xref: /titanic_41/usr/src/uts/common/fs/zfs/dsl_dataset.c (revision c3f177eadfdb30c8441fe9e19b825793f30c7272)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/dmu_objset.h>
27 #include <sys/dsl_dataset.h>
28 #include <sys/dsl_dir.h>
29 #include <sys/dsl_prop.h>
30 #include <sys/dsl_synctask.h>
31 #include <sys/dmu_traverse.h>
32 #include <sys/dmu_tx.h>
33 #include <sys/arc.h>
34 #include <sys/zio.h>
35 #include <sys/zap.h>
36 #include <sys/unique.h>
37 #include <sys/zfs_context.h>
38 #include <sys/zfs_ioctl.h>
39 #include <sys/spa.h>
40 #include <sys/zfs_znode.h>
41 #include <sys/zvol.h>
42 
43 static char *dsl_reaper = "the grim reaper";
44 
45 static dsl_checkfunc_t dsl_dataset_destroy_begin_check;
46 static dsl_syncfunc_t dsl_dataset_destroy_begin_sync;
47 static dsl_syncfunc_t dsl_dataset_set_reservation_sync;
48 
49 #define	DS_REF_MAX	(1ULL << 62)
50 
51 #define	DSL_DEADLIST_BLOCKSIZE	SPA_MAXBLOCKSIZE
52 
53 #define	DSL_DATASET_IS_DESTROYED(ds)	((ds)->ds_owner == dsl_reaper)
54 
55 
56 /*
57  * Figure out how much of this delta should be propogated to the dsl_dir
58  * layer.  If there's a refreservation, that space has already been
59  * partially accounted for in our ancestors.
60  */
61 static int64_t
62 parent_delta(dsl_dataset_t *ds, int64_t delta)
63 {
64 	uint64_t old_bytes, new_bytes;
65 
66 	if (ds->ds_reserved == 0)
67 		return (delta);
68 
69 	old_bytes = MAX(ds->ds_phys->ds_unique_bytes, ds->ds_reserved);
70 	new_bytes = MAX(ds->ds_phys->ds_unique_bytes + delta, ds->ds_reserved);
71 
72 	ASSERT3U(ABS((int64_t)(new_bytes - old_bytes)), <=, ABS(delta));
73 	return (new_bytes - old_bytes);
74 }
75 
76 void
77 dsl_dataset_block_born(dsl_dataset_t *ds, const blkptr_t *bp, dmu_tx_t *tx)
78 {
79 	int used = bp_get_dsize_sync(tx->tx_pool->dp_spa, bp);
80 	int compressed = BP_GET_PSIZE(bp);
81 	int uncompressed = BP_GET_UCSIZE(bp);
82 	int64_t delta;
83 
84 	dprintf_bp(bp, "born, ds=%p\n", ds);
85 
86 	ASSERT(dmu_tx_is_syncing(tx));
87 	/* It could have been compressed away to nothing */
88 	if (BP_IS_HOLE(bp))
89 		return;
90 	ASSERT(BP_GET_TYPE(bp) != DMU_OT_NONE);
91 	ASSERT3U(BP_GET_TYPE(bp), <, DMU_OT_NUMTYPES);
92 	if (ds == NULL) {
93 		/*
94 		 * Account for the meta-objset space in its placeholder
95 		 * dsl_dir.
96 		 */
97 		ASSERT3U(compressed, ==, uncompressed); /* it's all metadata */
98 		dsl_dir_diduse_space(tx->tx_pool->dp_mos_dir, DD_USED_HEAD,
99 		    used, compressed, uncompressed, tx);
100 		dsl_dir_dirty(tx->tx_pool->dp_mos_dir, tx);
101 		return;
102 	}
103 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
104 	mutex_enter(&ds->ds_dir->dd_lock);
105 	mutex_enter(&ds->ds_lock);
106 	delta = parent_delta(ds, used);
107 	ds->ds_phys->ds_used_bytes += used;
108 	ds->ds_phys->ds_compressed_bytes += compressed;
109 	ds->ds_phys->ds_uncompressed_bytes += uncompressed;
110 	ds->ds_phys->ds_unique_bytes += used;
111 	mutex_exit(&ds->ds_lock);
112 	dsl_dir_diduse_space(ds->ds_dir, DD_USED_HEAD, delta,
113 	    compressed, uncompressed, tx);
114 	dsl_dir_transfer_space(ds->ds_dir, used - delta,
115 	    DD_USED_REFRSRV, DD_USED_HEAD, tx);
116 	mutex_exit(&ds->ds_dir->dd_lock);
117 }
118 
119 int
120 dsl_dataset_block_kill(dsl_dataset_t *ds, const blkptr_t *bp, dmu_tx_t *tx,
121     boolean_t async)
122 {
123 	if (BP_IS_HOLE(bp))
124 		return (0);
125 
126 	ASSERT(dmu_tx_is_syncing(tx));
127 	ASSERT(bp->blk_birth <= tx->tx_txg);
128 
129 	int used = bp_get_dsize_sync(tx->tx_pool->dp_spa, bp);
130 	int compressed = BP_GET_PSIZE(bp);
131 	int uncompressed = BP_GET_UCSIZE(bp);
132 
133 	ASSERT(used > 0);
134 	if (ds == NULL) {
135 		/*
136 		 * Account for the meta-objset space in its placeholder
137 		 * dataset.
138 		 */
139 		dsl_free(tx->tx_pool, tx->tx_txg, bp);
140 
141 		dsl_dir_diduse_space(tx->tx_pool->dp_mos_dir, DD_USED_HEAD,
142 		    -used, -compressed, -uncompressed, tx);
143 		dsl_dir_dirty(tx->tx_pool->dp_mos_dir, tx);
144 		return (used);
145 	}
146 	ASSERT3P(tx->tx_pool, ==, ds->ds_dir->dd_pool);
147 
148 	ASSERT(!dsl_dataset_is_snapshot(ds));
149 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
150 
151 	if (bp->blk_birth > ds->ds_phys->ds_prev_snap_txg) {
152 		int64_t delta;
153 
154 		dprintf_bp(bp, "freeing: %s", "");
155 		dsl_free(tx->tx_pool, tx->tx_txg, bp);
156 
157 		mutex_enter(&ds->ds_dir->dd_lock);
158 		mutex_enter(&ds->ds_lock);
159 		ASSERT(ds->ds_phys->ds_unique_bytes >= used ||
160 		    !DS_UNIQUE_IS_ACCURATE(ds));
161 		delta = parent_delta(ds, -used);
162 		ds->ds_phys->ds_unique_bytes -= used;
163 		mutex_exit(&ds->ds_lock);
164 		dsl_dir_diduse_space(ds->ds_dir, DD_USED_HEAD,
165 		    delta, -compressed, -uncompressed, tx);
166 		dsl_dir_transfer_space(ds->ds_dir, -used - delta,
167 		    DD_USED_REFRSRV, DD_USED_HEAD, tx);
168 		mutex_exit(&ds->ds_dir->dd_lock);
169 	} else {
170 		dprintf_bp(bp, "putting on dead list: %s", "");
171 		if (async) {
172 			/*
173 			 * We are here as part of zio's write done callback,
174 			 * which means we're a zio interrupt thread.  We can't
175 			 * call bplist_enqueue() now because it may block
176 			 * waiting for I/O.  Instead, put bp on the deferred
177 			 * queue and let dsl_pool_sync() finish the job.
