xref: /illumos-gate/usr/src/uts/common/fs/zfs/vdev_label.c (revision 89a89ebfd7c3b4056afe2c03e959e22824df777d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * Virtual Device Labels
30  * ---------------------
31  *
32  * The vdev label serves several distinct purposes:
33  *
34  *	1. Uniquely identify this device as part of a ZFS pool and confirm its
35  *	   identity within the pool.
36  *
37  * 	2. Verify that all the devices given in a configuration are present
38  *         within the pool.
39  *
40  * 	3. Determine the uberblock for the pool.
41  *
42  * 	4. In case of an import operation, determine the configuration of the
43  *         toplevel vdev of which it is a part.
44  *
45  * 	5. If an import operation cannot find all the devices in the pool,
46  *         provide enough information to the administrator to determine which
47  *         devices are missing.
48  *
49  * It is important to note that while the kernel is responsible for writing the
50  * label, it only consumes the information in the first three cases.  The
51  * latter information is only consumed in userland when determining the
52  * configuration to import a pool.
53  *
54  *
55  * Label Organization
56  * ------------------
57  *
58  * Before describing the contents of the label, it's important to understand how
59  * the labels are written and updated with respect to the uberblock.
60  *
61  * When the pool configuration is altered, either because it was newly created
62  * or a device was added, we want to update all the labels such that we can deal
63  * with fatal failure at any point.  To this end, each disk has two labels which
64  * are updated before and after the uberblock is synced.  Assuming we have
65  * labels and an uberblock with the following transaction groups:
66  *
67  *              L1          UB          L2
68  *           +------+    +------+    +------+
69  *           |      |    |      |    |      |
70  *           | t10  |    | t10  |    | t10  |
71  *           |      |    |      |    |      |
72  *           +------+    +------+    +------+
73  *
74  * In this stable state, the labels and the uberblock were all updated within
75  * the same transaction group (10).  Each label is mirrored and checksummed, so
76  * that we can detect when we fail partway through writing the label.
77  *
78  * In order to identify which labels are valid, the labels are written in the
79  * following manner:
80  *
81  * 	1. For each vdev, update 'L1' to the new label
82  * 	2. Update the uberblock
83  * 	3. For each vdev, update 'L2' to the new label
84  *
85  * Given arbitrary failure, we can determine the correct label to use based on
86  * the transaction group.  If we fail after updating L1 but before updating the
87  * UB, we will notice that L1's transaction group is greater than the uberblock,
88  * so L2 must be valid.  If we fail after writing the uberblock but before
89  * writing L2, we will notice that L2's transaction group is less than L1, and
90  * therefore L1 is valid.
91  *
92  * Another added complexity is that not every label is updated when the config
93  * is synced.  If we add a single device, we do not want to have to re-write
94  * every label for every device in the pool.  This means that both L1 and L2 may
95  * be older than the pool uberblock, because the necessary information is stored
96  * on another vdev.
97  *
98  *
99  * On-disk Format
100  * --------------
101  *
102  * The vdev label consists of two distinct parts, and is wrapped within the
103  * vdev_label_t structure.  The label includes 8k of padding to permit legacy
104  * VTOC disk labels, but is otherwise ignored.
105  *
106  * The first half of the label is a packed nvlist which contains pool wide
107  * properties, per-vdev properties, and configuration information.  It is
108  * described in more detail below.
109  *
110  * The latter half of the label consists of a redundant array of uberblocks.
111  * These uberblocks are updated whenever a transaction group is committed,
112  * or when the configuration is updated.  When a pool is loaded, we scan each
113  * vdev for the 'best' uberblock.
114  *
115  *
116  * Configuration Information
117  * -------------------------
118  *
119  * The nvlist describing the pool and vdev contains the following elements:
120  *
121  * 	version		ZFS on-disk version
122  * 	name		Pool name
123  * 	state		Pool state
124  * 	txg		Transaction group in which this label was written
125  * 	pool_guid	Unique identifier for this pool
126  * 	vdev_tree	An nvlist describing vdev tree.
127  *
128  * Each leaf device label also contains the following:
129  *
130  * 	top_guid	Unique ID for top-level vdev in which this is contained
131  * 	guid		Unique ID for the leaf vdev
132  *
133  * The 'vs' configuration follows the format described in 'spa_config.c'.
134  */
135 
136 #include <sys/zfs_context.h>
137 #include <sys/spa.h>
138 #include <sys/spa_impl.h>
139 #include <sys/dmu.h>
140 #include <sys/zap.h>
141 #include <sys/vdev.h>
142 #include <sys/vdev_impl.h>
143 #include <sys/uberblock_impl.h>
144 #include <sys/metaslab.h>
145 #include <sys/zio.h>
146 #include <sys/fs/zfs.h>
147 
148 /*
149  * Basic routines to read and write from a vdev label.
150  * Used throughout the rest of this file.
151  */
152 uint64_t
153 vdev_label_offset(uint64_t psize, int l, uint64_t offset)
154 {
155 	ASSERT(offset < sizeof (vdev_label_t));
156 	ASSERT(P2PHASE_TYPED(psize, sizeof (vdev_label_t), uint64_t) == 0);
157 
158 	return (offset + l * sizeof (vdev_label_t) + (l < VDEV_LABELS / 2 ?
159 	    0 : psize - VDEV_LABELS * sizeof (vdev_label_t)));
160 }
161 
162 /*
163  * Returns back the vdev label associated with the passed in offset.
