1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright (c) 2012, 2014 by Delphix. All rights reserved.
24 * Copyright (c) 2013 Martin Matuska. All rights reserved.
25 * Copyright (c) 2014 Joyent, Inc. All rights reserved.
26 * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
27 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
28 */
29
30 #include <sys/dmu.h>
31 #include <sys/dmu_objset.h>
32 #include <sys/dmu_tx.h>
33 #include <sys/dsl_dataset.h>
34 #include <sys/dsl_dir.h>
35 #include <sys/dsl_prop.h>
36 #include <sys/dsl_synctask.h>
37 #include <sys/dsl_deleg.h>
38 #include <sys/dmu_impl.h>
39 #include <sys/spa.h>
40 #include <sys/metaslab.h>
41 #include <sys/zap.h>
42 #include <sys/zio.h>
43 #include <sys/arc.h>
44 #include <sys/sunddi.h>
45 #include <sys/zfeature.h>
46 #include <sys/policy.h>
47 #include <sys/zfs_znode.h>
48 #include "zfs_namecheck.h"
49 #include "zfs_prop.h"
50
51 /*
52 * Filesystem and Snapshot Limits
53 * ------------------------------
54 *
55 * These limits are used to restrict the number of filesystems and/or snapshots
56 * that can be created at a given level in the tree or below. A typical
57 * use-case is with a delegated dataset where the administrator wants to ensure
58 * that a user within the zone is not creating too many additional filesystems
59 * or snapshots, even though they're not exceeding their space quota.
60 *
61 * The filesystem and snapshot counts are stored as extensible properties. This
62 * capability is controlled by a feature flag and must be enabled to be used.
63 * Once enabled, the feature is not active until the first limit is set. At
64 * that point, future operations to create/destroy filesystems or snapshots
65 * will validate and update the counts.
66 *
67 * Because the count properties will not exist before the feature is active,
68 * the counts are updated when a limit is first set on an uninitialized
69 * dsl_dir node in the tree (The filesystem/snapshot count on a node includes
70 * all of the nested filesystems/snapshots. Thus, a new leaf node has a
71 * filesystem count of 0 and a snapshot count of 0. Non-existent filesystem and
72 * snapshot count properties on a node indicate uninitialized counts on that
73 * node.) When first setting a limit on an uninitialized node, the code starts
74 * at the filesystem with the new limit and descends into all sub-filesystems
75 * to add the count properties.
76 *
77 * In practice this is lightweight since a limit is typically set when the
78 * filesystem is created and thus has no children. Once valid, changing the
79 * limit value won't require a re-traversal since the counts are already valid.
80 * When recursively fixing the counts, if a node with a limit is encountered
81 * during the descent, the counts are known to be valid and there is no need to
82 * descend into that filesystem's children. The counts on filesystems above the
83 * one with the new limit will still be uninitialized, unless a limit is
84 * eventually set on one of those filesystems. The counts are always recursively
85 * updated when a limit is set on a dataset, unless there is already a limit.
86 * When a new limit value is set on a filesystem with an existing limit, it is
87 * possible for the new limit to be less than the current count at that level
88 * since a user who can change the limit is also allowed to exceed the limit.
89 *
90 * Once the feature is active, then whenever a filesystem or snapshot is
91 * created, the code recurses up the tree, validating the new count against the
92 * limit at each initialized level. In practice, most levels will not have a
93 * limit set. If there is a limit at any initialized level up the tree, the
94 * check must pass or the creation will fail. Likewise, when a filesystem or
95 * snapshot is destroyed, the counts are recursively adjusted all the way up
96 * the initizized nodes in the tree. Renaming a filesystem into different point
97 * in the tree will first validate, then update the counts on each branch up to
98 * the common ancestor. A receive will also validate the counts and then update
99 * them.
100 *
101 * An exception to the above behavior is that the limit is not enforced if the
102 * user has permission to modify the limit. This is primarily so that
103 * recursive snapshots in the global zone always work. We want to prevent a
104 * denial-of-service in which a lower level delegated dataset could max out its
105 * limit and thus block recursive snapshots from being taken in the global zone.
106 * Because of this, it is possible for the snapshot count to be over the limit
107 * and snapshots taken in the global zone could cause a lower level dataset to
108 * hit or exceed its limit. The administrator taking the global zone recursive
109 * snapshot should be aware of this side-effect and behave accordingly.
110 * For consistency, the filesystem limit is also not enforced if the user can
111 * modify the limit.
112 *
113 * The filesystem and snapshot limits are validated by dsl_fs_ss_limit_check()
114 * and updated by dsl_fs_ss_count_adjust(). A new limit value is setup in
115 * dsl_dir_activate_fs_ss_limit() and the counts are adjusted, if necessary, by
116 * dsl_dir_init_fs_ss_count().
117 *
118 * There is a special case when we receive a filesystem that already exists. In
119 * this case a temporary clone name of %X is created (see dmu_recv_begin). We
120 * never update the filesystem counts for temporary clones.
121 *
122 * Likewise, we do not update the snapshot counts for temporary snapshots,
123 * such as those created by zfs diff.
124 */
125
126 extern inline dsl_dir_phys_t *dsl_dir_phys(dsl_dir_t *dd);
127
128 static uint64_t dsl_dir_space_towrite(dsl_dir_t *dd);
129
130 static void
131 dsl_dir_evict(void *dbu)
132 {
133 dsl_dir_t *dd = dbu;
134 dsl_pool_t *dp = dd->dd_pool;
135 int t;
136
137 dd->dd_dbuf = NULL;
138
139 for (t = 0; t < TXG_SIZE; t++) {
140 ASSERT(!txg_list_member(&dp->dp_dirty_dirs, dd, t));
141 ASSERT(dd->dd_tempreserved[t] == 0);
142 ASSERT(dd->dd_space_towrite[t] == 0);
143 }
144
145 if (dd->dd_parent)
146 dsl_dir_async_rele(dd->dd_parent, dd);
147
148 spa_async_close(dd->dd_pool->dp_spa, dd);
149
150 /*
151 * The props callback list should have been cleaned up by
152 * objset_evict().
153 */
154 list_destroy(&dd->dd_prop_cbs);
155 mutex_destroy(&dd->dd_lock);
156 kmem_free(dd, sizeof (dsl_dir_t));
157 }
158
159 int
160 dsl_dir_hold_obj(dsl_pool_t *dp, uint64_t ddobj,
161 const char *tail, void *tag, dsl_dir_t **ddp)
162 {
163 dmu_buf_t *dbuf;
164 dsl_dir_t *dd;
165 int err;
166
167 ASSERT(dsl_pool_config_held(dp));
168
169 err = dmu_bonus_hold(dp->dp_meta_objset, ddobj, tag, &dbuf);
170 if (err != 0)
171 return (err);
172 dd = dmu_buf_get_user(dbuf);
173 #ifdef ZFS_DEBUG
174 {
175 dmu_object_info_t doi;
176 dmu_object_info_from_db(dbuf, &doi);
177 ASSERT3U(doi.doi_bonus_type, ==, DMU_OT_DSL_DIR);
178 ASSERT3U(doi.doi_bonus_size, >=, sizeof (dsl_dir_phys_t));
179 }
180 #endif
181 if (dd == NULL) {
182 dsl_dir_t *winner;
183
184 dd = kmem_zalloc(sizeof (dsl_dir_t), KM_SLEEP);
185 dd->dd_object = ddobj;
186 dd->dd_dbuf = dbuf;
187 dd->dd_pool = dp;
188 mutex_init(&dd->dd_lock, NULL, MUTEX_DEFAULT, NULL);
189
190 list_create(&dd->dd_prop_cbs, sizeof (dsl_prop_cb_record_t),
191 offsetof(dsl_prop_cb_record_t, cbr_node));
192
193 dsl_dir_snap_cmtime_update(dd);
194
195 if (dsl_dir_phys(dd)->dd_parent_obj) {
196 err = dsl_dir_hold_obj(dp,
197 dsl_dir_phys(dd)->dd_parent_obj, NULL, dd,
198 &dd->dd_parent);
199 if (err != 0)
200 goto errout;
201 if (tail) {
202 #ifdef ZFS_DEBUG
203 uint64_t foundobj;
204
205 err = zap_lookup(dp->dp_meta_objset,
206 dsl_dir_phys(dd->dd_parent)->
207 dd_child_dir_zapobj, tail,
208 sizeof (foundobj), 1, &foundobj);
209 ASSERT(err || foundobj == ddobj);
210 #endif
211 (void) strcpy(dd->dd_myname, tail);
212 } else {
213 err = zap_value_search(dp->dp_meta_objset,
214 dsl_dir_phys(dd->dd_parent)->
215 dd_child_dir_zapobj,
216 ddobj, 0, dd->dd_myname);
217 }
218 if (err != 0)
219 goto errout;
220 } else {
221 (void) strcpy(dd->dd_myname, spa_name(dp->dp_spa));
222 }
223
224 if (dsl_dir_is_clone(dd)) {
225 dmu_buf_t *origin_bonus;
226 dsl_dataset_phys_t *origin_phys;
227
228 /*
229 * We can't open the origin dataset, because
230 * that would require opening this dsl_dir.
231 * Just look at its phys directly instead.
232 */
233 err = dmu_bonus_hold(dp->dp_meta_objset,
234 dsl_dir_phys(dd)->dd_origin_obj, FTAG,
235 &origin_bonus);
236 if (err != 0)
237 goto errout;
238 origin_phys = origin_bonus->db_data;
239 dd->dd_origin_txg =
240 origin_phys->ds_creation_txg;
241 dmu_buf_rele(origin_bonus, FTAG);
242 }
243
244 dmu_buf_init_user(&dd->dd_dbu, dsl_dir_evict, &dd->dd_dbuf);
245 winner = dmu_buf_set_user_ie(dbuf, &dd->dd_dbu);
246 if (winner != NULL) {
247 if (dd->dd_parent)
248 dsl_dir_rele(dd->dd_parent, dd);
249 mutex_destroy(&dd->dd_lock);
250 kmem_free(dd, sizeof (dsl_dir_t));
251 dd = winner;
252 } else {
253 spa_open_ref(dp->dp_spa, dd);
254 }
255 }
256
257 /*
258 * The dsl_dir_t has both open-to-close and instantiate-to-evict
259 * holds on the spa. We need the open-to-close holds because
260 * otherwise the spa_refcnt wouldn't change when we open a
261 * dir which the spa also has open, so we could incorrectly
262 * think it was OK to unload/export/destroy the pool. We need
263 * the instantiate-to-evict hold because the dsl_dir_t has a
264 * pointer to the dd_pool, which has a pointer to the spa_t.
