1e0f1c0aOlaf Faaland/*
2e0f1c0aOlaf Faaland * CDDL HEADER START
3e0f1c0aOlaf Faaland *
4e0f1c0aOlaf Faaland * The contents of this file are subject to the terms of the
5e0f1c0aOlaf Faaland * Common Development and Distribution License (the "License").
6e0f1c0aOlaf Faaland * You may not use this file except in compliance with the License.
7e0f1c0aOlaf Faaland *
8e0f1c0aOlaf Faaland * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9e0f1c0aOlaf Faaland * or http://www.opensolaris.org/os/licensing.
10e0f1c0aOlaf Faaland * See the License for the specific language governing permissions
11e0f1c0aOlaf Faaland * and limitations under the License.
12e0f1c0aOlaf Faaland *
13e0f1c0aOlaf Faaland * When distributing Covered Code, include this CDDL HEADER in each
14e0f1c0aOlaf Faaland * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15e0f1c0aOlaf Faaland * If applicable, add the following below this CDDL HEADER, with the
16e0f1c0aOlaf Faaland * fields enclosed by brackets "[]" replaced with your own identifying
17e0f1c0aOlaf Faaland * information: Portions Copyright [yyyy] [name of copyright owner]
18e0f1c0aOlaf Faaland *
19e0f1c0aOlaf Faaland * CDDL HEADER END
20e0f1c0aOlaf Faaland */
21e0f1c0aOlaf Faaland/*
22e0f1c0aOlaf Faaland * Copyright (c) 2017 by Lawrence Livermore National Security, LLC.
23e0f1c0aOlaf Faaland * Copyright 2019 Joyent, Inc.
24e0f1c0aOlaf Faaland */
25e0f1c0aOlaf Faaland
26e0f1c0aOlaf Faaland#include <sys/abd.h>
27e0f1c0aOlaf Faaland#include <sys/mmp.h>
28e0f1c0aOlaf Faaland#include <sys/spa.h>
29e0f1c0aOlaf Faaland#include <sys/spa_impl.h>
30e0f1c0aOlaf Faaland#include <sys/time.h>
31e0f1c0aOlaf Faaland#include <sys/vdev.h>
32e0f1c0aOlaf Faaland#include <sys/vdev_impl.h>
33e0f1c0aOlaf Faaland#include <sys/zfs_context.h>
34e0f1c0aOlaf Faaland#include <sys/callb.h>
35e0f1c0aOlaf Faaland
36e0f1c0aOlaf Faaland/*
37e0f1c0aOlaf Faaland * Multi-Modifier Protection (MMP) attempts to prevent a user from importing
38e0f1c0aOlaf Faaland * or opening a pool on more than one host at a time.  In particular, it
39e0f1c0aOlaf Faaland * prevents "zpool import -f" on a host from succeeding while the pool is
40e0f1c0aOlaf Faaland * already imported on another host.  There are many other ways in which a
41e0f1c0aOlaf Faaland * device could be used by two hosts for different purposes at the same time
42e0f1c0aOlaf Faaland * resulting in pool damage.  This implementation does not attempt to detect
43e0f1c0aOlaf Faaland * those cases.
44e0f1c0aOlaf Faaland *
45e0f1c0aOlaf Faaland * MMP operates by ensuring there are frequent visible changes on disk (a
46e0f1c0aOlaf Faaland * "heartbeat") at all times.  And by altering the import process to check
47e0f1c0aOlaf Faaland * for these changes and failing the import when they are detected.  This
48e0f1c0aOlaf Faaland * functionality is enabled by setting the 'multihost' pool property to on.
49e0f1c0aOlaf Faaland *
50e0f1c0aOlaf Faaland * Uberblocks written by the txg_sync thread always go into the first
51e0f1c0aOlaf Faaland * (N-MMP_BLOCKS_PER_LABEL) slots, the remaining slots are reserved for MMP.
