]>
Commit | Line | Data |
---|---|---|
9ae529ec CS |
1 | /* |
2 | * CDDL HEADER START | |
3 | * | |
4 | * The contents of this file are subject to the terms of the | |
5 | * Common Development and Distribution License (the "License"). | |
6 | * You may not use this file except in compliance with the License. | |
7 | * | |
8 | * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE | |
9 | * or http://www.opensolaris.org/os/licensing. | |
10 | * See the License for the specific language governing permissions | |
11 | * and limitations under the License. | |
12 | * | |
13 | * When distributing Covered Code, include this CDDL HEADER in each | |
14 | * file and include the License file at usr/src/OPENSOLARIS.LICENSE. | |
15 | * If applicable, add the following below this CDDL HEADER, with the | |
16 | * fields enclosed by brackets "[]" replaced with your own identifying | |
17 | * information: Portions Copyright [yyyy] [name of copyright owner] | |
18 | * | |
19 | * CDDL HEADER END | |
20 | */ | |
21 | ||
22 | /* | |
2e528b49 | 23 | * Copyright (c) 2013 by Delphix. All rights reserved. |
9ae529ec CS |
24 | */ |
25 | ||
26 | #include <sys/zfs_context.h> | |
27 | #include <sys/zfeature.h> | |
28 | #include <sys/dmu.h> | |
29 | #include <sys/nvpair.h> | |
30 | #include <sys/zap.h> | |
31 | #include <sys/dmu_tx.h> | |
32 | #include "zfeature_common.h" | |
33 | #include <sys/spa_impl.h> | |
34 | ||
35 | /* | |
36 | * ZFS Feature Flags | |
37 | * ----------------- | |
38 | * | |
39 | * ZFS feature flags are used to provide fine-grained versioning to the ZFS | |
40 | * on-disk format. Once enabled on a pool feature flags replace the old | |
41 | * spa_version() number. | |
42 | * | |
43 | * Each new on-disk format change will be given a uniquely identifying string | |
44 | * guid rather than a version number. This avoids the problem of different | |
45 | * organizations creating new on-disk formats with the same version number. To | |
46 | * keep feature guids unique they should consist of the reverse dns name of the | |
47 | * organization which implemented the feature and a short name for the feature, | |
48 | * separated by a colon (e.g. com.delphix:async_destroy). | |
49 | * | |
50 | * Reference Counts | |
51 | * ---------------- | |
52 | * | |
53 | * Within each pool features can be in one of three states: disabled, enabled, | |
54 | * or active. These states are differentiated by a reference count stored on | |
55 | * disk for each feature: | |
56 | * | |
57 | * 1) If there is no reference count stored on disk the feature is disabled. | |
58 | * 2) If the reference count is 0 a system administrator has enabled the | |
59 | * feature, but the feature has not been used yet, so no on-disk | |
60 | * format changes have been made. | |
61 | * 3) If the reference count is greater than 0 the feature is active. | |
62 | * The format changes required by the feature are currently on disk. | |
63 | * Note that if the feature's format changes are reversed the feature | |
64 | * may choose to set its reference count back to 0. | |
65 | * | |
66 | * Feature flags makes no differentiation between non-zero reference counts | |
67 | * for an active feature (e.g. a reference count of 1 means the same thing as a | |
68 | * reference count of 27834721), but feature implementations may choose to use | |
69 | * the reference count to store meaningful information. For example, a new RAID | |
70 | * implementation might set the reference count to the number of vdevs using | |
71 | * it. If all those disks are removed from the pool the feature goes back to | |
72 | * having a reference count of 0. | |
73 | * | |
74 | * It is the responsibility of the individual features to maintain a non-zero | |
