xref: /freebsd/sys/contrib/openzfs/module/zfs/mmp.c (revision 22649d4dba730d46244fd2dff4fd174903c8379f)

// SPDX-License-Identifier: CDDL-1.0
/*
 * This file and its contents are supplied under the terms of the
 * Common Development and Distribution License ("CDDL"), version 1.0.
 * You may only use this file in accordance with the terms of version
 * 1.0 of the CDDL.
 *
 * A full copy of the text of the CDDL should have accompanied this
 * source.  A copy of the CDDL is also available via the Internet at
 * https://opensource.org/license/CDDL-1.0.
 */
/*
 * Copyright (c) 2017 by Lawrence Livermore National Security, LLC.
 */

#include <sys/abd.h>
#include <sys/mmp.h>
#include <sys/spa.h>
#include <sys/spa_impl.h>
#include <sys/time.h>
#include <sys/vdev.h>
#include <sys/vdev_impl.h>
#include <sys/zfs_context.h>
#include <sys/callb.h>

/*
 * Multi-Modifier Protection (MMP) attempts to prevent a user from importing
 * or opening a pool on more than one host at a time.  In particular, it
 * prevents "zpool import -f" on a host from succeeding while the pool is
 * already imported on another host.  There are many other ways in which a
 * device could be used by two hosts for different purposes at the same time
 * resulting in pool damage.  This implementation does not attempt to detect
 * those cases.
 *
 * MMP operates by ensuring there are frequent visible changes on disk (a
 * "heartbeat") at all times.  And by altering the import process to check
 * for these changes and failing the import when they are detected.  This
 * functionality is enabled by setting the 'multihost' pool property to on.
 *
 * Uberblocks written by the txg_sync thread always go into the first
 * (N-MMP_BLOCKS_PER_LABEL) slots, the remaining slots are reserved for MMP.
 * They are used to hold uberblocks which are exactly the same as the last
 * synced uberblock except that the ub_timestamp and mmp_config are frequently
 * updated.  Like all other uberblocks, the slot is written with an embedded
 * checksum, and slots with invalid checksums are ignored.  This provides the
 * "heartbeat", with no risk of overwriting good uberblocks that must be
 * preserved, e.g. previous txgs and associated block pointers.
 *
 * Three optional fields are added to uberblock structure; ub_mmp_magic,
 * ub_mmp_config, and ub_mmp_delay.  The ub_mmp_magic value allows zfs to tell
 * whether the other ub_mmp_* fields are valid.  The ub_mmp_config field tells
 * the importing host the settings of zfs_multihost_interval and
 * zfs_multihost_fail_intervals on the host which last had (or currently has)
 * the pool imported.  These determine how long a host must wait to detect
 * activity in the pool, before concluding the pool is not in use.  The
 * mmp_delay field is a decaying average of the amount of time between
 * completion of successive MMP writes, in nanoseconds.  It indicates whether
 * MMP is enabled.
 *
 * During import an activity test may now be performed to determine if
 * the pool is in use.  The activity test is typically required if the
 * ZPOOL_CONFIG_HOSTID does not match the system hostid, the pool state is
 * POOL_STATE_ACTIVE, and the pool is not a root pool.
 *
 * The activity test finds the "best" uberblock (highest txg, timestamp, and, if
 * ub_mmp_magic is valid, sequence number from ub_mmp_config).  It then waits
 * some time, and finds the "best" uberblock again.  If any of the mentioned
 * fields have different values in the newly read uberblock, the pool is in use
 * by another host and the import fails.  In order to assure the accuracy of the
 * activity test, the default values result in an activity test duration of 20x
 * the mmp write interval.
 *
 * The duration of the "zpool import" activity test depends on the information
 * available in the "best" uberblock:
 *
 * 1) If uberblock was written by zfs-0.8 or newer and fail_intervals > 0:
 *    ub_mmp_config.fail_intervals * ub_mmp_config.multihost_interval * 2
 *
 *    In this case, a weak guarantee is provided.  Since the host which last had
 *    the pool imported will suspend the pool if no mmp writes land within
 *    fail_intervals * multihost_interval ms, the absence of writes during that
 *    time means either the pool is not imported, or it is imported but the pool
 *    is suspended and no further writes will occur.
 *
 *    Note that resuming the suspended pool on the remote host would invalidate
 *    this guarantee, and so it is not allowed.
 *
 *    The factor of 2 provides a conservative safety factor and derives from
 *    MMP_IMPORT_SAFETY_FACTOR;
 *
 * 2) If uberblock was written by zfs-0.8 or newer and fail_intervals == 0:
 *    (ub_mmp_config.multihost_interval + ub_mmp_delay) *
 *        zfs_multihost_import_intervals
 *
 *    In this case no guarantee can provided.  However, as long as some devices
 *    are healthy and connected, it is likely that at least one write will land
 *    within (multihost_interval + mmp_delay) because multihost_interval is
 *    enough time for a write to be attempted to each leaf vdev, and mmp_delay
 *    is enough for one to land, based on past delays.  Multiplying by
 *    zfs_multihost_import_intervals provides a conservative safety factor.
 *
 * 3) If uberblock was written by zfs-0.7:
 *    (zfs_multihost_interval + ub_mmp_delay) * zfs_multihost_import_intervals
 *
 *    The same logic as case #2 applies, but we do not know remote tunables.
 *
 *    We use the local value for zfs_multihost_interval because the original MMP
 *    did not record this value in the uberblock.
 *
 *    ub_mmp_delay >= (zfs_multihost_interval / leaves), so if the other host
 *    has a much larger zfs_multihost_interval set, ub_mmp_delay will reflect
 *    that.  We will have waited enough time for zfs_multihost_import_intervals
 *    writes to be issued and all but one to land.
 *
 *    single device pool example delays
 *
 *    import_delay = (1 + 1) * 20   =  40s #defaults, no I/O delay
 *    import_delay = (1 + 10) * 20  = 220s #defaults, 10s I/O delay
 *    import_delay = (10 + 10) * 20 = 400s #10s multihost_interval,
 *                                          no I/O delay
 *    100 device pool example delays
 *
 *    import_delay = (1 + .01) * 20 =  20s #defaults, no I/O delay
 *    import_delay = (1 + 10) * 20  = 220s #defaults, 10s I/O delay
 *    import_delay = (10 + .1) * 20 = 202s #10s multihost_interval,
 *                                          no I/O delay
 *
 * 4) Otherwise, this uberblock was written by a pre-MMP zfs:
 *    zfs_multihost_import_intervals * zfs_multihost_interval
 *
 *    In this case local tunables are used.  By default this product = 10s, long
 *    enough for a pool with any activity at all to write at least one
 *    uberblock.  No guarantee can be provided.
 *
 * Additionally, the duration is then extended by a random 25% to attempt to to
 * detect simultaneous imports.  For example, if both partner hosts are rebooted
 * at the same time and automatically attempt to import the pool.
 *
 * Once the read-only activity check completes and the pool is determined to
 * be inactive a second check is performed to claim the pool.  During this
 * phase the host writes out MMP uberblocks to each of the devices which are
 * identical to the best uberblock but with a randomly selected sequence id.
 * The "best" uberblock is then read back and it must contain this new sequence
 * number.  This check is performed multiple times to ensure that there is
 * no window where a concurrently importing system can incorrectly determine
 * the pool to be inactive.
 */