52e0f1c0aOlaf Faaland * They are used to hold uberblocks which are exactly the same as the last
534348eb9Olaf Faaland * synced uberblock except that the ub_timestamp and mmp_config are frequently
544348eb9Olaf Faaland * updated.  Like all other uberblocks, the slot is written with an embedded
554348eb9Olaf Faaland * checksum, and slots with invalid checksums are ignored.  This provides the
56e0f1c0aOlaf Faaland * "heartbeat", with no risk of overwriting good uberblocks that must be
57e0f1c0aOlaf Faaland * preserved, e.g. previous txgs and associated block pointers.
58e0f1c0aOlaf Faaland *
594348eb9Olaf Faaland * Three optional fields are added to uberblock structure; ub_mmp_magic,
604348eb9Olaf Faaland * ub_mmp_config, and ub_mmp_delay.  The ub_mmp_magic value allows zfs to tell
614348eb9Olaf Faaland * whether the other ub_mmp_* fields are valid.  The ub_mmp_config field tells
624348eb9Olaf Faaland * the importing host the settings of zfs_multihost_interval and
634348eb9Olaf Faaland * zfs_multihost_fail_intervals on the host which last had (or currently has)
644348eb9Olaf Faaland * the pool imported.  These determine how long a host must wait to detect
654348eb9Olaf Faaland * activity in the pool, before concluding the pool is not in use.  The
664348eb9Olaf Faaland * mmp_delay field is a decaying average of the amount of time between
674348eb9Olaf Faaland * completion of successive MMP writes, in nanoseconds.  It indicates whether
684348eb9Olaf Faaland * MMP is enabled.
69e0f1c0aOlaf Faaland *
70e0f1c0aOlaf Faaland * During import an activity test may now be performed to determine if
71e0f1c0aOlaf Faaland * the pool is in use.  The activity test is typically required if the
72e0f1c0aOlaf Faaland * ZPOOL_CONFIG_HOSTID does not match the system hostid, the pool state is
73e0f1c0aOlaf Faaland * POOL_STATE_ACTIVE, and the pool is not a root pool.
74e0f1c0aOlaf Faaland *
754348eb9Olaf Faaland * The activity test finds the "best" uberblock (highest txg, timestamp, and, if
764348eb9Olaf Faaland * ub_mmp_magic is valid, sequence number from ub_mmp_config).  It then waits
774348eb9Olaf Faaland * some time, and finds the "best" uberblock again.  If any of the mentioned
784348eb9Olaf Faaland * fields have different values in the newly read uberblock, the pool is in use
794348eb9Olaf Faaland * by another host and the import fails.  In order to assure the accuracy of the
804348eb9Olaf Faaland * activity test, the default values result in an activity test duration of 20x
814348eb9Olaf Faaland * the mmp write interval.
824348eb9Olaf Faaland *
834348eb9Olaf Faaland * The duration of the "zpool import" activity test depends on the information
844348eb9Olaf Faaland * available in the "best" uberblock:
854348eb9Olaf Faaland *
864348eb9Olaf Faaland * 1) If uberblock was written by zfs-0.8 or newer and fail_intervals > 0:
874348eb9Olaf Faaland *    ub_mmp_config.fail_intervals * ub_mmp_config.multihost_interval * 2
884348eb9Olaf Faaland *
894348eb9Olaf Faaland *    In this case, a weak guarantee is provided.  Since the host which last had
904348eb9Olaf Faaland *    the pool imported will suspend the pool if no mmp writes land within
914348eb9Olaf Faaland *    fail_intervals * multihost_interval ms, the absence of writes during that
924348eb9Olaf Faaland *    time means either the pool is not imported, or it is imported but the pool
934348eb9Olaf Faaland *    is suspended and no further writes will occur.
944348eb9Olaf Faaland *
954348eb9Olaf Faaland *    Note that resuming the suspended pool on the remote host would invalidate
964348eb9Olaf Faaland *    this guarantee, and so it is not allowed.