164  */
165 int
166 vdev_label_number(uint64_t psize, uint64_t offset)
167 {
168 	int l;
169 
170 	if (offset >= psize - VDEV_LABEL_END_SIZE) {
171 		offset -= psize - VDEV_LABEL_END_SIZE;
172 		offset += (VDEV_LABELS / 2) * sizeof (vdev_label_t);
173 	}
174 	l = offset / sizeof (vdev_label_t);
175 	return (l < VDEV_LABELS ? l : -1);
176 }
177 
178 static void
179 vdev_label_read(zio_t *zio, vdev_t *vd, int l, void *buf, uint64_t offset,
180 	uint64_t size, zio_done_func_t *done, void *private)
181 {
182 	ASSERT(vd->vdev_children == 0);
183 
184 	zio_nowait(zio_read_phys(zio, vd,
185 	    vdev_label_offset(vd->vdev_psize, l, offset),
186 	    size, buf, ZIO_CHECKSUM_LABEL, done, private,
187 	    ZIO_PRIORITY_SYNC_READ,
188 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
189 	    B_TRUE));
190 }
191 
192 static void
193 vdev_label_write(zio_t *zio, vdev_t *vd, int l, void *buf, uint64_t offset,
194 	uint64_t size, zio_done_func_t *done, void *private, int flags)
195 {
196 	ASSERT(vd->vdev_children == 0);
197 
198 	zio_nowait(zio_write_phys(zio, vd,
199 	    vdev_label_offset(vd->vdev_psize, l, offset),
200 	    size, buf, ZIO_CHECKSUM_LABEL, done, private,
201 	    ZIO_PRIORITY_SYNC_WRITE, flags, B_TRUE));
202 }
203 
204 /*
205  * Generate the nvlist representing this vdev's config.
206  */
207 nvlist_t *
208 vdev_config_generate(spa_t *spa, vdev_t *vd, boolean_t getstats,
209     boolean_t isspare, boolean_t isl2cache)
210 {
211 	nvlist_t *nv = NULL;
212 
213 	VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
214 
215 	VERIFY(nvlist_add_string(nv, ZPOOL_CONFIG_TYPE,
216 	    vd->vdev_ops->vdev_op_type) == 0);
217 	if (!isspare && !isl2cache)
218 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_ID, vd->vdev_id)
219 		    == 0);
220 	VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_GUID, vd->vdev_guid) == 0);
221 
222 	if (vd->vdev_path != NULL)
223 		VERIFY(nvlist_add_string(nv, ZPOOL_CONFIG_PATH,
224 		    vd->vdev_path) == 0);
225 
226 	if (vd->vdev_devid != NULL)
227 		VERIFY(nvlist_add_string(nv, ZPOOL_CONFIG_DEVID,
228 		    vd->vdev_devid) == 0);
229 
230 	if (vd->vdev_physpath != NULL)
231 		VERIFY(nvlist_add_string(nv, ZPOOL_CONFIG_PHYS_PATH,
232 		    vd->vdev_physpath) == 0);
233 
234 	if (vd->vdev_nparity != 0) {
235 		ASSERT(strcmp(vd->vdev_ops->vdev_op_type,
236 		    VDEV_TYPE_RAIDZ) == 0);
237 
238 		/*
239 		 * Make sure someone hasn't managed to sneak a fancy new vdev
240 		 * into a crufty old storage pool.
241 		 */
242 		ASSERT(vd->vdev_nparity == 1 ||
243 		    (vd->vdev_nparity == 2 &&
244 		    spa_version(spa) >= SPA_VERSION_RAID6));
245 
246 		/*
247 		 * Note that we'll add the nparity tag even on storage pools
248 		 * that only support a single parity device -- older software
249 		 * will just ignore it.
250 		 */
251 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_NPARITY,
252 		    vd->vdev_nparity) == 0);
253 	}
254 
255 	if (vd->vdev_wholedisk != -1ULL)
256 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_WHOLE_DISK,
257 		    vd->vdev_wholedisk) == 0);
258 
259 	if (vd->vdev_not_present)
260 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_NOT_PRESENT, 1) == 0);
261 
262 	if (vd->vdev_isspare)
263 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_IS_SPARE, 1) == 0);
264 
265 	if (!isspare && !isl2cache && vd == vd->vdev_top) {
266 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_ARRAY,
267 		    vd->vdev_ms_array) == 0);
268 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_SHIFT,
269 		    vd->vdev_ms_shift) == 0);
270 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_ASHIFT,
271 		    vd->vdev_ashift) == 0);
272 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_ASIZE,
273 		    vd->vdev_asize) == 0);
274 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_IS_LOG,
275 		    vd->vdev_islog) == 0);
276 	}
277 
278 	if (vd->vdev_dtl.smo_object != 0)
279 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_DTL,
280 		    vd->vdev_dtl.smo_object) == 0);
281 
282 	if (getstats) {
283 		vdev_stat_t vs;
284 		vdev_get_stats(vd, &vs);
285 		VERIFY(nvlist_add_uint64_array(nv, ZPOOL_CONFIG_STATS,
286 		    (uint64_t *)&vs, sizeof (vs) / sizeof (uint64_t)) == 0);
287 	}
288 
289 	if (!vd->vdev_ops->vdev_op_leaf) {
290 		nvlist_t **child;
291 		int c;
292 
293 		child = kmem_alloc(vd->vdev_children * sizeof (nvlist_t *),
294 		    KM_SLEEP);
295 
296 		for (c = 0; c < vd->vdev_children; c++)
297 			child[c] = vdev_config_generate(spa, vd->vdev_child[c],
298 			    getstats, isspare, isl2cache);
299 
300 		VERIFY(nvlist_add_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
301 		    child, vd->vdev_children) == 0);
302 
303 		for (c = 0; c < vd->vdev_children; c++)
304 			nvlist_free(child[c]);
305 
306 		kmem_free(child, vd->vdev_children * sizeof (nvlist_t *));