/*
 * Used to control the frequency of mmp writes which are performed when the
 * 'multihost' pool property is on.  This is one factor used to determine the
 * length of the activity check during import.
 *
 * On average an mmp write will be issued for each leaf vdev every
 * zfs_multihost_interval milliseconds.  In practice, the observed period can
 * vary with the I/O load and this observed value is the ub_mmp_delay which is
 * stored in the uberblock.  The minimum allowed value is 100 ms.
 */
uint64_t zfs_multihost_interval = MMP_DEFAULT_INTERVAL;

/*
 * Used to control the duration of the activity test on import.  Smaller values
 * of zfs_multihost_import_intervals will reduce the import time but increase
 * the risk of failing to detect an active pool.  The total activity check time
 * is never allowed to drop below one second.  A value of 0 is ignored and
 * treated as if it was set to 1.
 */
uint_t zfs_multihost_import_intervals = MMP_DEFAULT_IMPORT_INTERVALS;

/*
 * Controls the behavior of the pool when mmp write failures or delays are
 * detected.
 *
 * When zfs_multihost_fail_intervals = 0, mmp write failures or delays are
 * ignored.  The failures will still be reported to the ZED which depending on
 * its configuration may take action such as suspending the pool or taking a
 * device offline.
 *
 * When zfs_multihost_fail_intervals > 0, the pool will be suspended if
 * zfs_multihost_fail_intervals * zfs_multihost_interval milliseconds pass
 * without a successful mmp write.  This guarantees the activity test will see
 * mmp writes if the pool is imported.  A value of 1 is ignored and treated as
 * if it was set to 2, because a single leaf vdev pool will issue a write once
 * per multihost_interval and thus any variation in latency would cause the
 * pool to be suspended.
 */
uint_t zfs_multihost_fail_intervals = MMP_DEFAULT_FAIL_INTERVALS;

