xref: /illumos-gate/usr/src/uts/common/fs/zfs/dsl_pool.c (revision f67950b2)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
24  * Copyright (c) 2013 Steven Hartland. All rights reserved.
25  * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
26  * Copyright (c) 2014 Integros [integros.com]
27  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
28  */
29 
30 #include <sys/dsl_pool.h>
31 #include <sys/dsl_dataset.h>
32 #include <sys/dsl_prop.h>
33 #include <sys/dsl_dir.h>
34 #include <sys/dsl_synctask.h>
35 #include <sys/dsl_scan.h>
36 #include <sys/dnode.h>
37 #include <sys/dmu_tx.h>
38 #include <sys/dmu_objset.h>
39 #include <sys/arc.h>
40 #include <sys/zap.h>
41 #include <sys/zio.h>
42 #include <sys/zfs_context.h>
43 #include <sys/fs/zfs.h>
44 #include <sys/zfs_znode.h>
45 #include <sys/spa_impl.h>
46 #include <sys/dsl_deadlist.h>
47 #include <sys/vdev_impl.h>
48 #include <sys/metaslab_impl.h>
49 #include <sys/bptree.h>
50 #include <sys/zfeature.h>
51 #include <sys/zil_impl.h>
52 #include <sys/dsl_userhold.h>
53 #include <sys/mmp.h>
54 
55 /*
56  * ZFS Write Throttle
57  * ------------------
58  *
59  * ZFS must limit the rate of incoming writes to the rate at which it is able
60  * to sync data modifications to the backend storage. Throttling by too much
61  * creates an artificial limit; throttling by too little can only be sustained
62  * for short periods and would lead to highly lumpy performance. On a per-pool
63  * basis, ZFS tracks the amount of modified (dirty) data. As operations change
64  * data, the amount of dirty data increases; as ZFS syncs out data, the amount
65  * of dirty data decreases. When the amount of dirty data exceeds a
66  * predetermined threshold further modifications are blocked until the amount
67  * of dirty data decreases (as data is synced out).
68  *
69  * The limit on dirty data is tunable, and should be adjusted according to
70  * both the IO capacity and available memory of the system. The larger the
71  * window, the more ZFS is able to aggregate and amortize metadata (and data)
72  * changes. However, memory is a limited resource, and allowing for more dirty
73  * data comes at the cost of keeping other useful data in memory (for example
74  * ZFS data cached by the ARC).
75  *
76  * Implementation
77  *
78  * As buffers are modified dsl_pool_willuse_space() increments both the per-
79  * txg (dp_dirty_pertxg[]) and poolwide (dp_dirty_total) accounting of
80  * dirty space used; dsl_pool_dirty_space() decrements those values as data
81  * is synced out from dsl_pool_sync(). While only the poolwide value is
82  * relevant, the per-txg value is useful for debugging. The tunable
83  * zfs_dirty_data_max determines the dirty space limit. Once that value is
84  * exceeded, new writes are halted until space frees up.
85  *
86  * The zfs_dirty_data_sync tunable dictates the threshold at which we
87  * ensure that there is a txg syncing (see the comment in txg.c for a full
88  * description of transaction group stages).
89  *
90  * The IO scheduler uses both the dirty space limit and current amount of
91  * dirty data as inputs. Those values affect the number of concurrent IOs ZFS
92  * issues. See the comment in vdev_queue.c for details of the IO scheduler.
93  *
94  * The delay is also calculated based on the amount of dirty data.  See the
95  * comment above dmu_tx_delay() for details.
96  */
97 
98 /*
99  * zfs_dirty_data_max will be set to zfs_dirty_data_max_percent% of all memory,
100  * capped at zfs_dirty_data_max_max.  It can also be overridden in /etc/system.
101  */
102 uint64_t zfs_dirty_data_max;
103 uint64_t zfs_dirty_data_max_max = 4ULL * 1024 * 1024 * 1024;
104 int zfs_dirty_data_max_percent = 10;
105 
106 /*
107  * If there's at least this much dirty data (as a percentage of
108  * zfs_dirty_data_max), push out a txg.  This should be less than
109  * zfs_vdev_async_write_active_min_dirty_percent.
110  */
111 uint64_t zfs_dirty_data_sync_pct = 20;
112 
113 /*
114  * Once there is this amount of dirty data, the dmu_tx_delay() will kick in
115  * and delay each transaction.
116  * This value should be >= zfs_vdev_async_write_active_max_dirty_percent.
117  */
118 int zfs_delay_min_dirty_percent = 60;
119 
120 /*
121  * This controls how quickly the delay approaches infinity.
122  * Larger values cause it to delay more for a given amount of dirty data.
123  * Therefore larger values will cause there to be less dirty data for a
124  * given throughput.
125  *
126  * For the smoothest delay, this value should be about 1 billion divided
127  * by the maximum number of operations per second.  This will smoothly
128  * handle between 10x and 1/10th this number.
129  *
130  * Note: zfs_delay_scale * zfs_dirty_data_max must be < 2^64, due to the
131  * multiply in dmu_tx_delay().
132  */
133 uint64_t zfs_delay_scale = 1000 * 1000 * 1000 / 2000;
134 
135 /*
136  * This determines the number of threads used by the dp_sync_taskq.
137  */
138 int zfs_sync_taskq_batch_pct = 75;
139 
140 /*
141  * These tunables determine the behavior of how zil_itxg_clean() is
142  * called via zil_clean() in the context of spa_sync(). When an itxg
143  * list needs to be cleaned, TQ_NOSLEEP will be used when dispatching.
144  * If the dispatch fails, the call to zil_itxg_clean() will occur
145  * synchronously in the context of spa_sync(), which can negatively
146  * impact the performance of spa_sync() (e.g. in the case of the itxg
147  * list having a large number of itxs that needs to be cleaned).
148  *
149  * Thus, these tunables can be used to manipulate the behavior of the
150  * taskq used by zil_clean(); they determine the number of taskq entries
151  * that are pre-populated when the taskq is first created (via the
152  * "zfs_zil_clean_taskq_minalloc" tunable) and the maximum number of
153  * taskq entries that are cached after an on-demand allocation (via the
154  * "zfs_zil_clean_taskq_maxalloc").
155  *
156  * The idea being, we want to try reasonably hard to ensure there will
157  * already be a taskq entry pre-allocated by the time that it is needed
158  * by zil_clean(). This way, we can avoid the possibility of an
159  * on-demand allocation of a new taskq entry from failing, which would
160  * result in zil_itxg_clean() being called synchronously from zil_clean()
161  * (which can adversely affect performance of spa_sync()).
162  *
163  * Additionally, the number of threads used by the taskq can be
164  * configured via the "zfs_zil_clean_taskq_nthr_pct" tunable.