75 | * reference count as long as the feature's format changes are present on disk. | |
76 | * | |
77 | * Dependencies | |
78 | * ------------ | |
79 | * | |
80 | * Each feature may depend on other features. The only effect of this | |
81 | * relationship is that when a feature is enabled all of its dependencies are | |
82 | * automatically enabled as well. Any future work to support disabling of | |
83 | * features would need to ensure that features cannot be disabled if other | |
84 | * enabled features depend on them. | |
85 | * | |
86 | * On-disk Format | |
87 | * -------------- | |
88 | * | |
89 | * When feature flags are enabled spa_version() is set to SPA_VERSION_FEATURES | |
90 | * (5000). In order for this to work the pool is automatically upgraded to | |
91 | * SPA_VERSION_BEFORE_FEATURES (28) first, so all pre-feature flags on disk | |
92 | * format changes will be in use. | |
93 | * | |
94 | * Information about features is stored in 3 ZAP objects in the pool's MOS. | |
95 | * These objects are linked to by the following names in the pool directory | |
96 | * object: | |
97 | * | |
98 | * 1) features_for_read: feature guid -> reference count | |
99 | * Features needed to open the pool for reading. | |
100 | * 2) features_for_write: feature guid -> reference count | |
101 | * Features needed to open the pool for writing. | |
102 | * 3) feature_descriptions: feature guid -> descriptive string | |
103 | * A human readable string. | |
104 | * | |
105 | * All enabled features appear in either features_for_read or | |
106 | * features_for_write, but not both. | |
107 | * | |
108 | * To open a pool in read-only mode only the features listed in | |
109 | * features_for_read need to be supported. | |
110 | * | |
111 | * To open the pool in read-write mode features in both features_for_read and | |
112 | * features_for_write need to be supported. | |
113 | * | |
114 | * Some features may be required to read the ZAP objects containing feature | |
115 | * information. To allow software to check for compatibility with these features | |
116 | * before the pool is opened their names must be stored in the label in a | |
117 | * new "features_for_read" entry (note that features that are only required | |
118 | * to write to a pool never need to be stored in the label since the | |
119 | * features_for_write ZAP object can be read before the pool is written to). | |
120 | * To save space in the label features must be explicitly marked as needing to | |
121 | * be written to the label. Also, reference counts are not stored in the label, | |
122 | * instead any feature whose reference count drops to 0 is removed from the | |
123 | * label. | |
124 | * | |
125 | * Adding New Features | |
126 | * ------------------- | |
127 | * | |
128 | * Features must be registered in zpool_feature_init() function in | |
129 | * zfeature_common.c using the zfeature_register() function. This function | |
130 | * has arguments to specify if the feature should be stored in the | |
131 | * features_for_read or features_for_write ZAP object and if it needs to be | |
132 | * written to the label when active. | |
133 | * | |
134 | * Once a feature is registered it will appear as a "feature@<feature name>" | |
135 | * property which can be set by an administrator. Feature implementors should | |
136 | * use the spa_feature_is_enabled() and spa_feature_is_active() functions to | |
137 | * query the state of a feature and the spa_feature_incr() and | |
138 | * spa_feature_decr() functions to change an enabled feature's reference count. | |
139 | * Reference counts may only be updated in the syncing context. | |
140 | * | |
141 | * Features may not perform enable-time initialization. Instead, any such | |
142 | * initialization should occur when the feature is first used. This design | |