265 */
266 spa_open_ref(dp->dp_spa, tag);
267 ASSERT3P(dd->dd_pool, ==, dp);
268 ASSERT3U(dd->dd_object, ==, ddobj);
269 ASSERT3P(dd->dd_dbuf, ==, dbuf);
270 *ddp = dd;
271 return (0);
272
273 errout:
274 if (dd->dd_parent)
275 dsl_dir_rele(dd->dd_parent, dd);
276 mutex_destroy(&dd->dd_lock);
277 kmem_free(dd, sizeof (dsl_dir_t));
278 dmu_buf_rele(dbuf, tag);
279 return (err);
280 }
281
282 void
283 dsl_dir_rele(dsl_dir_t *dd, void *tag)
284 {
285 dprintf_dd(dd, "%s\n", "");
286 spa_close(dd->dd_pool->dp_spa, tag);
287 dmu_buf_rele(dd->dd_dbuf, tag);
288 }
289
290 /*
291 * Remove a reference to the given dsl dir that is being asynchronously
292 * released. Async releases occur from a taskq performing eviction of
293 * dsl datasets and dirs. This process is identical to a normal release
294 * with the exception of using the async API for releasing the reference on
295 * the spa.
296 */
297 void
298 dsl_dir_async_rele(dsl_dir_t *dd, void *tag)
299 {
300 dprintf_dd(dd, "%s\n", "");
301 spa_async_close(dd->dd_pool->dp_spa, tag);
302 dmu_buf_rele(dd->dd_dbuf, tag);
303 }
304
305 /* buf must be long enough (MAXNAMELEN + strlen(MOS_DIR_NAME) + 1 should do) */
306 void
307 dsl_dir_name(dsl_dir_t *dd, char *buf)
308 {
309 if (dd->dd_parent) {
310 dsl_dir_name(dd->dd_parent, buf);
311 (void) strcat(buf, "/");
312 } else {
313 buf[0] = '\0';
314 }
315 if (!MUTEX_HELD(&dd->dd_lock)) {
316 /*
317 * recursive mutex so that we can use
318 * dprintf_dd() with dd_lock held
319 */
320 mutex_enter(&dd->dd_lock);
321 (void) strcat(buf, dd->dd_myname);
322 mutex_exit(&dd->dd_lock);
323 } else {
324 (void) strcat(buf, dd->dd_myname);
325 }
326 }
327
328 /* Calculate name length, avoiding all the strcat calls of dsl_dir_name */
329 int
330 dsl_dir_namelen(dsl_dir_t *dd)
331 {
332 int result = 0;
333
334 if (dd->dd_parent) {
335 /* parent's name + 1 for the "/" */
336 result = dsl_dir_namelen(dd->dd_parent) + 1;
337 }
338
339 if (!MUTEX_HELD(&dd->dd_lock)) {
340 /* see dsl_dir_name */
341 mutex_enter(&dd->dd_lock);
342 result += strlen(dd->dd_myname);
343 mutex_exit(&dd->dd_lock);
344 } else {
345 result += strlen(dd->dd_myname);
346 }
347
348 return (result);
349 }
350
351 static int
352 getcomponent(const char *path, char *component, const char **nextp)
353 {
354 char *p;
355
356 if ((path == NULL) || (path[0] == '\0'))
357 return (SET_ERROR(ENOENT));
358 /* This would be a good place to reserve some namespace... */
359 p = strpbrk(path, "/@");
360 if (p && (p[1] == '/' || p[1] == '@')) {
361 /* two separators in a row */
362 return (SET_ERROR(EINVAL));
363 }
364 if (p == NULL || p == path) {
365 /*
366 * if the first thing is an @ or /, it had better be an
367 * @ and it had better not have any more ats or slashes,
368 * and it had better have something after the @.
369 */
370 if (p != NULL &&
371 (p[0] != '@' || strpbrk(path+1, "/@") || p[1] == '\0'))
372 return (SET_ERROR(EINVAL));
373 if (strlen(path) >= MAXNAMELEN)
374 return (SET_ERROR(ENAMETOOLONG));
375 (void) strcpy(component, path);
376 p = NULL;
377 } else if (p[0] == '/') {
378 if (p - path >= MAXNAMELEN)
379 return (SET_ERROR(ENAMETOOLONG));
380 (void) strncpy(component, path, p - path);
381 component[p - path] = '\0';
382 p++;
383 } else if (p[0] == '@') {
384 /*
385 * if the next separator is an @, there better not be
386 * any more slashes.
387 */
388 if (strchr(path, '/'))
389 return (SET_ERROR(EINVAL));
390 if (p - path >= MAXNAMELEN)
391 return (SET_ERROR(ENAMETOOLONG));
392 (void) strncpy(component, path, p - path);
393 component[p - path] = '\0';
394 } else {
395 panic("invalid p=%p", (void *)p);
396 }
397 *nextp = p;
398 return (0);
399 }
400
401 /*
402 * Return the dsl_dir_t, and possibly the last component which couldn't
403 * be found in *tail. The name must be in the specified dsl_pool_t. This
404 * thread must hold the dp_config_rwlock for the pool. Returns NULL if the
405 * path is bogus, or if tail==NULL and we couldn't parse the whole name.
406 * (*tail)[0] == '@' means that the last component is a snapshot.
407 */
408 int
409 dsl_dir_hold(dsl_pool_t *dp, const char *name, void *tag,
410 dsl_dir_t **ddp, const char **tailp)
411 {
412 char buf[MAXNAMELEN];
413 const char *spaname, *next, *nextnext = NULL;
414 int err;
415 dsl_dir_t *dd;
416 uint64_t ddobj;
417
418 err = getcomponent(name, buf, &next);
419 if (err != 0)
420 return (err);
421
422 /* Make sure the name is in the specified pool. */
423 spaname = spa_name(dp->dp_spa);
424 if (strcmp(buf, spaname) != 0)
425 return (SET_ERROR(EXDEV));
426
427 ASSERT(dsl_pool_config_held(dp));
428
429 err = dsl_dir_hold_obj(dp, dp->dp_root_dir_obj, NULL, tag, &dd);
430 if (err != 0) {
431 return (err);
432 }
433
434 while (next != NULL) {
435 dsl_dir_t *child_dd;
436 err = getcomponent(next, buf, &nextnext);
437 if (err != 0)
438 break;
439 ASSERT(next[0] != '\0');
440 if (next[0] == '@')
441 break;
442 dprintf("looking up %s in obj%lld\n",
443 buf, dsl_dir_phys(dd)->dd_child_dir_zapobj);
444
445 err = zap_lookup(dp->dp_meta_objset,
446 dsl_dir_phys(dd)->dd_child_dir_zapobj,
447 buf, sizeof (ddobj), 1, &ddobj);
448 if (err != 0) {
449 if (err == ENOENT)
450 err = 0;
451 break;
452 }
453
454 err = dsl_dir_hold_obj(dp, ddobj, buf, tag, &child_dd);
455 if (err != 0)
456 break;
457 dsl_dir_rele(dd, tag);
458 dd = child_dd;
459 next = nextnext;
460 }
461
462 if (err != 0) {
463 dsl_dir_rele(dd, tag);
464 return (err);
465 }
466
467 /*
468 * It's an error if there's more than one component left, or
469 * tailp==NULL and there's any component left.
470 */
471 if (next != NULL &&
472 (tailp == NULL || (nextnext && nextnext[0] != '\0'))) {
473 /* bad path name */
474 dsl_dir_rele(dd, tag);
475 dprintf("next=%p (%s) tail=%p\n", next, next?next:"", tailp);
476 err = SET_ERROR(ENOENT);
477 }
478 if (tailp != NULL)
479 *tailp = next;
480 *ddp = dd;
481 return (err);
482 }
483
484 /*
485 * If the counts are already initialized for this filesystem and its
486 * descendants then do nothing, otherwise initialize the counts.
487 *
488 * The counts on this filesystem, and those below, may be uninitialized due to
489 * either the use of a pre-existing pool which did not support the
490 * filesystem/snapshot limit feature, or one in which the feature had not yet
491 * been enabled.
492 *
493 * Recursively descend the filesystem tree and update the filesystem/snapshot
494 * counts on each filesystem below, then update the cumulative count on the
495 * current filesystem. If the filesystem already has a count set on it,
496 * then we know that its counts, and the counts on the filesystems below it,
497 * are already correct, so we don't have to update this filesystem.
498 */
499 static void
500 dsl_dir_init_fs_ss_count(dsl_dir_t *dd, dmu_tx_t *tx)
501 {
502 uint64_t my_fs_cnt = 0;
503 uint64_t my_ss_cnt = 0;
504 dsl_pool_t *dp = dd->dd_pool;
505 objset_t *os = dp->dp_meta_objset;
506 zap_cursor_t *zc;
507 zap_attribute_t *za;
508 dsl_dataset_t *ds;
509
510 ASSERT(spa_feature_is_active(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT));
511 ASSERT(dsl_pool_config_held(dp));
512 ASSERT(dmu_tx_is_syncing(tx));
513
514 dsl_dir_zapify(dd, tx);
515
516 /*
517 * If the filesystem count has already been initialized then we
518 * don't need to recurse down any further.