165  */
166 int zfs_zil_clean_taskq_nthr_pct = 100;
167 int zfs_zil_clean_taskq_minalloc = 1024;
168 int zfs_zil_clean_taskq_maxalloc = 1024 * 1024;
169 
170 int
171 dsl_pool_open_special_dir(dsl_pool_t *dp, const char *name, dsl_dir_t **ddp)
172 {
173 	uint64_t obj;
174 	int err;
175 
176 	err = zap_lookup(dp->dp_meta_objset,
177 	    dsl_dir_phys(dp->dp_root_dir)->dd_child_dir_zapobj,
178 	    name, sizeof (obj), 1, &obj);
179 	if (err)
180 		return (err);
181 
182 	return (dsl_dir_hold_obj(dp, obj, name, dp, ddp));
183 }
184 
185 static dsl_pool_t *
186 dsl_pool_open_impl(spa_t *spa, uint64_t txg)
187 {
188 	dsl_pool_t *dp;
189 	blkptr_t *bp = spa_get_rootblkptr(spa);
190 
191 	dp = kmem_zalloc(sizeof (dsl_pool_t), KM_SLEEP);
192 	dp->dp_spa = spa;
193 	dp->dp_meta_rootbp = *bp;
194 	rrw_init(&dp->dp_config_rwlock, B_TRUE);
195 	txg_init(dp, txg);
196 	mmp_init(spa);
197 
198 	txg_list_create(&dp->dp_dirty_datasets, spa,
199 	    offsetof(dsl_dataset_t, ds_dirty_link));
200 	txg_list_create(&dp->dp_dirty_zilogs, spa,
201 	    offsetof(zilog_t, zl_dirty_link));
202 	txg_list_create(&dp->dp_dirty_dirs, spa,
203 	    offsetof(dsl_dir_t, dd_dirty_link));
204 	txg_list_create(&dp->dp_sync_tasks, spa,
205 	    offsetof(dsl_sync_task_t, dst_node));
206 	txg_list_create(&dp->dp_early_sync_tasks, spa,
207 	    offsetof(dsl_sync_task_t, dst_node));
208 
209 	dp->dp_sync_taskq = taskq_create("dp_sync_taskq",
210 	    zfs_sync_taskq_batch_pct, minclsyspri, 1, INT_MAX,
211 	    TASKQ_THREADS_CPU_PCT);
212 
213 	dp->dp_zil_clean_taskq = taskq_create("dp_zil_clean_taskq",
214 	    zfs_zil_clean_taskq_nthr_pct, minclsyspri,
215 	    zfs_zil_clean_taskq_minalloc,
216 	    zfs_zil_clean_taskq_maxalloc,
217 	    TASKQ_PREPOPULATE | TASKQ_THREADS_CPU_PCT);
218 
219 	mutex_init(&dp->dp_lock, NULL, MUTEX_DEFAULT, NULL);
220 	cv_init(&dp->dp_spaceavail_cv, NULL, CV_DEFAULT, NULL);
221 
222 	dp->dp_vnrele_taskq = taskq_create("zfs_vn_rele_taskq", 1, minclsyspri,
223 	    1, 4, 0);
224 
225 	return (dp);
226 }
227 
228 int
229 dsl_pool_init(spa_t *spa, uint64_t txg, dsl_pool_t **dpp)
230 {
231 	int err;
232 	dsl_pool_t *dp = dsl_pool_open_impl(spa, txg);
233 
234 	err = dmu_objset_open_impl(spa, NULL, &dp->dp_meta_rootbp,
235 	    &dp->dp_meta_objset);
236 	if (err != 0)
237 		dsl_pool_close(dp);
238 	else
239 		*dpp = dp;
240 
241 	return (err);
242 }
243 
244 int
245 dsl_pool_open(dsl_pool_t *dp)
246 {
247 	int err;
248 	dsl_dir_t *dd;
249 	dsl_dataset_t *ds;
250 	uint64_t obj;
251 
252 	rrw_enter(&dp->dp_config_rwlock, RW_WRITER, FTAG);
253 	err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
254 	    DMU_POOL_ROOT_DATASET, sizeof (uint64_t), 1,
255 	    &dp->dp_root_dir_obj);
256 	if (err)
257 		goto out;
258 
259 	err = dsl_dir_hold_obj(dp, dp->dp_root_dir_obj,
260 	    NULL, dp, &dp->dp_root_dir);
261 	if (err)
262 		goto out;
263 
264 	err = dsl_pool_open_special_dir(dp, MOS_DIR_NAME, &dp->dp_mos_dir);
265 	if (err)
266 		goto out;
267 
268 	if (spa_version(dp->dp_spa) >= SPA_VERSION_ORIGIN) {
269 		err = dsl_pool_open_special_dir(dp, ORIGIN_DIR_NAME, &dd);
270 		if (err)
271 			goto out;
272 		err = dsl_dataset_hold_obj(dp,
273 		    dsl_dir_phys(dd)->dd_head_dataset_obj, FTAG, &ds);
274 		if (err == 0) {
275 			err = dsl_dataset_hold_obj(dp,
276 			    dsl_dataset_phys(ds)->ds_prev_snap_obj, dp,
277 			    &dp->dp_origin_snap);
278 			dsl_dataset_rele(ds, FTAG);
279 		}
280 		dsl_dir_rele(dd, dp);
281 		if (err)
282 			goto out;
283 	}
284 
285 	if (spa_version(dp->dp_spa) >= SPA_VERSION_DEADLISTS) {
286 		err = dsl_pool_open_special_dir(dp, FREE_DIR_NAME,
287 		    &dp->dp_free_dir);
288 		if (err)
289 			goto out;
290 
291 		err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
292 		    DMU_POOL_FREE_BPOBJ, sizeof (uint64_t), 1, &obj);
293 		if (err)
294 			goto out;
295 		VERIFY0(bpobj_open(&dp->dp_free_bpobj,
296 		    dp->dp_meta_objset, obj));
297 	}
298 
299 	if (spa_feature_is_active(dp->dp_spa, SPA_FEATURE_OBSOLETE_COUNTS)) {
300 		err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
301 		    DMU_POOL_OBSOLETE_BPOBJ, sizeof (uint64_t), 1, &obj);
302 		if (err == 0) {
303 			VERIFY0(bpobj_open(&dp->dp_obsolete_bpobj,
304 			    dp->dp_meta_objset, obj));
305 		} else if (err == ENOENT) {
306 			/*
307 			 * We might not have created the remap bpobj yet.
308 			 */
309 			err = 0;
310 		} else {
311 			goto out;
312 		}
313 	}
314 
315 	/*
316 	 * Note: errors ignored, because the these special dirs, used for
317 	 * space accounting, are only created on demand.
318 	 */
319 	(void) dsl_pool_open_special_dir(dp, LEAK_DIR_NAME,
320 	    &dp->dp_leak_dir);
321 
322 	if (spa_feature_is_active(dp->dp_spa, SPA_FEATURE_ASYNC_DESTROY)) {
323 		err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
324 		    DMU_POOL_BPTREE_OBJ, sizeof (uint64_t), 1,
325 		    &dp->dp_bptree_obj);
326 		if (err != 0)
327 			goto out;
328 	}
329 
330 	if (spa_feature_is_active(dp->dp_spa, SPA_FEATURE_EMPTY_BPOBJ)) {
331 		err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
332 		    DMU_POOL_EMPTY_BPOBJ, sizeof (uint64_t), 1,
333 		    &dp->dp_empty_bpobj);
334 		if (err != 0)
335 			goto out;
336 	}
337 
338 	err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
339 	    DMU_POOL_TMP_USERREFS, sizeof (uint64_t), 1,
340 	    &dp->dp_tmp_userrefs_obj);
341 	if (err == ENOENT)
342 		err = 0;
343 	if (err)
344 		goto out;
345 
346 	err = dsl_scan_init(dp, dp->dp_tx.tx_open_txg);
347 
348 out:
349 	rrw_exit(&dp->dp_config_rwlock, FTAG);
350 	return (err);
351 }
352 
353 void
354 dsl_pool_close(dsl_pool_t *dp)
355 {
356 	/*
357 	 * Drop our references from dsl_pool_open().
