint64_t snapobj;
2617
2618			snapobj = dsl_dataset_phys(ds)->ds_snapnames_zapobj;
2619			dsl_dataset_rele(ds, FTAG);
2620
2621			for (zap_cursor_init(&zc, dp->dp_meta_objset, snapobj);
2622			    zap_cursor_retrieve(&zc, attr) == 0;
2623			    (void) zap_cursor_advance(&zc)) {
2624				ASSERT3U(attr->za_integer_length, ==,
2625				    sizeof (uint64_t));
2626				ASSERT3U(attr->za_num_integers, ==, 1);
2627
2628				err = dsl_dataset_hold_obj(dp,
2629				    attr->za_first_integer, FTAG, &ds);
2630				if (err != 0)
2631					break;
2632				err = dcp->dc_func(dp, ds, dcp->dc_arg);
2633				dsl_dataset_rele(ds, FTAG);
2634				if (err != 0)
2635					break;
2636			}
2637			zap_cursor_fini(&zc);
2638		}
2639	}
2640
2641	kmem_free(attr, sizeof (zap_attribute_t));
2642
2643	if (err != 0) {
2644		dsl_dir_rele(dd, FTAG);
2645		goto out;
2646	}
2647
2648	/*
2649	 * Apply to self.
2650	 */
2651	err = dsl_dataset_hold_obj(dp, thisobj, FTAG, &ds);
2652
2653	/*
2654	 * Note: we hold the dir while calling dsl_dataset_hold_obj() so
2655	 * that the dir will remain cached, and we won't have to re-instantiate
2656	 * it (which could be expensive due to finding its name via
2657	 * zap_value_search()).
2658	 */
2659	dsl_dir_rele(dd, FTAG);
2660	if (err != 0)
2661		goto out;
2662	err = dcp->dc_func(dp, ds, dcp->dc_arg);
2663	dsl_dataset_rele(ds, FTAG);
2664
2665out:
2666	if (err != 0) {
2667		mutex_enter(dcp->dc_error_lock);
2668		/* only keep first error */
2669		if (*dcp->dc_error == 0)
2670			*dcp->dc_error = err;
2671		mutex_exit(dcp->dc_error_lock);
2672	}
2673
2674	if (dcp->dc_ddname != NULL)
2675		spa_strfree(dcp->dc_ddname);
2676	kmem_free(dcp, sizeof (*dcp));
2677}
2678
2679static void
2680dmu_objset_find_dp_cb(void *arg)
2681{
2682	dmu_objset_find_ctx_t *dcp = arg;
2683	dsl_pool_t *dp = dcp->dc_dp;
2684
2685	/*
2686	 * We need to get a pool_config_lock here, as there are several
2687	 * asssert(pool_config_held) down the stack. Getting a lock via
2688	 * dsl_pool_config_enter is risky, as it might be stalled by a
2689	 * pending writer. This would deadlock, as the write lock can
2690	 * only be granted when our parent thread gives up the lock.
2691	 * The _prio interface gives us priority over a pending writer.
2692	 */
2693	dsl_pool_config_enter_prio(dp, FTAG);
2694
2695	dmu_objset_find_dp_impl(dcp);
2696
2697	dsl_pool_config_exit(dp, FTAG);
2698}
2699
2700/*
2701 * Find objsets under and including ddobj, call func(ds) on each.
2702 * The order for the enumeration is completely undefined.
2703 * func is called with dsl_pool_config held.
2704 */
2705int
2706dmu_objset_find_dp(dsl_pool_t *dp, uint64_t ddobj,
2707    int func(dsl_pool_t *, dsl_dataset_t *, void *), void *arg, int flags)
2708{
2709	int error = 0;
2710	taskq_t *tq = NULL;
2711	int ntasks;
2712	dmu_objset_find_ctx_t *dcp;
2713	kmutex_t err_lock;
2714
2715	mutex_init(&err_lock, NULL, MUTEX_DEFAULT, NULL);
2716	dcp = kmem_alloc(sizeof (*dcp), KM_SLEEP);
2717	dcp->dc_tq = NULL;
2718	dcp->dc_dp = dp;
2719	dcp->dc_ddobj = ddobj;
2720	dcp->dc_ddname = NULL;
2721	dcp->dc_func = func;
2722	dcp->dc_arg = arg;
2723	dcp->dc_flags = flags;
2724	dcp->dc_error_lock = &err_lock;
2725	dcp->dc_error = &error;
2726
2727	if ((flags & DS_FIND_SERIALIZE) || dsl_pool_config_held_writer(dp)) {
2728		/*
2729		 * In case a write lock is held we can't make use of
2730		 * parallelism, as down the stack of the worker threads
2731		 * the lock is asserted via dsl_pool_config_held.