178 			 */
179 			bplist_enqueue_deferred(&ds->ds_deadlist, bp);
180 		} else {
181 			VERIFY(0 == bplist_enqueue(&ds->ds_deadlist, bp, tx));
182 		}
183 		ASSERT3U(ds->ds_prev->ds_object, ==,
184 		    ds->ds_phys->ds_prev_snap_obj);
185 		ASSERT(ds->ds_prev->ds_phys->ds_num_children > 0);
186 		/* if (bp->blk_birth > prev prev snap txg) prev unique += bs */
187 		if (ds->ds_prev->ds_phys->ds_next_snap_obj ==
188 		    ds->ds_object && bp->blk_birth >
189 		    ds->ds_prev->ds_phys->ds_prev_snap_txg) {
190 			dmu_buf_will_dirty(ds->ds_prev->ds_dbuf, tx);
191 			mutex_enter(&ds->ds_prev->ds_lock);
192 			ds->ds_prev->ds_phys->ds_unique_bytes += used;
193 			mutex_exit(&ds->ds_prev->ds_lock);
194 		}
195 		if (bp->blk_birth > ds->ds_origin_txg) {
196 			dsl_dir_transfer_space(ds->ds_dir, used,
197 			    DD_USED_HEAD, DD_USED_SNAP, tx);
198 		}
199 	}
200 	mutex_enter(&ds->ds_lock);
201 	ASSERT3U(ds->ds_phys->ds_used_bytes, >=, used);
202 	ds->ds_phys->ds_used_bytes -= used;
203 	ASSERT3U(ds->ds_phys->ds_compressed_bytes, >=, compressed);
204 	ds->ds_phys->ds_compressed_bytes -= compressed;
205 	ASSERT3U(ds->ds_phys->ds_uncompressed_bytes, >=, uncompressed);
206 	ds->ds_phys->ds_uncompressed_bytes -= uncompressed;
207 	mutex_exit(&ds->ds_lock);
208 
209 	return (used);
210 }
211 
212 uint64_t
213 dsl_dataset_prev_snap_txg(dsl_dataset_t *ds)
214 {
215 	uint64_t trysnap = 0;
216 
217 	if (ds == NULL)
218 		return (0);
219 	/*
220 	 * The snapshot creation could fail, but that would cause an
221 	 * incorrect FALSE return, which would only result in an
222 	 * overestimation of the amount of space that an operation would
223 	 * consume, which is OK.
224 	 *
225 	 * There's also a small window where we could miss a pending
226 	 * snapshot, because we could set the sync task in the quiescing
227 	 * phase.  So this should only be used as a guess.
228 	 */
229 	if (ds->ds_trysnap_txg >
230 	    spa_last_synced_txg(ds->ds_dir->dd_pool->dp_spa))
231 		trysnap = ds->ds_trysnap_txg;
232 	return (MAX(ds->ds_phys->ds_prev_snap_txg, trysnap));
233 }
234 
235 boolean_t
236 dsl_dataset_block_freeable(dsl_dataset_t *ds, uint64_t blk_birth)
237 {
238 	return (blk_birth > dsl_dataset_prev_snap_txg(ds));
239 }
240 
241 /* ARGSUSED */
242 static void
243 dsl_dataset_evict(dmu_buf_t *db, void *dsv)
244 {
245 	dsl_dataset_t *ds = dsv;
246 
247 	ASSERT(ds->ds_owner == NULL || DSL_DATASET_IS_DESTROYED(ds));
248 
249 	unique_remove(ds->ds_fsid_guid);
250 
251 	if (ds->ds_objset != NULL)
252 		dmu_objset_evict(ds->ds_objset);
253 
254 	if (ds->ds_prev) {
255 		dsl_dataset_drop_ref(ds->ds_prev, ds);
256 		ds->ds_prev = NULL;
257 	}
258 
259 	bplist_close(&ds->ds_deadlist);
260 	if (ds->ds_dir)
261 		dsl_dir_close(ds->ds_dir, ds);
262 
263 	ASSERT(!list_link_active(&ds->ds_synced_link));
264 
265 	mutex_destroy(&ds->ds_lock);
266 	mutex_destroy(&ds->ds_recvlock);
267 	mutex_destroy(&ds->ds_opening_lock);
268 	rw_destroy(&ds->ds_rwlock);
269 	cv_destroy(&ds->ds_exclusive_cv);
270 	bplist_fini(&ds->ds_deadlist);
271 
272 	kmem_free(ds, sizeof (dsl_dataset_t));
273 }
274 
275 static int
276 dsl_dataset_get_snapname(dsl_dataset_t *ds)
277 {
278 	dsl_dataset_phys_t *headphys;
279 	int err;
280 	dmu_buf_t *headdbuf;
281 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
282 	objset_t *mos = dp->dp_meta_objset;
283 
284 	if (ds->ds_snapname[0])
285 		return (0);
286 	if (ds->ds_phys->ds_next_snap_obj == 0)
287 		return (0);
288 
289 	err = dmu_bonus_hold(mos, ds->ds_dir->dd_phys->dd_head_dataset_obj,
290 	    FTAG, &headdbuf);
291 	if (err)
292 		return (err);
293 	headphys = headdbuf->db_data;
294 	err = zap_value_search(dp->dp_meta_objset,
295 	    headphys->ds_snapnames_zapobj, ds->ds_object, 0, ds->ds_snapname);
296 	dmu_buf_rele(headdbuf, FTAG);
297 	return (err);
298 }
299 
300 static int
301 dsl_dataset_snap_lookup(dsl_dataset_t *ds, const char *name, uint64_t *value)
302 {
303 	objset_t *mos = ds->ds_dir->dd_pool->dp_meta_objset;
304 	uint64_t snapobj = ds->ds_phys->ds_snapnames_zapobj;
305 	matchtype_t mt;
306 	int err;
307 
308 	if (ds->ds_phys->ds_flags & DS_FLAG_CI_DATASET)
309 		mt = MT_FIRST;
310 	else
311 		mt = MT_EXACT;
312 
313 	err = zap_lookup_norm(mos, snapobj, name, 8, 1,
314 	    value, mt, NULL, 0, NULL);
315 	if (err == ENOTSUP && mt == MT_FIRST)
316 		err = zap_lookup(mos, snapobj, name, 8, 1, value);
317 	return (err);
318 }
319 
320 static int
321 dsl_dataset_snap_remove(dsl_dataset_t *ds, char *name, dmu_tx_t *tx)
322 {
323 	objset_t *mos = ds->ds_dir->dd_pool->dp_meta_objset;
324 	uint64_t snapobj = ds->ds_phys->ds_snapnames_zapobj;
325 	matchtype_t mt;
326 	int err;
327 
328 	dsl_dir_snap_cmtime_update(ds->ds_dir);
329 
330 	if (ds->ds_phys->ds_flags & DS_FLAG_CI_DATASET)
331 		mt = MT_FIRST;
332 	else
333 		mt = MT_EXACT;
334 
335 	err = zap_remove_norm(mos, snapobj, name, mt, tx);
336 	if (err == ENOTSUP && mt == MT_FIRST)
337 		err = zap_remove(mos, snapobj, name, tx);
338 	return (err);
339 }
340 
341 static int
342 dsl_dataset_get_ref(dsl_pool_t *dp, uint64_t dsobj, void *tag,
343     dsl_dataset_t **dsp)
344 {
345 	objset_t *mos = dp->dp_meta_objset;
346 	dmu_buf_t *dbuf;
347 	dsl_dataset_t *ds;
348 	int err;
349 
350 	ASSERT(RW_LOCK_HELD(&dp->dp_config_rwlock) ||
351 	    dsl_pool_sync_context(dp));
352 
353 	err = dmu_bonus_hold(mos, dsobj, tag, &dbuf);
354 	if (err)
355 		return (err);
356 	ds = dmu_buf_get_user(dbuf);
357 	if (ds == NULL) {
358 		dsl_dataset_t *winner;
359 
360 		ds = kmem_zalloc(sizeof (dsl_dataset_t), KM_SLEEP);
361 		ds->ds_dbuf = dbuf;
362 		ds->ds_object = dsobj;
363 		ds->ds_phys = dbuf->db_data;
364 
365 		mutex_init(&ds->ds_lock, NULL, MUTEX_DEFAULT, NULL);
366 		mutex_init(&ds->ds_recvlock, NULL, MUTEX_DEFAULT, NULL);
367 		mutex_init(&ds->ds_opening_lock, NULL, MUTEX_DEFAULT, NULL);
368 		rw_init(&ds->ds_rwlock, 0, 0, 0);
369 		cv_init(&ds->ds_exclusive_cv, NULL, CV_DEFAULT, NULL);
370 		bplist_init(&ds->ds_deadlist);
371 
372 		err = bplist_open(&ds->ds_deadlist,
373 		    mos, ds->ds_phys->ds_deadlist_obj);
374 		if (err == 0) {
375 			err = dsl_dir_open_obj(dp,
376 			    ds->ds_phys->ds_dir_obj, NULL, ds, &ds->ds_dir);
377 		}
378 		if (err) {
379 			/*
380 			 * we don't really need to close the blist if we
381 			 * just opened it.