307 
308 	} else {
309 		if (vd->vdev_offline && !vd->vdev_tmpoffline)
310 			VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_OFFLINE,
311 			    B_TRUE) == 0);
312 		if (vd->vdev_faulted)
313 			VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_FAULTED,
314 			    B_TRUE) == 0);
315 		if (vd->vdev_degraded)
316 			VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_DEGRADED,
317 			    B_TRUE) == 0);
318 		if (vd->vdev_removed)
319 			VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_REMOVED,
320 			    B_TRUE) == 0);
321 		if (vd->vdev_unspare)
322 			VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_UNSPARE,
323 			    B_TRUE) == 0);
324 	}
325 
326 	return (nv);
327 }
328 
329 nvlist_t *
330 vdev_label_read_config(vdev_t *vd)
331 {
332 	spa_t *spa = vd->vdev_spa;
333 	nvlist_t *config = NULL;
334 	vdev_phys_t *vp;
335 	zio_t *zio;
336 	int l;
337 
338 	ASSERT(spa_config_held(spa, RW_READER) ||
339 	    spa_config_held(spa, RW_WRITER));
340 
341 	if (!vdev_readable(vd))
342 		return (NULL);
343 
344 	vp = zio_buf_alloc(sizeof (vdev_phys_t));
345 
346 	for (l = 0; l < VDEV_LABELS; l++) {
347 
348 		zio = zio_root(spa, NULL, NULL, ZIO_FLAG_CANFAIL |
349 		    ZIO_FLAG_SPECULATIVE | ZIO_FLAG_CONFIG_HELD);
350 
351 		vdev_label_read(zio, vd, l, vp,
352 		    offsetof(vdev_label_t, vl_vdev_phys),
353 		    sizeof (vdev_phys_t), NULL, NULL);
354 
355 		if (zio_wait(zio) == 0 &&
356 		    nvlist_unpack(vp->vp_nvlist, sizeof (vp->vp_nvlist),
357 		    &config, 0) == 0)
358 			break;
359 
360 		if (config != NULL) {
361 			nvlist_free(config);
362 			config = NULL;
363 		}
364 	}
365 
366 	zio_buf_free(vp, sizeof (vdev_phys_t));
367 
368 	return (config);
369 }
370 
371 /*
372  * Determine if a device is in use.  The 'spare_guid' parameter will be filled
373  * in with the device guid if this spare is active elsewhere on the system.
374  */
375 static boolean_t
376 vdev_inuse(vdev_t *vd, uint64_t crtxg, vdev_labeltype_t reason,
377     uint64_t *spare_guid, uint64_t *l2cache_guid)
378 {
379 	spa_t *spa = vd->vdev_spa;
380 	uint64_t state, pool_guid, device_guid, txg, spare_pool;
381 	uint64_t vdtxg = 0;
382 	nvlist_t *label;
383 
384 	if (spare_guid)
385 		*spare_guid = 0ULL;
386 	if (l2cache_guid)
387 		*l2cache_guid = 0ULL;
388 
389 	/*
390 	 * Read the label, if any, and perform some basic sanity checks.
391 	 */
392 	if ((label = vdev_label_read_config(vd)) == NULL)
393 		return (B_FALSE);
394 
395 	(void) nvlist_lookup_uint64(label, ZPOOL_CONFIG_CREATE_TXG,
396 	    &vdtxg);
397 
398 	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_STATE,
399 	    &state) != 0 ||
400 	    nvlist_lookup_uint64(label, ZPOOL_CONFIG_GUID,
401 	    &device_guid) != 0) {
402 		nvlist_free(label);
403 		return (B_FALSE);
404 	}
405 
406 	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
407 	    (nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_GUID,
408 	    &pool_guid) != 0 ||
409 	    nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_TXG,
410 	    &txg) != 0)) {
411 		nvlist_free(label);
412 		return (B_FALSE);
413 	}
414 
415 	nvlist_free(label);
416 
417 	/*
418 	 * Check to see if this device indeed belongs to the pool it claims to
419 	 * be a part of.  The only way this is allowed is if the device is a hot
420 	 * spare (which we check for later on).
421 	 */
422 	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
423 	    !spa_guid_exists(pool_guid, device_guid) &&
424 	    !spa_spare_exists(device_guid, NULL, NULL) &&
425 	    !spa_l2cache_exists(device_guid, NULL))
426 		return (B_FALSE);
427 
428 	/*
429 	 * If the transaction group is zero, then this an initialized (but
430 	 * unused) label.  This is only an error if the create transaction
431 	 * on-disk is the same as the one we're using now, in which case the
432 	 * user has attempted to add the same vdev multiple times in the same
433 	 * transaction.
434 	 */
435 	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
436 	    txg == 0 && vdtxg == crtxg)
437 		return (B_TRUE);
438 
439 	/*
440 	 * Check to see if this is a spare device.  We do an explicit check for
441 	 * spa_has_spare() here because it may be on our pending list of spares
442 	 * to add.  We also check if it is an l2cache device.
443 	 */
444 	if (spa_spare_exists(device_guid, &spare_pool, NULL) ||
445 	    spa_has_spare(spa, device_guid)) {
446 		if (spare_guid)
447 			*spare_guid = device_guid;
448 
449 		switch (reason) {
450 		case VDEV_LABEL_CREATE:
451 		case VDEV_LABEL_L2CACHE:
452 			return (B_TRUE);
453 
454 		case VDEV_LABEL_REPLACE:
455 			return (!spa_has_spare(spa, device_guid) ||
456 			    spare_pool != 0ULL);
457 
458 		case VDEV_LABEL_SPARE:
459 			return (spa_has_spare(spa, device_guid));
460 		}
461 	}
462 
463 	/*
464 	 * Check to see if this is an l2cache device.