974348eb9Olaf Faaland *
984348eb9Olaf Faaland *    The factor of 2 provides a conservative safety factor and derives from
994348eb9Olaf Faaland *    MMP_IMPORT_SAFETY_FACTOR;
1004348eb9Olaf Faaland *
1014348eb9Olaf Faaland * 2) If uberblock was written by zfs-0.8 or newer and fail_intervals == 0:
1024348eb9Olaf Faaland *    (ub_mmp_config.multihost_interval + ub_mmp_delay) *
1034348eb9Olaf Faaland *        zfs_multihost_import_intervals
1044348eb9Olaf Faaland *
1054348eb9Olaf Faaland *    In this case no guarantee can provided.  However, as long as some devices
1064348eb9Olaf Faaland *    are healthy and connected, it is likely that at least one write will land
1074348eb9Olaf Faaland *    within (multihost_interval + mmp_delay) because multihost_interval is
1084348eb9Olaf Faaland *    enough time for a write to be attempted to each leaf vdev, and mmp_delay
1094348eb9Olaf Faaland *    is enough for one to land, based on past delays.  Multiplying by
1104348eb9Olaf Faaland *    zfs_multihost_import_intervals provides a conservative safety factor.
1114348eb9Olaf Faaland *
1124348eb9Olaf Faaland * 3) If uberblock was written by zfs-0.7:
1134348eb9Olaf Faaland *    (zfs_multihost_interval + ub_mmp_delay) * zfs_multihost_import_intervals
1144348eb9Olaf Faaland *
1154348eb9Olaf Faaland *    The same logic as case #2 applies, but we do not know remote tunables.
1164348eb9Olaf Faaland *
1174348eb9Olaf Faaland *    We use the local value for zfs_multihost_interval because the original MMP
1184348eb9Olaf Faaland *    did not record this value in the uberblock.
1194348eb9Olaf Faaland *
1204348eb9Olaf Faaland *    ub_mmp_delay >= (zfs_multihost_interval / leaves), so if the other host
1214348eb9Olaf Faaland *    has a much larger zfs_multihost_interval set, ub_mmp_delay will reflect
1224348eb9Olaf Faaland *    that.  We will have waited enough time for zfs_multihost_import_intervals
1234348eb9Olaf Faaland *    writes to be issued and all but one to land.
1244348eb9Olaf Faaland *
1254348eb9Olaf Faaland *    single device pool example delays
1264348eb9Olaf Faaland *
1274348eb9Olaf Faaland *    import_delay = (1 + 1) * 20   =  40s #defaults, no I/O delay
1284348eb9Olaf Faaland *    import_delay = (1 + 10) * 20  = 220s #defaults, 10s I/O delay
1294348eb9Olaf Faaland *    import_delay = (10 + 10) * 20 = 400s #10s multihost_interval,
1304348eb9Olaf Faaland *                                          no I/O delay
1314348eb9Olaf Faaland *    100 device pool example delays
1324348eb9Olaf Faaland *
1334348eb9Olaf Faaland *    import_delay = (1 + .01) * 20 =  20s #defaults, no I/O delay
1344348eb9Olaf Faaland *    import_delay = (1 + 10) * 20  = 220s #defaults, 10s I/O delay
1354348eb9Olaf Faaland *    import_delay = (10 + .1) * 20 = 202s #10s multihost_interval,
1364348eb9Olaf Faaland *                                          no I/O delay
1374348eb9Olaf Faaland *
1384348eb9Olaf Faaland * 4) Otherwise, this uberblock was written by a pre-MMP zfs:
1394348eb9Olaf Faaland *    zfs_multihost_import_intervals * zfs_multihost_interval
1404348eb9Olaf Faaland *
1414348eb9Olaf Faaland *    In this case local tunables are used.  By default this product = 10s, long
1424348eb9Olaf Faaland *    enough for a pool with any activity at all to write at least one
1434348eb9Olaf Faaland *    uberblock.  No guarantee can be provided.