519 */
520 if (zap_contains(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT) == 0)
521 return;
522
523 zc = kmem_alloc(sizeof (zap_cursor_t), KM_SLEEP);
524 za = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP);
525
526 /* Iterate my child dirs */
527 for (zap_cursor_init(zc, os, dsl_dir_phys(dd)->dd_child_dir_zapobj);
528 zap_cursor_retrieve(zc, za) == 0; zap_cursor_advance(zc)) {
529 dsl_dir_t *chld_dd;
530 uint64_t count;
531
532 VERIFY0(dsl_dir_hold_obj(dp, za->za_first_integer, NULL, FTAG,
533 &chld_dd));
534
535 /*
536 * Ignore hidden ($FREE, $MOS & $ORIGIN) objsets and
537 * temporary datasets.
538 */
539 if (chld_dd->dd_myname[0] == '$' ||
540 chld_dd->dd_myname[0] == '%') {
541 dsl_dir_rele(chld_dd, FTAG);
542 continue;
543 }
544
545 my_fs_cnt++; /* count this child */
546
547 dsl_dir_init_fs_ss_count(chld_dd, tx);
548
549 VERIFY0(zap_lookup(os, chld_dd->dd_object,
550 DD_FIELD_FILESYSTEM_COUNT, sizeof (count), 1, &count));
551 my_fs_cnt += count;
552 VERIFY0(zap_lookup(os, chld_dd->dd_object,
553 DD_FIELD_SNAPSHOT_COUNT, sizeof (count), 1, &count));
554 my_ss_cnt += count;
555
556 dsl_dir_rele(chld_dd, FTAG);
557 }
558 zap_cursor_fini(zc);
559 /* Count my snapshots (we counted children's snapshots above) */
560 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool,
561 dsl_dir_phys(dd)->dd_head_dataset_obj, FTAG, &ds));
562
563 for (zap_cursor_init(zc, os, dsl_dataset_phys(ds)->ds_snapnames_zapobj);
564 zap_cursor_retrieve(zc, za) == 0;
565 zap_cursor_advance(zc)) {
566 /* Don't count temporary snapshots */
567 if (za->za_name[0] != '%')
568 my_ss_cnt++;
569 }
570 zap_cursor_fini(zc);
571
572 dsl_dataset_rele(ds, FTAG);
573
574 kmem_free(zc, sizeof (zap_cursor_t));
575 kmem_free(za, sizeof (zap_attribute_t));
576
577 /* we're in a sync task, update counts */
578 dmu_buf_will_dirty(dd->dd_dbuf, tx);
579 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT,
580 sizeof (my_fs_cnt), 1, &my_fs_cnt, tx));
581 VERIFY0(zap_add(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT,
582 sizeof (my_ss_cnt), 1, &my_ss_cnt, tx));
583 }
584
585 static int
586 dsl_dir_actv_fs_ss_limit_check(void *arg, dmu_tx_t *tx)
587 {
588 char *ddname = (char *)arg;
589 dsl_pool_t *dp = dmu_tx_pool(tx);
590 dsl_dataset_t *ds;
591 dsl_dir_t *dd;
592 int error;
593
594 error = dsl_dataset_hold(dp, ddname, FTAG, &ds);
595 if (error != 0)
596 return (error);
597
598 if (!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT)) {
599 dsl_dataset_rele(ds, FTAG);
600 return (SET_ERROR(ENOTSUP));
601 }
602
603 dd = ds->ds_dir;
604 if (spa_feature_is_active(dp->dp_spa, SPA_FEATURE_FS_SS_LIMIT) &&
605 dsl_dir_is_zapified(dd) &&
606 zap_contains(dp->dp_meta_objset, dd->dd_object,
607 DD_FIELD_FILESYSTEM_COUNT) == 0) {
608 dsl_dataset_rele(ds, FTAG);
609 return (SET_ERROR(EALREADY));
610 }
611
612 dsl_dataset_rele(ds, FTAG);
613 return (0);
614 }
615
616 static void
617 dsl_dir_actv_fs_ss_limit_sync(void *arg, dmu_tx_t *tx)
618 {
619 char *ddname = (char *)arg;
620 dsl_pool_t *dp = dmu_tx_pool(tx);
621 dsl_dataset_t *ds;
622 spa_t *spa;
623
624 VERIFY0(dsl_dataset_hold(dp, ddname, FTAG, &ds));
625
626 spa = dsl_dataset_get_spa(ds);
627
628 if (!spa_feature_is_active(spa, SPA_FEATURE_FS_SS_LIMIT)) {
629 /*
630 * Since the feature was not active and we're now setting a
631 * limit, increment the feature-active counter so that the
632 * feature becomes active for the first time.
633 *
634 * We are already in a sync task so we can update the MOS.
635 */
636 spa_feature_incr(spa, SPA_FEATURE_FS_SS_LIMIT, tx);
637 }
638
639 /*
640 * Since we are now setting a non-UINT64_MAX limit on the filesystem,
641 * we need to ensure the counts are correct. Descend down the tree from
642 * this point and update all of the counts to be accurate.
643 */
644 dsl_dir_init_fs_ss_count(ds->ds_dir, tx);
645
646 dsl_dataset_rele(ds, FTAG);
647 }
648
649 /*
650 * Make sure the feature is enabled and activate it if necessary.
651 * Since we're setting a limit, ensure the on-disk counts are valid.
652 * This is only called by the ioctl path when setting a limit value.
653 *
654 * We do not need to validate the new limit, since users who can change the
655 * limit are also allowed to exceed the limit.
656 */
657 int
658 dsl_dir_activate_fs_ss_limit(const char *ddname)
659 {
660 int error;
661
662 error = dsl_sync_task(ddname, dsl_dir_actv_fs_ss_limit_check,
663 dsl_dir_actv_fs_ss_limit_sync, (void *)ddname, 0,
664 ZFS_SPACE_CHECK_RESERVED);
665
666 if (error == EALREADY)
667 error = 0;
668
669 return (error);
670 }
671
672 /*
673 * Used to determine if the filesystem_limit or snapshot_limit should be
674 * enforced. We allow the limit to be exceeded if the user has permission to
675 * write the property value. We pass in the creds that we got in the open
676 * context since we will always be the GZ root in syncing context. We also have
677 * to handle the case where we are allowed to change the limit on the current
678 * dataset, but there may be another limit in the tree above.
679 *
680 * We can never modify these two properties within a non-global zone. In
681 * addition, the other checks are modeled on zfs_secpolicy_write_perms. We
682 * can't use that function since we are already holding the dp_config_rwlock.
683 * In addition, we already have the dd and dealing with snapshots is simplified
684 * in this code.
685 */
686
687 typedef enum {
688 ENFORCE_ALWAYS,
689 ENFORCE_NEVER,
690 ENFORCE_ABOVE
691 } enforce_res_t;
692
693 static enforce_res_t
694 dsl_enforce_ds_ss_limits(dsl_dir_t *dd, zfs_prop_t prop, cred_t *cr)
695 {
696 enforce_res_t enforce = ENFORCE_ALWAYS;
697 uint64_t obj;
698 dsl_dataset_t *ds;
699 uint64_t zoned;
700
701 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT ||
702 prop == ZFS_PROP_SNAPSHOT_LIMIT);
703
704 #ifdef _KERNEL
705 if (crgetzoneid(cr) != GLOBAL_ZONEID)
706 return (ENFORCE_ALWAYS);
707
708 if (secpolicy_zfs(cr) == 0)
709 return (ENFORCE_NEVER);
710 #endif
711
712 if ((obj = dsl_dir_phys(dd)->dd_head_dataset_obj) == 0)
713 return (ENFORCE_ALWAYS);
714
715 ASSERT(dsl_pool_config_held(dd->dd_pool));
716
717 if (dsl_dataset_hold_obj(dd->dd_pool, obj, FTAG, &ds) != 0)
718 return (ENFORCE_ALWAYS);
719
720 if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL) || zoned) {
721 /* Only root can access zoned fs's from the GZ */
722 enforce = ENFORCE_ALWAYS;
723 } else {
724 if (dsl_deleg_access_impl(ds, zfs_prop_to_name(prop), cr) == 0)
725 enforce = ENFORCE_ABOVE;
726 }
727
728 dsl_dataset_rele(ds, FTAG);
729 return (enforce);
730 }
731
732 /*
733 * Check if adding additional child filesystem(s) would exceed any filesystem
734 * limits or adding additional snapshot(s) would exceed any snapshot limits.
735 * The prop argument indicates which limit to check.
736 *
737 * Note that all filesystem limits up to the root (or the highest
738 * initialized) filesystem or the given ancestor must be satisfied.
739 */
740 int
741 dsl_fs_ss_limit_check(dsl_dir_t *dd, uint64_t delta, zfs_prop_t prop,
742 dsl_dir_t *ancestor, cred_t *cr)
743 {
744 objset_t *os = dd->dd_pool->dp_meta_objset;
745 uint64_t limit, count;
746 char *count_prop;
747 enforce_res_t enforce;
748 int err = 0;
749
750 ASSERT(dsl_pool_config_held(dd->dd_pool));
751 ASSERT(prop == ZFS_PROP_FILESYSTEM_LIMIT ||
752 prop == ZFS_PROP_SNAPSHOT_LIMIT);
753
754 /*
755 * If we're allowed to change the limit, don't enforce the limit
756 * e.g. this can happen if a snapshot is taken by an administrative
757 * user in the global zone (i.e. a recursive snapshot by root).
758 * However, we must handle the case of delegated permissions where we
759 * are allowed to change the limit on the current dataset, but there
760 * is another limit in the tree above.
761 */
762 enforce = dsl_enforce_ds_ss_limits(dd, prop, cr);
763 if (enforce == ENFORCE_NEVER)
764 return (0);
765
766 /*
767 * e.g. if renaming a dataset with no snapshots, count adjustment
768 * is 0.
769 */
770 if (delta == 0)
771 return (0);
772
773 if (prop == ZFS_PROP_SNAPSHOT_LIMIT) {
774 /*
775 * We don't enforce the limit for temporary snapshots. This is
776 * indicated by a NULL cred_t argument.