382 			 */
383 			mutex_destroy(&ds->ds_lock);
384 			mutex_destroy(&ds->ds_recvlock);
385 			mutex_destroy(&ds->ds_opening_lock);
386 			rw_destroy(&ds->ds_rwlock);
387 			cv_destroy(&ds->ds_exclusive_cv);
388 			bplist_fini(&ds->ds_deadlist);
389 			kmem_free(ds, sizeof (dsl_dataset_t));
390 			dmu_buf_rele(dbuf, tag);
391 			return (err);
392 		}
393 
394 		if (!dsl_dataset_is_snapshot(ds)) {
395 			ds->ds_snapname[0] = '\0';
396 			if (ds->ds_phys->ds_prev_snap_obj) {
397 				err = dsl_dataset_get_ref(dp,
398 				    ds->ds_phys->ds_prev_snap_obj,
399 				    ds, &ds->ds_prev);
400 			}
401 
402 			if (err == 0 && dsl_dir_is_clone(ds->ds_dir)) {
403 				dsl_dataset_t *origin;
404 
405 				err = dsl_dataset_hold_obj(dp,
406 				    ds->ds_dir->dd_phys->dd_origin_obj,
407 				    FTAG, &origin);
408 				if (err == 0) {
409 					ds->ds_origin_txg =
410 					    origin->ds_phys->ds_creation_txg;
411 					dsl_dataset_rele(origin, FTAG);
412 				}
413 			}
414 		} else {
415 			if (zfs_flags & ZFS_DEBUG_SNAPNAMES)
416 				err = dsl_dataset_get_snapname(ds);
417 			if (err == 0 && ds->ds_phys->ds_userrefs_obj != 0) {
418 				err = zap_count(
419 				    ds->ds_dir->dd_pool->dp_meta_objset,
420 				    ds->ds_phys->ds_userrefs_obj,
421 				    &ds->ds_userrefs);
422 			}
423 		}
424 
425 		if (err == 0 && !dsl_dataset_is_snapshot(ds)) {
426 			/*
427 			 * In sync context, we're called with either no lock
428 			 * or with the write lock.  If we're not syncing,
429 			 * we're always called with the read lock held.
430 			 */
431 			boolean_t need_lock =
432 			    !RW_WRITE_HELD(&dp->dp_config_rwlock) &&
433 			    dsl_pool_sync_context(dp);
434 
435 			if (need_lock)
436 				rw_enter(&dp->dp_config_rwlock, RW_READER);
437 
438 			err = dsl_prop_get_ds(ds,
439 			    "refreservation", sizeof (uint64_t), 1,
440 			    &ds->ds_reserved, NULL);
441 			if (err == 0) {
442 				err = dsl_prop_get_ds(ds,
443 				    "refquota", sizeof (uint64_t), 1,
444 				    &ds->ds_quota, NULL);
445 			}
446 
447 			if (need_lock)
448 				rw_exit(&dp->dp_config_rwlock);
449 		} else {
450 			ds->ds_reserved = ds->ds_quota = 0;
451 		}
452 
453 		if (err == 0) {
454 			winner = dmu_buf_set_user_ie(dbuf, ds, &ds->ds_phys,
455 			    dsl_dataset_evict);
456 		}
457 		if (err || winner) {
458 			bplist_close(&ds->ds_deadlist);
459 			if (ds->ds_prev)
460 				dsl_dataset_drop_ref(ds->ds_prev, ds);
461 			dsl_dir_close(ds->ds_dir, ds);
462 			mutex_destroy(&ds->ds_lock);
463 			mutex_destroy(&ds->ds_recvlock);
464 			mutex_destroy(&ds->ds_opening_lock);
465 			rw_destroy(&ds->ds_rwlock);
466 			cv_destroy(&ds->ds_exclusive_cv);
467 			bplist_fini(&ds->ds_deadlist);
468 			kmem_free(ds, sizeof (dsl_dataset_t));
469 			if (err) {
470 				dmu_buf_rele(dbuf, tag);
471 				return (err);
472 			}
473 			ds = winner;
474 		} else {
475 			ds->ds_fsid_guid =
476 			    unique_insert(ds->ds_phys->ds_fsid_guid);
477 		}
478 	}
479 	ASSERT3P(ds->ds_dbuf, ==, dbuf);
480 	ASSERT3P(ds->ds_phys, ==, dbuf->db_data);
481 	ASSERT(ds->ds_phys->ds_prev_snap_obj != 0 ||
482 	    spa_version(dp->dp_spa) < SPA_VERSION_ORIGIN ||
483 	    dp->dp_origin_snap == NULL || ds == dp->dp_origin_snap);
484 	mutex_enter(&ds->ds_lock);
485 	if (!dsl_pool_sync_context(dp) && DSL_DATASET_IS_DESTROYED(ds)) {
486 		mutex_exit(&ds->ds_lock);
487 		dmu_buf_rele(ds->ds_dbuf, tag);
488 		return (ENOENT);
489 	}
490 	mutex_exit(&ds->ds_lock);
491 	*dsp = ds;
492 	return (0);
493 }
494 
495 static int
496 dsl_dataset_hold_ref(dsl_dataset_t *ds, void *tag)
497 {
498 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
499 
500 	/*
501 	 * In syncing context we don't want the rwlock lock: there
502 	 * may be an existing writer waiting for sync phase to
503 	 * finish.  We don't need to worry about such writers, since
504 	 * sync phase is single-threaded, so the writer can't be
505 	 * doing anything while we are active.
506 	 */
507 	if (dsl_pool_sync_context(dp)) {
508 		ASSERT(!DSL_DATASET_IS_DESTROYED(ds));
509 		return (0);
510 	}
511 
512 	/*
513 	 * Normal users will hold the ds_rwlock as a READER until they
514 	 * are finished (i.e., call dsl_dataset_rele()).  "Owners" will
515 	 * drop their READER lock after they set the ds_owner field.
516 	 *
517 	 * If the dataset is being destroyed, the destroy thread will
518 	 * obtain a WRITER lock for exclusive access after it's done its
519 	 * open-context work and then change the ds_owner to
520 	 * dsl_reaper once destruction is assured.  So threads
521 	 * may block here temporarily, until the "destructability" of
522 	 * the dataset is determined.