1444348eb9Olaf Faaland *
1454348eb9Olaf Faaland * Additionally, the duration is then extended by a random 25% to attempt to to
1464348eb9Olaf Faaland * detect simultaneous imports.  For example, if both partner hosts are rebooted
1474348eb9Olaf Faaland * at the same time and automatically attempt to import the pool.
148e0f1c0aOlaf Faaland */
149e0f1c0aOlaf Faaland
150e0f1c0aOlaf Faaland/*
151e0f1c0aOlaf Faaland * Used to control the frequency of mmp writes which are performed when the
152e0f1c0aOlaf Faaland * 'multihost' pool property is on.  This is one factor used to determine the
153e0f1c0aOlaf Faaland * length of the activity check during import.
154e0f1c0aOlaf Faaland *
1554348eb9Olaf Faaland * On average an mmp write will be issued for each leaf vdev every
1564348eb9Olaf Faaland * zfs_multihost_interval milliseconds.  In practice, the observed period can
1574348eb9Olaf Faaland * vary with the I/O load and this observed value is the ub_mmp_delay which is
158e0f1c0aOlaf Faaland * stored in the uberblock.  The minimum allowed value is 100 ms.
159e0f1c0aOlaf Faaland */
160e0f1c0aOlaf Faalandulong_t zfs_multihost_interval = MMP_DEFAULT_INTERVAL;
161e0f1c0aOlaf Faaland
162e0f1c0aOlaf Faaland/*
163e0f1c0aOlaf Faaland * Used to control the duration of the activity test on import.  Smaller values
164e0f1c0aOlaf Faaland * of zfs_multihost_import_intervals will reduce the import time but increase
165e0f1c0aOlaf Faaland * the risk of failing to detect an active pool.  The total activity check time
166e0f1c0aOlaf Faaland * is never allowed to drop below one second.  A value of 0 is ignored and
167e0f1c0aOlaf Faaland * treated as if it was set to 1.
168e0f1c0aOlaf Faaland */
169e0f1c0aOlaf Faalanduint_t zfs_multihost_import_intervals = MMP_DEFAULT_IMPORT_INTERVALS;
170e0f1c0aOlaf Faaland
171e0f1c0aOlaf Faaland/*
1724348eb9Olaf Faaland * Controls the behavior of the pool when mmp write failures or delays are
1734348eb9Olaf Faaland * detected.
174e0f1c0aOlaf Faaland *
1754348eb9Olaf Faaland * When zfs_multihost_fail_intervals = 0, mmp write failures or delays are
1764348eb9Olaf Faaland * ignored.  The failures will still be reported to the ZED which depending on
1774348eb9Olaf Faaland * its configuration may take action such as suspending the pool or taking a
178e0f1c0aOlaf Faaland * device offline.
179e0f1c0aOlaf Faaland *
1804348eb9Olaf Faaland * When zfs_multihost_fail_intervals > 0, the pool will be suspended if
1814348eb9Olaf Faaland * zfs_multihost_fail_intervals * zfs_multihost_interval milliseconds pass
1824348eb9Olaf Faaland * without a successful mmp write.  This guarantees the activity test will see
1834348eb9Olaf Faaland * mmp writes if the pool is imported.  A value of 1 is ignored and treated as
1844348eb9Olaf Faaland * if it was set to 2, because a single leaf vdev pool will issue a write once
1854348eb9Olaf Faaland * per multihost_interval and thus any variation in latency would cause the
1864348eb9Olaf Faaland * pool to be suspended.