358 	 *
359 	 * Since we held the origin_snap from "syncing" context (which
360 	 * includes pool-opening context), it actually only got a "ref"
361 	 * and not a hold, so just drop that here.
362 	 */
363 	if (dp->dp_origin_snap != NULL)
364 		dsl_dataset_rele(dp->dp_origin_snap, dp);
365 	if (dp->dp_mos_dir != NULL)
366 		dsl_dir_rele(dp->dp_mos_dir, dp);
367 	if (dp->dp_free_dir != NULL)
368 		dsl_dir_rele(dp->dp_free_dir, dp);
369 	if (dp->dp_leak_dir != NULL)
370 		dsl_dir_rele(dp->dp_leak_dir, dp);
371 	if (dp->dp_root_dir != NULL)
372 		dsl_dir_rele(dp->dp_root_dir, dp);
373 
374 	bpobj_close(&dp->dp_free_bpobj);
375 	bpobj_close(&dp->dp_obsolete_bpobj);
376 
377 	/* undo the dmu_objset_open_impl(mos) from dsl_pool_open() */
378 	if (dp->dp_meta_objset != NULL)
379 		dmu_objset_evict(dp->dp_meta_objset);
380 
381 	txg_list_destroy(&dp->dp_dirty_datasets);
382 	txg_list_destroy(&dp->dp_dirty_zilogs);
383 	txg_list_destroy(&dp->dp_sync_tasks);
384 	txg_list_destroy(&dp->dp_early_sync_tasks);
385 	txg_list_destroy(&dp->dp_dirty_dirs);
386 
387 	taskq_destroy(dp->dp_zil_clean_taskq);
388 	taskq_destroy(dp->dp_sync_taskq);
389 
390 	/*
391 	 * We can't set retry to TRUE since we're explicitly specifying
392 	 * a spa to flush. This is good enough; any missed buffers for
393 	 * this spa won't cause trouble, and they'll eventually fall
394 	 * out of the ARC just like any other unused buffer.
395 	 */
396 	arc_flush(dp->dp_spa, FALSE);
397 
398 	mmp_fini(dp->dp_spa);
399 	txg_fini(dp);
400 	dsl_scan_fini(dp);
401 	dmu_buf_user_evict_wait();
402 
403 	rrw_destroy(&dp->dp_config_rwlock);
404 	mutex_destroy(&dp->dp_lock);
405 	taskq_destroy(dp->dp_vnrele_taskq);
406 	if (dp->dp_blkstats != NULL)
407 		kmem_free(dp->dp_blkstats, sizeof (zfs_all_blkstats_t));
408 	kmem_free(dp, sizeof (dsl_pool_t));
409 }
410 
411 void
412 dsl_pool_create_obsolete_bpobj(dsl_pool_t *dp, dmu_tx_t *tx)
413 {
414 	uint64_t obj;
415 	/*
416 	 * Currently, we only create the obsolete_bpobj where there are
417 	 * indirect vdevs with referenced mappings.
418 	 */
419 	ASSERT(spa_feature_is_active(dp->dp_spa, SPA_FEATURE_DEVICE_REMOVAL));
420 	/* create and open the obsolete_bpobj */
421 	obj = bpobj_alloc(dp->dp_meta_objset, SPA_OLD_MAXBLOCKSIZE, tx);
422 	VERIFY0(bpobj_open(&dp->dp_obsolete_bpobj, dp->dp_meta_objset, obj));
423 	VERIFY0(zap_add(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
424 	    DMU_POOL_OBSOLETE_BPOBJ, sizeof (uint64_t), 1, &obj, tx));
425 	spa_feature_incr(dp->dp_spa, SPA_FEATURE_OBSOLETE_COUNTS, tx);
426 }
427 
428 void
429 dsl_pool_destroy_obsolete_bpobj(dsl_pool_t *dp, dmu_tx_t *tx)
430 {
431 	spa_feature_decr(dp->dp_spa, SPA_FEATURE_OBSOLETE_COUNTS, tx);
432 	VERIFY0(zap_remove(dp->dp_meta_objset,
433 	    DMU_POOL_DIRECTORY_OBJECT,
434 	    DMU_POOL_OBSOLETE_BPOBJ, tx));
435 	bpobj_free(dp->dp_meta_objset,
436 	    dp->dp_obsolete_bpobj.bpo_object, tx);
437 	bpobj_close(&dp->dp_obsolete_bpobj);
438 }
439 
440 dsl_pool_t *
441 dsl_pool_create(spa_t *spa, nvlist_t *zplprops, dsl_crypto_params_t *dcp,
442     uint64_t txg)
443 {
444 	int err;
445 	dsl_pool_t *dp = dsl_pool_open_impl(spa, txg);
446 	dmu_tx_t *tx = dmu_tx_create_assigned(dp, txg);
447 	dsl_dataset_t *ds;
448 	uint64_t obj;
449 
450 	rrw_enter(&dp->dp_config_rwlock, RW_WRITER, FTAG);
451 
452 	/* create and open the MOS (meta-objset) */
453 	dp->dp_meta_objset = dmu_objset_create_impl(spa,
454 	    NULL, &dp->dp_meta_rootbp, DMU_OST_META, tx);
455 	spa->spa_meta_objset = dp->dp_meta_objset;
456 
457 	/* create the pool directory */
458 	err = zap_create_claim(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
459 	    DMU_OT_OBJECT_DIRECTORY, DMU_OT_NONE, 0, tx);
460 	ASSERT0(err);
461 
462 	/* Initialize scan structures */
463 	VERIFY0(dsl_scan_init(dp, txg));
464 
465 	/* create and open the root dir */
466 	dp->dp_root_dir_obj = dsl_dir_create_sync(dp, NULL, NULL, tx);
467 	VERIFY0(dsl_dir_hold_obj(dp, dp->dp_root_dir_obj,
468 	    NULL, dp, &dp->dp_root_dir));
469 
470 	/* create and open the meta-objset dir */
471 	(void) dsl_dir_create_sync(dp, dp->dp_root_dir, MOS_DIR_NAME, tx);
472 	VERIFY0(dsl_pool_open_special_dir(dp,
473 	    MOS_DIR_NAME, &dp->dp_mos_dir));
474 
475 	if (spa_version(spa) >= SPA_VERSION_DEADLISTS) {
476 		/* create and open the free dir */
477 		(void) dsl_dir_create_sync(dp, dp->dp_root_dir,
478 		    FREE_DIR_NAME, tx);
479 		VERIFY0(dsl_pool_open_special_dir(dp,
480 		    FREE_DIR_NAME, &dp->dp_free_dir));
481 
482 		/* create and open the free_bplist */
483 		obj = bpobj_alloc(dp->dp_meta_objset, SPA_OLD_MAXBLOCKSIZE, tx);
484 		VERIFY(zap_add(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
485 		    DMU_POOL_FREE_BPOBJ, sizeof (uint64_t), 1, &obj, tx) == 0);
486 		VERIFY0(bpobj_open(&dp->dp_free_bpobj,
487 		    dp->dp_meta_objset, obj));
488 	}
489 
490 	if (spa_version(spa) >= SPA_VERSION_DSL_SCRUB)
491 		dsl_pool_create_origin(dp, tx);
492 
493 	/*
494 	 * Some features may be needed when creating the root dataset, so we
495 	 * create the feature objects here.