143 | * enforces that on-disk changes be made only when features are used. Code | |
144 | * should only check if a feature is enabled using spa_feature_is_enabled(), | |
145 | * not by relying on any feature specific metadata existing. If a feature is | |
146 | * enabled, but the feature's metadata is not on disk yet then it should be | |
147 | * created as needed. | |
148 | * | |
149 | * As an example, consider the com.delphix:async_destroy feature. This feature | |
150 | * relies on the existence of a bptree in the MOS that store blocks for | |
151 | * asynchronous freeing. This bptree is not created when async_destroy is | |
152 | * enabled. Instead, when a dataset is destroyed spa_feature_is_enabled() is | |
153 | * called to check if async_destroy is enabled. If it is and the bptree object | |
154 | * does not exist yet, the bptree object is created as part of the dataset | |
155 | * destroy and async_destroy's reference count is incremented to indicate it | |
156 | * has made an on-disk format change. Later, after the destroyed dataset's | |
157 | * blocks have all been asynchronously freed there is no longer any use for the | |
158 | * bptree object, so it is destroyed and async_destroy's reference count is | |
159 | * decremented back to 0 to indicate that it has undone its on-disk format | |
160 | * changes. | |
161 | */ | |
162 | ||
163 | typedef enum { | |
164 | FEATURE_ACTION_ENABLE, | |
165 | FEATURE_ACTION_INCR, | |
166 | FEATURE_ACTION_DECR, | |
167 | } feature_action_t; | |
168 | ||
169 | /* | |
170 | * Checks that the features active in the specified object are supported by | |
171 | * this software. Adds each unsupported feature (name -> description) to | |
172 | * the supplied nvlist. | |
173 | */ | |
174 | boolean_t | |
175 | feature_is_supported(objset_t *os, uint64_t obj, uint64_t desc_obj, | |
b9b24bb4 | 176 | nvlist_t *unsup_feat, nvlist_t *enabled_feat) |
9ae529ec CS |
177 | { |
178 | boolean_t supported; | |
179 | zap_cursor_t *zc; | |
180 | zap_attribute_t *za; | |
181 | char *buf; | |
182 | ||
d1d7e268 MK |
183 | zc = kmem_alloc(sizeof (zap_cursor_t), KM_SLEEP); |
184 | za = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP); | |
9ae529ec CS |
185 | buf = kmem_alloc(MAXPATHLEN, KM_SLEEP); |
186 | ||
187 | supported = B_TRUE; | |
188 | for (zap_cursor_init(zc, os, obj); | |
189 | zap_cursor_retrieve(zc, za) == 0; | |
190 | zap_cursor_advance(zc)) { | |
191 | ASSERT(za->za_integer_length == sizeof (uint64_t) && | |
192 | za->za_num_integers == 1); | |
193 | ||
b9b24bb4 CS |
194 | if (NULL != enabled_feat) { |
195 | fnvlist_add_uint64(enabled_feat, za->za_name, | |
196 | za->za_first_integer); | |
197 | } | |
198 | ||
9ae529ec CS |
199 | if (za->za_first_integer != 0 && |
200 | !zfeature_is_supported(za->za_name)) { | |
201 | supported = B_FALSE; | |
202 | ||
b9b24bb4 | 203 | if (NULL != unsup_feat) { |
9ae529ec CS |
204 | char *desc = ""; |
205 | ||
206 | if (zap_lookup(os, desc_obj, za->za_name, | |
13a7ba1c | 207 | 1, MAXPATHLEN, buf) == 0) |
9ae529ec CS |
208 | desc = buf; |
209 | ||
210 | VERIFY(nvlist_add_string(unsup_feat, | |
211 | za->za_name, desc) == 0); | |
212 | } | |
213 | } | |
214 | } | |
215 | zap_cursor_fini(zc); | |
216 | ||
217 | kmem_free(buf, MAXPATHLEN); | |
d1d7e268 MK |
218 | kmem_free(za, sizeof (zap_attribute_t)); |
219 | kmem_free(zc, sizeof (zap_cursor_t)); | |
9ae529ec CS |
220 | |
221 | return (supported); | |
222 | } | |
223 | ||
224 | static int | |
225 | feature_get_refcount(objset_t *os, uint64_t read_obj, uint64_t write_obj, | |
226 | zfeature_info_t *feature, uint64_t *res) | |
227 | { | |
228 | int err; | |
229 | uint64_t refcount; | |
230 | uint64_t zapobj = feature->fi_can_readonly ? write_obj : read_obj; | |
231 | ||
753c3839 MA |