187e0f1c0aOlaf Faaland */
188e0f1c0aOlaf Faalanduint_t zfs_multihost_fail_intervals = MMP_DEFAULT_FAIL_INTERVALS;
189e0f1c0aOlaf Faaland
190e0f1c0aOlaf Faalandchar *mmp_tag = "mmp_write_uberblock";
191e0f1c0aOlaf Faalandstatic void mmp_thread(void *arg);
192e0f1c0aOlaf Faaland
193e0f1c0aOlaf Faalandvoid
194e0f1c0aOlaf Faalandmmp_init(spa_t *spa)
195e0f1c0aOlaf Faaland{
196e0f1c0aOlaf Faaland	mmp_thread_t *mmp = &spa->spa_mmp;
197e0f1c0aOlaf Faaland
198e0f1c0aOlaf Faaland	mutex_init(&mmp->mmp_thread_lock, NULL, MUTEX_DEFAULT, NULL);
199e0f1c0aOlaf Faaland	cv_init(&mmp->mmp_thread_cv, NULL, CV_DEFAULT, NULL);
200e0f1c0aOlaf Faaland	mutex_init(&mmp->mmp_io_lock, NULL, MUTEX_DEFAULT, NULL);
201e0f1c0aOlaf Faaland	mmp->mmp_kstat_id = 1;
2024348eb9Olaf Faaland
2034348eb9Olaf Faaland	/*
2044348eb9Olaf Faaland	 * mmp_write_done() calculates mmp_delay based on prior mmp_delay and
2054348eb9Olaf Faaland	 * the elapsed time since the last write.  For the first mmp write,
2064348eb9Olaf Faaland	 * there is no "last write", so we start with fake non-zero values.
2074348eb9Olaf Faaland	 */
2084348eb9Olaf Faaland	mmp->mmp_last_write = gethrtime();
2094348eb9Olaf Faaland	mmp->mmp_delay = MSEC2NSEC(MMP_INTERVAL_OK(zfs_multihost_interval));
210e0f1c0aOlaf Faaland}
211e0f1c0aOlaf Faaland
212e0f1c0aOlaf Faalandvoid
213e0f1c0aOlaf Faalandmmp_fini(spa_t *spa)
214e0f1c0aOlaf Faaland{
215e0f1c0aOlaf Faaland	mmp_thread_t *mmp = &spa->spa_mmp;
216e0f1c0aOlaf Faaland
217e0f1c0aOlaf Faaland	mutex_destroy(&mmp->mmp_thread_lock);
218e0f1c0aOlaf Faaland	cv_destroy(&mmp->mmp_thread_cv);
219e0f1c0aOlaf Faaland	mutex_destroy(&mmp->mmp_io_lock);
220e0f1c0aOlaf Faaland}
221e0f1c0aOlaf Faaland
222e0f1c0aOlaf Faalandstatic void
223e0f1c0aOlaf Faalandmmp_thread_enter(mmp_thread_t *mmp, callb_cpr_t *cpr)
224e0f1c0aOlaf Faaland{
225e0f1c0aOlaf Faaland	CALLB_CPR_INIT(cpr, &mmp->mmp_thread_lock, callb_generic_cpr, FTAG);
226e0f1c0aOlaf Faaland	mutex_enter(&mmp->mmp_thread_lock);
227e0f1c0aOlaf Faaland}
228e0f1c0aOlaf Faaland
229e0f1c0aOlaf Faalandstatic void
230e0f1c0aOlaf Faalandmmp_thread_exit(mmp_thread_t *mmp, kthread_t **mpp, callb_cpr_t *cpr)
231e0f1c0aOlaf Faaland{
232e0f1c0aOlaf Faaland	ASSERT(*mpp != NULL);
233e0f1c0aOlaf Faaland	*mpp = NULL;
234e0f1c0aOlaf Faaland	cv_broadcast(&mmp->mmp_thread_cv);
235e0f1c0aOlaf Faaland	CALLB_CPR_EXIT(cpr);		/* drops &mmp->mmp_thread_lock */