496 	 */
497 	if (spa_version(spa) >= SPA_VERSION_FEATURES)
498 		spa_feature_create_zap_objects(spa, tx);
499 
500 	if (dcp != NULL && dcp->cp_crypt != ZIO_CRYPT_OFF &&
501 	    dcp->cp_crypt != ZIO_CRYPT_INHERIT)
502 		spa_feature_enable(spa, SPA_FEATURE_ENCRYPTION, tx);
503 
504 	/* create the root dataset */
505 	obj = dsl_dataset_create_sync_dd(dp->dp_root_dir, NULL, dcp, 0, tx);
506 
507 	/* create the root objset */
508 	VERIFY0(dsl_dataset_hold_obj_flags(dp, obj,
509 	    DS_HOLD_FLAG_DECRYPT, FTAG, &ds));
510 #ifdef _KERNEL
511 	{
512 		objset_t *os;
513 		rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG);
514 		os = dmu_objset_create_impl(dp->dp_spa, ds,
515 		    dsl_dataset_get_blkptr(ds), DMU_OST_ZFS, tx);
516 		rrw_exit(&ds->ds_bp_rwlock, FTAG);
517 		zfs_create_fs(os, kcred, zplprops, tx);
518 	}
519 #endif
520 	dsl_dataset_rele_flags(ds, DS_HOLD_FLAG_DECRYPT, FTAG);
521 
522 	dmu_tx_commit(tx);
523 
524 	rrw_exit(&dp->dp_config_rwlock, FTAG);
525 
526 	return (dp);
527 }
528 
529 /*
530  * Account for the meta-objset space in its placeholder dsl_dir.
531  */
532 void
533 dsl_pool_mos_diduse_space(dsl_pool_t *dp,
534     int64_t used, int64_t comp, int64_t uncomp)
535 {
536 	ASSERT3U(comp, ==, uncomp); /* it's all metadata */
537 	mutex_enter(&dp->dp_lock);
538 	dp->dp_mos_used_delta += used;
539 	dp->dp_mos_compressed_delta += comp;
540 	dp->dp_mos_uncompressed_delta += uncomp;
541 	mutex_exit(&dp->dp_lock);
542 }
543 
544 static void
545 dsl_pool_sync_mos(dsl_pool_t *dp, dmu_tx_t *tx)
546 {
547 	zio_t *zio = zio_root(dp->dp_spa, NULL, NULL, ZIO_FLAG_MUSTSUCCEED);
548 	dmu_objset_sync(dp->dp_meta_objset, zio, tx);
549 	VERIFY0(zio_wait(zio));
550 	dprintf_bp(&dp->dp_meta_rootbp, "meta objset rootbp is %s", "");
551 	spa_set_rootblkptr(dp->dp_spa, &dp->dp_meta_rootbp);
552 }
553 
554 static void
555 dsl_pool_dirty_delta(dsl_pool_t *dp, int64_t delta)
556 {
557 	ASSERT(MUTEX_HELD(&dp->dp_lock));
558 
559 	if (delta < 0)
560 		ASSERT3U(-delta, <=, dp->dp_dirty_total);
561 
562 	dp->dp_dirty_total += delta;
563 
564 	/*
565 	 * Note: we signal even when increasing dp_dirty_total.
566 	 * This ensures forward progress -- each thread wakes the next waiter.
567 	 */
568 	if (dp->dp_dirty_total < zfs_dirty_data_max)
569 		cv_signal(&dp->dp_spaceavail_cv);
570 }
571 
572 static boolean_t
573 dsl_early_sync_task_verify(dsl_pool_t *dp, uint64_t txg)
574 {
575 	spa_t *spa = dp->dp_spa;
576 	vdev_t *rvd = spa->spa_root_vdev;
577 
578 	for (uint64_t c = 0; c < rvd->vdev_children; c++) {
579 		vdev_t *vd = rvd->vdev_child[c];
580 		txg_list_t *tl = &vd->vdev_ms_list;
581 		metaslab_t *ms;
582 
583 		for (ms = txg_list_head(tl, TXG_CLEAN(txg)); ms;
584 		    ms = txg_list_next(tl, ms, TXG_CLEAN(txg))) {
585 			VERIFY(range_tree_is_empty(ms->ms_freeing));
586 			VERIFY(range_tree_is_empty(ms->ms_checkpointing));
587 		}
588 	}
589 
590 	return (B_TRUE);
591 }
592 
593 void
594 dsl_pool_sync(dsl_pool_t *dp, uint64_t txg)
595 {
596 	zio_t *zio;
597 	dmu_tx_t *tx;
598 	dsl_dir_t *dd;
599 	dsl_dataset_t *ds;
600 	objset_t *mos = dp->dp_meta_objset;
601 	list_t synced_datasets;
602 
603 	list_create(&synced_datasets, sizeof (dsl_dataset_t),
604 	    offsetof(dsl_dataset_t, ds_synced_link));
605 
606 	tx = dmu_tx_create_assigned(dp, txg);
607 
608 	/*
609 	 * Run all early sync tasks before writing out any dirty blocks.
610 	 * For more info on early sync tasks see block comment in
611 	 * dsl_early_sync_task().
612 	 */
613 	if (!txg_list_empty(&dp->dp_early_sync_tasks, txg)) {
614 		dsl_sync_task_t *dst;
615 
616 		ASSERT3U(spa_sync_pass(dp->dp_spa), ==, 1);
617 		while ((dst =
618 		    txg_list_remove(&dp->dp_early_sync_tasks, txg)) != NULL) {
619 			ASSERT(dsl_early_sync_task_verify(dp, txg));
620 			dsl_sync_task_sync(dst, tx);
621 		}
622 		ASSERT(dsl_early_sync_task_verify(dp, txg));
623 	}
624 
625 	/*
626 	 * Write out all dirty blocks of dirty datasets.
627 	 */
628 	zio = zio_root(dp->dp_spa, NULL, NULL, ZIO_FLAG_MUSTSUCCEED);
629 	while ((ds = txg_list_remove(&dp->dp_dirty_datasets, txg)) != NULL) {
630 		/*
631 		 * We must not sync any non-MOS datasets twice, because
632 		 * we may have taken a snapshot of them.  However, we
633 		 * may sync newly-created datasets on pass 2.
634 		 */
635 		ASSERT(!list_link_active(&ds->ds_synced_link));
636 		list_insert_tail(&synced_datasets, ds);
637 		dsl_dataset_sync(ds, zio, tx);
638 	}
639 	VERIFY0(zio_wait(zio));
640 
641 	/*
642 	 * We have written all of the accounted dirty data, so our
643 	 * dp_space_towrite should now be zero.  However, some seldom-used
644 	 * code paths do not adhere to this (e.g. dbuf_undirty(), also
645 	 * rounding error in dbuf_write_physdone).
646 	 * Shore up the accounting of any dirtied space now.
647 	 */
648 	dsl_pool_undirty_space(dp, dp->dp_dirty_pertxg[txg & TXG_MASK], txg);
649 
650 	/*
651 	 * Update the long range free counter after
652 	 * we're done syncing user data
653 	 */
654 	mutex_enter(&dp->dp_lock);
655 	ASSERT(spa_sync_pass(dp->dp_spa) == 1 ||
656 	    dp->dp_long_free_dirty_pertxg[txg & TXG_MASK] == 0);
657 	dp->dp_long_free_dirty_pertxg[txg & TXG_MASK] = 0;
658 	mutex_exit(&dp->dp_lock);
659 
660 	/*
661 	 * After the data blocks have been written (ensured by the zio_wait()
662 	 * above), update the user/group/project space accounting.  This happens
663 	 * in tasks dispatched to dp_sync_taskq, so wait for them before
664 	 * continuing.