465 	 */
466 	if (spa_l2cache_exists(device_guid, NULL))
467 		return (B_TRUE);
468 
469 	/*
470 	 * If the device is marked ACTIVE, then this device is in use by another
471 	 * pool on the system.
472 	 */
473 	return (state == POOL_STATE_ACTIVE);
474 }
475 
476 /*
477  * Initialize a vdev label.  We check to make sure each leaf device is not in
478  * use, and writable.  We put down an initial label which we will later
479  * overwrite with a complete label.  Note that it's important to do this
480  * sequentially, not in parallel, so that we catch cases of multiple use of the
481  * same leaf vdev in the vdev we're creating -- e.g. mirroring a disk with
482  * itself.
483  */
484 int
485 vdev_label_init(vdev_t *vd, uint64_t crtxg, vdev_labeltype_t reason)
486 {
487 	spa_t *spa = vd->vdev_spa;
488 	nvlist_t *label;
489 	vdev_phys_t *vp;
490 	vdev_boot_header_t *vb;
491 	uberblock_t *ub;
492 	zio_t *zio;
493 	int l, c, n;
494 	char *buf;
495 	size_t buflen;
496 	int error;
497 	uint64_t spare_guid, l2cache_guid;
498 	int flags = ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL;
499 
500 	ASSERT(spa_config_held(spa, RW_WRITER));
501 
502 	for (c = 0; c < vd->vdev_children; c++)
503 		if ((error = vdev_label_init(vd->vdev_child[c],
504 		    crtxg, reason)) != 0)
505 			return (error);
506 
507 	if (!vd->vdev_ops->vdev_op_leaf)
508 		return (0);
509 
510 	/*
511 	 * Dead vdevs cannot be initialized.
512 	 */
513 	if (vdev_is_dead(vd))
514 		return (EIO);
515 
516 	/*
517 	 * Determine if the vdev is in use.
518 	 */
519 	if (reason != VDEV_LABEL_REMOVE &&
520 	    vdev_inuse(vd, crtxg, reason, &spare_guid, &l2cache_guid))
521 		return (EBUSY);
522 
523 	ASSERT(reason != VDEV_LABEL_REMOVE ||
524 	    vdev_inuse(vd, crtxg, reason, NULL, NULL));
525 
526 	/*
527 	 * If this is a request to add or replace a spare or l2cache device
528 	 * that is in use elsewhere on the system, then we must update the
529 	 * guid (which was initialized to a random value) to reflect the
530 	 * actual GUID (which is shared between multiple pools).
531 	 */
532 	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_L2CACHE &&
533 	    spare_guid != 0ULL) {
534 		vdev_t *pvd = vd->vdev_parent;
535 
536 		for (; pvd != NULL; pvd = pvd->vdev_parent) {
537 			pvd->vdev_guid_sum -= vd->vdev_guid;
538 			pvd->vdev_guid_sum += spare_guid;
539 		}
540 
541 		vd->vdev_guid = vd->vdev_guid_sum = spare_guid;
542 
543 		/*
544 		 * If this is a replacement, then we want to fallthrough to the
545 		 * rest of the code.  If we're adding a spare, then it's already
546 		 * labeled appropriately and we can just return.
547 		 */
548 		if (reason == VDEV_LABEL_SPARE)
549 			return (0);
550 		ASSERT(reason == VDEV_LABEL_REPLACE);
551 	}
552 
553 	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_SPARE &&
554 	    l2cache_guid != 0ULL) {
555 		vdev_t *pvd = vd->vdev_parent;
556 
557 		for (; pvd != NULL; pvd = pvd->vdev_parent) {
558 			pvd->vdev_guid_sum -= vd->vdev_guid;
559 			pvd->vdev_guid_sum += l2cache_guid;
560 		}
561 
562 		vd->vdev_guid = vd->vdev_guid_sum = l2cache_guid;
563 
564 		/*
565 		 * If this is a replacement, then we want to fallthrough to the
566 		 * rest of the code.  If we're adding an l2cache, then it's
567 		 * already labeled appropriately and we can just return.
568 		 */
569 		if (reason == VDEV_LABEL_L2CACHE)
570 			return (0);
571 		ASSERT(reason == VDEV_LABEL_REPLACE);
572 	}
573 
574 	/*
575 	 * Initialize its label.
576 	 */
577 	vp = zio_buf_alloc(sizeof (vdev_phys_t));
578 	bzero(vp, sizeof (vdev_phys_t));
579 
580 	/*
581 	 * Generate a label describing the pool and our top-level vdev.
582 	 * We mark it as being from txg 0 to indicate that it's not
583 	 * really part of an active pool just yet.  The labels will
584 	 * be written again with a meaningful txg by spa_sync().
585 	 */
586 	if (reason == VDEV_LABEL_SPARE ||
587 	    (reason == VDEV_LABEL_REMOVE && vd->vdev_isspare)) {
588 		/*
589 		 * For inactive hot spares, we generate a special label that
590 		 * identifies as a mutually shared hot spare.  We write the
591 		 * label if we are adding a hot spare, or if we are removing an
592 		 * active hot spare (in which case we want to revert the
593 		 * labels).