236e0f1c0aOlaf Faaland	thread_exit();
237e0f1c0aOlaf Faaland}
238e0f1c0aOlaf Faaland
239e0f1c0aOlaf Faalandvoid
240e0f1c0aOlaf Faalandmmp_thread_start(spa_t *spa)
241e0f1c0aOlaf Faaland{
242e0f1c0aOlaf Faaland	mmp_thread_t *mmp = &spa->spa_mmp;
243e0f1c0aOlaf Faaland
244e0f1c0aOlaf Faaland	if (spa_writeable(spa)) {
245e0f1c0aOlaf Faaland		mutex_enter(&mmp->mmp_thread_lock);
246e0f1c0aOlaf Faaland		if (!mmp->mmp_thread) {
247e0f1c0aOlaf Faaland			mmp->mmp_thread = thread_create(NULL, 0, mmp_thread,
248e0f1c0aOlaf Faaland			    spa, 0, &p0, TS_RUN, minclsyspri);
2494348eb9Olaf Faaland			zfs_dbgmsg("MMP thread started pool '%s' "
2504348eb9Olaf Faaland			    "gethrtime %llu", spa_name(spa), gethrtime());
251e0f1c0aOlaf Faaland		}
252e0f1c0aOlaf Faaland		mutex_exit(&mmp->mmp_thread_lock);
253e0f1c0aOlaf Faaland	}
254e0f1c0aOlaf Faaland}
255e0f1c0aOlaf Faaland
256e0f1c0aOlaf Faalandvoid
257e0f1c0aOlaf Faalandmmp_thread_stop(spa_t *spa)
258e0f1c0aOlaf Faaland{
259e0f1c0aOlaf Faaland	mmp_thread_t *mmp = &spa->spa_mmp;
260e0f1c0aOlaf Faaland
261e0f1c0aOlaf Faaland	mutex_enter(&mmp->mmp_thread_lock);
262e0f1c0aOlaf Faaland	mmp->mmp_thread_exiting = 1;
263e0f1c0aOlaf Faaland	cv_broadcast(&mmp->mmp_thread_cv);
264e0f1c0aOlaf Faaland
265e0f1c0aOlaf Faaland	while (mmp->mmp_thread) {
266e0f1c0aOlaf Faaland		cv_wait(&mmp->mmp_thread_cv, &mmp->mmp_thread_lock);
267e0f1c0aOlaf Faaland	}
268e0f1c0aOlaf Faaland	mutex_exit(&mmp->mmp_thread_lock);
2694348eb9Olaf Faaland	zfs_dbgmsg("MMP thread stopped pool '%s' gethrtime %llu",
2704348eb9Olaf Faaland	    spa_name(spa), gethrtime());
271e0f1c0aOlaf Faaland
272e0f1c0aOlaf Faaland	ASSERT(mmp->mmp_thread == NULL);
273e0f1c0aOlaf Faaland	mmp->mmp_thread_exiting = 0;
274e0f1c0aOlaf Faaland}
275e0f1c0aOlaf Faaland
276e0f1c0aOlaf Faalandtypedef enum mmp_vdev_state_flag {
277e0f1c0aOlaf Faaland	MMP_FAIL_NOT_WRITABLE	= (1 << 0),
278e0f1c0aOlaf Faaland	MMP_FAIL_WRITE_PENDING	= (1 << 1),
279e0f1c0aOlaf Faaland} mmp_vdev_state_flag_t;
280e0f1c0aOlaf Faaland
281e0f1c0aOlaf Faaland/*
282e0f1c0aOlaf Faaland * Find a leaf vdev to write an MMP block to.  It must not have an outstanding
283e0f1c0aOlaf Faaland * mmp write (if so a new write will also likely block).  If there is no usable
284e0f1c0aOlaf Faaland * leaf, a nonzero error value is returned. The error value returned is a bit
285e0f1c0aOlaf Faaland * field.