777 */
778 if (cr == NULL)
779 return (0);
780
781 count_prop = DD_FIELD_SNAPSHOT_COUNT;
782 } else {
783 count_prop = DD_FIELD_FILESYSTEM_COUNT;
784 }
785
786 /*
787 * If an ancestor has been provided, stop checking the limit once we
788 * hit that dir. We need this during rename so that we don't overcount
789 * the check once we recurse up to the common ancestor.
790 */
791 if (ancestor == dd)
792 return (0);
793
794 /*
795 * If we hit an uninitialized node while recursing up the tree, we can
796 * stop since we know there is no limit here (or above). The counts are
797 * not valid on this node and we know we won't touch this node's counts.
798 */
799 if (!dsl_dir_is_zapified(dd) || zap_lookup(os, dd->dd_object,
800 count_prop, sizeof (count), 1, &count) == ENOENT)
801 return (0);
802
803 err = dsl_prop_get_dd(dd, zfs_prop_to_name(prop), 8, 1, &limit, NULL,
804 B_FALSE);
805 if (err != 0)
806 return (err);
807
808 /* Is there a limit which we've hit? */
809 if (enforce == ENFORCE_ALWAYS && (count + delta) > limit)
810 return (SET_ERROR(EDQUOT));
811
812 if (dd->dd_parent != NULL)
813 err = dsl_fs_ss_limit_check(dd->dd_parent, delta, prop,
814 ancestor, cr);
815
816 return (err);
817 }
818
819 /*
820 * Adjust the filesystem or snapshot count for the specified dsl_dir_t and all
821 * parents. When a new filesystem/snapshot is created, increment the count on
822 * all parents, and when a filesystem/snapshot is destroyed, decrement the
823 * count.
824 */
825 void
826 dsl_fs_ss_count_adjust(dsl_dir_t *dd, int64_t delta, const char *prop,
827 dmu_tx_t *tx)
828 {
829 int err;
830 objset_t *os = dd->dd_pool->dp_meta_objset;
831 uint64_t count;
832
833 ASSERT(dsl_pool_config_held(dd->dd_pool));
834 ASSERT(dmu_tx_is_syncing(tx));
835 ASSERT(strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0 ||
836 strcmp(prop, DD_FIELD_SNAPSHOT_COUNT) == 0);
837
838 /*
839 * When we receive an incremental stream into a filesystem that already
840 * exists, a temporary clone is created. We don't count this temporary
841 * clone, whose name begins with a '%'. We also ignore hidden ($FREE,
842 * $MOS & $ORIGIN) objsets.
843 */
844 if ((dd->dd_myname[0] == '%' || dd->dd_myname[0] == '$') &&
845 strcmp(prop, DD_FIELD_FILESYSTEM_COUNT) == 0)
846 return;
847
848 /*
849 * e.g. if renaming a dataset with no snapshots, count adjustment is 0
850 */
851 if (delta == 0)
852 return;
853
854 /*
855 * If we hit an uninitialized node while recursing up the tree, we can
856 * stop since we know the counts are not valid on this node and we
857 * know we shouldn't touch this node's counts. An uninitialized count
858 * on the node indicates that either the feature has not yet been
859 * activated or there are no limits on this part of the tree.
860 */
861 if (!dsl_dir_is_zapified(dd) || (err = zap_lookup(os, dd->dd_object,
862 prop, sizeof (count), 1, &count)) == ENOENT)
863 return;
864 VERIFY0(err);
865
866 count += delta;
867 /* Use a signed verify to make sure we're not neg. */
868 VERIFY3S(count, >=, 0);
869
870 VERIFY0(zap_update(os, dd->dd_object, prop, sizeof (count), 1, &count,
871 tx));
872
873 /* Roll up this additional count into our ancestors */
874 if (dd->dd_parent != NULL)
875 dsl_fs_ss_count_adjust(dd->dd_parent, delta, prop, tx);
876 }
877
878 uint64_t
879 dsl_dir_create_sync(dsl_pool_t *dp, dsl_dir_t *pds, const char *name,
880 dmu_tx_t *tx)
881 {
882 objset_t *mos = dp->dp_meta_objset;
883 uint64_t ddobj;
884 dsl_dir_phys_t *ddphys;
885 dmu_buf_t *dbuf;
886
887 ddobj = dmu_object_alloc(mos, DMU_OT_DSL_DIR, 0,
888 DMU_OT_DSL_DIR, sizeof (dsl_dir_phys_t), tx);
889 if (pds) {
890 VERIFY(0 == zap_add(mos, dsl_dir_phys(pds)->dd_child_dir_zapobj,
891 name, sizeof (uint64_t), 1, &ddobj, tx));
892 } else {
893 /* it's the root dir */
894 VERIFY(0 == zap_add(mos, DMU_POOL_DIRECTORY_OBJECT,
895 DMU_POOL_ROOT_DATASET, sizeof (uint64_t), 1, &ddobj, tx));
896 }
897 VERIFY(0 == dmu_bonus_hold(mos, ddobj, FTAG, &dbuf));
898 dmu_buf_will_dirty(dbuf, tx);
899 ddphys = dbuf->db_data;
900
901 ddphys->dd_creation_time = gethrestime_sec();
902 if (pds) {
903 ddphys->dd_parent_obj = pds->dd_object;
904
905 /* update the filesystem counts */
906 dsl_fs_ss_count_adjust(pds, 1, DD_FIELD_FILESYSTEM_COUNT, tx);
907 }
908 ddphys->dd_props_zapobj = zap_create(mos,
909 DMU_OT_DSL_PROPS, DMU_OT_NONE, 0, tx);
910 ddphys->dd_child_dir_zapobj = zap_create(mos,
911 DMU_OT_DSL_DIR_CHILD_MAP, DMU_OT_NONE, 0, tx);
912 if (spa_version(dp->dp_spa) >= SPA_VERSION_USED_BREAKDOWN)
913 ddphys->dd_flags |= DD_FLAG_USED_BREAKDOWN;
914 dmu_buf_rele(dbuf, FTAG);
915
916 return (ddobj);
917 }
918
919 boolean_t
920 dsl_dir_is_clone(dsl_dir_t *dd)
921 {
922 return (dsl_dir_phys(dd)->dd_origin_obj &&
923 (dd->dd_pool->dp_origin_snap == NULL ||
924 dsl_dir_phys(dd)->dd_origin_obj !=
925 dd->dd_pool->dp_origin_snap->ds_object));
926 }
927
928 void
929 dsl_dir_stats(dsl_dir_t *dd, nvlist_t *nv)
930 {
931 mutex_enter(&dd->dd_lock);
932 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USED,
933 dsl_dir_phys(dd)->dd_used_bytes);
934 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_QUOTA,
935 dsl_dir_phys(dd)->dd_quota);
936 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_RESERVATION,
937 dsl_dir_phys(dd)->dd_reserved);
938 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_COMPRESSRATIO,
939 dsl_dir_phys(dd)->dd_compressed_bytes == 0 ? 100 :
940 (dsl_dir_phys(dd)->dd_uncompressed_bytes * 100 /
941 dsl_dir_phys(dd)->dd_compressed_bytes));
942 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_LOGICALUSED,
943 dsl_dir_phys(dd)->dd_uncompressed_bytes);
944 if (dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN) {
945 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDSNAP,
946 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_SNAP]);
947 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDDS,
948 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_HEAD]);
949 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDREFRESERV,
950 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_REFRSRV]);
951 dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USEDCHILD,
952 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_CHILD] +
953 dsl_dir_phys(dd)->dd_used_breakdown[DD_USED_CHILD_RSRV]);
954 }
955 mutex_exit(&dd->dd_lock);
956
957 if (dsl_dir_is_zapified(dd)) {
958 uint64_t count;
959 objset_t *os = dd->dd_pool->dp_meta_objset;
960
961 if (zap_lookup(os, dd->dd_object, DD_FIELD_FILESYSTEM_COUNT,
962 sizeof (count), 1, &count) == 0) {
963 dsl_prop_nvlist_add_uint64(nv,
964 ZFS_PROP_FILESYSTEM_COUNT, count);
965 }
966 if (zap_lookup(os, dd->dd_object, DD_FIELD_SNAPSHOT_COUNT,
967 sizeof (count), 1, &count) == 0) {
968 dsl_prop_nvlist_add_uint64(nv,
969 ZFS_PROP_SNAPSHOT_COUNT, count);
970 }
971 }
972
973 if (dsl_dir_is_clone(dd)) {
974 dsl_dataset_t *ds;
975 char buf[MAXNAMELEN];
976
977 VERIFY0(dsl_dataset_hold_obj(dd->dd_pool,
978 dsl_dir_phys(dd)->dd_origin_obj, FTAG, &ds));
979 dsl_dataset_name(ds, buf);
980 dsl_dataset_rele(ds, FTAG);
981 dsl_prop_nvlist_add_string(nv, ZFS_PROP_ORIGIN, buf);
982 }
983 }
984
985 void
986 dsl_dir_dirty(dsl_dir_t *dd, dmu_tx_t *tx)
987 {
988 dsl_pool_t *dp = dd->dd_pool;
989
990 ASSERT(dsl_dir_phys(dd));
991
992 if (txg_list_add(&dp->dp_dirty_dirs, dd, tx->tx_txg)) {
993 /* up the hold count until we can be written out */
994 dmu_buf_add_ref(dd->dd_dbuf, dd);
995 }
996 }
997
998 static int64_t
999 parent_delta(dsl_dir_t *dd, uint64_t used, int64_t delta)
1000 {
1001 uint64_t old_accounted = MAX(used, dsl_dir_phys(dd)->dd_reserved);
1002 uint64_t new_accounted =
1003 MAX(used + delta, dsl_dir_phys(dd)->dd_reserved);
1004 return (new_accounted - old_accounted);
1005 }
1006
1007 void
1008 dsl_dir_sync(dsl_dir_t *dd, dmu_tx_t *tx)
1009 {
1010 ASSERT(dmu_tx_is_syncing(tx));
1011
1012 mutex_enter(&dd->dd_lock);
1013 ASSERT0(dd->dd_tempreserved[tx->tx_txg&TXG_MASK]);
1014 dprintf_dd(dd, "txg=%llu towrite=%lluK\n", tx->tx_txg,
1015 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] / 1024);
1016 dd->dd_space_towrite[tx->tx_txg&TXG_MASK] = 0;
1017 mutex_exit(&dd->dd_lock);
1018
1019 /* release the hold from dsl_dir_dirty */
1020 dmu_buf_rele(dd->dd_dbuf, dd);
1021 }
1022
1023 static uint64_t
1024 dsl_dir_space_towrite(dsl_dir_t *dd)
1025 {
1026 uint64_t space = 0;
1027 int i;
1028
1029 ASSERT(MUTEX_HELD(&dd->dd_lock));
1030
1031 for (i = 0; i < TXG_SIZE; i++) {
1032 space += dd->dd_space_towrite[i&TXG_MASK];
1033 ASSERT3U(dd->dd_space_towrite[i&TXG_MASK], >=, 0);
1034 }
1035 return (space);
1036 }
1037
1038 /*
1039 * How much space would dd have available if ancestor had delta applied
1040 * to it? If ondiskonly is set, we're only interested in what's
1041 * on-disk, not estimated pending changes.