523 	 */
524 	ASSERT(!RW_WRITE_HELD(&dp->dp_config_rwlock));
525 	mutex_enter(&ds->ds_lock);
526 	while (!rw_tryenter(&ds->ds_rwlock, RW_READER)) {
527 		rw_exit(&dp->dp_config_rwlock);
528 		cv_wait(&ds->ds_exclusive_cv, &ds->ds_lock);
529 		if (DSL_DATASET_IS_DESTROYED(ds)) {
530 			mutex_exit(&ds->ds_lock);
531 			dsl_dataset_drop_ref(ds, tag);
532 			rw_enter(&dp->dp_config_rwlock, RW_READER);
533 			return (ENOENT);
534 		}
535 		rw_enter(&dp->dp_config_rwlock, RW_READER);
536 	}
537 	mutex_exit(&ds->ds_lock);
538 	return (0);
539 }
540 
541 int
542 dsl_dataset_hold_obj(dsl_pool_t *dp, uint64_t dsobj, void *tag,
543     dsl_dataset_t **dsp)
544 {
545 	int err = dsl_dataset_get_ref(dp, dsobj, tag, dsp);
546 
547 	if (err)
548 		return (err);
549 	return (dsl_dataset_hold_ref(*dsp, tag));
550 }
551 
552 int
553 dsl_dataset_own_obj(dsl_pool_t *dp, uint64_t dsobj, boolean_t inconsistentok,
554     void *tag, dsl_dataset_t **dsp)
555 {
556 	int err = dsl_dataset_hold_obj(dp, dsobj, tag, dsp);
557 	if (err)
558 		return (err);
559 	if (!dsl_dataset_tryown(*dsp, inconsistentok, tag)) {
560 		dsl_dataset_rele(*dsp, tag);
561 		*dsp = NULL;
562 		return (EBUSY);
563 	}
564 	return (0);
565 }
566 
567 int
568 dsl_dataset_hold(const char *name, void *tag, dsl_dataset_t **dsp)
569 {
570 	dsl_dir_t *dd;
571 	dsl_pool_t *dp;
572 	const char *snapname;
573 	uint64_t obj;
574 	int err = 0;
575 
576 	err = dsl_dir_open_spa(NULL, name, FTAG, &dd, &snapname);
577 	if (err)
578 		return (err);
579 
580 	dp = dd->dd_pool;
581 	obj = dd->dd_phys->dd_head_dataset_obj;
582 	rw_enter(&dp->dp_config_rwlock, RW_READER);
583 	if (obj)
584 		err = dsl_dataset_get_ref(dp, obj, tag, dsp);
585 	else
586 		err = ENOENT;
587 	if (err)
588 		goto out;
589 
590 	err = dsl_dataset_hold_ref(*dsp, tag);
591 
592 	/* we may be looking for a snapshot */
593 	if (err == 0 && snapname != NULL) {
594 		dsl_dataset_t *ds = NULL;
595 
596 		if (*snapname++ != '@') {
597 			dsl_dataset_rele(*dsp, tag);
598 			err = ENOENT;
599 			goto out;
600 		}
601 
602 		dprintf("looking for snapshot '%s'\n", snapname);
603 		err = dsl_dataset_snap_lookup(*dsp, snapname, &obj);
604 		if (err == 0)
605 			err = dsl_dataset_get_ref(dp, obj, tag, &ds);
606 		dsl_dataset_rele(*dsp, tag);
607 
608 		ASSERT3U((err == 0), ==, (ds != NULL));
609 
610 		if (ds) {
611 			mutex_enter(&ds->ds_lock);
612 			if (ds->ds_snapname[0] == 0)
613 				(void) strlcpy(ds->ds_snapname, snapname,
614 				    sizeof (ds->ds_snapname));
615 			mutex_exit(&ds->ds_lock);
616 			err = dsl_dataset_hold_ref(ds, tag);
617 			*dsp = err ? NULL : ds;
618 		}
619 	}
620 out:
621 	rw_exit(&dp->dp_config_rwlock);
622 	dsl_dir_close(dd, FTAG);
623 	return (err);
624 }
625 
626 int
627 dsl_dataset_own(const char *name, boolean_t inconsistentok,
628     void *tag, dsl_dataset_t **dsp)
629 {
630 	int err = dsl_dataset_hold(name, tag, dsp);
631 	if (err)
632 		return (err);
633 	if (!dsl_dataset_tryown(*dsp, inconsistentok, tag)) {
634 		dsl_dataset_rele(*dsp, tag);
635 		return (EBUSY);
636 	}
637 	return (0);
638 }
639 
640 void
641 dsl_dataset_name(dsl_dataset_t *ds, char *name)
642 {
643 	if (ds == NULL) {
644 		(void) strcpy(name, "mos");
645 	} else {
646 		dsl_dir_name(ds->ds_dir, name);
647 		VERIFY(0 == dsl_dataset_get_snapname(ds));
648 		if (ds->ds_snapname[0]) {
649 			(void) strcat(name, "@");
650 			/*
651 			 * We use a "recursive" mutex so that we
652 			 * can call dprintf_ds() with ds_lock held.
653 			 */
654 			if (!MUTEX_HELD(&ds->ds_lock)) {
655 				mutex_enter(&ds->ds_lock);
656 				(void) strcat(name, ds->ds_snapname);
657 				mutex_exit(&ds->ds_lock);
658 			} else {
659 				(void) strcat(name, ds->ds_snapname);
660 			}
661 		}
662 	}
663 }
664 
665 static int
666 dsl_dataset_namelen(dsl_dataset_t *ds)
667 {
668 	int result;
669 
670 	if (ds == NULL) {
671 		result = 3;	/* "mos" */
672 	} else {
673 		result = dsl_dir_namelen(ds->ds_dir);
674 		VERIFY(0 == dsl_dataset_get_snapname(ds));
675 		if (ds->ds_snapname[0]) {
676 			++result;	/* adding one for the @-sign */
677 			if (!MUTEX_HELD(&ds->ds_lock)) {
678 				mutex_enter(&ds->ds_lock);
679 				result += strlen(ds->ds_snapname);
680 				mutex_exit(&ds->ds_lock);
681 			} else {
682 				result += strlen(ds->ds_snapname);
683 			}
684 		}
685 	}
686 
687 	return (result);
688 }
689 
690 void
691 dsl_dataset_drop_ref(dsl_dataset_t *ds, void *tag)
692 {
693 	dmu_buf_rele(ds->ds_dbuf, tag);
694 }
695 
696 void
697 dsl_dataset_rele(dsl_dataset_t *ds, void *tag)
698 {
699 	if (!dsl_pool_sync_context(ds->ds_dir->dd_pool)) {
700 		rw_exit(&ds->ds_rwlock);
701 	}
702 	dsl_dataset_drop_ref(ds, tag);
703 }
704 
705 void
706 dsl_dataset_disown(dsl_dataset_t *ds, void *tag)
707 {
708 	ASSERT((ds->ds_owner == tag && ds->ds_dbuf) ||
709 	    (DSL_DATASET_IS_DESTROYED(ds) && ds->ds_dbuf == NULL));
710 
711 	mutex_enter(&ds->ds_lock);
712 	ds->ds_owner = NULL;
713 	if (RW_WRITE_HELD(&ds->ds_rwlock)) {
714 		rw_exit(&ds->ds_rwlock);
715 		cv_broadcast(&ds->ds_exclusive_cv);
716 	}
717 	mutex_exit(&ds->ds_lock);
718 	if (ds->ds_dbuf)
719 		dsl_dataset_drop_ref(ds, tag);
720 	else
721 		dsl_dataset_evict(ds->ds_dbuf, ds);
722 }
723 
724 boolean_t
725 dsl_dataset_tryown(dsl_dataset_t *ds, boolean_t inconsistentok, void *tag)
726 {
727 	boolean_t gotit = FALSE;
728 
729 	mutex_enter(&ds->ds_lock);
730 	if (ds->ds_owner == NULL &&
731 	    (!DS_IS_INCONSISTENT(ds) || inconsistentok)) {
732 		ds->ds_owner = tag;
733 		if (!dsl_pool_sync_context(ds->ds_dir->dd_pool))
734 			rw_exit(&ds->ds_rwlock);
735 		gotit = TRUE;
736 	}
737 	mutex_exit(&ds->ds_lock);
738 	return (gotit);
739 }
740 
741 void
742 dsl_dataset_make_exclusive(dsl_dataset_t *ds, void *owner)
743 {
744 	ASSERT3P(owner, ==, ds->ds_owner);
745 	if (!RW_WRITE_HELD(&ds->ds_rwlock))
746 		rw_enter(&ds->ds_rwlock, RW_WRITER);
747 }
748 
749 uint64_t
750 dsl_dataset_create_sync_dd(dsl_dir_t *dd, dsl_dataset_t *origin,
751     uint64_t flags, dmu_tx_t *tx)
752 {
753 	dsl_pool_t *dp = dd->dd_pool;
754 	dmu_buf_t *dbuf;
755 	dsl_dataset_phys_t *dsphys;
756 	uint64_t dsobj;
757 	objset_t *mos = dp->dp_meta_objset;
758 
759 	if (origin == NULL)
760 		origin = dp->dp_origin_snap;
761 
762 	ASSERT(origin == NULL || origin->ds_dir->dd_pool == dp);
763 	ASSERT(origin == NULL || origin->ds_phys->ds_num_children > 0);
764 	ASSERT(dmu_tx_is_syncing(tx));
765 	ASSERT(dd->dd_phys->dd_head_dataset_obj == 0);
766 
767 	dsobj = dmu_object_alloc(mos, DMU_OT_DSL_DATASET, 0,
768 	    DMU_OT_DSL_DATASET, sizeof (dsl_dataset_phys_t), tx);
769 	VERIFY(0 == dmu_bonus_hold(mos, dsobj, FTAG, &dbuf));
770 	dmu_buf_will_dirty(dbuf, tx);
771 	dsphys = dbuf->db_data;
772 	bzero(dsphys, sizeof (dsl_dataset_phys_t));