594 		 */
595 		VERIFY(nvlist_alloc(&label, NV_UNIQUE_NAME, KM_SLEEP) == 0);
596 
597 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_VERSION,
598 		    spa_version(spa)) == 0);
599 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_POOL_STATE,
600 		    POOL_STATE_SPARE) == 0);
601 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_GUID,
602 		    vd->vdev_guid) == 0);
603 	} else if (reason == VDEV_LABEL_L2CACHE ||
604 	    (reason == VDEV_LABEL_REMOVE && vd->vdev_isl2cache)) {
605 		/*
606 		 * For level 2 ARC devices, add a special label.
607 		 */
608 		VERIFY(nvlist_alloc(&label, NV_UNIQUE_NAME, KM_SLEEP) == 0);
609 
610 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_VERSION,
611 		    spa_version(spa)) == 0);
612 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_POOL_STATE,
613 		    POOL_STATE_L2CACHE) == 0);
614 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_GUID,
615 		    vd->vdev_guid) == 0);
616 	} else {
617 		label = spa_config_generate(spa, vd, 0ULL, B_FALSE);
618 
619 		/*
620 		 * Add our creation time.  This allows us to detect multiple
621 		 * vdev uses as described above, and automatically expires if we
622 		 * fail.
623 		 */
624 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_CREATE_TXG,
625 		    crtxg) == 0);
626 	}
627 
628 	buf = vp->vp_nvlist;
629 	buflen = sizeof (vp->vp_nvlist);
630 
631 	error = nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, KM_SLEEP);
632 	if (error != 0) {
633 		nvlist_free(label);
634 		zio_buf_free(vp, sizeof (vdev_phys_t));
635 		/* EFAULT means nvlist_pack ran out of room */
636 		return (error == EFAULT ? ENAMETOOLONG : EINVAL);
637 	}
638 
639 	/*
640 	 * Initialize boot block header.
641 	 */
642 	vb = zio_buf_alloc(sizeof (vdev_boot_header_t));
643 	bzero(vb, sizeof (vdev_boot_header_t));
644 	vb->vb_magic = VDEV_BOOT_MAGIC;
645 	vb->vb_version = VDEV_BOOT_VERSION;
646 	vb->vb_offset = VDEV_BOOT_OFFSET;
647 	vb->vb_size = VDEV_BOOT_SIZE;
648 
649 	/*
650 	 * Initialize uberblock template.
651 	 */
652 	ub = zio_buf_alloc(VDEV_UBERBLOCK_SIZE(vd));
653 	bzero(ub, VDEV_UBERBLOCK_SIZE(vd));
654 	*ub = spa->spa_uberblock;
655 	ub->ub_txg = 0;
656 
657 	/*
658 	 * Write everything in parallel.
659 	 */
660 	zio = zio_root(spa, NULL, NULL, flags);
661 
662 	for (l = 0; l < VDEV_LABELS; l++) {
663 
664 		vdev_label_write(zio, vd, l, vp,
665 		    offsetof(vdev_label_t, vl_vdev_phys),
666 		    sizeof (vdev_phys_t), NULL, NULL, flags);
667 
668 		vdev_label_write(zio, vd, l, vb,
669 		    offsetof(vdev_label_t, vl_boot_header),
670 		    sizeof (vdev_boot_header_t), NULL, NULL, flags);
671 
672 		for (n = 0; n < VDEV_UBERBLOCK_COUNT(vd); n++) {
673 			vdev_label_write(zio, vd, l, ub,
674 			    VDEV_UBERBLOCK_OFFSET(vd, n),
675 			    VDEV_UBERBLOCK_SIZE(vd), NULL, NULL, flags);
676 		}
677 	}
678 
679 	error = zio_wait(zio);
680 
681 	nvlist_free(label);
682 	zio_buf_free(ub, VDEV_UBERBLOCK_SIZE(vd));
683 	zio_buf_free(vb, sizeof (vdev_boot_header_t));
684 	zio_buf_free(vp, sizeof (vdev_phys_t));
685 
686 	/*
687 	 * If this vdev hasn't been previously identified as a spare, then we
688 	 * mark it as such only if a) we are labeling it as a spare, or b) it
689 	 * exists as a spare elsewhere in the system.  Do the same for
690 	 * level 2 ARC devices.
691 	 */
692 	if (error == 0 && !vd->vdev_isspare &&
693 	    (reason == VDEV_LABEL_SPARE ||
694 	    spa_spare_exists(vd->vdev_guid, NULL, NULL)))
695 		spa_spare_add(vd);
696 
697 	if (error == 0 && !vd->vdev_isl2cache &&
698 	    (reason == VDEV_LABEL_L2CACHE ||
699 	    spa_l2cache_exists(vd->vdev_guid, NULL)))
700 		spa_l2cache_add(vd);
701 
702 	return (error);
703 }
704 
705 /*
706  * ==========================================================================
707  * uberblock load/sync
708  * ==========================================================================
709  */
710 
711 /*
712  * Consider the following situation: txg is safely synced to disk.  We've
713  * written the first uberblock for txg + 1, and then we lose power.  When we
714  * come back up, we fail to see the uberblock for txg + 1 because, say,
715  * it was on a mirrored device and the replica to which we wrote txg + 1
716  * is now offline.  If we then make some changes and sync txg + 1, and then
717  * the missing replica comes back, then for a new seconds we'll have two
718  * conflicting uberblocks on disk with the same txg.  The solution is simple:
719  * among uberblocks with equal txg, choose the one with the latest timestamp.