2732		 * In case of a read lock this is solved by getting a read
2733		 * lock in each worker thread, which isn't possible in case
2734		 * of a writer lock. So we fall back to the synchronous path
2735		 * here.
2736		 * In the future it might be possible to get some magic into
2737		 * dsl_pool_config_held in a way that it returns true for
2738		 * the worker threads so that a single lock held from this
2739		 * thread suffices. For now, stay single threaded.
2740		 */
2741		dmu_objset_find_dp_impl(dcp);
2742		mutex_destroy(&err_lock);
2743
2744		return (error);
2745	}
2746
2747	ntasks = dmu_find_threads;
2748	if (ntasks == 0)
2749		ntasks = vdev_count_leaves(dp->dp_spa) * 4;
2750	tq = taskq_create("dmu_objset_find", ntasks, minclsyspri, ntasks,
2751	    INT_MAX, 0);
2752	if (tq == NULL) {
2753		kmem_free(dcp, sizeof (*dcp));
2754		mutex_destroy(&err_lock);
2755
2756		return (SET_ERROR(ENOMEM));
2757	}
2758	dcp->dc_tq = tq;
2759
2760	/* dcp will be freed by task */
2761	(void) taskq_dispatch(tq, dmu_objset_find_dp_cb, dcp, TQ_SLEEP);
2762
2763	/*
2764	 * PORTING: this code relies on the property of taskq_wait to wait
2765	 * until no more tasks are queued and no more tasks are active. As
2766	 * we always queue new tasks from within other tasks, task_wait
2767	 * reliably waits for the full recursion to finish, even though we
2768	 * enqueue new tasks after taskq_wait has been called.
2769	 * On platforms other than illumos, taskq_wait may not have this
2770	 * property.
2771	 */
2772	taskq_wait(tq);
2773	taskq_destroy(tq);
2774	mutex_destroy(&err_lock);
2775
2776	return (error);
2777}
2778
2779/*
2780 * Find all objsets under name, and for each, call 'func(child_name, arg)'.
2781 * The dp_config_rwlock must not be held when this is called, and it
2782 * will not be held when the callback is called.
2783 * Therefore this function should only be used when the pool is not changing
2784 * (e.g. in syncing context), or the callback can deal with the possible races.
2785 */
2786static int
2787dmu_objset_find_impl(spa_t *spa, const char *name,
2788    int func(const char *, void *), void *arg, int flags)
2789{
2790	dsl_dir_t *dd;
2791	dsl_pool_t *dp = spa_get_dsl(spa);
2792	dsl_dataset_t *ds;
2793	zap_cursor_t zc;
2794	zap_attribute_t *attr;
2795	char *child;
2796	uint64_t thisobj;
2797	int err;
2798
2799	dsl_pool_config_enter(dp, FTAG);
2800
2801	err = dsl_dir_hold(dp, name, FTAG, &dd, NULL);
2802	if (err != 0) {
2803		dsl_pool_config_exit(dp, FTAG);
2804		return (err);
2805	}
2806
2807	/* Don't visit hidden ($MOS & $ORIGIN) objsets. */
2808	if (dd->dd_myname[0] == '$') {
2809		dsl_dir_rele(dd, FTAG);
2810		dsl_pool_config_exit(dp, FTAG);
2811		return (0);
2812	}
2813
2814	thisobj = dsl_dir_phys(dd)->dd_head_dataset_obj;
2815	attr = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP);
2816
2817	/*
2818	 * Iterate over all children.
2819	 */
2820	if (flags & DS_FIND_CHILDREN) {
2821		for (zap_cursor_init(&zc, dp->dp_meta_objset,
2822		    dsl_dir_phys(dd)->dd_child_dir_zapobj);
2823		    zap_cursor_retrieve(&zc, attr) == 0;
2824		    (void) zap_cursor_advance(&zc)) {
2825			ASSERT3U(attr->za_integer_length, ==,
2826			    sizeof (uint64_t));
2827			ASSERT3U(attr->za_num_integers, ==, 1);
2828
2829			child = kmem_asprintf("%s/%s", name, attr->za_name);
2830			dsl_pool_config_exit(dp, FTAG);
2831			err = dmu_objset_find_impl(spa, child,
2832			    func, arg, flags);
2833			dsl_pool_config_enter(dp, FTAG);
2834			strfree(child);
2835			if (err != 0)
2836				break;
2837		}
2838		zap_cursor_fini(&zc);
2839
2840		if (err != 0) {
2841			dsl_dir_rele(dd, FTAG);
2842			dsl_pool_config_exit(dp, FTAG);
2843			kmem_free(attr, sizeof (zap_attribute_t));
2844			return (err);
2845		}
2846	}
2847
2848	/*
2849	 * Iterate over all snapshots.