773 	dsphys->ds_dir_obj = dd->dd_object;
774 	dsphys->ds_flags = flags;
775 	dsphys->ds_fsid_guid = unique_create();
776 	(void) random_get_pseudo_bytes((void*)&dsphys->ds_guid,
777 	    sizeof (dsphys->ds_guid));
778 	dsphys->ds_snapnames_zapobj =
779 	    zap_create_norm(mos, U8_TEXTPREP_TOUPPER, DMU_OT_DSL_DS_SNAP_MAP,
780 	    DMU_OT_NONE, 0, tx);
781 	dsphys->ds_creation_time = gethrestime_sec();
782 	dsphys->ds_creation_txg = tx->tx_txg == TXG_INITIAL ? 1 : tx->tx_txg;
783 	dsphys->ds_deadlist_obj =
784 	    bplist_create(mos, DSL_DEADLIST_BLOCKSIZE, tx);
785 
786 	if (origin) {
787 		dsphys->ds_prev_snap_obj = origin->ds_object;
788 		dsphys->ds_prev_snap_txg =
789 		    origin->ds_phys->ds_creation_txg;
790 		dsphys->ds_used_bytes =
791 		    origin->ds_phys->ds_used_bytes;
792 		dsphys->ds_compressed_bytes =
793 		    origin->ds_phys->ds_compressed_bytes;
794 		dsphys->ds_uncompressed_bytes =
795 		    origin->ds_phys->ds_uncompressed_bytes;
796 		dsphys->ds_bp = origin->ds_phys->ds_bp;
797 		dsphys->ds_flags |= origin->ds_phys->ds_flags;
798 
799 		dmu_buf_will_dirty(origin->ds_dbuf, tx);
800 		origin->ds_phys->ds_num_children++;
801 
802 		if (spa_version(dp->dp_spa) >= SPA_VERSION_NEXT_CLONES) {
803 			if (origin->ds_phys->ds_next_clones_obj == 0) {
804 				origin->ds_phys->ds_next_clones_obj =
805 				    zap_create(mos,
806 				    DMU_OT_NEXT_CLONES, DMU_OT_NONE, 0, tx);
807 			}
808 			VERIFY(0 == zap_add_int(mos,
809 			    origin->ds_phys->ds_next_clones_obj,
810 			    dsobj, tx));
811 		}
812 
813 		dmu_buf_will_dirty(dd->dd_dbuf, tx);
814 		dd->dd_phys->dd_origin_obj = origin->ds_object;
815 	}
816 
817 	if (spa_version(dp->dp_spa) >= SPA_VERSION_UNIQUE_ACCURATE)
818 		dsphys->ds_flags |= DS_FLAG_UNIQUE_ACCURATE;
819 
820 	dmu_buf_rele(dbuf, FTAG);
821 
822 	dmu_buf_will_dirty(dd->dd_dbuf, tx);
823 	dd->dd_phys->dd_head_dataset_obj = dsobj;
824 
825 	return (dsobj);
826 }
827 
828 uint64_t
829 dsl_dataset_create_sync(dsl_dir_t *pdd, const char *lastname,
830     dsl_dataset_t *origin, uint64_t flags, cred_t *cr, dmu_tx_t *tx)
831 {
832 	dsl_pool_t *dp = pdd->dd_pool;
833 	uint64_t dsobj, ddobj;
834 	dsl_dir_t *dd;
835 
836 	ASSERT(lastname[0] != '@');
837 
838 	ddobj = dsl_dir_create_sync(dp, pdd, lastname, tx);
839 	VERIFY(0 == dsl_dir_open_obj(dp, ddobj, lastname, FTAG, &dd));
840 
841 	dsobj = dsl_dataset_create_sync_dd(dd, origin, flags, tx);
842 
843 	dsl_deleg_set_create_perms(dd, tx, cr);
844 
845 	dsl_dir_close(dd, FTAG);
846 
847 	return (dsobj);
848 }
849 
850 struct destroyarg {
851 	dsl_sync_task_group_t *dstg;
852 	char *snapname;
853 	char *failed;
854 	boolean_t defer;
855 };
856 
857 static int
858 dsl_snapshot_destroy_one(char *name, void *arg)
859 {
860 	struct destroyarg *da = arg;
861 	dsl_dataset_t *ds;
862 	int err;
863 	char *dsname;
864 
865 	dsname = kmem_asprintf("%s@%s", name, da->snapname);
866 	err = dsl_dataset_own(dsname, B_TRUE, da->dstg, &ds);
867 	strfree(dsname);
868 	if (err == 0) {
869 		struct dsl_ds_destroyarg *dsda;
870 
871 		dsl_dataset_make_exclusive(ds, da->dstg);
872 		if (ds->ds_objset != NULL) {
873 			dmu_objset_evict(ds->ds_objset);
874 			ds->ds_objset = NULL;
875 		}
876 		dsda = kmem_zalloc(sizeof (struct dsl_ds_destroyarg), KM_SLEEP);
877 		dsda->ds = ds;
878 		dsda->defer = da->defer;
879 		dsl_sync_task_create(da->dstg, dsl_dataset_destroy_check,
880 		    dsl_dataset_destroy_sync, dsda, da->dstg, 0);
881 	} else if (err == ENOENT) {
882 		err = 0;
883 	} else {
884 		(void) strcpy(da->failed, name);
885 	}
886 	return (err);
887 }
888 
889 /*
890  * Destroy 'snapname' in all descendants of 'fsname'.
891  */
892 #pragma weak dmu_snapshots_destroy = dsl_snapshots_destroy
893 int
894 dsl_snapshots_destroy(char *fsname, char *snapname, boolean_t defer)
895 {
896 	int err;
897 	struct destroyarg da;
898 	dsl_sync_task_t *dst;
899 	spa_t *spa;
900 
901 	err = spa_open(fsname, &spa, FTAG);
902 	if (err)
903 		return (err);
904 	da.dstg = dsl_sync_task_group_create(spa_get_dsl(spa));
905 	da.snapname = snapname;
906 	da.failed = fsname;
907 	da.defer = defer;
908 
909 	err = dmu_objset_find(fsname,
910 	    dsl_snapshot_destroy_one, &da, DS_FIND_CHILDREN);
911 
912 	if (err == 0)
913 		err = dsl_sync_task_group_wait(da.dstg);
914 
915 	for (dst = list_head(&da.dstg->dstg_tasks); dst;
916 	    dst = list_next(&da.dstg->dstg_tasks, dst)) {
917 		struct dsl_ds_destroyarg *dsda = dst->dst_arg1;
918 		dsl_dataset_t *ds = dsda->ds;
919 
920 		/*
921 		 * Return the file system name that triggered the error
922 		 */
923 		if (dst->dst_err) {
924 			dsl_dataset_name(ds, fsname);
925 			*strchr(fsname, '@') = '\0';
926 		}
927 		ASSERT3P(dsda->rm_origin, ==, NULL);
928 		dsl_dataset_disown(ds, da.dstg);
929 		kmem_free(dsda, sizeof (struct dsl_ds_destroyarg));
930 	}
931 
932 	dsl_sync_task_group_destroy(da.dstg);
933 	spa_close(spa, FTAG);
934 	return (err);
935 }
936 
937 static boolean_t
938 dsl_dataset_might_destroy_origin(dsl_dataset_t *ds)
939 {
940 	boolean_t might_destroy = B_FALSE;
941 
942 	mutex_enter(&ds->ds_lock);
943 	if (ds->ds_phys->ds_num_children == 2 && ds->ds_userrefs == 0 &&
944 	    DS_IS_DEFER_DESTROY(ds))
945 		might_destroy = B_TRUE;
946 	mutex_exit(&ds->ds_lock);
947 
948 	return (might_destroy);
949 }
950 
951 /*
952  * If we're removing a clone, and these three conditions are true:
953  *	1) the clone's origin has no other children
954  *	2) the clone's origin has no user references
955  *	3) the clone's origin has been marked for deferred destruction
956  * Then, prepare to remove the origin as part of this sync task group.
957  */
958 static int
959 dsl_dataset_origin_rm_prep(struct dsl_ds_destroyarg *dsda, void *tag)
960 {
961 	dsl_dataset_t *ds = dsda->ds;
962 	dsl_dataset_t *origin = ds->ds_prev;
963 
964 	if (dsl_dataset_might_destroy_origin(origin)) {
965 		char *name;
966 		int namelen;
967 		int error;
968 
969 		namelen = dsl_dataset_namelen(origin) + 1;
970 		name = kmem_alloc(namelen, KM_SLEEP);
971 		dsl_dataset_name(origin, name);
972 #ifdef _KERNEL
973 		error = zfs_unmount_snap(name, NULL);
974 		if (error) {
975 			kmem_free(name, namelen);
976 			return (error);
977 		}
978 #endif
979 		error = dsl_dataset_own(name, B_TRUE, tag, &origin);
980 		kmem_free(name, namelen);
981 		if (error)
982 			return (error);
983 		dsda->rm_origin = origin;
984 		dsl_dataset_make_exclusive(origin, tag);
985 
986 		if (origin->ds_objset != NULL) {
987 			dmu_objset_evict(origin->ds_objset);
988 			origin->ds_objset = NULL;
989 		}
990 	}
991 
992 	return (0);
993 }
994 
995 /*
996  * ds must be opened as OWNER.  On return (whether successful or not),
997  * ds will be closed and caller can no longer dereference it.