286e0f1c0aOlaf Faaland *
287e0f1c0aOlaf Faaland * MMP_FAIL_WRITE_PENDING   One or more leaf vdevs are writeable, but have an
288e0f1c0aOlaf Faaland *                          outstanding MMP write.
289e0f1c0aOlaf Faaland * MMP_FAIL_NOT_WRITABLE    One or more leaf vdevs are not writeable.
290e0f1c0aOlaf Faaland */
291e0f1c0aOlaf Faaland
292e0f1c0aOlaf Faalandstatic int
293e0f1c0aOlaf Faalandmmp_next_leaf(spa_t *spa)
294e0f1c0aOlaf Faaland{
295e0f1c0aOlaf Faaland	vdev_t *leaf;
296e0f1c0aOlaf Faaland	vdev_t *starting_leaf;
297e0f1c0aOlaf Faaland	int fail_mask = 0;
298e0f1c0aOlaf Faaland
299e0f1c0aOlaf Faaland	ASSERT(MUTEX_HELD(&spa->spa_mmp.mmp_io_lock));
300e0f1c0aOlaf Faaland	ASSERT(spa_config_held(spa, SCL_STATE, RW_READER));
301e0f1c0aOlaf Faaland	ASSERT(list_link_active(&spa->spa_leaf_list.list_head) == B_TRUE);
302e0f1c0aOlaf Faaland	ASSERT(!list_is_empty(&spa->spa_leaf_list));
303e0f1c0aOlaf Faaland
304e0f1c0aOlaf Faaland	if (spa->spa_mmp.mmp_leaf_last_gen != spa->spa_leaf_list_gen) {
305e0f1c0aOlaf Faaland		spa->spa_mmp.mmp_last_leaf = list_head(&spa->spa_leaf_list);
306e0f1c0aOlaf Faaland		spa->spa_mmp.mmp_leaf_last_gen = spa->spa_leaf_list_gen;
307e0f1c0aOlaf Faaland	}
308e0f1c0aOlaf Faaland
309e0f1c0aOlaf Faaland	leaf = spa->spa_mmp.mmp_last_leaf;
310e0f1c0aOlaf Faaland	if (leaf == NULL)
311e0f1c0aOlaf Faaland		leaf = list_head(&spa->spa_leaf_list);
312e0f1c0aOlaf Faaland	starting_leaf = leaf;
313e0f1c0aOlaf Faaland
314e0f1c0aOlaf Faaland	do {
315e0f1c0aOlaf Faaland		leaf = list_next(&spa->spa_leaf_list, leaf);
316e0f1c0aOlaf Faaland		if (leaf == NULL)
317e0f1c0aOlaf Faaland			leaf = list_head(&spa->spa_leaf_list);
318e0f1c0aOlaf Faaland
319e0f1c0aOlaf Faaland		if (!vdev_writeable(leaf)) {
320e0f1c0aOlaf Faaland			fail_mask |= MMP_FAIL_NOT_WRITABLE;
321e0f1c0aOlaf Faaland		} else if (leaf->vdev_mmp_pending != 0) {
322e0f1c0aOlaf Faaland			fail_mask |= MMP_FAIL_WRITE_PENDING;
323e0f1c0aOlaf Faaland		} else {
324e0f1c0aOlaf Faaland			spa->spa_mmp.mmp_last_leaf = leaf;
325e0f1c0aOlaf Faaland			return (0);
326e0f1c0aOlaf Faaland		}
327e0f1c0aOlaf Faaland	} while (leaf != starting_leaf);
328e0f1c0aOlaf Faaland
329e0f1c0aOlaf Faaland	ASSERT(fail_mask);
330e0f1c0aOlaf Faaland
331e0f1c0aOlaf Faaland	return (fail_mask);
332e0f1c0aOlaf Faaland}
333e0f1c0aOlaf Faaland
334e0f1c0aOlaf Faaland/*
335e0f1c0aOlaf Faaland * MMP writes are issued on a fixed schedule, but may complete at variable,
336e0f1c0aOlaf Faaland * much longer, intervals.  The mmp_delay captures long periods between
337e0f1c0aOlaf Faaland * successful writes for any reason, including disk latency, scheduling delays,
338e0f1c0aOlaf Faaland * etc.