232 | /* |
233 | * If the pool is currently being created, the feature objects may not | |
234 | * have been allocated yet. Act as though all features are disabled. | |
235 | */ | |
236 | if (zapobj == 0) | |
2e528b49 | 237 | return (SET_ERROR(ENOTSUP)); |
9ae529ec CS |
238 | |
239 | err = zap_lookup(os, zapobj, feature->fi_guid, sizeof (uint64_t), 1, | |
240 | &refcount); | |
241 | if (err != 0) { | |
242 | if (err == ENOENT) | |
2e528b49 | 243 | return (SET_ERROR(ENOTSUP)); |
9ae529ec CS |
244 | else |
245 | return (err); | |
246 | } | |
247 | *res = refcount; | |
248 | return (0); | |
249 | } | |
250 | ||
251 | static int | |
252 | feature_do_action(objset_t *os, uint64_t read_obj, uint64_t write_obj, | |
253 | uint64_t desc_obj, zfeature_info_t *feature, feature_action_t action, | |
254 | dmu_tx_t *tx) | |
255 | { | |
256 | int error; | |
257 | uint64_t refcount; | |
258 | uint64_t zapobj = feature->fi_can_readonly ? write_obj : read_obj; | |
259 | ||
260 | ASSERT(0 != zapobj); | |
261 | ASSERT(zfeature_is_valid_guid(feature->fi_guid)); | |
262 | ||
263 | error = zap_lookup(os, zapobj, feature->fi_guid, | |
264 | sizeof (uint64_t), 1, &refcount); | |
265 | ||
266 | /* | |
267 | * If we can't ascertain the status of the specified feature, an I/O | |
268 | * error occurred. | |
269 | */ | |
270 | if (error != 0 && error != ENOENT) | |
271 | return (error); | |
272 | ||
273 | switch (action) { | |
274 | case FEATURE_ACTION_ENABLE: | |
275 | /* | |
276 | * If the feature is already enabled, ignore the request. | |
277 | */ | |
278 | if (error == 0) | |
279 | return (0); | |
280 | refcount = 0; | |
281 | break; | |
282 | case FEATURE_ACTION_INCR: | |
283 | if (error == ENOENT) | |
2e528b49 | 284 | return (SET_ERROR(ENOTSUP)); |
9ae529ec | 285 | if (refcount == UINT64_MAX) |
2e528b49 | 286 | return (SET_ERROR(EOVERFLOW)); |
9ae529ec CS |
287 | refcount++; |
288 | break; | |
289 | case FEATURE_ACTION_DECR: | |
290 | if (error == ENOENT) | |
2e528b49 | 291 | return (SET_ERROR(ENOTSUP)); |
9ae529ec | 292 | if (refcount == 0) |
2e528b49 | 293 | return (SET_ERROR(EOVERFLOW)); |
9ae529ec CS |
294 | refcount--; |
295 | break; | |
296 | default: | |
297 | ASSERT(0); | |
298 | break; | |
299 | } | |
300 | ||
301 | if (action == FEATURE_ACTION_ENABLE) { | |
302 | int i; | |
303 | ||
304 | for (i = 0; feature->fi_depends[i] != NULL; i++) { | |
305 | zfeature_info_t *dep = feature->fi_depends[i]; | |
306 | ||
307 | error = feature_do_action(os, read_obj, write_obj, | |
308 | desc_obj, dep, FEATURE_ACTION_ENABLE, tx); | |
309 | if (error != 0) | |
310 | return (error); | |
311 | } | |
312 | } | |
313 | ||
314 | error = zap_update(os, zapobj, feature->fi_guid, | |
315 | sizeof (uint64_t), 1, &refcount, tx); | |
316 | if (error != 0) | |
317 | return (error); | |
318 | ||
319 | if (action == FEATURE_ACTION_ENABLE) { | |
320 | error = zap_update(os, desc_obj, | |
321 | feature->fi_guid, 1, strlen(feature->fi_desc) + 1, | |
322 | feature->fi_desc, tx); | |
323 | if (error != 0) | |
324 | return (error); | |
325 | } | |
326 | ||
327 | if (action == FEATURE_ACTION_INCR && refcount == 1 && feature->fi_mos) { | |
328 | spa_activate_mos_feature(dmu_objset_spa(os), feature->fi_guid); | |
329 | } | |
330 | ||
331 | if (action == FEATURE_ACTION_DECR && refcount == 0) { | |
332 | spa_deactivate_mos_feature(dmu_objset_spa(os), | |
333 | feature->fi_guid); | |
334 | } | |
335 | ||
336 | return (0); | |
337 | } | |
338 | ||
339 | void | |
340 | spa_feature_create_zap_objects(spa_t *spa, dmu_tx_t *tx) | |
341 | { | |
342 | /* | |
343 | * We create feature flags ZAP objects in two instances: during pool | |
344 | * creation and during pool upgrade. | |
345 | */ | |
346 | ASSERT(dsl_pool_sync_context(spa_get_dsl(spa)) || (!spa->spa_sync_on && | |