998  */
999 int
1000 dsl_dataset_destroy(dsl_dataset_t *ds, void *tag, boolean_t defer)
1001 {
1002 	int err;
1003 	dsl_sync_task_group_t *dstg;
1004 	objset_t *os;
1005 	dsl_dir_t *dd;
1006 	uint64_t obj;
1007 	struct dsl_ds_destroyarg dsda = { 0 };
1008 	dsl_dataset_t dummy_ds = { 0 };
1009 
1010 	dsda.ds = ds;
1011 
1012 	if (dsl_dataset_is_snapshot(ds)) {
1013 		/* Destroying a snapshot is simpler */
1014 		dsl_dataset_make_exclusive(ds, tag);
1015 
1016 		if (ds->ds_objset != NULL) {
1017 			dmu_objset_evict(ds->ds_objset);
1018 			ds->ds_objset = NULL;
1019 		}
1020 		dsda.defer = defer;
1021 		err = dsl_sync_task_do(ds->ds_dir->dd_pool,
1022 		    dsl_dataset_destroy_check, dsl_dataset_destroy_sync,
1023 		    &dsda, tag, 0);
1024 		ASSERT3P(dsda.rm_origin, ==, NULL);
1025 		goto out;
1026 	} else if (defer) {
1027 		err = EINVAL;
1028 		goto out;
1029 	}
1030 
1031 	dd = ds->ds_dir;
1032 	dummy_ds.ds_dir = dd;
1033 	dummy_ds.ds_object = ds->ds_object;
1034 
1035 	/*
1036 	 * Check for errors and mark this ds as inconsistent, in
1037 	 * case we crash while freeing the objects.
1038 	 */
1039 	err = dsl_sync_task_do(dd->dd_pool, dsl_dataset_destroy_begin_check,
1040 	    dsl_dataset_destroy_begin_sync, ds, NULL, 0);
1041 	if (err)
1042 		goto out;
1043 
1044 	err = dmu_objset_from_ds(ds, &os);
1045 	if (err)
1046 		goto out;
1047 
1048 	/*
1049 	 * remove the objects in open context, so that we won't
1050 	 * have too much to do in syncing context.
1051 	 */
1052 	for (obj = 0; err == 0; err = dmu_object_next(os, &obj, FALSE,
1053 	    ds->ds_phys->ds_prev_snap_txg)) {
1054 		/*
1055 		 * Ignore errors, if there is not enough disk space
1056 		 * we will deal with it in dsl_dataset_destroy_sync().
1057 		 */
1058 		(void) dmu_free_object(os, obj);
1059 	}
1060 
1061 	/*
1062 	 * We need to sync out all in-flight IO before we try to evict
1063 	 * (the dataset evict func is trying to clear the cached entries
1064 	 * for this dataset in the ARC).
1065 	 */
1066 	txg_wait_synced(dd->dd_pool, 0);
1067 
1068 	/*
1069 	 * If we managed to free all the objects in open
1070 	 * context, the user space accounting should be zero.
1071 	 */
1072 	if (ds->ds_phys->ds_bp.blk_fill == 0 &&
1073 	    dmu_objset_userused_enabled(os)) {
1074 		uint64_t count;
1075 
1076 		ASSERT(zap_count(os, DMU_USERUSED_OBJECT, &count) != 0 ||
1077 		    count == 0);
1078 		ASSERT(zap_count(os, DMU_GROUPUSED_OBJECT, &count) != 0 ||
1079 		    count == 0);
1080 	}
1081 
1082 	if (err != ESRCH)
1083 		goto out;
1084 
1085 	rw_enter(&dd->dd_pool->dp_config_rwlock, RW_READER);
1086 	err = dsl_dir_open_obj(dd->dd_pool, dd->dd_object, NULL, FTAG, &dd);
1087 	rw_exit(&dd->dd_pool->dp_config_rwlock);
1088 
1089 	if (err)
1090 		goto out;
1091 
1092 	if (ds->ds_objset) {
1093 		/*
1094 		 * We need to sync out all in-flight IO before we try
1095 		 * to evict (the dataset evict func is trying to clear
1096 		 * the cached entries for this dataset in the ARC).
1097 		 */
1098 		txg_wait_synced(dd->dd_pool, 0);
1099 	}
1100 
1101 	/*
1102 	 * Blow away the dsl_dir + head dataset.
1103 	 */
1104 	dsl_dataset_make_exclusive(ds, tag);
1105 	if (ds->ds_objset) {
1106 		dmu_objset_evict(ds->ds_objset);
1107 		ds->ds_objset = NULL;
1108 	}
1109 
1110 	/*
1111 	 * If we're removing a clone, we might also need to remove its
1112 	 * origin.
1113 	 */
1114 	do {
1115 		dsda.need_prep = B_FALSE;
1116 		if (dsl_dir_is_clone(dd)) {
1117 			err = dsl_dataset_origin_rm_prep(&dsda, tag);
1118 			if (err) {
1119 				dsl_dir_close(dd, FTAG);
1120 				goto out;
1121 			}
1122 		}
1123 
1124 		dstg = dsl_sync_task_group_create(ds->ds_dir->dd_pool);
1125 		dsl_sync_task_create(dstg, dsl_dataset_destroy_check,
1126 		    dsl_dataset_destroy_sync, &dsda, tag, 0);
1127 		dsl_sync_task_create(dstg, dsl_dir_destroy_check,
1128 		    dsl_dir_destroy_sync, &dummy_ds, FTAG, 0);
1129 		err = dsl_sync_task_group_wait(dstg);
1130 		dsl_sync_task_group_destroy(dstg);
1131 
1132 		/*
1133 		 * We could be racing against 'zfs release' or 'zfs destroy -d'
1134 		 * on the origin snap, in which case we can get EBUSY if we
1135 		 * needed to destroy the origin snap but were not ready to
1136 		 * do so.
1137 		 */
1138 		if (dsda.need_prep) {
1139 			ASSERT(err == EBUSY);
1140 			ASSERT(dsl_dir_is_clone(dd));
1141 			ASSERT(dsda.rm_origin == NULL);
1142 		}
1143 	} while (dsda.need_prep);
1144 
1145 	if (dsda.rm_origin != NULL)
1146 		dsl_dataset_disown(dsda.rm_origin, tag);
1147 
1148 	/* if it is successful, dsl_dir_destroy_sync will close the dd */
1149 	if (err)
1150 		dsl_dir_close(dd, FTAG);
1151 out:
1152 	dsl_dataset_disown(ds, tag);
1153 	return (err);
1154 }
1155 
1156 blkptr_t *
1157 dsl_dataset_get_blkptr(dsl_dataset_t *ds)
1158 {
1159 	return (&ds->ds_phys->ds_bp);
1160 }
1161 
1162 void
1163 dsl_dataset_set_blkptr(dsl_dataset_t *ds, blkptr_t *bp, dmu_tx_t *tx)
1164 {
1165 	ASSERT(dmu_tx_is_syncing(tx));
1166 	/* If it's the meta-objset, set dp_meta_rootbp */
1167 	if (ds == NULL) {
1168 		tx->tx_pool->dp_meta_rootbp = *bp;
1169 	} else {
1170 		dmu_buf_will_dirty(ds->ds_dbuf, tx);
1171 		ds->ds_phys->ds_bp = *bp;
1172 	}
1173 }
1174 
1175 spa_t *
1176 dsl_dataset_get_spa(dsl_dataset_t *ds)
1177 {
1178 	return (ds->ds_dir->dd_pool->dp_spa);
1179 }
1180 
1181 void
1182 dsl_dataset_dirty(dsl_dataset_t *ds, dmu_tx_t *tx)
1183 {
1184 	dsl_pool_t *dp;
1185 
1186 	if (ds == NULL) /* this is the meta-objset */
1187 		return;
1188 
1189 	ASSERT(ds->ds_objset != NULL);
1190 
1191 	if (ds->ds_phys->ds_next_snap_obj != 0)
1192 		panic("dirtying snapshot!");
1193 
1194 	dp = ds->ds_dir->dd_pool;
1195 
1196 	if (txg_list_add(&dp->dp_dirty_datasets, ds, tx->tx_txg) == 0) {
1197 		/* up the hold count until we can be written out */
1198 		dmu_buf_add_ref(ds->ds_dbuf, ds);
1199 	}
1200 }
1201 
1202 /*
1203  * The unique space in the head dataset can be calculated by subtracting
1204  * the space used in the most recent snapshot, that is still being used
1205  * in this file system, from the space currently in use.  To figure out
1206  * the space in the most recent snapshot still in use, we need to take
1207  * the total space used in the snapshot and subtract out the space that
1208  * has been freed up since the snapshot was taken.