1042 */
1043 uint64_t
1044 dsl_dir_space_available(dsl_dir_t *dd,
1045 dsl_dir_t *ancestor, int64_t delta, int ondiskonly)
1046 {
1047 uint64_t parentspace, myspace, quota, used;
1048
1049 /*
1050 * If there are no restrictions otherwise, assume we have
1051 * unlimited space available.
1052 */
1053 quota = UINT64_MAX;
1054 parentspace = UINT64_MAX;
1055
1056 if (dd->dd_parent != NULL) {
1057 parentspace = dsl_dir_space_available(dd->dd_parent,
1058 ancestor, delta, ondiskonly);
1059 }
1060
1061 mutex_enter(&dd->dd_lock);
1062 if (dsl_dir_phys(dd)->dd_quota != 0)
1063 quota = dsl_dir_phys(dd)->dd_quota;
1064 used = dsl_dir_phys(dd)->dd_used_bytes;
1065 if (!ondiskonly)
1066 used += dsl_dir_space_towrite(dd);
1067
1068 if (dd->dd_parent == NULL) {
1069 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, FALSE);
1070 quota = MIN(quota, poolsize);
1071 }
1072
1073 if (dsl_dir_phys(dd)->dd_reserved > used && parentspace != UINT64_MAX) {
1074 /*
1075 * We have some space reserved, in addition to what our
1076 * parent gave us.
1077 */
1078 parentspace += dsl_dir_phys(dd)->dd_reserved - used;
1079 }
1080
1081 if (dd == ancestor) {
1082 ASSERT(delta <= 0);
1083 ASSERT(used >= -delta);
1084 used += delta;
1085 if (parentspace != UINT64_MAX)
1086 parentspace -= delta;
1087 }
1088
1089 if (used > quota) {
1090 /* over quota */
1091 myspace = 0;
1092 } else {
1093 /*
1094 * the lesser of the space provided by our parent and
1095 * the space left in our quota
1096 */
1097 myspace = MIN(parentspace, quota - used);
1098 }
1099
1100 mutex_exit(&dd->dd_lock);
1101
1102 return (myspace);
1103 }
1104
1105 struct tempreserve {
1106 list_node_t tr_node;
1107 dsl_dir_t *tr_ds;
1108 uint64_t tr_size;
1109 };
1110
1111 static int
1112 dsl_dir_tempreserve_impl(dsl_dir_t *dd, uint64_t asize, boolean_t netfree,
1113 boolean_t ignorequota, boolean_t checkrefquota, list_t *tr_list,
1114 dmu_tx_t *tx, boolean_t first)
1115 {
1116 uint64_t txg = tx->tx_txg;
1117 uint64_t est_inflight, used_on_disk, quota, parent_rsrv;
1118 uint64_t deferred = 0;
1119 struct tempreserve *tr;
1120 int retval = EDQUOT;
1121 int txgidx = txg & TXG_MASK;
1122 int i;
1123 uint64_t ref_rsrv = 0;
1124
1125 ASSERT3U(txg, !=, 0);
1126 ASSERT3S(asize, >, 0);
1127
1128 mutex_enter(&dd->dd_lock);
1129
1130 /*
1131 * Check against the dsl_dir's quota. We don't add in the delta
1132 * when checking for over-quota because they get one free hit.
1133 */
1134 est_inflight = dsl_dir_space_towrite(dd);
1135 for (i = 0; i < TXG_SIZE; i++)
1136 est_inflight += dd->dd_tempreserved[i];
1137 used_on_disk = dsl_dir_phys(dd)->dd_used_bytes;
1138
1139 /*
1140 * On the first iteration, fetch the dataset's used-on-disk and
1141 * refreservation values. Also, if checkrefquota is set, test if
1142 * allocating this space would exceed the dataset's refquota.
1143 */
1144 if (first && tx->tx_objset) {
1145 int error;
1146 dsl_dataset_t *ds = tx->tx_objset->os_dsl_dataset;
1147
1148 error = dsl_dataset_check_quota(ds, checkrefquota,
1149 asize, est_inflight, &used_on_disk, &ref_rsrv);
1150 if (error) {
1151 mutex_exit(&dd->dd_lock);
1152 return (error);
1153 }
1154 }
1155
1156 /*
1157 * If this transaction will result in a net free of space,
1158 * we want to let it through.
1159 */
1160 if (ignorequota || netfree || dsl_dir_phys(dd)->dd_quota == 0)
1161 quota = UINT64_MAX;
1162 else
1163 quota = dsl_dir_phys(dd)->dd_quota;
1164
1165 /*
1166 * Adjust the quota against the actual pool size at the root
1167 * minus any outstanding deferred frees.
1168 * To ensure that it's possible to remove files from a full
1169 * pool without inducing transient overcommits, we throttle
1170 * netfree transactions against a quota that is slightly larger,
1171 * but still within the pool's allocation slop. In cases where
1172 * we're very close to full, this will allow a steady trickle of
1173 * removes to get through.
1174 */
1175 if (dd->dd_parent == NULL) {
1176 spa_t *spa = dd->dd_pool->dp_spa;
1177 uint64_t poolsize = dsl_pool_adjustedsize(dd->dd_pool, netfree);
1178 deferred = metaslab_class_get_deferred(spa_normal_class(spa));
1179 if (poolsize - deferred < quota) {
1180 quota = poolsize - deferred;
1181 retval = ENOSPC;
1182 }
1183 }
1184
1185 /*
1186 * If they are requesting more space, and our current estimate
1187 * is over quota, they get to try again unless the actual
1188 * on-disk is over quota and there are no pending changes (which
1189 * may free up space for us).
1190 */
1191 if (used_on_disk + est_inflight >= quota) {
1192 if (est_inflight > 0 || used_on_disk < quota ||
1193 (retval == ENOSPC && used_on_disk < quota + deferred))
1194 retval = ERESTART;
1195 dprintf_dd(dd, "failing: used=%lluK inflight = %lluK "
1196 "quota=%lluK tr=%lluK err=%d\n",
1197 used_on_disk>>10, est_inflight>>10,
1198 quota>>10, asize>>10, retval);
1199 mutex_exit(&dd->dd_lock);
1200 return (SET_ERROR(retval));
1201 }
1202
1203 /* We need to up our estimated delta before dropping dd_lock */
1204 dd->dd_tempreserved[txgidx] += asize;
1205
1206 parent_rsrv = parent_delta(dd, used_on_disk + est_inflight,
1207 asize - ref_rsrv);
1208 mutex_exit(&dd->dd_lock);
1209
1210 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP);
1211 tr->tr_ds = dd;
1212 tr->tr_size = asize;
1213 list_insert_tail(tr_list, tr);
1214
1215 /* see if it's OK with our parent */
1216 if (dd->dd_parent && parent_rsrv) {
1217 boolean_t ismos = (dsl_dir_phys(dd)->dd_head_dataset_obj == 0);
1218
1219 return (dsl_dir_tempreserve_impl(dd->dd_parent,
1220 parent_rsrv, netfree, ismos, TRUE, tr_list, tx, FALSE));
1221 } else {
1222 return (0);
1223 }
1224 }
1225
1226 /*
1227 * Reserve space in this dsl_dir, to be used in this tx's txg.
1228 * After the space has been dirtied (and dsl_dir_willuse_space()
1229 * has been called), the reservation should be canceled, using
1230 * dsl_dir_tempreserve_clear().
1231 */
1232 int
1233 dsl_dir_tempreserve_space(dsl_dir_t *dd, uint64_t lsize, uint64_t asize,
1234 uint64_t fsize, uint64_t usize, void **tr_cookiep, dmu_tx_t *tx)
1235 {
1236 int err;
1237 list_t *tr_list;
1238
1239 if (asize == 0) {
1240 *tr_cookiep = NULL;
1241 return (0);
1242 }
1243
1244 tr_list = kmem_alloc(sizeof (list_t), KM_SLEEP);
1245 list_create(tr_list, sizeof (struct tempreserve),
1246 offsetof(struct tempreserve, tr_node));
1247 ASSERT3S(asize, >, 0);
1248 ASSERT3S(fsize, >=, 0);
1249
1250 err = arc_tempreserve_space(lsize, tx->tx_txg);
1251 if (err == 0) {
1252 struct tempreserve *tr;
1253
1254 tr = kmem_zalloc(sizeof (struct tempreserve), KM_SLEEP);
1255 tr->tr_size = lsize;
1256 list_insert_tail(tr_list, tr);
1257 } else {
1258 if (err == EAGAIN) {
1259 /*
1260 * If arc_memory_throttle() detected that pageout
1261 * is running and we are low on memory, we delay new
1262 * non-pageout transactions to give pageout an
1263 * advantage.
1264 *
1265 * It is unfortunate to be delaying while the caller's
1266 * locks are held.