720  */
721 static int
722 vdev_uberblock_compare(uberblock_t *ub1, uberblock_t *ub2)
723 {
724 	if (ub1->ub_txg < ub2->ub_txg)
725 		return (-1);
726 	if (ub1->ub_txg > ub2->ub_txg)
727 		return (1);
728 
729 	if (ub1->ub_timestamp < ub2->ub_timestamp)
730 		return (-1);
731 	if (ub1->ub_timestamp > ub2->ub_timestamp)
732 		return (1);
733 
734 	return (0);
735 }
736 
737 static void
738 vdev_uberblock_load_done(zio_t *zio)
739 {
740 	uberblock_t *ub = zio->io_data;
741 	uberblock_t *ubbest = zio->io_private;
742 	spa_t *spa = zio->io_spa;
743 
744 	ASSERT3U(zio->io_size, ==, VDEV_UBERBLOCK_SIZE(zio->io_vd));
745 
746 	if (zio->io_error == 0 && uberblock_verify(ub) == 0) {
747 		mutex_enter(&spa->spa_uberblock_lock);
748 		if (vdev_uberblock_compare(ub, ubbest) > 0)
749 			*ubbest = *ub;
750 		mutex_exit(&spa->spa_uberblock_lock);
751 	}
752 
753 	zio_buf_free(zio->io_data, zio->io_size);
754 }
755 
756 void
757 vdev_uberblock_load(zio_t *zio, vdev_t *vd, uberblock_t *ubbest)
758 {
759 	int l, c, n;
760 
761 	for (c = 0; c < vd->vdev_children; c++)
762 		vdev_uberblock_load(zio, vd->vdev_child[c], ubbest);
763 
764 	if (!vd->vdev_ops->vdev_op_leaf)
765 		return;
766 
767 	if (vdev_is_dead(vd))
768 		return;
769 
770 	for (l = 0; l < VDEV_LABELS; l++) {
771 		for (n = 0; n < VDEV_UBERBLOCK_COUNT(vd); n++) {
772 			vdev_label_read(zio, vd, l,
773 			    zio_buf_alloc(VDEV_UBERBLOCK_SIZE(vd)),
774 			    VDEV_UBERBLOCK_OFFSET(vd, n),
775 			    VDEV_UBERBLOCK_SIZE(vd),
776 			    vdev_uberblock_load_done, ubbest);
777 		}
778 	}
779 }
780 
781 /*
782  * On success, increment root zio's count of good writes.
783  * We only get credit for writes to known-visible vdevs; see spa_vdev_add().
784  */
785 static void
786 vdev_uberblock_sync_done(zio_t *zio)
787 {
788 	uint64_t *good_writes = zio->io_private;
789 
790 	if (zio->io_error == 0 && zio->io_vd->vdev_top->vdev_ms_array != 0)
791 		atomic_add_64(good_writes, 1);
792 }
793 
794 /*
795  * Write the uberblock to all labels of all leaves of the specified vdev.
796  */
797 static void
798 vdev_uberblock_sync(zio_t *zio, uberblock_t *ub, vdev_t *vd)
799 {
800 	int l, c, n;
801 	uberblock_t *ubbuf;
802 
803 	for (c = 0; c < vd->vdev_children; c++)
804 		vdev_uberblock_sync(zio, ub, vd->vdev_child[c]);
805 
806 	if (!vd->vdev_ops->vdev_op_leaf)
807 		return;
808 
809 	if (vdev_is_dead(vd))
810 		return;
811 
812 	n = ub->ub_txg & (VDEV_UBERBLOCK_COUNT(vd) - 1);
813 
814 	ubbuf = zio_buf_alloc(VDEV_UBERBLOCK_SIZE(vd));
815 	bzero(ubbuf, VDEV_UBERBLOCK_SIZE(vd));
816 	*ubbuf = *ub;
817 
818 	for (l = 0; l < VDEV_LABELS; l++)
819 		vdev_label_write(zio, vd, l, ubbuf,
820 		    VDEV_UBERBLOCK_OFFSET(vd, n),
821 		    VDEV_UBERBLOCK_SIZE(vd),
822 		    vdev_uberblock_sync_done, zio->io_private,
823 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_PROPAGATE);
824 
825 	zio_buf_free(ubbuf, VDEV_UBERBLOCK_SIZE(vd));
826 }
827 
828 static void
829 vdev_uberblock_sync_list_done(zio_t *zio)
830 {
831 	uint64_t *good_writes = zio->io_private;
832 
833 	if (*good_writes == 0)
834 		zio->io_error = EIO;
835 }
836 
837 int
838 vdev_uberblock_sync_list(vdev_t **svd, int svdcount, uberblock_t *ub, int flags)
839 {
840 	spa_t *spa = svd[0]->vdev_spa;
841 	int v;
842 	zio_t *zio, *nio;
843 	uint64_t good_writes = 0;
844 	int io_flags = flags;
845 
846 	/*
847 	 * If we've been asked to update all the vdevs then we change
848 	 * our flags to ZIO_FLAG_MUSTSUCCEED so that the pipeline can
849 	 * handle error should all update fail.
850 	 */
851 	if (svdcount == spa->spa_root_vdev->vdev_children)
852 		io_flags &= ~ZIO_FLAG_CANFAIL;
853 
854 	/*
855 	 * We rely on the value of good_writes and the root I/O to determine
856 	 * how a complete failure is handled. In the event that the root is a
857 	 * ZIO_FLAG_MUSTSUCCED, then the pipeline will block this I/O if we
858 	 * were unable to update any uberblock. Once the I/O is blocked the
859 	 * pipeline will retry it when the error is cleared. Unfortunately,
860 	 * the pipeline does not have the complete I/O tree so it will be
861 	 * unable to retry the actual uberblock update. Instead we rely on
862 	 * the value of good_writes to return the failed status to the caller
863 	 * which will retry on error and thus resubmit the complete I/O
864 	 * tree.