#ifndef _KERNEL
/*
 * Manual recovery only, set by zhack.  Drops the mirror legs this host
 * cannot open from the uberblock claim's required write count, so a pool
 * whose config still expects legs that died with a peer host can be
 * imported by hand.  Every leg which can be opened is still required.
 *
 * This is deliberately absent from the kernel module.  The write, the wait
 * and the re-read are untouched, so a competing importer which shares any
 * visibility with us is still caught; a live peer whose legs are all
 * invisible from here is not, and cannot be by any write-and-read scheme.
 * That residual is why this is a manual operation guarded by fencing.
 */
boolean_t mmp_claim_relaxed = B_FALSE;
#endif

static const void *const mmp_tag = "mmp_write_uberblock";
static __attribute__((noreturn)) void mmp_thread(void *arg);

void
mmp_init(spa_t *spa)
{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_init(&mmp->mmp_thread_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&mmp->mmp_thread_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&mmp->mmp_io_lock, NULL, MUTEX_DEFAULT, NULL);
	mmp->mmp_kstat_id = 1;
}

void
mmp_fini(spa_t *spa)
{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_destroy(&mmp->mmp_thread_lock);
	cv_destroy(&mmp->mmp_thread_cv);
	mutex_destroy(&mmp->mmp_io_lock);
}

static void
mmp_thread_enter(mmp_thread_t *mmp, callb_cpr_t *cpr)
{
	CALLB_CPR_INIT(cpr, &mmp->mmp_thread_lock, callb_generic_cpr, FTAG);
	mutex_enter(&mmp->mmp_thread_lock);
}

static void
mmp_thread_exit(mmp_thread_t *mmp, kthread_t **mpp, callb_cpr_t *cpr)
{
	ASSERT(*mpp != NULL);
	*mpp = NULL;
	cv_broadcast(&mmp->mmp_thread_cv);
	CALLB_CPR_EXIT(cpr);		/* drops &mmp->mmp_thread_lock */
}

void
mmp_thread_start(spa_t *spa)
{
	mmp_thread_t *mmp = &spa->spa_mmp;

	if (spa_writeable(spa)) {
		mutex_enter(&mmp->mmp_thread_lock);
		if (!mmp->mmp_thread) {
			mmp->mmp_thread = thread_create(NULL, 0, mmp_thread,
			    spa, 0, &p0, TS_RUN, defclsyspri);
			zfs_dbgmsg("mmp: mmp thread started spa=%s "
			    "gethrtime=%llu", spa_name(spa), gethrtime());
		}
		mutex_exit(&mmp->mmp_thread_lock);
	}
}

void
mmp_thread_stop(spa_t *spa)
{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_enter(&mmp->mmp_thread_lock);
	mmp->mmp_thread_exiting = 1;
	cv_broadcast(&mmp->mmp_thread_cv);

	while (mmp->mmp_thread) {
		cv_wait(&mmp->mmp_thread_cv, &mmp->mmp_thread_lock);
	}
	mutex_exit(&mmp->mmp_thread_lock);
	zfs_dbgmsg("mmp: mmp thread stopped spa=%s gethrtime=%llu",
	    spa_name(spa), gethrtime());

	ASSERT0P(mmp->mmp_thread);
	mmp->mmp_thread_exiting = 0;
}

typedef enum mmp_vdev_state_flag {
	MMP_FAIL_NOT_WRITABLE	= (1 << 0),
	MMP_FAIL_WRITE_PENDING	= (1 << 1),
} mmp_vdev_state_flag_t;

/*
 * Find a leaf vdev to write an MMP block to.  It must not have an outstanding
 * mmp write (if so a new write will also likely block).  If there is no usable
 * leaf, a nonzero error value is returned. The error value returned is a bit
 * field.
 *
 * MMP_FAIL_WRITE_PENDING   One or more leaf vdevs are writeable, but have an
 *                          outstanding MMP write.
 * MMP_FAIL_NOT_WRITABLE    One or more leaf vdevs are not writeable.
 */

static int
mmp_next_leaf(spa_t *spa)
{
	vdev_t *leaf;
	vdev_t *starting_leaf;
	int fail_mask = 0;

	ASSERT(MUTEX_HELD(&spa->spa_mmp.mmp_io_lock));
	ASSERT(spa_config_held(spa, SCL_STATE, RW_READER));
	ASSERT(list_link_active(&spa->spa_leaf_list.list_head) == B_TRUE);
	ASSERT(!list_is_empty(&spa->spa_leaf_list));

	if (spa->spa_mmp.mmp_leaf_last_gen != spa->spa_leaf_list_gen) {
		spa->spa_mmp.mmp_last_leaf = list_head(&spa->spa_leaf_list);
		spa->spa_mmp.mmp_leaf_last_gen = spa->spa_leaf_list_gen;
	}

	leaf = spa->spa_mmp.mmp_last_leaf;
	if (leaf == NULL)
		leaf = list_head(&spa->spa_leaf_list);
	starting_leaf = leaf;

	do {
		leaf = list_next(&spa->spa_leaf_list, leaf);
		if (leaf == NULL) {
			leaf = list_head(&spa->spa_leaf_list);
			ASSERT3P(leaf, !=, NULL);
		}