1267 */
1268 txg_delay(dd->dd_pool, tx->tx_txg,
1269 MSEC2NSEC(10), MSEC2NSEC(10));
1270 err = SET_ERROR(ERESTART);
1271 }
1272 }
1273
1274 if (err == 0) {
1275 err = dsl_dir_tempreserve_impl(dd, asize, fsize >= asize,
1276 FALSE, asize > usize, tr_list, tx, TRUE);
1277 }
1278
1279 if (err != 0)
1280 dsl_dir_tempreserve_clear(tr_list, tx);
1281 else
1282 *tr_cookiep = tr_list;
1283
1284 return (err);
1285 }
1286
1287 /*
1288 * Clear a temporary reservation that we previously made with
1289 * dsl_dir_tempreserve_space().
1290 */
1291 void
1292 dsl_dir_tempreserve_clear(void *tr_cookie, dmu_tx_t *tx)
1293 {
1294 int txgidx = tx->tx_txg & TXG_MASK;
1295 list_t *tr_list = tr_cookie;
1296 struct tempreserve *tr;
1297
1298 ASSERT3U(tx->tx_txg, !=, 0);
1299
1300 if (tr_cookie == NULL)
1301 return;
1302
1303 while ((tr = list_head(tr_list)) != NULL) {
1304 if (tr->tr_ds) {
1305 mutex_enter(&tr->tr_ds->dd_lock);
1306 ASSERT3U(tr->tr_ds->dd_tempreserved[txgidx], >=,
1307 tr->tr_size);
1308 tr->tr_ds->dd_tempreserved[txgidx] -= tr->tr_size;
1309 mutex_exit(&tr->tr_ds->dd_lock);
1310 } else {
1311 arc_tempreserve_clear(tr->tr_size);
1312 }
1313 list_remove(tr_list, tr);
1314 kmem_free(tr, sizeof (struct tempreserve));
1315 }
1316
1317 kmem_free(tr_list, sizeof (list_t));
1318 }
1319
1320 /*
1321 * This should be called from open context when we think we're going to write
1322 * or free space, for example when dirtying data. Be conservative; it's okay
1323 * to write less space or free more, but we don't want to write more or free
1324 * less than the amount specified.
1325 */
1326 void
1327 dsl_dir_willuse_space(dsl_dir_t *dd, int64_t space, dmu_tx_t *tx)
1328 {
1329 int64_t parent_space;
1330 uint64_t est_used;
1331
1332 mutex_enter(&dd->dd_lock);
1333 if (space > 0)
1334 dd->dd_space_towrite[tx->tx_txg & TXG_MASK] += space;
1335
1336 est_used = dsl_dir_space_towrite(dd) + dsl_dir_phys(dd)->dd_used_bytes;
1337 parent_space = parent_delta(dd, est_used, space);
1338 mutex_exit(&dd->dd_lock);
1339
1340 /* Make sure that we clean up dd_space_to* */
1341 dsl_dir_dirty(dd, tx);
1342
1343 /* XXX this is potentially expensive and unnecessary... */
1344 if (parent_space && dd->dd_parent)
1345 dsl_dir_willuse_space(dd->dd_parent, parent_space, tx);
1346 }
1347
1348 /* call from syncing context when we actually write/free space for this dd */
1349 void
1350 dsl_dir_diduse_space(dsl_dir_t *dd, dd_used_t type,
1351 int64_t used, int64_t compressed, int64_t uncompressed, dmu_tx_t *tx)
1352 {
1353 int64_t accounted_delta;
1354
1355 /*
1356 * dsl_dataset_set_refreservation_sync_impl() calls this with
1357 * dd_lock held, so that it can atomically update
1358 * ds->ds_reserved and the dsl_dir accounting, so that
1359 * dsl_dataset_check_quota() can see dataset and dir accounting
1360 * consistently.
1361 */
1362 boolean_t needlock = !MUTEX_HELD(&dd->dd_lock);
1363
1364 ASSERT(dmu_tx_is_syncing(tx));
1365 ASSERT(type < DD_USED_NUM);
1366
1367 dmu_buf_will_dirty(dd->dd_dbuf, tx);
1368
1369 if (needlock)
1370 mutex_enter(&dd->dd_lock);
1371 accounted_delta =
1372 parent_delta(dd, dsl_dir_phys(dd)->dd_used_bytes, used);
1373 ASSERT(used >= 0 || dsl_dir_phys(dd)->dd_used_bytes >= -used);
1374 ASSERT(compressed >= 0 ||
1375 dsl_dir_phys(dd)->dd_compressed_bytes >= -compressed);
1376 ASSERT(uncompressed >= 0 ||
1377 dsl_dir_phys(dd)->dd_uncompressed_bytes >= -uncompressed);
1378 dsl_dir_phys(dd)->dd_used_bytes += used;
1379 dsl_dir_phys(dd)->dd_uncompressed_bytes += uncompressed;
1380 dsl_dir_phys(dd)->dd_compressed_bytes += compressed;
1381
1382 if (dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN) {
1383 ASSERT(used > 0 ||
1384 dsl_dir_phys(dd)->dd_used_breakdown[type] >= -used);
1385 dsl_dir_phys(dd)->dd_used_breakdown[type] += used;
1386 #ifdef DEBUG
1387 dd_used_t t;
1388 uint64_t u = 0;
1389 for (t = 0; t < DD_USED_NUM; t++)
1390 u += dsl_dir_phys(dd)->dd_used_breakdown[t];
1391 ASSERT3U(u, ==, dsl_dir_phys(dd)->dd_used_bytes);
1392 #endif
1393 }
1394 if (needlock)
1395 mutex_exit(&dd->dd_lock);
1396
1397 if (dd->dd_parent != NULL) {
1398 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD,
1399 accounted_delta, compressed, uncompressed, tx);
1400 dsl_dir_transfer_space(dd->dd_parent,
1401 used - accounted_delta,
1402 DD_USED_CHILD_RSRV, DD_USED_CHILD, tx);
1403 }
1404 }
1405
1406 void
1407 dsl_dir_transfer_space(dsl_dir_t *dd, int64_t delta,
1408 dd_used_t oldtype, dd_used_t newtype, dmu_tx_t *tx)
1409 {
1410 ASSERT(dmu_tx_is_syncing(tx));
1411 ASSERT(oldtype < DD_USED_NUM);
1412 ASSERT(newtype < DD_USED_NUM);
1413
1414 if (delta == 0 ||
1415 !(dsl_dir_phys(dd)->dd_flags & DD_FLAG_USED_BREAKDOWN))
1416 return;
1417
1418 dmu_buf_will_dirty(dd->dd_dbuf, tx);
1419 mutex_enter(&dd->dd_lock);
1420 ASSERT(delta > 0 ?
1421 dsl_dir_phys(dd)->dd_used_breakdown[oldtype] >= delta :
1422 dsl_dir_phys(dd)->dd_used_breakdown[newtype] >= -delta);
1423 ASSERT(dsl_dir_phys(dd)->dd_used_bytes >= ABS(delta));
1424 dsl_dir_phys(dd)->dd_used_breakdown[oldtype] -= delta;
1425 dsl_dir_phys(dd)->dd_used_breakdown[newtype] += delta;
1426 mutex_exit(&dd->dd_lock);
1427 }
1428
1429 typedef struct dsl_dir_set_qr_arg {
1430 const char *ddsqra_name;
1431 zprop_source_t ddsqra_source;
1432 uint64_t ddsqra_value;
1433 } dsl_dir_set_qr_arg_t;
1434
1435 static int
1436 dsl_dir_set_quota_check(void *arg, dmu_tx_t *tx)
1437 {
1438 dsl_dir_set_qr_arg_t *ddsqra = arg;
1439 dsl_pool_t *dp = dmu_tx_pool(tx);
1440 dsl_dataset_t *ds;
1441 int error;
1442 uint64_t towrite, newval;
1443
1444 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds);
1445 if (error != 0)
1446 return (error);
1447
1448 error = dsl_prop_predict(ds->ds_dir, "quota",
1449 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval);
1450 if (error != 0) {
1451 dsl_dataset_rele(ds, FTAG);
1452 return (error);
1453 }
1454
1455 if (newval == 0) {
1456 dsl_dataset_rele(ds, FTAG);
1457 return (0);
1458 }
1459
1460 mutex_enter(&ds->ds_dir->dd_lock);
1461 /*
1462 * If we are doing the preliminary check in open context, and
1463 * there are pending changes, then don't fail it, since the
1464 * pending changes could under-estimate the amount of space to be
1465 * freed up.
1466 */
1467 towrite = dsl_dir_space_towrite(ds->ds_dir);
1468 if ((dmu_tx_is_syncing(tx) || towrite == 0) &&
1469 (newval < dsl_dir_phys(ds->ds_dir)->dd_reserved ||
1470 newval < dsl_dir_phys(ds->ds_dir)->dd_used_bytes + towrite)) {
1471 error = SET_ERROR(ENOSPC);
1472 }
1473 mutex_exit(&ds->ds_dir->dd_lock);
1474 dsl_dataset_rele(ds, FTAG);
1475 return (error);
1476 }
1477
1478 static void
1479 dsl_dir_set_quota_sync(void *arg, dmu_tx_t *tx)
1480 {
1481 dsl_dir_set_qr_arg_t *ddsqra = arg;
1482 dsl_pool_t *dp = dmu_tx_pool(tx);
1483 dsl_dataset_t *ds;
1484 uint64_t newval;
1485
1486 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds));
1487
1488 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) {
1489 dsl_prop_set_sync_impl(ds, zfs_prop_to_name(ZFS_PROP_QUOTA),
1490 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1,
1491 &ddsqra->ddsqra_value, tx);
1492
1493 VERIFY0(dsl_prop_get_int_ds(ds,
1494 zfs_prop_to_name(ZFS_PROP_QUOTA), &newval));
1495 } else {
1496 newval = ddsqra->ddsqra_value;
1497 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld",
1498 zfs_prop_to_name(ZFS_PROP_QUOTA), (longlong_t)newval);
1499 }
1500
1501 dmu_buf_will_dirty(ds->ds_dir->dd_dbuf, tx);
1502 mutex_enter(&ds->ds_dir->dd_lock);
1503 dsl_dir_phys(ds->ds_dir)->dd_quota = newval;
1504 mutex_exit(&ds->ds_dir->dd_lock);
1505 dsl_dataset_rele(ds, FTAG);
1506 }
1507
1508 int
1509 dsl_dir_set_quota(const char *ddname, zprop_source_t source, uint64_t quota)
1510 {
1511 dsl_dir_set_qr_arg_t ddsqra;
1512
1513 ddsqra.ddsqra_name = ddname;
1514 ddsqra.ddsqra_source = source;
1515 ddsqra.ddsqra_value = quota;
1516
1517 return (dsl_sync_task(ddname, dsl_dir_set_quota_check,
1518 dsl_dir_set_quota_sync, &ddsqra, 0, ZFS_SPACE_CHECK_NONE));
1519 }
1520
1521 int
1522 dsl_dir_set_reservation_check(void *arg, dmu_tx_t *tx)
1523 {
1524 dsl_dir_set_qr_arg_t *ddsqra = arg;
1525 dsl_pool_t *dp = dmu_tx_pool(tx);
1526 dsl_dataset_t *ds;
1527 dsl_dir_t *dd;
1528 uint64_t newval, used, avail;
1529 int error;
1530
1531 error = dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds);
1532 if (error != 0)
1533 return (error);
1534 dd = ds->ds_dir;
1535
1536 /*
1537 * If we are doing the preliminary check in open context, the
1538 * space estimates may be inaccurate.