665 	 */
666 	for (ds = list_head(&synced_datasets); ds != NULL;
667 	    ds = list_next(&synced_datasets, ds)) {
668 		dmu_objset_do_userquota_updates(ds->ds_objset, tx);
669 	}
670 	taskq_wait(dp->dp_sync_taskq);
671 
672 	/*
673 	 * Sync the datasets again to push out the changes due to
674 	 * userspace updates.  This must be done before we process the
675 	 * sync tasks, so that any snapshots will have the correct
676 	 * user accounting information (and we won't get confused
677 	 * about which blocks are part of the snapshot).
678 	 */
679 	zio = zio_root(dp->dp_spa, NULL, NULL, ZIO_FLAG_MUSTSUCCEED);
680 	while ((ds = txg_list_remove(&dp->dp_dirty_datasets, txg)) != NULL) {
681 		objset_t *os = ds->ds_objset;
682 
683 		ASSERT(list_link_active(&ds->ds_synced_link));
684 		dmu_buf_rele(ds->ds_dbuf, ds);
685 		dsl_dataset_sync(ds, zio, tx);
686 
687 		/*
688 		 * Release any key mappings created by calls to
689 		 * dsl_dataset_dirty() from the userquota accounting
690 		 * code paths.
691 		 */
692 		if (os->os_encrypted && !os->os_raw_receive &&
693 		    !os->os_next_write_raw[txg & TXG_MASK]) {
694 			ASSERT3P(ds->ds_key_mapping, !=, NULL);
695 			key_mapping_rele(dp->dp_spa, ds->ds_key_mapping, ds);
696 		}
697 	}
698 	VERIFY0(zio_wait(zio));
699 
700 	/*
701 	 * Now that the datasets have been completely synced, we can
702 	 * clean up our in-memory structures accumulated while syncing:
703 	 *
704 	 *  - move dead blocks from the pending deadlist to the on-disk deadlist
705 	 *  - release hold from dsl_dataset_dirty()
706 	 *  - release key mapping hold from dsl_dataset_dirty()
707 	 */
708 	while ((ds = list_remove_head(&synced_datasets)) != NULL) {
709 		objset_t *os = ds->ds_objset;
710 
711 		if (os->os_encrypted && !os->os_raw_receive &&
712 		    !os->os_next_write_raw[txg & TXG_MASK]) {
713 			ASSERT3P(ds->ds_key_mapping, !=, NULL);
714 			key_mapping_rele(dp->dp_spa, ds->ds_key_mapping, ds);
715 		}
716 
717 		dsl_dataset_sync_done(ds, tx);
718 	}
719 	while ((dd = txg_list_remove(&dp->dp_dirty_dirs, txg)) != NULL) {
720 		dsl_dir_sync(dd, tx);
721 	}
722 
723 	/*
724 	 * The MOS's space is accounted for in the pool/$MOS
725 	 * (dp_mos_dir).  We can't modify the mos while we're syncing
726 	 * it, so we remember the deltas and apply them here.
727 	 */
728 	if (dp->dp_mos_used_delta != 0 || dp->dp_mos_compressed_delta != 0 ||
729 	    dp->dp_mos_uncompressed_delta != 0) {
730 		dsl_dir_diduse_space(dp->dp_mos_dir, DD_USED_HEAD,
731 		    dp->dp_mos_used_delta,
732 		    dp->dp_mos_compressed_delta,
733 		    dp->dp_mos_uncompressed_delta, tx);
734 		dp->dp_mos_used_delta = 0;
735 		dp->dp_mos_compressed_delta = 0;
736 		dp->dp_mos_uncompressed_delta = 0;
737 	}
738 
739 	if (!multilist_is_empty(mos->os_dirty_dnodes[txg & TXG_MASK])) {
740 		dsl_pool_sync_mos(dp, tx);
741 	}
742 
743 	/*
744 	 * If we modify a dataset in the same txg that we want to destroy it,
745 	 * its dsl_dir's dd_dbuf will be dirty, and thus have a hold on it.
746 	 * dsl_dir_destroy_check() will fail if there are unexpected holds.
747 	 * Therefore, we want to sync the MOS (thus syncing the dd_dbuf
748 	 * and clearing the hold on it) before we process the sync_tasks.
749 	 * The MOS data dirtied by the sync_tasks will be synced on the next
750 	 * pass.
751 	 */
752 	if (!txg_list_empty(&dp->dp_sync_tasks, txg)) {
753 		dsl_sync_task_t *dst;
754 		/*
755 		 * No more sync tasks should have been added while we
756 		 * were syncing.
757 		 */
758 		ASSERT3U(spa_sync_pass(dp->dp_spa), ==, 1);
759 		while ((dst = txg_list_remove(&dp->dp_sync_tasks, txg)) != NULL)
760 			dsl_sync_task_sync(dst, tx);
761 	}
762 
763 	dmu_tx_commit(tx);
764 
765 	DTRACE_PROBE2(dsl_pool_sync__done, dsl_pool_t *dp, dp, uint64_t, txg);
766 }
767 
768 void
769 dsl_pool_sync_done(dsl_pool_t *dp, uint64_t txg)
770 {
771 	zilog_t *zilog;
772 
773 	while (zilog = txg_list_head(&dp->dp_dirty_zilogs, txg)) {
774 		dsl_dataset_t *ds = dmu_objset_ds(zilog->zl_os);
775 		/*
776 		 * We don't remove the zilog from the dp_dirty_zilogs
777 		 * list until after we've cleaned it. This ensures that
778 		 * callers of zilog_is_dirty() receive an accurate
779 		 * answer when they are racing with the spa sync thread.
780 		 */
781 		zil_clean(zilog, txg);
782 		(void) txg_list_remove_this(&dp->dp_dirty_zilogs, zilog, txg);
783 		ASSERT(!dmu_objset_is_dirty(zilog->zl_os, txg));
784 		dmu_buf_rele(ds->ds_dbuf, zilog);
785 	}
786 	ASSERT(!dmu_objset_is_dirty(dp->dp_meta_objset, txg));
787 }
788 
789 /*
790  * TRUE if the current thread is the tx_sync_thread or if we
791  * are being called from SPA context during pool initialization.
792  */
793 int
794 dsl_pool_sync_context(dsl_pool_t *dp)
795 {
796 	return (curthread == dp->dp_tx.tx_sync_thread ||
797 	    spa_is_initializing(dp->dp_spa) ||
798 	    taskq_member(dp->dp_sync_taskq, curthread));
799 }
800 
801 /*
802  * This function returns the amount of allocatable space in the pool
803  * minus whatever space is currently reserved by ZFS for specific
804  * purposes. Specifically:
805  *
806  * 1] Any reserved SLOP space
807  * 2] Any space used by the checkpoint
808  * 3] Any space used for deferred frees
809  *
810  * The latter 2 are especially important because they are needed to
811  * rectify the SPA's and DMU's different understanding of how much space
812  * is used. Now the DMU is aware of that extra space tracked by the SPA
813  * without having to maintain a separate special dir (e.g similar to
814  * $MOS, $FREEING, and $LEAKED).