		/*
		 * We skip unwritable, offline, detached, and dRAID spare
		 * devices as they are either not legal targets or the write
		 * may fail or not be seen by other hosts.  Skipped dRAID
		 * spares can never be written so the fail mask is not set.
		 */
		if (!vdev_writeable(leaf) || leaf->vdev_offline ||
		    leaf->vdev_detached) {
			fail_mask |= MMP_FAIL_NOT_WRITABLE;
		} else if (leaf->vdev_ops == &vdev_draid_spare_ops) {
			continue;
		} else if (leaf->vdev_mmp_pending != 0) {
			fail_mask |= MMP_FAIL_WRITE_PENDING;
		} else {
			spa->spa_mmp.mmp_last_leaf = leaf;
			return (0);
		}
	} while (leaf != starting_leaf);

	ASSERT(fail_mask);

	return (fail_mask);
}

/*
 * MMP writes are issued on a fixed schedule, but may complete at variable,
 * much longer, intervals.  The mmp_delay captures long periods between
 * successful writes for any reason, including disk latency, scheduling delays,
 * etc.
 *
 * The mmp_delay is usually calculated as a decaying average, but if the latest
 * delay is higher we do not average it, so that we do not hide sudden spikes
 * which the importing host must wait for.
 *
 * If writes are occurring frequently, such as due to a high rate of txg syncs,
 * the mmp_delay could become very small.  Since those short delays depend on
 * activity we cannot count on, we never allow mmp_delay to get lower than rate
 * expected if only mmp_thread writes occur.
 *
 * If an mmp write was skipped or fails, and we have already waited longer than
 * mmp_delay, we need to update it so the next write reflects the longer delay.
 *
 * Do not set mmp_delay if the multihost property is not on, so as not to
 * trigger an activity check on import.
 */
static void
mmp_delay_update(spa_t *spa, boolean_t write_completed)
{
	mmp_thread_t *mts = &spa->spa_mmp;
	hrtime_t delay = gethrtime() - mts->mmp_last_write;

	ASSERT(MUTEX_HELD(&mts->mmp_io_lock));

	if (spa_multihost(spa) == B_FALSE) {
		mts->mmp_delay = 0;
		return;
	}

	if (delay > mts->mmp_delay)
		mts->mmp_delay = delay;

	if (write_completed == B_FALSE)
		return;

	mts->mmp_last_write = gethrtime();

	/*
	 * strictly less than, in case delay was changed above.
	 */
	if (delay < mts->mmp_delay) {
		hrtime_t min_delay =
		    MSEC2NSEC(MMP_INTERVAL_OK(zfs_multihost_interval)) /
		    MAX(1, vdev_count_leaves(spa));
		mts->mmp_delay = MAX(((delay + mts->mmp_delay * 127) / 128),
		    min_delay);
	}
}

static void
mmp_write_done(zio_t *zio)
{
	spa_t *spa = zio->io_spa;
	vdev_t *vd = zio->io_vd;
	mmp_thread_t *mts = zio->io_private;

	mutex_enter(&mts->mmp_io_lock);
	uint64_t mmp_kstat_id = vd->vdev_mmp_kstat_id;
	hrtime_t mmp_write_duration = gethrtime() - vd->vdev_mmp_pending;

	mmp_delay_update(spa, (zio->io_error == 0));

	vd->vdev_mmp_pending = 0;
	vd->vdev_mmp_kstat_id = 0;

	mutex_exit(&mts->mmp_io_lock);
	spa_config_exit(spa, SCL_STATE, mmp_tag);

	spa_mmp_history_set(spa, mmp_kstat_id, zio->io_error,
	    mmp_write_duration);

	abd_free(zio->io_abd);
}

/*
 * When the uberblock on-disk is updated by a spa_sync,
 * creating a new "best" uberblock, update the one stored
 * in the mmp thread state, used for mmp writes.
 */
void
mmp_update_uberblock(spa_t *spa, uberblock_t *ub)
{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_enter(&mmp->mmp_io_lock);
	mmp->mmp_ub = *ub;
	mmp->mmp_seq = 1;
	mmp->mmp_ub.ub_timestamp = gethrestime_sec();
	mmp_delay_update(spa, B_TRUE);
	mutex_exit(&mmp->mmp_io_lock);
}

/*
 * Choose a random vdev, label, and MMP block, and write over it
 * with a copy of the last-synced uberblock, whose timestamp
 * has been updated to reflect that the pool is in use.
 */
static void
mmp_write_uberblock(spa_t *spa)
{
	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL;
	mmp_thread_t *mmp = &spa->spa_mmp;
	uberblock_t *ub;
	vdev_t *vd = NULL;
	int label, error;
	uint64_t offset;

	hrtime_t lock_acquire_time = gethrtime();
	spa_config_enter_priority(spa, SCL_STATE, mmp_tag, RW_READER);
	lock_acquire_time = gethrtime() - lock_acquire_time;
	if (lock_acquire_time > (MSEC2NSEC(MMP_MIN_INTERVAL) / 10))
		zfs_dbgmsg("mmp: long SCL_STATE acquisition, spa=%s "
		    "acquire_time=%llu gethrtime=%llu", spa_name(spa),
		    lock_acquire_time, gethrtime());

	mutex_enter(&mmp->mmp_io_lock);

	error = mmp_next_leaf(spa);