1209  */
1210 static void
1211 dsl_dataset_recalc_head_uniq(dsl_dataset_t *ds)
1212 {
1213 	uint64_t mrs_used;
1214 	uint64_t dlused, dlcomp, dluncomp;
1215 
1216 	ASSERT(ds->ds_object == ds->ds_dir->dd_phys->dd_head_dataset_obj);
1217 
1218 	if (ds->ds_phys->ds_prev_snap_obj != 0)
1219 		mrs_used = ds->ds_prev->ds_phys->ds_used_bytes;
1220 	else
1221 		mrs_used = 0;
1222 
1223 	VERIFY(0 == bplist_space(&ds->ds_deadlist, &dlused, &dlcomp,
1224 	    &dluncomp));
1225 
1226 	ASSERT3U(dlused, <=, mrs_used);
1227 	ds->ds_phys->ds_unique_bytes =
1228 	    ds->ds_phys->ds_used_bytes - (mrs_used - dlused);
1229 
1230 	if (!DS_UNIQUE_IS_ACCURATE(ds) &&
1231 	    spa_version(ds->ds_dir->dd_pool->dp_spa) >=
1232 	    SPA_VERSION_UNIQUE_ACCURATE)
1233 		ds->ds_phys->ds_flags |= DS_FLAG_UNIQUE_ACCURATE;
1234 }
1235 
1236 static uint64_t
1237 dsl_dataset_unique(dsl_dataset_t *ds)
1238 {
1239 	if (!DS_UNIQUE_IS_ACCURATE(ds) && !dsl_dataset_is_snapshot(ds))
1240 		dsl_dataset_recalc_head_uniq(ds);
1241 
1242 	return (ds->ds_phys->ds_unique_bytes);
1243 }
1244 
1245 struct killarg {
1246 	dsl_dataset_t *ds;
1247 	dmu_tx_t *tx;
1248 };
1249 
1250 /* ARGSUSED */
1251 static int
1252 kill_blkptr(spa_t *spa, zilog_t *zilog, const blkptr_t *bp,
1253     const zbookmark_t *zb, const dnode_phys_t *dnp, void *arg)
1254 {
1255 	struct killarg *ka = arg;
1256 	dmu_tx_t *tx = ka->tx;
1257 
1258 	if (bp == NULL)
1259 		return (0);
1260 
1261 	if (zb->zb_level == ZB_ZIL_LEVEL) {
1262 		ASSERT(zilog != NULL);
1263 		/*
1264 		 * It's a block in the intent log.  It has no
1265 		 * accounting, so just free it.
1266 		 */
1267 		dsl_free(ka->tx->tx_pool, ka->tx->tx_txg, bp);
1268 	} else {
1269 		ASSERT(zilog == NULL);
1270 		ASSERT3U(bp->blk_birth, >, ka->ds->ds_phys->ds_prev_snap_txg);
1271 		(void) dsl_dataset_block_kill(ka->ds, bp, tx, B_FALSE);
1272 	}
1273 
1274 	return (0);
1275 }
1276 
1277 /* ARGSUSED */
1278 static int
1279 dsl_dataset_destroy_begin_check(void *arg1, void *arg2, dmu_tx_t *tx)
1280 {
1281 	dsl_dataset_t *ds = arg1;
1282 	objset_t *mos = ds->ds_dir->dd_pool->dp_meta_objset;
1283 	uint64_t count;
1284 	int err;
1285 
1286 	/*
1287 	 * Can't delete a head dataset if there are snapshots of it.
1288 	 * (Except if the only snapshots are from the branch we cloned
1289 	 * from.)
1290 	 */
1291 	if (ds->ds_prev != NULL &&
1292 	    ds->ds_prev->ds_phys->ds_next_snap_obj == ds->ds_object)
1293 		return (EBUSY);
1294 
1295 	/*
1296 	 * This is really a dsl_dir thing, but check it here so that
1297 	 * we'll be less likely to leave this dataset inconsistent &
1298 	 * nearly destroyed.
1299 	 */
1300 	err = zap_count(mos, ds->ds_dir->dd_phys->dd_child_dir_zapobj, &count);
1301 	if (err)
1302 		return (err);
1303 	if (count != 0)
1304 		return (EEXIST);
1305 
1306 	return (0);
1307 }
1308 
1309 /* ARGSUSED */
1310 static void
1311 dsl_dataset_destroy_begin_sync(void *arg1, void *arg2, cred_t *cr, dmu_tx_t *tx)
1312 {
1313 	dsl_dataset_t *ds = arg1;
1314 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
1315 
1316 	/* Mark it as inconsistent on-disk, in case we crash */
1317 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
1318 	ds->ds_phys->ds_flags |= DS_FLAG_INCONSISTENT;
1319 
1320 	spa_history_internal_log(LOG_DS_DESTROY_BEGIN, dp->dp_spa, tx,
1321 	    cr, "dataset = %llu", ds->ds_object);
1322 }
1323 
1324 static int
1325 dsl_dataset_origin_check(struct dsl_ds_destroyarg *dsda, void *tag,
1326     dmu_tx_t *tx)
1327 {
1328 	dsl_dataset_t *ds = dsda->ds;
1329 	dsl_dataset_t *ds_prev = ds->ds_prev;
1330 
1331 	if (dsl_dataset_might_destroy_origin(ds_prev)) {
1332 		struct dsl_ds_destroyarg ndsda = {0};
1333 
1334 		/*
1335 		 * If we're not prepared to remove the origin, don't remove
1336 		 * the clone either.
1337 		 */
1338 		if (dsda->rm_origin == NULL) {
1339 			dsda->need_prep = B_TRUE;
1340 			return (EBUSY);
1341 		}
1342 
1343 		ndsda.ds = ds_prev;
1344 		ndsda.is_origin_rm = B_TRUE;
1345 		return (dsl_dataset_destroy_check(&ndsda, tag, tx));
1346 	}
1347 
1348 	/*
1349 	 * If we're not going to remove the origin after all,
1350 	 * undo the open context setup.
1351 	 */
1352 	if (dsda->rm_origin != NULL) {
1353 		dsl_dataset_disown(dsda->rm_origin, tag);
1354 		dsda->rm_origin = NULL;
1355 	}
1356 
1357 	return (0);
1358 }
1359 
1360 /* ARGSUSED */
1361 int
1362 dsl_dataset_destroy_check(void *arg1, void *arg2, dmu_tx_t *tx)
1363 {
1364 	struct dsl_ds_destroyarg *dsda = arg1;
1365 	dsl_dataset_t *ds = dsda->ds;
1366 
1367 	/* we have an owner hold, so noone else can destroy us */
1368 	ASSERT(!DSL_DATASET_IS_DESTROYED(ds));
1369 
1370 	/*
1371 	 * Only allow deferred destroy on pools that support it.
1372 	 * NOTE: deferred destroy is only supported on snapshots.
1373 	 */
1374 	if (dsda->defer) {
1375 		if (spa_version(ds->ds_dir->dd_pool->dp_spa) <
1376 		    SPA_VERSION_USERREFS)
1377 			return (ENOTSUP);
1378 		ASSERT(dsl_dataset_is_snapshot(ds));
1379 		return (0);
1380 	}
1381 
1382 	/*
1383 	 * Can't delete a head dataset if there are snapshots of it.
1384 	 * (Except if the only snapshots are from the branch we cloned
1385 	 * from.)