1539 */
1540 if (!dmu_tx_is_syncing(tx)) {
1541 dsl_dataset_rele(ds, FTAG);
1542 return (0);
1543 }
1544
1545 error = dsl_prop_predict(ds->ds_dir,
1546 zfs_prop_to_name(ZFS_PROP_RESERVATION),
1547 ddsqra->ddsqra_source, ddsqra->ddsqra_value, &newval);
1548 if (error != 0) {
1549 dsl_dataset_rele(ds, FTAG);
1550 return (error);
1551 }
1552
1553 mutex_enter(&dd->dd_lock);
1554 used = dsl_dir_phys(dd)->dd_used_bytes;
1555 mutex_exit(&dd->dd_lock);
1556
1557 if (dd->dd_parent) {
1558 avail = dsl_dir_space_available(dd->dd_parent,
1559 NULL, 0, FALSE);
1560 } else {
1561 avail = dsl_pool_adjustedsize(dd->dd_pool, B_FALSE) - used;
1562 }
1563
1564 if (MAX(used, newval) > MAX(used, dsl_dir_phys(dd)->dd_reserved)) {
1565 uint64_t delta = MAX(used, newval) -
1566 MAX(used, dsl_dir_phys(dd)->dd_reserved);
1567
1568 if (delta > avail ||
1569 (dsl_dir_phys(dd)->dd_quota > 0 &&
1570 newval > dsl_dir_phys(dd)->dd_quota))
1571 error = SET_ERROR(ENOSPC);
1572 }
1573
1574 dsl_dataset_rele(ds, FTAG);
1575 return (error);
1576 }
1577
1578 void
1579 dsl_dir_set_reservation_sync_impl(dsl_dir_t *dd, uint64_t value, dmu_tx_t *tx)
1580 {
1581 uint64_t used;
1582 int64_t delta;
1583
1584 dmu_buf_will_dirty(dd->dd_dbuf, tx);
1585
1586 mutex_enter(&dd->dd_lock);
1587 used = dsl_dir_phys(dd)->dd_used_bytes;
1588 delta = MAX(used, value) - MAX(used, dsl_dir_phys(dd)->dd_reserved);
1589 dsl_dir_phys(dd)->dd_reserved = value;
1590
1591 if (dd->dd_parent != NULL) {
1592 /* Roll up this additional usage into our ancestors */
1593 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV,
1594 delta, 0, 0, tx);
1595 }
1596 mutex_exit(&dd->dd_lock);
1597 }
1598
1599
1600 static void
1601 dsl_dir_set_reservation_sync(void *arg, dmu_tx_t *tx)
1602 {
1603 dsl_dir_set_qr_arg_t *ddsqra = arg;
1604 dsl_pool_t *dp = dmu_tx_pool(tx);
1605 dsl_dataset_t *ds;
1606 uint64_t newval;
1607
1608 VERIFY0(dsl_dataset_hold(dp, ddsqra->ddsqra_name, FTAG, &ds));
1609
1610 if (spa_version(dp->dp_spa) >= SPA_VERSION_RECVD_PROPS) {
1611 dsl_prop_set_sync_impl(ds,
1612 zfs_prop_to_name(ZFS_PROP_RESERVATION),
1613 ddsqra->ddsqra_source, sizeof (ddsqra->ddsqra_value), 1,
1614 &ddsqra->ddsqra_value, tx);
1615
1616 VERIFY0(dsl_prop_get_int_ds(ds,
1617 zfs_prop_to_name(ZFS_PROP_RESERVATION), &newval));
1618 } else {
1619 newval = ddsqra->ddsqra_value;
1620 spa_history_log_internal_ds(ds, "set", tx, "%s=%lld",
1621 zfs_prop_to_name(ZFS_PROP_RESERVATION),
1622 (longlong_t)newval);
1623 }
1624
1625 dsl_dir_set_reservation_sync_impl(ds->ds_dir, newval, tx);
1626 dsl_dataset_rele(ds, FTAG);
1627 }
1628
1629 int
1630 dsl_dir_set_reservation(const char *ddname, zprop_source_t source,
1631 uint64_t reservation)
1632 {
1633 dsl_dir_set_qr_arg_t ddsqra;
1634
1635 ddsqra.ddsqra_name = ddname;
1636 ddsqra.ddsqra_source = source;
1637 ddsqra.ddsqra_value = reservation;
1638
1639 return (dsl_sync_task(ddname, dsl_dir_set_reservation_check,
1640 dsl_dir_set_reservation_sync, &ddsqra, 0, ZFS_SPACE_CHECK_NONE));
1641 }
1642
1643 static dsl_dir_t *
1644 closest_common_ancestor(dsl_dir_t *ds1, dsl_dir_t *ds2)
1645 {
1646 for (; ds1; ds1 = ds1->dd_parent) {
1647 dsl_dir_t *dd;
1648 for (dd = ds2; dd; dd = dd->dd_parent) {
1649 if (ds1 == dd)
1650 return (dd);
1651 }
1652 }
1653 return (NULL);
1654 }
1655
1656 /*
1657 * If delta is applied to dd, how much of that delta would be applied to
1658 * ancestor? Syncing context only.
1659 */
1660 static int64_t
1661 would_change(dsl_dir_t *dd, int64_t delta, dsl_dir_t *ancestor)
1662 {
1663 if (dd == ancestor)
1664 return (delta);
1665
1666 mutex_enter(&dd->dd_lock);
1667 delta = parent_delta(dd, dsl_dir_phys(dd)->dd_used_bytes, delta);
1668 mutex_exit(&dd->dd_lock);
1669 return (would_change(dd->dd_parent, delta, ancestor));
1670 }
1671
1672 typedef struct dsl_dir_rename_arg {
1673 const char *ddra_oldname;
1674 const char *ddra_newname;
1675 cred_t *ddra_cred;
1676 } dsl_dir_rename_arg_t;
1677
1678 /* ARGSUSED */
1679 static int
1680 dsl_valid_rename(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg)
1681 {
1682 int *deltap = arg;
1683 char namebuf[MAXNAMELEN];
1684
1685 dsl_dataset_name(ds, namebuf);
1686
1687 if (strlen(namebuf) + *deltap >= MAXNAMELEN)
1688 return (SET_ERROR(ENAMETOOLONG));
1689 return (0);
1690 }
1691
1692 static int
1693 dsl_dir_rename_check(void *arg, dmu_tx_t *tx)
1694 {
1695 dsl_dir_rename_arg_t *ddra = arg;
1696 dsl_pool_t *dp = dmu_tx_pool(tx);
1697 dsl_dir_t *dd, *newparent;
1698 const char *mynewname;
1699 int error;
1700 int delta = strlen(ddra->ddra_newname) - strlen(ddra->ddra_oldname);
1701
1702 /* target dir should exist */
1703 error = dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL);
1704 if (error != 0)
1705 return (error);
1706
1707 /* new parent should exist */
1708 error = dsl_dir_hold(dp, ddra->ddra_newname, FTAG,
1709 &newparent, &mynewname);
1710 if (error != 0) {
1711 dsl_dir_rele(dd, FTAG);
1712 return (error);
1713 }
1714
1715 /* can't rename to different pool */
1716 if (dd->dd_pool != newparent->dd_pool) {
1717 dsl_dir_rele(newparent, FTAG);
1718 dsl_dir_rele(dd, FTAG);
1719 return (SET_ERROR(ENXIO));
1720 }
1721
1722 /* new name should not already exist */
1723 if (mynewname == NULL) {
1724 dsl_dir_rele(newparent, FTAG);
1725 dsl_dir_rele(dd, FTAG);
1726 return (SET_ERROR(EEXIST));
1727 }
1728
1729 /* if the name length is growing, validate child name lengths */
1730 if (delta > 0) {
1731 error = dmu_objset_find_dp(dp, dd->dd_object, dsl_valid_rename,
1732 &delta, DS_FIND_CHILDREN | DS_FIND_SNAPSHOTS);
1733 if (error != 0) {
1734 dsl_dir_rele(newparent, FTAG);
1735 dsl_dir_rele(dd, FTAG);
1736 return (error);
1737 }
1738 }
1739
1740 if (dmu_tx_is_syncing(tx)) {
1741 if (spa_feature_is_active(dp->dp_spa,
1742 SPA_FEATURE_FS_SS_LIMIT)) {
1743 /*
1744 * Although this is the check function and we don't
1745 * normally make on-disk changes in check functions,
1746 * we need to do that here.