	/*
	 * spa_mmp_history has two types of entries:
	 * Issued MMP write: records time issued, error status, etc.
	 * Skipped MMP write: an MMP write could not be issued because no
	 * suitable leaf vdev was available.  See comment above struct
	 * spa_mmp_history for details.
	 */

	if (error) {
		mmp_delay_update(spa, B_FALSE);
		if (mmp->mmp_skip_error == error) {
			spa_mmp_history_set_skip(spa, mmp->mmp_kstat_id - 1);
		} else {
			mmp->mmp_skip_error = error;
			spa_mmp_history_add(spa, mmp->mmp_ub.ub_txg,
			    gethrestime_sec(), mmp->mmp_delay, NULL, 0,
			    mmp->mmp_kstat_id++, error);
			zfs_dbgmsg("mmp: error choosing leaf, spa=%s "
			    "gethrtime=%llu fail_mask=%#x", spa_name(spa),
			    gethrtime(), error);
		}
		mutex_exit(&mmp->mmp_io_lock);
		spa_config_exit(spa, SCL_STATE, mmp_tag);
		return;
	}

	vd = spa->spa_mmp.mmp_last_leaf;
	if (mmp->mmp_skip_error != 0) {
		zfs_dbgmsg("mmp: write after skipping due to unavailable "
		    "leaves, spa=%s gethrtime=%llu vdev=%llu error=%d",
		    spa_name(spa), (u_longlong_t)gethrtime(),
		    (u_longlong_t)vd->vdev_guid, mmp->mmp_skip_error);
		mmp->mmp_skip_error = 0;
	}

	if (mmp->mmp_zio_root == NULL)
		mmp->mmp_zio_root = zio_root(spa, NULL, NULL,
		    flags | ZIO_FLAG_GODFATHER);

	if (mmp->mmp_ub.ub_timestamp != gethrestime_sec()) {
		/*
		 * Want to reset mmp_seq when timestamp advances because after
		 * an mmp_seq wrap new values will not be chosen by
		 * uberblock_compare() as the "best".
		 */
		mmp->mmp_ub.ub_timestamp = gethrestime_sec();
		mmp->mmp_seq = 1;
	}

	ub = &mmp->mmp_ub;
	ub->ub_mmp_magic = MMP_MAGIC;
	ub->ub_mmp_delay = mmp->mmp_delay;
	ub->ub_mmp_config = MMP_SEQ_SET(mmp->mmp_seq) |
	    MMP_INTERVAL_SET(MMP_INTERVAL_OK(zfs_multihost_interval)) |
	    MMP_FAIL_INT_SET(MMP_FAIL_INTVS_OK(
	    zfs_multihost_fail_intervals));
	vd->vdev_mmp_pending = gethrtime();
	vd->vdev_mmp_kstat_id = mmp->mmp_kstat_id;

	zio_t *zio  = zio_null(mmp->mmp_zio_root, spa, NULL, NULL, NULL, flags);
	abd_t *ub_abd = abd_alloc_for_io(VDEV_UBERBLOCK_SIZE(vd), B_TRUE);
	abd_copy_from_buf(ub_abd, ub, sizeof (uberblock_t));
	abd_zero_off(ub_abd, sizeof (uberblock_t),
	    VDEV_UBERBLOCK_SIZE(vd) - sizeof (uberblock_t));

	mmp->mmp_seq++;
	mmp->mmp_kstat_id++;
	mutex_exit(&mmp->mmp_io_lock);

	offset = VDEV_UBERBLOCK_OFFSET(vd, VDEV_UBERBLOCK_COUNT(vd) -
	    MMP_BLOCKS_PER_LABEL + random_in_range(MMP_BLOCKS_PER_LABEL));

	label = random_in_range(VDEV_LABELS);
	vdev_label_write(zio, vd, label, ub_abd, offset,
	    VDEV_UBERBLOCK_SIZE(vd), mmp_write_done, mmp,
	    flags | ZIO_FLAG_DONT_PROPAGATE);

	(void) spa_mmp_history_add(spa, ub->ub_txg, ub->ub_timestamp,
	    ub->ub_mmp_delay, vd, label, vd->vdev_mmp_kstat_id, 0);

	zio_nowait(zio);
}

static void
mmp_claim_uberblock_sync_done(zio_t *zio)
{
	uint64_t *good_writes = zio->io_private;

	if (zio->io_error == 0 && zio->io_vd->vdev_top->vdev_ms_array != 0)
		atomic_inc_64(good_writes);
}