865 	 */
866 	zio = zio_root(spa, NULL, NULL, io_flags);
867 	nio = zio_null(zio, spa, vdev_uberblock_sync_list_done, &good_writes,
868 	    flags);
869 	for (v = 0; v < svdcount; v++)
870 		vdev_uberblock_sync(nio, ub, svd[v]);
871 	zio_nowait(nio);
872 	(void) zio_wait(zio);
873 
874 	/*
875 	 * Flush the uberblocks to disk.  This ensures that the odd labels
876 	 * are no longer needed (because the new uberblocks and the even
877 	 * labels are safely on disk), so it is safe to overwrite them.
878 	 */
879 	zio = zio_root(spa, NULL, NULL, flags);
880 
881 	for (v = 0; v < svdcount; v++)
882 		zio_flush(zio, svd[v]);
883 
884 	(void) zio_wait(zio);
885 
886 	return (good_writes >= 1 ? 0 : EIO);
887 }
888 
889 /*
890  * On success, increment the count of good writes for our top-level vdev.
891  */
892 static void
893 vdev_label_sync_done(zio_t *zio)
894 {
895 	uint64_t *good_writes = zio->io_private;
896 
897 	if (zio->io_error == 0)
898 		atomic_add_64(good_writes, 1);
899 }
900 
901 /*
902  * If there weren't enough good writes, indicate failure to the parent.
903  */
904 static void
905 vdev_label_sync_top_done(zio_t *zio)
906 {
907 	uint64_t *good_writes = zio->io_private;
908 
909 	if (*good_writes == 0)
910 		zio->io_error = EIO;
911 
912 	kmem_free(good_writes, sizeof (uint64_t));
913 }
914 
915 /*
916  * We ignore errors for log and cache devices, simply free the private data.
917  */
918 static void
919 vdev_label_sync_ignore_done(zio_t *zio)
920 {
921 	kmem_free(zio->io_private, sizeof (uint64_t));
922 }
923 
924 /*
925  * Write all even or odd labels to all leaves of the specified vdev.
926  */
927 static void
928 vdev_label_sync(zio_t *zio, vdev_t *vd, int l, uint64_t txg)
929 {
930 	nvlist_t *label;
931 	vdev_phys_t *vp;
932 	char *buf;
933 	size_t buflen;
934 	int c;
935 
936 	for (c = 0; c < vd->vdev_children; c++)
937 		vdev_label_sync(zio, vd->vdev_child[c], l, txg);
938 
939 	if (!vd->vdev_ops->vdev_op_leaf)
940 		return;
941 
942 	if (vdev_is_dead(vd))
943 		return;
944 
945 	/*
946 	 * Generate a label describing the top-level config to which we belong.
947 	 */
948 	label = spa_config_generate(vd->vdev_spa, vd, txg, B_FALSE);
949 
950 	vp = zio_buf_alloc(sizeof (vdev_phys_t));
951 	bzero(vp, sizeof (vdev_phys_t));
952 
953 	buf = vp->vp_nvlist;
954 	buflen = sizeof (vp->vp_nvlist);
955 
956 	if (nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, KM_SLEEP) == 0) {
957 		for (; l < VDEV_LABELS; l += 2) {
958 			vdev_label_write(zio, vd, l, vp,
959 			    offsetof(vdev_label_t, vl_vdev_phys),
960 			    sizeof (vdev_phys_t),
961 			    vdev_label_sync_done, zio->io_private,
962 			    ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_PROPAGATE);
963 		}
964 	}
965 
966 	zio_buf_free(vp, sizeof (vdev_phys_t));
967 	nvlist_free(label);
968 }
969 
970 int
971 vdev_label_sync_list(spa_t *spa, int l, int flags, uint64_t txg)
972 {
973 	list_t *dl = &spa->spa_dirty_list;
974 	vdev_t *vd;
975 	zio_t *zio, *nio;
976 	int error;
977 	int io_flags = flags & ~ZIO_FLAG_CANFAIL;
978 
979 	/*
980 	 * The root I/O for all label updates must succeed and we track
981 	 * the error returned back from the null I/O to determine if we
982 	 * need to reissue the I/O tree from scratch. If we are unable
983 	 * to update any leaf vdev associated with a dirty top-level vdev,
984 	 * then the pipeline will either suspend or panic when the root I/O
985 	 * is issued. If the error is cleared, then the pipleine will retry
986 	 * the root I/O. Unfortunately we've lost the entire I/O tree so we
987 	 * return back the original error to the caller and allow the caller
988 	 * to call use again so that we can build the I/O tree from scratch.
989 	 */
990 	zio = zio_root(spa, NULL, NULL, io_flags);
991 	nio = zio_null(zio, spa, NULL, NULL, flags);
992 
993 	for (vd = list_head(dl); vd != NULL; vd = list_next(dl, vd)) {
994 		uint64_t *good_writes = kmem_zalloc(sizeof (uint64_t),
995 		    KM_SLEEP);
996 		zio_t *vio = zio_null(nio, spa,
997 		    (vd->vdev_islog || vd->vdev_aux != NULL) ?
998 		    vdev_label_sync_ignore_done : vdev_label_sync_top_done,
999 		    good_writes, flags);
1000 		vdev_label_sync(vio, vd, l, txg);
1001 		zio_nowait(vio);
1002 	}
1003 	error = zio_wait(nio);
1004 	(void) zio_wait(zio);
1005 
1006 	/*
1007 	 * Flush the new labels to disk.