815  *
816  * Note: By deferred frees here, we mean the frees that were deferred
817  * in spa_sync() after sync pass 1 (spa_deferred_bpobj), and not the
818  * segments placed in ms_defer trees during metaslab_sync_done().
819  */
820 uint64_t
821 dsl_pool_adjustedsize(dsl_pool_t *dp, zfs_space_check_t slop_policy)
822 {
823 	spa_t *spa = dp->dp_spa;
824 	uint64_t space, resv, adjustedsize;
825 	uint64_t spa_deferred_frees =
826 	    spa->spa_deferred_bpobj.bpo_phys->bpo_bytes;
827 
828 	space = spa_get_dspace(spa)
829 	    - spa_get_checkpoint_space(spa) - spa_deferred_frees;
830 	resv = spa_get_slop_space(spa);
831 
832 	switch (slop_policy) {
833 	case ZFS_SPACE_CHECK_NORMAL:
834 		break;
835 	case ZFS_SPACE_CHECK_RESERVED:
836 		resv >>= 1;
837 		break;
838 	case ZFS_SPACE_CHECK_EXTRA_RESERVED:
839 		resv >>= 2;
840 		break;
841 	case ZFS_SPACE_CHECK_NONE:
842 		resv = 0;
843 		break;
844 	default:
845 		panic("invalid slop policy value: %d", slop_policy);
846 		break;
847 	}
848 	adjustedsize = (space >= resv) ? (space - resv) : 0;
849 
850 	return (adjustedsize);
851 }
852 
853 uint64_t
854 dsl_pool_unreserved_space(dsl_pool_t *dp, zfs_space_check_t slop_policy)
855 {
856 	uint64_t poolsize = dsl_pool_adjustedsize(dp, slop_policy);
857 	uint64_t deferred =
858 	    metaslab_class_get_deferred(spa_normal_class(dp->dp_spa));
859 	uint64_t quota = (poolsize >= deferred) ? (poolsize - deferred) : 0;
860 	return (quota);
861 }
862 
863 boolean_t
864 dsl_pool_need_dirty_delay(dsl_pool_t *dp)
865 {
866 	uint64_t delay_min_bytes =
867 	    zfs_dirty_data_max * zfs_delay_min_dirty_percent / 100;
868 	uint64_t dirty_min_bytes =
869 	    zfs_dirty_data_max * zfs_dirty_data_sync_pct / 100;
870 	boolean_t rv;
871 
872 	mutex_enter(&dp->dp_lock);
873 	if (dp->dp_dirty_total > dirty_min_bytes)
874 		txg_kick(dp);
875 	rv = (dp->dp_dirty_total > delay_min_bytes);
876 	mutex_exit(&dp->dp_lock);
877 	return (rv);
878 }
879 
880 void
881 dsl_pool_dirty_space(dsl_pool_t *dp, int64_t space, dmu_tx_t *tx)
882 {
883 	if (space > 0) {
884 		mutex_enter(&dp->dp_lock);
885 		dp->dp_dirty_pertxg[tx->tx_txg & TXG_MASK] += space;
886 		dsl_pool_dirty_delta(dp, space);
887 		mutex_exit(&dp->dp_lock);
888 	}
889 }
890 
891 void
892 dsl_pool_undirty_space(dsl_pool_t *dp, int64_t space, uint64_t txg)
893 {
894 	ASSERT3S(space, >=, 0);
895 	if (space == 0)
896 		return;
897 	mutex_enter(&dp->dp_lock);
898 	if (dp->dp_dirty_pertxg[txg & TXG_MASK] < space) {
899 		/* XXX writing something we didn't dirty? */
900 		space = dp->dp_dirty_pertxg[txg & TXG_MASK];
901 	}
902 	ASSERT3U(dp->dp_dirty_pertxg[txg & TXG_MASK], >=, space);
903 	dp->dp_dirty_pertxg[txg & TXG_MASK] -= space;
904 	ASSERT3U(dp->dp_dirty_total, >=, space);
905 	dsl_pool_dirty_delta(dp, -space);
906 	mutex_exit(&dp->dp_lock);
907 }
908 
909 /* ARGSUSED */
910 static int
911 upgrade_clones_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
912 {
913 	dmu_tx_t *tx = arg;
914 	dsl_dataset_t *ds, *prev = NULL;
915 	int err;
916 
917 	err = dsl_dataset_hold_obj(dp, hds->ds_object, FTAG, &ds);
918 	if (err)
919 		return (err);
920 
921 	while (dsl_dataset_phys(ds)->ds_prev_snap_obj != 0) {
922 		err = dsl_dataset_hold_obj(dp,
923 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, FTAG, &prev);
924 		if (err) {
925 			dsl_dataset_rele(ds, FTAG);
926 			return (err);
927 		}
928 
929 		if (dsl_dataset_phys(prev)->ds_next_snap_obj != ds->ds_object)
930 			break;
931 		dsl_dataset_rele(ds, FTAG);
932 		ds = prev;
933 		prev = NULL;
934 	}
935 
936 	if (prev == NULL) {
937 		prev = dp->dp_origin_snap;
938 
939 		/*
940 		 * The $ORIGIN can't have any data, or the accounting
941 		 * will be wrong.