/*
 * Write the uberblock to the first label of all leaves of the specified vdev.
 * One write per mirror leg the config still expects present, one for a
 * singleton, and parity+1 for raidz or draid vdevs.
 */
static void
mmp_claim_uberblock_sync(zio_t *zio, uint64_t *good_writes,
    uint64_t *issued_writes, uint64_t *req_writes, uberblock_t *ub, vdev_t *vd,
    int flags)
{
	for (uint64_t c = 0; c < vd->vdev_children; c++) {
		vdev_t *cvd = vd->vdev_child[c];

		if (cvd->vdev_islog || cvd->vdev_isspare ||
		    cvd->vdev_isl2cache || cvd->vdev_ishole ||
		    cvd->vdev_ops == &vdev_indirect_ops)
			continue;

		if (cvd->vdev_top == cvd) {
			uint64_t nparity = vdev_get_nparity(cvd);
			if (nparity) {
				*req_writes += nparity + 1;
			} else {
				/*
				 * Mirror: any single leg is enough for a
				 * remote host to see the claim, so require a
				 * write to every leg the pool config still
				 * expects to be present.  A leg taken out of
				 * service is recorded persistently in the
				 * config (offline, faulted, or removed) and
				 * is seen the same way by every host, so it
				 * is not required and a degraded mirror can
				 * still be claimed.  A leg merely unreachable
				 * from this host has none of those states and
				 * stays required, so a host which can see
				 * only some of the legs of an otherwise
				 * healthy mirror still fails the claim and
				 * cannot split the pool.
				 */
				uint64_t present = 0;
				for (uint64_t l = 0; l < cvd->vdev_children;
				    l++) {
					vdev_t *lvd = cvd->vdev_child[l];
#ifndef _KERNEL
					/*
					 * Manual recovery forgives the legs
					 * this host could not open, and marks
					 * that same set offline before it
					 * exports, so the relaxed claim
					 * accepts nothing the later ordinary
					 * imports would not.
					 */
					if (mmp_claim_relaxed &&
					    lvd->vdev_not_present)
						continue;
#endif
					if (!lvd->vdev_offline &&
					    !lvd->vdev_faulted &&
					    !lvd->vdev_removed)
						present++;
				}
				*req_writes += MAX(present, 1);
			}
		}

		mmp_claim_uberblock_sync(zio, good_writes, issued_writes,
		    req_writes, ub, cvd, flags);
	}

	if (!vd->vdev_ops->vdev_op_leaf)
		return;

	if (!vdev_writeable(vd))
		return;

	if (vd->vdev_ops == &vdev_draid_spare_ops)
		return;

	/*
	 * Count the writes actually issued alongside those required.  A leaf
	 * the config expects present but which cannot be written is never
	 * issued one, so a shortfall here means a device is missing rather
	 * than failing.  Gated exactly as good_writes is in
	 * mmp_claim_uberblock_sync_done() so that the two counts describe the
	 * same set of leaves and can be compared.
	 */
	if (vd->vdev_top->vdev_ms_array != 0)
		(*issued_writes)++;

	abd_t *ub_abd = abd_alloc_for_io(VDEV_UBERBLOCK_SIZE(vd), B_TRUE);
	abd_copy_from_buf(ub_abd, ub, sizeof (uberblock_t));
	abd_zero_off(ub_abd, sizeof (uberblock_t),
	    VDEV_UBERBLOCK_SIZE(vd) - sizeof (uberblock_t));

	vdev_label_write(zio, vd, 0, ub_abd,
	    VDEV_UBERBLOCK_OFFSET(vd, VDEV_UBERBLOCK_COUNT(vd) -
	    MMP_BLOCKS_PER_LABEL), VDEV_UBERBLOCK_SIZE(vd),
	    mmp_claim_uberblock_sync_done, good_writes,
	    flags | ZIO_FLAG_DONT_PROPAGATE);

	abd_free(ub_abd);
}

int
mmp_claim_uberblock(spa_t *spa, vdev_t *vd, uberblock_t *ub)
{
	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL;
	uint64_t good_writes = 0;
	uint64_t issued_writes = 0;
	uint64_t req_writes = 0;
	zio_t *zio;

	ASSERT(MMP_VALID(ub));
	ASSERT(MMP_SEQ_VALID(ub));

	spa_config_enter(spa, SCL_ALL, mmp_tag, RW_WRITER);

	/* Sync the uberblock to all writeable leaves */
	zio = zio_root(spa, NULL, NULL, flags);
	mmp_claim_uberblock_sync(zio, &good_writes, &issued_writes, &req_writes,
	    ub, vd, flags);
	(void) zio_wait(zio);

	/* Flush the new uberblocks so they're immediately visible */
	zio = zio_root(spa, NULL, NULL, flags);
	zio_flush(zio, vd);
	(void) zio_wait(zio);

	spa_config_exit(spa, SCL_ALL, mmp_tag);

	zfs_dbgmsg("mmp: claiming uberblock, spa=%s txg=%llu seq=%llu "
	    "req_writes=%llu issued_writes=%llu good_writes=%llu",
	    spa_load_name(spa),
	    (u_longlong_t)ub->ub_txg, (u_longlong_t)MMP_SEQ(ub),
	    (u_longlong_t)req_writes, (u_longlong_t)issued_writes,
	    (u_longlong_t)good_writes);