347 | tx->tx_txg == TXG_INITIAL)); | |
348 | ||
349 | spa->spa_feat_for_read_obj = zap_create_link(spa->spa_meta_objset, | |
350 | DMU_OTN_ZAP_METADATA, DMU_POOL_DIRECTORY_OBJECT, | |
351 | DMU_POOL_FEATURES_FOR_READ, tx); | |
352 | spa->spa_feat_for_write_obj = zap_create_link(spa->spa_meta_objset, | |
353 | DMU_OTN_ZAP_METADATA, DMU_POOL_DIRECTORY_OBJECT, | |
354 | DMU_POOL_FEATURES_FOR_WRITE, tx); | |
355 | spa->spa_feat_desc_obj = zap_create_link(spa->spa_meta_objset, | |
356 | DMU_OTN_ZAP_METADATA, DMU_POOL_DIRECTORY_OBJECT, | |
357 | DMU_POOL_FEATURE_DESCRIPTIONS, tx); | |
358 | } | |
359 | ||
360 | /* | |
361 | * Enable any required dependencies, then enable the requested feature. | |
362 | */ | |
363 | void | |
364 | spa_feature_enable(spa_t *spa, zfeature_info_t *feature, dmu_tx_t *tx) | |
365 | { | |
366 | ASSERT3U(spa_version(spa), >=, SPA_VERSION_FEATURES); | |
367 | VERIFY3U(0, ==, feature_do_action(spa->spa_meta_objset, | |
368 | spa->spa_feat_for_read_obj, spa->spa_feat_for_write_obj, | |
369 | spa->spa_feat_desc_obj, feature, FEATURE_ACTION_ENABLE, tx)); | |
370 | } | |
371 | ||
9ae529ec CS |
372 | void |
373 | spa_feature_incr(spa_t *spa, zfeature_info_t *feature, dmu_tx_t *tx) | |
374 | { | |
93cf2076 | 375 | ASSERT(dmu_tx_is_syncing(tx)); |
9ae529ec CS |
376 | ASSERT3U(spa_version(spa), >=, SPA_VERSION_FEATURES); |
377 | VERIFY3U(0, ==, feature_do_action(spa->spa_meta_objset, | |
378 | spa->spa_feat_for_read_obj, spa->spa_feat_for_write_obj, | |
379 | spa->spa_feat_desc_obj, feature, FEATURE_ACTION_INCR, tx)); | |
380 | } | |
381 | ||
9ae529ec CS |
382 | void |
383 | spa_feature_decr(spa_t *spa, zfeature_info_t *feature, dmu_tx_t *tx) | |
384 | { | |
93cf2076 | 385 | ASSERT(dmu_tx_is_syncing(tx)); |
9ae529ec CS |
386 | ASSERT3U(spa_version(spa), >=, SPA_VERSION_FEATURES); |
387 | VERIFY3U(0, ==, feature_do_action(spa->spa_meta_objset, | |
388 | spa->spa_feat_for_read_obj, spa->spa_feat_for_write_obj, | |
389 | spa->spa_feat_desc_obj, feature, FEATURE_ACTION_DECR, tx)); | |
390 | } | |
391 | ||
93cf2076 GW |
392 | /* |
393 | * This interface is for debugging only. Normal consumers should use | |
394 | * spa_feature_is_enabled/spa_feature_is_active. | |
395 | */ | |
396 | int | |
397 | spa_feature_get_refcount(spa_t *spa, zfeature_info_t *feature) | |
398 | { | |
399 | int err; | |
400 | uint64_t refcount = 0; | |
401 | ||
402 | if (spa_version(spa) < SPA_VERSION_FEATURES) | |
403 | return (B_FALSE); | |
404 | ||
405 | err = feature_get_refcount(spa->spa_meta_objset, | |
406 | spa->spa_feat_for_read_obj, spa->spa_feat_for_write_obj, | |
407 | feature, &refcount); | |
408 | ASSERT(err == 0 || err == ENOTSUP); | |
409 | return (err == 0 ? refcount : 0); | |
410 | } | |
411 | ||
9ae529ec CS |
412 | boolean_t |
413 | spa_feature_is_enabled(spa_t *spa, zfeature_info_t *feature) | |
414 | { | |
415 | int err; | |
416 | uint64_t refcount = 0; | |
417 | ||
418 | if (spa_version(spa) < SPA_VERSION_FEATURES) | |
419 | return (B_FALSE); | |
420 | ||
421 | err = feature_get_refcount(spa->spa_meta_objset, | |
422 | spa->spa_feat_for_read_obj, spa->spa_feat_for_write_obj, | |
423 | feature, &refcount); | |
424 | ASSERT(err == 0 || err == ENOTSUP); | |
425 | return (err == 0); | |
426 | } | |
427 | ||
428 | boolean_t | |
429 | spa_feature_is_active(spa_t *spa, zfeature_info_t *feature) | |
430 | { | |
431 | int err; | |
432 | uint64_t refcount = 0; | |
433 | ||
434 | if (spa_version(spa) < SPA_VERSION_FEATURES) | |
435 | return (B_FALSE); | |
436 | ||
437 | err = feature_get_refcount(spa->spa_meta_objset, | |
438 | spa->spa_feat_for_read_obj, spa->spa_feat_for_write_obj, | |
439 | feature, &refcount); | |
440 | ASSERT(err == 0 || err == ENOTSUP); | |
441 | return (err == 0 && refcount > 0); | |
442 | } |