339e0f1c0aOlaf Faaland *
340e0f1c0aOlaf Faaland * The mmp_delay is usually calculated as a decaying average, but if the latest
341e0f1c0aOlaf Faaland * delay is higher we do not average it, so that we do not hide sudden spikes
342e0f1c0aOlaf Faaland * which the importing host must wait for.
343e0f1c0aOlaf Faaland *
344e0f1c0aOlaf Faaland * If writes are occurring frequently, such as due to a high rate of txg syncs,
345e0f1c0aOlaf Faaland * the mmp_delay could become very small.  Since those short delays depend on
346e0f1c0aOlaf Faaland * activity we cannot count on, we never allow mmp_delay to get lower than rate
347e0f1c0aOlaf Faaland * expected if only mmp_thread writes occur.
348e0f1c0aOlaf Faaland *
349e0f1c0aOlaf Faaland * If an mmp write was skipped or fails, and we have already waited longer than
350e0f1c0aOlaf Faaland * mmp_delay, we need to update it so the next write reflects the longer delay.
351e0f1c0aOlaf Faaland *
352e0f1c0aOlaf Faaland * Do not set mmp_delay if the multihost property is not on, so as not to
353e0f1c0aOlaf Faaland * trigger an activity check on import.
354e0f1c0aOlaf Faaland */
355e0f1c0aOlaf Faalandstatic void
356e0f1c0aOlaf Faalandmmp_delay_update(spa_t *spa, boolean_t write_completed)
357e0f1c0aOlaf Faaland{
358e0f1c0aOlaf Faaland	mmp_thread_t *mts = &spa->spa_mmp;
359e0f1c0aOlaf Faaland	hrtime_t delay = gethrtime() - mts->mmp_last_write;
360e0f1c0aOlaf Faaland
361e0f1c0aOlaf Faaland	ASSERT(MUTEX_HELD(&mts->mmp_io_lock));
362e0f1c0aOlaf Faaland
363e0f1c0aOlaf Faaland	if (spa_multihost(spa) == B_FALSE) {
364e0f1c0aOlaf Faaland		mts->mmp_delay = 0;
365e0f1c0aOlaf Faaland		return;
366e0f1c0aOlaf Faaland	}
367e0f1c0aOlaf Faaland
368e0f1c0aOlaf Faaland	if (delay > mts->mmp_delay)
369e0f1c0aOlaf Faaland		mts->mmp_delay = delay;
370e0f1c0aOlaf Faaland
371e0f1c0aOlaf Faaland	if (write_completed == B_FALSE)
372e0f1c0aOlaf Faaland		return;
373e0f1c0aOlaf Faaland
374e0f1c0aOlaf Faaland	mts->mmp_last_write = gethrtime();
375e0f1c0aOlaf Faaland
376e0f1c0aOlaf Faaland	/*
377e0f1c0aOlaf Faaland	 * strictly less than, in case delay was changed above.
378e0f1c0aOlaf Faaland	 */
379e0f1c0aOlaf Faaland	if (delay < mts->mmp_delay) {
3804348eb9Olaf Faaland		hrtime_t min_delay =
3814348eb9Olaf Faaland		    MSEC2NSEC(MMP_INTERVAL_OK(zfs_multihost_interval)) /
382e0f1c0aOlaf Faaland		    MAX(1, vdev_count_leaves(spa));
383e0f1c0aOlaf Faaland		mts->mmp_delay = MAX(((delay + mts->mmp_delay * 127) / 128),
384e0f1c0aOlaf Faaland		    min_delay);
385e0f1c0aOlaf Faaland	}
386e0f1c0aOlaf Faaland}
387e0f1c0aOlaf Faaland