	/*
	 * To guarantee visibility from a remote host we require a minimum
	 * number of good writes. For raidz/draid vdevs parity+1 writes, for
	 * mirrors one write per leg the config expects present, and for
	 * singletons 1 write.
	 *
	 * Distinguish the two ways of falling short.  Too few writes issued
	 * means a device the config expects present could not be written at
	 * all, which persists across retries and is what 'zhack mmp reclaim'
	 * recovers.  Enough issued but too few good means the writes reached
	 * present devices and failed, which a retry may clear.
	 */
	if (req_writes == 0)
		return (SET_ERROR(EIO));

	if (issued_writes < req_writes)
		return (SET_ERROR(ENODEV));

	if (good_writes < req_writes)
		return (SET_ERROR(EIO));

	return (0);
}

static __attribute__((noreturn)) void
mmp_thread(void *arg)
{
	spa_t *spa = (spa_t *)arg;
	mmp_thread_t *mmp = &spa->spa_mmp;
	boolean_t suspended = spa_suspended(spa);
	boolean_t multihost = spa_multihost(spa);
	uint64_t mmp_interval = MSEC2NSEC(MMP_INTERVAL_OK(
	    zfs_multihost_interval));
	uint32_t mmp_fail_intervals = MMP_FAIL_INTVS_OK(
	    zfs_multihost_fail_intervals);
	hrtime_t mmp_fail_ns = mmp_fail_intervals * mmp_interval;
	boolean_t last_spa_suspended;
	boolean_t last_spa_multihost;
	uint64_t last_mmp_interval;
	uint32_t last_mmp_fail_intervals;
	hrtime_t last_mmp_fail_ns;
	callb_cpr_t cpr;
	int skip_wait = 0;

	mmp_thread_enter(mmp, &cpr);

	/*
	 * There have been no MMP writes yet.  Setting mmp_last_write here gives
	 * us one mmp_fail_ns period, which is consistent with the activity
	 * check duration, to try to land an MMP write before MMP suspends the
	 * pool (if so configured).
	 */

	mutex_enter(&mmp->mmp_io_lock);
	mmp->mmp_last_write = gethrtime();
	mmp->mmp_delay = MSEC2NSEC(MMP_INTERVAL_OK(zfs_multihost_interval));
	mutex_exit(&mmp->mmp_io_lock);

	while (!mmp->mmp_thread_exiting) {
		hrtime_t next_time = gethrtime() +
		    MSEC2NSEC(MMP_DEFAULT_INTERVAL);
		int leaves = MAX(vdev_count_leaves(spa), 1);

		/* Detect changes in tunables or state */

		last_spa_suspended = suspended;
		last_spa_multihost = multihost;
		suspended = spa_suspended(spa);
		multihost = spa_multihost(spa);

		last_mmp_interval = mmp_interval;
		last_mmp_fail_intervals = mmp_fail_intervals;
		last_mmp_fail_ns = mmp_fail_ns;
		mmp_interval = MSEC2NSEC(MMP_INTERVAL_OK(
		    zfs_multihost_interval));
		mmp_fail_intervals = MMP_FAIL_INTVS_OK(
		    zfs_multihost_fail_intervals);

		/* Smooth so pool is not suspended when reducing tunables */
		if (mmp_fail_intervals * mmp_interval < mmp_fail_ns) {
			mmp_fail_ns = (mmp_fail_ns * 31 +
			    mmp_fail_intervals * mmp_interval) / 32;
		} else {
			mmp_fail_ns = mmp_fail_intervals *
			    mmp_interval;
		}

		if (mmp_interval != last_mmp_interval ||
		    mmp_fail_intervals != last_mmp_fail_intervals) {
			/*
			 * We want other hosts to see new tunables as quickly as
			 * possible.  Write out at higher frequency than usual.
			 */
			skip_wait += leaves;
		}

		if (multihost)
			next_time = gethrtime() + mmp_interval / leaves;

		if (mmp_fail_ns != last_mmp_fail_ns) {
			zfs_dbgmsg("mmp: interval change, spa=%s "
			    "gethrtime=%llu last_mmp_interval=%llu "
			    "mmp_interval=%llu last_mmp_fail_intervals=%u "
			    "mmp_fail_intervals=%u mmp_fail_ns=%llu "
			    "skip_wait=%d leaves=%d next_time=%llu",
			    spa_name(spa), (u_longlong_t)gethrtime(),
			    (u_longlong_t)last_mmp_interval,
			    (u_longlong_t)mmp_interval, last_mmp_fail_intervals,
			    mmp_fail_intervals, (u_longlong_t)mmp_fail_ns,
			    skip_wait, leaves, (u_longlong_t)next_time);
		}