2850	 */
2851	if (flags & DS_FIND_SNAPSHOTS) {
2852		err = dsl_dataset_hold_obj(dp, thisobj, FTAG, &ds);
2853
2854		if (err == 0) {
2855			uint64_t snapobj;
2856
2857			snapobj = dsl_dataset_phys(ds)->ds_snapnames_zapobj;
2858			dsl_dataset_rele(ds, FTAG);
2859
2860			for (zap_cursor_init(&zc, dp->dp_meta_objset, snapobj);
2861			    zap_cursor_retrieve(&zc, attr) == 0;
2862			    (void) zap_cursor_advance(&zc)) {
2863				ASSERT3U(attr->za_integer_length, ==,
2864				    sizeof (uint64_t));
2865				ASSERT3U(attr->za_num_integers, ==, 1);
2866
2867				child = kmem_asprintf("%s@%s",
2868				    name, attr->za_name);
2869				dsl_pool_config_exit(dp, FTAG);
2870				err = func(child, arg);
2871				dsl_pool_config_enter(dp, FTAG);
2872				strfree(child);
2873				if (err != 0)
2874					break;
2875			}
2876			zap_cursor_fini(&zc);
2877		}
2878	}
2879
2880	dsl_dir_rele(dd, FTAG);
2881	kmem_free(attr, sizeof (zap_attribute_t));
2882	dsl_pool_config_exit(dp, FTAG);
2883
2884	if (err != 0)
2885		return (err);
2886
2887	/* Apply to self. */
2888	return (func(name, arg));
2889}
2890
2891/*
2892 * See comment above dmu_objset_find_impl().
2893 */
2894int
2895dmu_objset_find(char *name, int func(const char *, void *), void *arg,
2896    int flags)
2897{
2898	spa_t *spa;
2899	int error;
2900
2901	error = spa_open(name, &spa, FTAG);
2902	if (error != 0)
2903		return (error);
2904	error = dmu_objset_find_impl(spa, name, func, arg, flags);
2905	spa_close(spa, FTAG);
2906	return (error);
2907}
2908
2909boolean_t
2910dmu_objset_incompatible_encryption_version(objset_t *os)
2911{
2912	return (dsl_dir_incompatible_encryption_version(
2913	    os->os_dsl_dataset->ds_dir));
2914}
2915
2916void
2917dmu_objset_set_user(objset_t *os, void *user_ptr)
2918{
2919	ASSERT(MUTEX_HELD(&os->os_user_ptr_lock));
2920	os->os_user_ptr = user_ptr;
2921}
2922
2923void *
2924dmu_objset_get_user(objset_t *os)
2925{
2926	ASSERT(MUTEX_HELD(&os->os_user_ptr_lock));
2927	return (os->os_user_ptr);
2928}
2929
2930/*
2931 * Determine name of filesystem, given name of snapshot.
2932 * buf must be at least ZFS_MAX_DATASET_NAME_LEN bytes
2933 */
2934int
2935dmu_fsname(const char *snapname, char *buf)
2936{
2937	char *atp = strchr(snapname, '@');
2938	if (atp == NULL)
2939		return (SET_ERROR(EINVAL));
2940	if (atp - snapname >= ZFS_MAX_DATASET_NAME_LEN)
2941		return (SET_ERROR(ENAMETOOLONG));
2942	(void) strlcpy(buf, snapname, atp - snapname + 1);
2943	return (0);
2944}
2945
2946/*
2947 * Call when we think we're going to write/free space in open context to track
2948 * the amount of dirty data in the open txg, which is also the amount
2949 * of memory that can not be evicted until this txg syncs.
2950 */
2951void
2952dmu_objset_willuse_space(objset_t *os, int64_t space, dmu_tx_t *tx)
2953{
2954	dsl_dataset_t *ds = os->os_dsl_dataset;
2955	int64_t aspace = spa_get_worst_case_asize(os->os_spa, space);
2956
2957	if (ds != NULL) {
2958		dsl_dir_willuse_space(ds->ds_dir, aspace, tx);
2959		dsl_pool_dirty_space(dmu_tx_pool(tx), space, tx);
2960	}
2961}
2962