1747 *
1748 * Ensure this portion of the tree's counts have been
1749 * initialized in case the new parent has limits set.
1750 */
1751 dsl_dir_init_fs_ss_count(dd, tx);
1752 }
1753 }
1754
1755 if (newparent != dd->dd_parent) {
1756 /* is there enough space? */
1757 uint64_t myspace =
1758 MAX(dsl_dir_phys(dd)->dd_used_bytes,
1759 dsl_dir_phys(dd)->dd_reserved);
1760 objset_t *os = dd->dd_pool->dp_meta_objset;
1761 uint64_t fs_cnt = 0;
1762 uint64_t ss_cnt = 0;
1763
1764 if (dsl_dir_is_zapified(dd)) {
1765 int err;
1766
1767 err = zap_lookup(os, dd->dd_object,
1768 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1,
1769 &fs_cnt);
1770 if (err != ENOENT && err != 0) {
1771 dsl_dir_rele(newparent, FTAG);
1772 dsl_dir_rele(dd, FTAG);
1773 return (err);
1774 }
1775
1776 /*
1777 * have to add 1 for the filesystem itself that we're
1778 * moving
1779 */
1780 fs_cnt++;
1781
1782 err = zap_lookup(os, dd->dd_object,
1783 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1,
1784 &ss_cnt);
1785 if (err != ENOENT && err != 0) {
1786 dsl_dir_rele(newparent, FTAG);
1787 dsl_dir_rele(dd, FTAG);
1788 return (err);
1789 }
1790 }
1791
1792 /* no rename into our descendant */
1793 if (closest_common_ancestor(dd, newparent) == dd) {
1794 dsl_dir_rele(newparent, FTAG);
1795 dsl_dir_rele(dd, FTAG);
1796 return (SET_ERROR(EINVAL));
1797 }
1798
1799 error = dsl_dir_transfer_possible(dd->dd_parent,
1800 newparent, fs_cnt, ss_cnt, myspace, ddra->ddra_cred);
1801 if (error != 0) {
1802 dsl_dir_rele(newparent, FTAG);
1803 dsl_dir_rele(dd, FTAG);
1804 return (error);
1805 }
1806 }
1807
1808 dsl_dir_rele(newparent, FTAG);
1809 dsl_dir_rele(dd, FTAG);
1810 return (0);
1811 }
1812
1813 static void
1814 dsl_dir_rename_sync(void *arg, dmu_tx_t *tx)
1815 {
1816 dsl_dir_rename_arg_t *ddra = arg;
1817 dsl_pool_t *dp = dmu_tx_pool(tx);
1818 dsl_dir_t *dd, *newparent;
1819 const char *mynewname;
1820 int error;
1821 objset_t *mos = dp->dp_meta_objset;
1822
1823 VERIFY0(dsl_dir_hold(dp, ddra->ddra_oldname, FTAG, &dd, NULL));
1824 VERIFY0(dsl_dir_hold(dp, ddra->ddra_newname, FTAG, &newparent,
1825 &mynewname));
1826
1827 /* Log this before we change the name. */
1828 spa_history_log_internal_dd(dd, "rename", tx,
1829 "-> %s", ddra->ddra_newname);
1830
1831 if (newparent != dd->dd_parent) {
1832 objset_t *os = dd->dd_pool->dp_meta_objset;
1833 uint64_t fs_cnt = 0;
1834 uint64_t ss_cnt = 0;
1835
1836 /*
1837 * We already made sure the dd counts were initialized in the
1838 * check function.
1839 */
1840 if (spa_feature_is_active(dp->dp_spa,
1841 SPA_FEATURE_FS_SS_LIMIT)) {
1842 VERIFY0(zap_lookup(os, dd->dd_object,
1843 DD_FIELD_FILESYSTEM_COUNT, sizeof (fs_cnt), 1,
1844 &fs_cnt));
1845 /* add 1 for the filesystem itself that we're moving */
1846 fs_cnt++;
1847
1848 VERIFY0(zap_lookup(os, dd->dd_object,
1849 DD_FIELD_SNAPSHOT_COUNT, sizeof (ss_cnt), 1,
1850 &ss_cnt));
1851 }
1852
1853 dsl_fs_ss_count_adjust(dd->dd_parent, -fs_cnt,
1854 DD_FIELD_FILESYSTEM_COUNT, tx);
1855 dsl_fs_ss_count_adjust(newparent, fs_cnt,
1856 DD_FIELD_FILESYSTEM_COUNT, tx);
1857
1858 dsl_fs_ss_count_adjust(dd->dd_parent, -ss_cnt,
1859 DD_FIELD_SNAPSHOT_COUNT, tx);
1860 dsl_fs_ss_count_adjust(newparent, ss_cnt,
1861 DD_FIELD_SNAPSHOT_COUNT, tx);
1862
1863 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD,
1864 -dsl_dir_phys(dd)->dd_used_bytes,
1865 -dsl_dir_phys(dd)->dd_compressed_bytes,
1866 -dsl_dir_phys(dd)->dd_uncompressed_bytes, tx);
1867 dsl_dir_diduse_space(newparent, DD_USED_CHILD,
1868 dsl_dir_phys(dd)->dd_used_bytes,
1869 dsl_dir_phys(dd)->dd_compressed_bytes,
1870 dsl_dir_phys(dd)->dd_uncompressed_bytes, tx);
1871
1872 if (dsl_dir_phys(dd)->dd_reserved >
1873 dsl_dir_phys(dd)->dd_used_bytes) {
1874 uint64_t unused_rsrv = dsl_dir_phys(dd)->dd_reserved -
1875 dsl_dir_phys(dd)->dd_used_bytes;
1876
1877 dsl_dir_diduse_space(dd->dd_parent, DD_USED_CHILD_RSRV,
1878 -unused_rsrv, 0, 0, tx);
1879 dsl_dir_diduse_space(newparent, DD_USED_CHILD_RSRV,
1880 unused_rsrv, 0, 0, tx);
1881 }
1882 }
1883
1884 dmu_buf_will_dirty(dd->dd_dbuf, tx);
1885
1886 /* remove from old parent zapobj */
1887 error = zap_remove(mos,
1888 dsl_dir_phys(dd->dd_parent)->dd_child_dir_zapobj,
1889 dd->dd_myname, tx);
1890 ASSERT0(error);
1891
1892 (void) strcpy(dd->dd_myname, mynewname);
1893 dsl_dir_rele(dd->dd_parent, dd);
1894 dsl_dir_phys(dd)->dd_parent_obj = newparent->dd_object;
1895 VERIFY0(dsl_dir_hold_obj(dp,
1896 newparent->dd_object, NULL, dd, &dd->dd_parent));
1897
1898 /* add to new parent zapobj */
1899 VERIFY0(zap_add(mos, dsl_dir_phys(newparent)->dd_child_dir_zapobj,
1900 dd->dd_myname, 8, 1, &dd->dd_object, tx));
1901
1902 dsl_prop_notify_all(dd);
1903
1904 dsl_dir_rele(newparent, FTAG);
1905 dsl_dir_rele(dd, FTAG);
1906 }
1907
1908 int
1909 dsl_dir_rename(const char *oldname, const char *newname)
1910 {
1911 dsl_dir_rename_arg_t ddra;
1912
1913 ddra.ddra_oldname = oldname;
1914 ddra.ddra_newname = newname;
1915 ddra.ddra_cred = CRED();
1916
1917 return (dsl_sync_task(oldname,
1918 dsl_dir_rename_check, dsl_dir_rename_sync, &ddra,
1919 3, ZFS_SPACE_CHECK_RESERVED));
1920 }
1921
1922 int
1923 dsl_dir_transfer_possible(dsl_dir_t *sdd, dsl_dir_t *tdd,
1924 uint64_t fs_cnt, uint64_t ss_cnt, uint64_t space, cred_t *cr)
1925 {
1926 dsl_dir_t *ancestor;
1927 int64_t adelta;
1928 uint64_t avail;
1929 int err;
1930
1931 ancestor = closest_common_ancestor(sdd, tdd);
1932 adelta = would_change(sdd, -space, ancestor);
1933 avail = dsl_dir_space_available(tdd, ancestor, adelta, FALSE);
1934 if (avail < space)
1935 return (SET_ERROR(ENOSPC));
1936
1937 err = dsl_fs_ss_limit_check(tdd, fs_cnt, ZFS_PROP_FILESYSTEM_LIMIT,
1938 ancestor, cr);
1939 if (err != 0)
1940 return (err);
1941 err = dsl_fs_ss_limit_check(tdd, ss_cnt, ZFS_PROP_SNAPSHOT_LIMIT,
1942 ancestor, cr);
1943 if (err != 0)
1944 return (err);
1945
1946 return (0);
1947 }
1948
1949 timestruc_t
1950 dsl_dir_snap_cmtime(dsl_dir_t *dd)
1951 {
1952 timestruc_t t;
1953
1954 mutex_enter(&dd->dd_lock);
1955 t = dd->dd_snap_cmtime;
1956 mutex_exit(&dd->dd_lock);
1957
1958 return (t);
1959 }
1960
1961 void
1962 dsl_dir_snap_cmtime_update(dsl_dir_t *dd)
1963 {
1964 timestruc_t t;
1965
1966 gethrestime(&t);
1967 mutex_enter(&dd->dd_lock);
1968 dd->dd_snap_cmtime = t;
1969 mutex_exit(&dd->dd_lock);
1970 }
1971
1972 void
1973 dsl_dir_zapify(dsl_dir_t *dd, dmu_tx_t *tx)
1974 {
1975 objset_t *mos = dd->dd_pool->dp_meta_objset;
1976 dmu_object_zapify(mos, dd->dd_object, DMU_OT_DSL_DIR, tx);
1977 }
1978
1979 boolean_t
1980 dsl_dir_is_zapified(dsl_dir_t *dd)
1981 {
1982 dmu_object_info_t doi;
1983
1984 dmu_object_info_from_db(dd->dd_dbuf, &doi);
1985 return (doi.doi_type == DMU_OTN_ZAP_METADATA);
1986 }