		/*
		 * MMP off => on, or suspended => !suspended:
		 * No writes occurred recently.  Update mmp_last_write to give
		 * us some time to try.
		 */
		if ((!last_spa_multihost && multihost) ||
		    (last_spa_suspended && !suspended)) {
			zfs_dbgmsg("mmp: state change spa=%s: gethrtime=%llu "
			    "last_spa_multihost=%u multihost=%u "
			    "last_spa_suspended=%u suspended=%u",
			    spa_name(spa), (u_longlong_t)gethrtime(),
			    last_spa_multihost, multihost, last_spa_suspended,
			    suspended);
			mutex_enter(&mmp->mmp_io_lock);
			mmp->mmp_last_write = gethrtime();
			mmp->mmp_delay = mmp_interval;
			mutex_exit(&mmp->mmp_io_lock);
		}

		/*
		 * MMP on => off:
		 * mmp_delay == 0 tells importing node to skip activity check.
		 */
		if (last_spa_multihost && !multihost) {
			mutex_enter(&mmp->mmp_io_lock);
			mmp->mmp_delay = 0;
			mutex_exit(&mmp->mmp_io_lock);
		}

		/*
		 * Suspend the pool if no MMP write has succeeded in over
		 * mmp_interval * mmp_fail_intervals nanoseconds.
		 */
		if (multihost && !suspended && mmp_fail_intervals &&
		    (gethrtime() - mmp->mmp_last_write) > mmp_fail_ns) {
			zfs_dbgmsg("mmp: suspending pool, spa=%s "
			    "gethrtime=%llu mmp_last_write=%llu "
			    "mmp_interval=%llu mmp_fail_intervals=%llu "
			    "mmp_fail_ns=%llu txg=%llu",
			    spa_name(spa), (u_longlong_t)gethrtime(),
			    (u_longlong_t)mmp->mmp_last_write,
			    (u_longlong_t)mmp_interval,
			    (u_longlong_t)mmp_fail_intervals,
			    (u_longlong_t)mmp_fail_ns,
			    (u_longlong_t)spa->spa_uberblock.ub_txg);
			cmn_err(CE_WARN, "MMP writes to pool '%s' have not "
			    "succeeded in over %llu ms; suspending pool. "
			    "Hrtime %llu",
			    spa_name(spa),
			    NSEC2MSEC(gethrtime() - mmp->mmp_last_write),
			    gethrtime());
			zio_suspend(spa, NULL, ZIO_SUSPEND_MMP);
		}

		if (multihost && !suspended)
			mmp_write_uberblock(spa);

		if (skip_wait > 0) {
			next_time = gethrtime() + MSEC2NSEC(MMP_MIN_INTERVAL) /
			    leaves;
			skip_wait--;
		}

		CALLB_CPR_SAFE_BEGIN(&cpr);
		(void) cv_timedwait_idle_hires(&mmp->mmp_thread_cv,
		    &mmp->mmp_thread_lock, next_time, USEC2NSEC(100),
		    CALLOUT_FLAG_ABSOLUTE);
		CALLB_CPR_SAFE_END(&cpr, &mmp->mmp_thread_lock);
	}

	/* Outstanding writes are allowed to complete. */
	zio_wait(mmp->mmp_zio_root);

	mmp->mmp_zio_root = NULL;
	mmp_thread_exit(mmp, &mmp->mmp_thread, &cpr);

	thread_exit();
}

/*
 * Signal the MMP thread to wake it, when it is sleeping on
 * its cv.  Used when some module parameter has changed and
 * we want the thread to know about it.
 * Only signal if the pool is active and mmp thread is
 * running, otherwise there is no thread to wake.
 */
static void
mmp_signal_thread(spa_t *spa)
{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_enter(&mmp->mmp_thread_lock);
	if (mmp->mmp_thread)
		cv_broadcast(&mmp->mmp_thread_cv);
	mutex_exit(&mmp->mmp_thread_lock);
}

void
mmp_signal_all_threads(void)
{
	spa_t *spa = NULL;

	spa_namespace_enter(FTAG);
	while ((spa = spa_next(spa))) {
		if (spa->spa_state == POOL_STATE_ACTIVE)
			mmp_signal_thread(spa);
	}
	spa_namespace_exit(FTAG);
}

ZFS_MODULE_PARAM_CALL(zfs_multihost, zfs_multihost_, interval,
	param_set_multihost_interval, spl_param_get_u64, ZMOD_RW,
	"Milliseconds between mmp writes to each leaf");

ZFS_MODULE_PARAM(zfs_multihost, zfs_multihost_, fail_intervals, UINT, ZMOD_RW,
	"Max allowed period without a successful mmp write");

ZFS_MODULE_PARAM(zfs_multihost, zfs_multihost_, import_intervals, UINT, ZMOD_RW,
	"Number of zfs_multihost_interval periods to wait for activity");