1008 	 */
1009 	zio = zio_root(spa, NULL, NULL, flags);
1010 
1011 	for (vd = list_head(dl); vd != NULL; vd = list_next(dl, vd))
1012 		zio_flush(zio, vd);
1013 
1014 	(void) zio_wait(zio);
1015 
1016 	return (error);
1017 }
1018 
1019 /*
1020  * Sync the uberblock and any changes to the vdev configuration.
1021  *
1022  * The order of operations is carefully crafted to ensure that
1023  * if the system panics or loses power at any time, the state on disk
1024  * is still transactionally consistent.  The in-line comments below
1025  * describe the failure semantics at each stage.
1026  *
1027  * Moreover, vdev_config_sync() is designed to be idempotent: if it fails
1028  * at any time, you can just call it again, and it will resume its work.
1029  */
1030 void
1031 vdev_config_sync(vdev_t **svd, int svdcount, uint64_t txg)
1032 {
1033 	spa_t *spa = svd[0]->vdev_spa;
1034 	uberblock_t *ub = &spa->spa_uberblock;
1035 	vdev_t *vd;
1036 	zio_t *zio;
1037 	int flags = ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL;
1038 
1039 	ASSERT(ub->ub_txg <= txg);
1040 
1041 	/*
1042 	 * If this isn't a resync due to I/O errors,
1043 	 * and nothing changed in this transaction group,
1044 	 * and the vdev configuration hasn't changed,
1045 	 * then there's nothing to do.
1046 	 */
1047 	if (ub->ub_txg < txg &&
1048 	    uberblock_update(ub, spa->spa_root_vdev, txg) == B_FALSE &&
1049 	    list_is_empty(&spa->spa_dirty_list))
1050 		return;
1051 
1052 	if (txg > spa_freeze_txg(spa))
1053 		return;
1054 
1055 	ASSERT(txg <= spa->spa_final_txg);
1056 
1057 	/*
1058 	 * Flush the write cache of every disk that's been written to
1059 	 * in this transaction group.  This ensures that all blocks
1060 	 * written in this txg will be committed to stable storage
1061 	 * before any uberblock that references them.
1062 	 */
1063 	zio = zio_root(spa, NULL, NULL, flags);
1064 
1065 	for (vd = txg_list_head(&spa->spa_vdev_txg_list, TXG_CLEAN(txg)); vd;
1066 	    vd = txg_list_next(&spa->spa_vdev_txg_list, vd, TXG_CLEAN(txg)))
1067 		zio_flush(zio, vd);
1068 
1069 	(void) zio_wait(zio);
1070 
1071 	/*
1072 	 * Sync out the even labels (L0, L2) for every dirty vdev.  If the
1073 	 * system dies in the middle of this process, that's OK: all of the
1074 	 * even labels that made it to disk will be newer than any uberblock,
1075 	 * and will therefore be considered invalid.  The odd labels (L1, L3),
1076 	 * which have not yet been touched, will still be valid.  We flush
1077 	 * the new labels to disk to ensure that all even-label updates
1078 	 * are committed to stable storage before the uberblock update.
1079 	 * Failure to update any of the labels will invoke the 'failmode'
1080 	 * code path. Thus we must retry the entire I/O tree once the error
1081 	 * is cleared and we ar resumed.
1082 	 */
1083 	while (vdev_label_sync_list(spa, 0, flags, txg) != 0)
1084 		;
1085 
1086 	/*
1087 	 * Sync the uberblocks to all vdevs in svd[]. If we are unable
1088 	 * to do so, then we attempt to sync out to all top-level vdevs.
1089 	 * If the system dies in the middle of this step, there are two cases
1090 	 * to consider, and the on-disk state is consistent either way:
1091 	 *
1092 	 * (1)	If none of the new uberblocks made it to disk, then the
1093 	 *	previous uberblock will be the newest, and the odd labels
1094 	 *	(which had not yet been touched) will be valid with respect
1095 	 *	to that uberblock.
1096 	 *
1097 	 * (2)	If one or more new uberblocks made it to disk, then they
1098 	 *	will be the newest, and the even labels (which had all
1099 	 *	been successfully committed) will be valid with respect
1100 	 *	to the new uberblocks.
1101 	 *
1102 	 * In addition, if we have failed to update all the uberblocks then
1103 	 * we will follow the 'failmode' code path. We must retry the entire
1104 	 * I/O tree if we are resumed.
1105 	 */
1106 	if (vdev_uberblock_sync_list(svd, svdcount, ub, flags) != 0) {
1107 		vdev_t *rvd = spa->spa_root_vdev;
1108 
1109 		while (vdev_uberblock_sync_list(rvd->vdev_child,
1110 		    rvd->vdev_children, ub, flags))
1111 			;
1112 	}
1113 
1114 	/*
1115 	 * Sync out odd labels for every dirty vdev.  If the system dies
1116 	 * in the middle of this process, the even labels and the new
1117 	 * uberblocks will suffice to open the pool.  The next time
1118 	 * the pool is opened, the first thing we'll do -- before any
1119 	 * user data is modified -- is mark every vdev dirty so that
1120 	 * all labels will be brought up to date.  We flush the new labels
1121 	 * to disk to ensure that all odd-label updates are committed to
1122 	 * stable storage before the next transaction group begins.
1123 	 * Failure to update any of the labels will invoke the 'failmode'
1124 	 * code path. Thus we must retry the entire I/O tree once the error
1125 	 * is cleared and we are resumed.
1126 	 */
1127 	while (vdev_label_sync_list(spa, 1, flags, txg) != 0)
1128 		;
1129 }
1130