942 		 */
943 		rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG);
944 		ASSERT0(dsl_dataset_phys(prev)->ds_bp.blk_birth);
945 		rrw_exit(&ds->ds_bp_rwlock, FTAG);
946 
947 		/* The origin doesn't get attached to itself */
948 		if (ds->ds_object == prev->ds_object) {
949 			dsl_dataset_rele(ds, FTAG);
950 			return (0);
951 		}
952 
953 		dmu_buf_will_dirty(ds->ds_dbuf, tx);
954 		dsl_dataset_phys(ds)->ds_prev_snap_obj = prev->ds_object;
955 		dsl_dataset_phys(ds)->ds_prev_snap_txg =
956 		    dsl_dataset_phys(prev)->ds_creation_txg;
957 
958 		dmu_buf_will_dirty(ds->ds_dir->dd_dbuf, tx);
959 		dsl_dir_phys(ds->ds_dir)->dd_origin_obj = prev->ds_object;
960 
961 		dmu_buf_will_dirty(prev->ds_dbuf, tx);
962 		dsl_dataset_phys(prev)->ds_num_children++;
963 
964 		if (dsl_dataset_phys(ds)->ds_next_snap_obj == 0) {
965 			ASSERT(ds->ds_prev == NULL);
966 			VERIFY0(dsl_dataset_hold_obj(dp,
967 			    dsl_dataset_phys(ds)->ds_prev_snap_obj,
968 			    ds, &ds->ds_prev));
969 		}
970 	}
971 
972 	ASSERT3U(dsl_dir_phys(ds->ds_dir)->dd_origin_obj, ==, prev->ds_object);
973 	ASSERT3U(dsl_dataset_phys(ds)->ds_prev_snap_obj, ==, prev->ds_object);
974 
975 	if (dsl_dataset_phys(prev)->ds_next_clones_obj == 0) {
976 		dmu_buf_will_dirty(prev->ds_dbuf, tx);
977 		dsl_dataset_phys(prev)->ds_next_clones_obj =
978 		    zap_create(dp->dp_meta_objset,
979 		    DMU_OT_NEXT_CLONES, DMU_OT_NONE, 0, tx);
980 	}
981 	VERIFY0(zap_add_int(dp->dp_meta_objset,
982 	    dsl_dataset_phys(prev)->ds_next_clones_obj, ds->ds_object, tx));
983 
984 	dsl_dataset_rele(ds, FTAG);
985 	if (prev != dp->dp_origin_snap)
986 		dsl_dataset_rele(prev, FTAG);
987 	return (0);
988 }
989 
990 void
991 dsl_pool_upgrade_clones(dsl_pool_t *dp, dmu_tx_t *tx)
992 {
993 	ASSERT(dmu_tx_is_syncing(tx));
994 	ASSERT(dp->dp_origin_snap != NULL);
995 
996 	VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj, upgrade_clones_cb,
997 	    tx, DS_FIND_CHILDREN | DS_FIND_SERIALIZE));
998 }
999 
1000 /* ARGSUSED */
1001 static int
1002 upgrade_dir_clones_cb(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg)
1003 {
1004 	dmu_tx_t *tx = arg;
1005 	objset_t *mos = dp->dp_meta_objset;
1006 
1007 	if (dsl_dir_phys(ds->ds_dir)->dd_origin_obj != 0) {
1008 		dsl_dataset_t *origin;
1009 
1010 		VERIFY0(dsl_dataset_hold_obj(dp,
1011 		    dsl_dir_phys(ds->ds_dir)->dd_origin_obj, FTAG, &origin));
1012 
1013 		if (dsl_dir_phys(origin->ds_dir)->dd_clones == 0) {
1014 			dmu_buf_will_dirty(origin->ds_dir->dd_dbuf, tx);
1015 			dsl_dir_phys(origin->ds_dir)->dd_clones =
1016 			    zap_create(mos, DMU_OT_DSL_CLONES, DMU_OT_NONE,
1017 			    0, tx);
1018 		}
1019 
1020 		VERIFY0(zap_add_int(dp->dp_meta_objset,
1021 		    dsl_dir_phys(origin->ds_dir)->dd_clones,
1022 		    ds->ds_object, tx));
1023 
1024 		dsl_dataset_rele(origin, FTAG);
1025 	}
1026 	return (0);
1027 }
1028 
1029 void
1030 dsl_pool_upgrade_dir_clones(dsl_pool_t *dp, dmu_tx_t *tx)
1031 {
1032 	ASSERT(dmu_tx_is_syncing(tx));
1033 	uint64_t obj;
1034 
1035 	(void) dsl_dir_create_sync(dp, dp->dp_root_dir, FREE_DIR_NAME, tx);
1036 	VERIFY0(dsl_pool_open_special_dir(dp,
1037 	    FREE_DIR_NAME, &dp->dp_free_dir));
1038 
1039 	/*
1040 	 * We can't use bpobj_alloc(), because spa_version() still
1041 	 * returns the old version, and we need a new-version bpobj with
1042 	 * subobj support.  So call dmu_object_alloc() directly.
1043 	 */
1044 	obj = dmu_object_alloc(dp->dp_meta_objset, DMU_OT_BPOBJ,
1045 	    SPA_OLD_MAXBLOCKSIZE, DMU_OT_BPOBJ_HDR, sizeof (bpobj_phys_t), tx);
1046 	VERIFY0(zap_add(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
1047 	    DMU_POOL_FREE_BPOBJ, sizeof (uint64_t), 1, &obj, tx));
1048 	VERIFY0(bpobj_open(&dp->dp_free_bpobj, dp->dp_meta_objset, obj));
1049 
1050 	VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
1051 	    upgrade_dir_clones_cb, tx, DS_FIND_CHILDREN | DS_FIND_SERIALIZE));
1052 }
1053 
1054 void
1055 dsl_pool_create_origin(dsl_pool_t *dp, dmu_tx_t *tx)
1056 {
1057 	uint64_t dsobj;
1058 	dsl_dataset_t *ds;
1059 
1060 	ASSERT(dmu_tx_is_syncing(tx));
1061 	ASSERT(dp->dp_origin_snap == NULL);
1062 	ASSERT(rrw_held(&dp->dp_config_rwlock, RW_WRITER));
1063 
1064 	/* create the origin dir, ds, & snap-ds */
1065 	dsobj = dsl_dataset_create_sync(dp->dp_root_dir, ORIGIN_DIR_NAME,
1066 	    NULL, 0, kcred, NULL, tx);
1067 	VERIFY0(dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds));
1068 	dsl_dataset_snapshot_sync_impl(ds, ORIGIN_DIR_NAME, tx);
1069 	VERIFY0(dsl_dataset_hold_obj(dp, dsl_dataset_phys(ds)->ds_prev_snap_obj,
1070 	    dp, &dp->dp_origin_snap));
1071 	dsl_dataset_rele(ds, FTAG);
1072 }
1073 
1074 taskq_t *
1075 dsl_pool_vnrele_taskq(dsl_pool_t *dp)
1076 {
1077 	return (dp->dp_vnrele_taskq);
1078 }
1079 
1080 /*
1081  * Walk through the pool-wide zap object of temporary snapshot user holds
1082  * and release them.
1083  */
1084 void
1085 dsl_pool_clean_tmp_userrefs(dsl_pool_t *dp)
1086 {
1087 	zap_attribute_t za;
1088 	zap_cursor_t zc;
1089 	objset_t *mos = dp->dp_meta_objset;
1090 	uint64_t zapobj = dp->dp_tmp_userrefs_obj;
1091 	nvlist_t *holds;
1092 
1093 	if (zapobj == 0)
1094 		return;
1095 	ASSERT(spa_version(dp->dp_spa) >= SPA_VERSION_USERREFS);
1096 
1097 	holds = fnvlist_alloc();
1098 
1099 	for (zap_cursor_init(&zc, mos, zapobj);
1100 	    zap_cursor_retrieve(&zc, &za) == 0;
1101 	    zap_cursor_advance(&zc)) {
1102 		char *htag;
1103 		nvlist_t *tags;
1104 
1105 		htag = strchr(za.za_name, '-');
1106 		*htag = '\0';
1107 		++htag;
1108 		if (nvlist_lookup_nvlist(holds, za.za_name, &tags) != 0) {
1109 			tags = fnvlist_alloc();
1110 			fnvlist_add_boolean(tags, htag);
1111 			fnvlist_add_nvlist(holds, za.za_name, tags);
1112 			fnvlist_free(tags);
1113 		} else {
1114 			fnvlist_add_boolean(tags, htag);
1115 		}
1116 	}
1117 	dsl_dataset_user_release_tmp(dp, holds);
1118 	fnvlist_free(holds);
1119 	zap_cursor_fini(&zc);
1120 }
1121 
1122 /*
1123  * Create the pool-wide zap object for storing temporary snapshot holds.
1124  */
1125 void
1126 dsl_pool_user_hold_create_obj(dsl_pool_t *dp, dmu_tx_t *tx)
1127 {
1128 	objset_t *mos = dp->dp_meta_objset;
1129 
1130 	ASSERT(dp->dp_tmp_userrefs_obj == 0);
1131 	ASSERT(dmu_tx_is_syncing(tx));
1132 
1133 	dp->dp_tmp_userrefs_obj = zap_create_link(mos, DMU_OT_USERREFS,
1134 	    DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_TMP_USERREFS, tx);
1135 }
1136 
1137 static int
1138 dsl_pool_user_hold_rele_impl(dsl_pool_t *dp, uint64_t dsobj,
1139     const char *tag, uint64_t now, dmu_tx_t *tx, boolean_t holding)
1140 {
1141 	objset_t *mos = dp->dp_meta_objset;
1142 	uint64_t zapobj = dp->dp_tmp_userrefs_obj;
1143 	char *name;
1144 	int error;
1145 
1146 	ASSERT(spa_version(dp->dp_spa) >= SPA_VERSION_USERREFS);
1147 	ASSERT(dmu_tx_is_syncing(tx));
1148 
1149 	/*
1150 	 * If the pool was created prior to SPA_VERSION_USERREFS, the
1151 	 * zap object for temporary holds might not exist yet.
1152 	 */
1153 	if (zapobj == 0) {
1154 		if (holding) {
1155 			dsl_pool_user_hold_create_obj(dp, tx);
1156 			zapobj = dp->dp_tmp_userrefs_obj;
1157 		} else {
1158 			return (SET_ERROR(ENOENT));
1159 		}
1160 	}
1161 
1162 	name = kmem_asprintf("%llx-%s", (u_longlong_t)dsobj, tag);
1163 	if (holding)
1164 		error = zap_add(mos, zapobj, name, 8, 1, &now, tx);
1165 	else
1166 		error = zap_remove(mos, zapobj, name, tx);
1167 	strfree(name);
1168 
1169 	return (error);
1170 }
1171 
1172 /*
1173  * Add a temporary hold for the given dataset object and tag.
1174  */
1175 int
1176 dsl_pool_user_hold(dsl_pool_t *dp, uint64_t dsobj, const char *tag,
1177     uint64_t now, dmu_tx_t *tx)
1178 {
1179 	return (dsl_pool_user_hold_rele_impl(dp, dsobj, tag, now, tx, B_TRUE));
1180 }
1181 
1182 /*
1183  * Release a temporary hold for the given dataset object and tag.
1184  */
1185 int
1186 dsl_pool_user_release(dsl_pool_t *dp, uint64_t dsobj, const char *tag,
1187     dmu_tx_t *tx)
1188 {
1189 	return (dsl_pool_user_hold_rele_impl(dp, dsobj, tag, 0, tx, B_FALSE));
1190 }
1191 
1192 /*
1193  * DSL Pool Configuration Lock
1194  *
1195  * The dp_config_rwlock protects against changes to DSL state (e.g. dataset
1196  * creation / destruction / rename / property setting).  It must be held for
1197  * read to hold a dataset or dsl_dir.  I.e. you must call
1198  * dsl_pool_config_enter() or dsl_pool_hold() before calling
1199  * dsl_{dataset,dir}_hold{_obj}.  In most circumstances, the dp_config_rwlock
1200  * must be held continuously until all datasets and dsl_dirs are released.
1201  *
1202  * The only exception to this rule is that if a "long hold" is placed on
1203  * a dataset, then the dp_config_rwlock may be dropped while the dataset
1204  * is still held.  The long hold will prevent the dataset from being
1205  * destroyed -- the destroy will fail with EBUSY.  A long hold can be
1206  * obtained by calling dsl_dataset_long_hold(), or by "owning" a dataset
1207  * (by calling dsl_{dataset,objset}_{try}own{_obj}).
1208  *
1209  * Legitimate long-holders (including owners) should be long-running, cancelable
1210  * tasks that should cause "zfs destroy" to fail.  This includes DMU
1211  * consumers (i.e. a ZPL filesystem being mounted or ZVOL being open),
1212  * "zfs send", and "zfs diff".  There are several other long-holders whose
1213  * uses are suboptimal (e.g. "zfs promote", and zil_suspend()).
1214  *
1215  * The usual formula for long-holding would be:
1216  * dsl_pool_hold()
1217  * dsl_dataset_hold()
1218  * ... perform checks ...
1219  * dsl_dataset_long_hold()
1220  * dsl_pool_rele()
1221  * ... perform long-running task ...
1222  * dsl_dataset_long_rele()
1223  * dsl_dataset_rele()
1224  *
1225  * Note that when the long hold is released, the dataset is still held but
1226  * the pool is not held.  The dataset may change arbitrarily during this time
1227  * (e.g. it could be destroyed).  Therefore you shouldn't do anything to the
1228  * dataset except release it.
1229  *
1230  * User-initiated operations (e.g. ioctls, zfs_ioc_*()) are either read-only
1231  * or modifying operations.
1232  *
1233  * Modifying operations should generally use dsl_sync_task().  The synctask
1234  * infrastructure enforces proper locking strategy with respect to the
1235  * dp_config_rwlock.  See the comment above dsl_sync_task() for details.
1236  *
1237  * Read-only operations will manually hold the pool, then the dataset, obtain
1238  * information from the dataset, then release the pool and dataset.
1239  * dmu_objset_{hold,rele}() are convenience routines that also do the pool
1240  * hold/rele.
1241  */
1242 
1243 int
1244 dsl_pool_hold(const char *name, void *tag, dsl_pool_t **dp)
1245 {
1246 	spa_t *spa;
1247 	int error;
1248 
1249 	error = spa_open(name, &spa, tag);
1250 	if (error == 0) {
1251 		*dp = spa_get_dsl(spa);
1252 		dsl_pool_config_enter(*dp, tag);
1253 	}
1254 	return (error);
1255 }
1256 
1257 void
1258 dsl_pool_rele(dsl_pool_t *dp, void *tag)
1259 {
1260 	dsl_pool_config_exit(dp, tag);
1261 	spa_close(dp->dp_spa, tag);
1262 }
1263 
1264 void
1265 dsl_pool_config_enter(dsl_pool_t *dp, void *tag)
1266 {
1267 	/*
1268 	 * We use a "reentrant" reader-writer lock, but not reentrantly.
1269 	 *
1270 	 * The rrwlock can (with the track_all flag) track all reading threads,
1271 	 * which is very useful for debugging which code path failed to release
1272 	 * the lock, and for verifying that the *current* thread does hold
1273 	 * the lock.
1274 	 *
1275 	 * (Unlike a rwlock, which knows that N threads hold it for
1276 	 * read, but not *which* threads, so rw_held(RW_READER) returns TRUE
1277 	 * if any thread holds it for read, even if this thread doesn't).
1278 	 */
1279 	ASSERT(!rrw_held(&dp->dp_config_rwlock, RW_READER));
1280 	rrw_enter(&dp->dp_config_rwlock, RW_READER, tag);
1281 }
1282 
1283 void
1284 dsl_pool_config_enter_prio(dsl_pool_t *dp, void *tag)
1285 {
1286 	ASSERT(!rrw_held(&dp->dp_config_rwlock, RW_READER));
1287 	rrw_enter_read_prio(&dp->dp_config_rwlock, tag);
1288 }
1289 
1290 void
1291 dsl_pool_config_exit(dsl_pool_t *dp, void *tag)
1292 {
1293 	rrw_exit(&dp->dp_config_rwlock, tag);
1294 }
1295 
1296 boolean_t
1297 dsl_pool_config_held(dsl_pool_t *dp)
1298 {
1299 	return (RRW_LOCK_HELD(&dp->dp_config_rwlock));
1300 }
1301 
1302 boolean_t
1303 dsl_pool_config_held_writer(dsl_pool_t *dp)
1304 {
1305 	return (RRW_WRITE_HELD(&dp->dp_config_rwlock));
1306 }
1307