1386 	 */
1387 	if (ds->ds_prev != NULL &&
1388 	    ds->ds_prev->ds_phys->ds_next_snap_obj == ds->ds_object)
1389 		return (EBUSY);
1390 
1391 	/*
1392 	 * If we made changes this txg, traverse_dsl_dataset won't find
1393 	 * them.  Try again.
1394 	 */
1395 	if (ds->ds_phys->ds_bp.blk_birth >= tx->tx_txg)
1396 		return (EAGAIN);
1397 
1398 	if (dsl_dataset_is_snapshot(ds)) {
1399 		/*
1400 		 * If this snapshot has an elevated user reference count,
1401 		 * we can't destroy it yet.
1402 		 */
1403 		if (ds->ds_userrefs > 0 && !dsda->releasing)
1404 			return (EBUSY);
1405 
1406 		mutex_enter(&ds->ds_lock);
1407 		/*
1408 		 * Can't delete a branch point. However, if we're destroying
1409 		 * a clone and removing its origin due to it having a user
1410 		 * hold count of 0 and having been marked for deferred destroy,
1411 		 * it's OK for the origin to have a single clone.
1412 		 */
1413 		if (ds->ds_phys->ds_num_children >
1414 		    (dsda->is_origin_rm ? 2 : 1)) {
1415 			mutex_exit(&ds->ds_lock);
1416 			return (EEXIST);
1417 		}
1418 		mutex_exit(&ds->ds_lock);
1419 	} else if (dsl_dir_is_clone(ds->ds_dir)) {
1420 		return (dsl_dataset_origin_check(dsda, arg2, tx));
1421 	}
1422 
1423 	/* XXX we should do some i/o error checking... */
1424 	return (0);
1425 }
1426 
1427 struct refsarg {
1428 	kmutex_t lock;
1429 	boolean_t gone;
1430 	kcondvar_t cv;
1431 };
1432 
1433 /* ARGSUSED */
1434 static void
1435 dsl_dataset_refs_gone(dmu_buf_t *db, void *argv)
1436 {
1437 	struct refsarg *arg = argv;
1438 
1439 	mutex_enter(&arg->lock);
1440 	arg->gone = TRUE;
1441 	cv_signal(&arg->cv);
1442 	mutex_exit(&arg->lock);
1443 }
1444 
1445 static void
1446 dsl_dataset_drain_refs(dsl_dataset_t *ds, void *tag)
1447 {
1448 	struct refsarg arg;
1449 
1450 	mutex_init(&arg.lock, NULL, MUTEX_DEFAULT, NULL);
1451 	cv_init(&arg.cv, NULL, CV_DEFAULT, NULL);
1452 	arg.gone = FALSE;
1453 	(void) dmu_buf_update_user(ds->ds_dbuf, ds, &arg, &ds->ds_phys,
1454 	    dsl_dataset_refs_gone);
1455 	dmu_buf_rele(ds->ds_dbuf, tag);
1456 	mutex_enter(&arg.lock);
1457 	while (!arg.gone)
1458 		cv_wait(&arg.cv, &arg.lock);
1459 	ASSERT(arg.gone);
1460 	mutex_exit(&arg.lock);
1461 	ds->ds_dbuf = NULL;
1462 	ds->ds_phys = NULL;
1463 	mutex_destroy(&arg.lock);
1464 	cv_destroy(&arg.cv);
1465 }
1466 
1467 static void
1468 remove_from_next_clones(dsl_dataset_t *ds, uint64_t obj, dmu_tx_t *tx)
1469 {
1470 	objset_t *mos = ds->ds_dir->dd_pool->dp_meta_objset;
1471 	uint64_t count;
1472 	int err;
1473 
1474 	ASSERT(ds->ds_phys->ds_num_children >= 2);
1475 	err = zap_remove_int(mos, ds->ds_phys->ds_next_clones_obj, obj, tx);
1476 	/*
1477 	 * The err should not be ENOENT, but a bug in a previous version
1478 	 * of the code could cause upgrade_clones_cb() to not set
1479 	 * ds_next_snap_obj when it should, leading to a missing entry.
1480 	 * If we knew that the pool was created after
1481 	 * SPA_VERSION_NEXT_CLONES, we could assert that it isn't
1482 	 * ENOENT.  However, at least we can check that we don't have
1483 	 * too many entries in the next_clones_obj even after failing to
1484 	 * remove this one.
1485 	 */
1486 	if (err != ENOENT) {
1487 		VERIFY3U(err, ==, 0);
1488 	}
1489 	ASSERT3U(0, ==, zap_count(mos, ds->ds_phys->ds_next_clones_obj,
1490 	    &count));
1491 	ASSERT3U(count, <=, ds->ds_phys->ds_num_children - 2);
1492 }
1493 
1494 void
1495 dsl_dataset_destroy_sync(void *arg1, void *tag, cred_t *cr, dmu_tx_t *tx)
1496 {
1497 	struct dsl_ds_destroyarg *dsda = arg1;
1498 	dsl_dataset_t *ds = dsda->ds;
1499 	int err;
1500 	int after_branch_point = FALSE;
1501 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
1502 	objset_t *mos = dp->dp_meta_objset;
1503 	dsl_dataset_t *ds_prev = NULL;
1504 	uint64_t obj;
1505 
1506 	ASSERT(ds->ds_owner);
1507 	ASSERT(dsda->defer || ds->ds_phys->ds_num_children <= 1);
1508 	ASSERT(ds->ds_prev == NULL ||
1509 	    ds->ds_prev->ds_phys->ds_next_snap_obj != ds->ds_object);
1510 	ASSERT3U(ds->ds_phys->ds_bp.blk_birth, <=, tx->tx_txg);
1511 
1512 	if (dsda->defer) {
1513 		ASSERT(spa_version(dp->dp_spa) >= SPA_VERSION_USERREFS);
1514 		if (ds->ds_userrefs > 0 || ds->ds_phys->ds_num_children > 1) {
1515 			dmu_buf_will_dirty(ds->ds_dbuf, tx);
1516 			ds->ds_phys->ds_flags |= DS_FLAG_DEFER_DESTROY;
1517 			return;
1518 		}
1519 	}
1520 
1521 	/* signal any waiters that this dataset is going away */
1522 	mutex_enter(&ds->ds_lock);
1523 	ds->ds_owner = dsl_reaper;
1524 	cv_broadcast(&ds->ds_exclusive_cv);
1525 	mutex_exit(&ds->ds_lock);
1526 
1527 	/* Remove our reservation */
1528 	if (ds->ds_reserved != 0) {
1529 		dsl_prop_setarg_t psa;
1530 		uint64_t value = 0;
1531 
1532 		dsl_prop_setarg_init_uint64(&psa, "refreservation",
1533 		    (ZPROP_SRC_NONE | ZPROP_SRC_LOCAL | ZPROP_SRC_RECEIVED),
1534 		    &value);
1535 		psa.psa_effective_value = 0;	/* predict default value */
1536 
1537 		dsl_dataset_set_reservation_sync(ds, &psa, cr, tx);
1538 		ASSERT3U(ds->ds_reserved, ==, 0);
1539 	}
1540 
1541 	ASSERT(RW_WRITE_HELD(&dp->dp_config_rwlock));
1542 
1543 	dsl_pool_ds_destroyed(ds, tx);
1544 
1545 	obj = ds->ds_object;
1546 
1547 	if (ds->ds_phys->ds_prev_snap_obj != 0) {
1548 		if (ds->ds_prev) {
1549 			ds_prev = ds->ds_prev;
1550 		} else {
1551 			VERIFY(0 == dsl_dataset_hold_obj(dp,
1552 			    ds->ds_phys->ds_prev_snap_obj, FTAG, &ds_prev));
1553 		}
1554 		after_branch_point =
1555 		    (ds_prev->ds_phys->ds_next_snap_obj != obj);
1556 
1557 		dmu_buf_will_dirty(ds_prev->ds_dbuf, tx);
1558 		if (after_branch_point &&
1559 		    ds_prev->ds_phys->ds_next_clones_obj != 0) {
1560 			remove_from_next_clones(ds_prev, obj, tx);
1561 			if (ds->ds_phys->ds_next_snap_obj != 0) {
1562 				VERIFY(0 == zap_add_int(mos,
1563 				    ds_prev->ds_phys->ds_next_clones_obj,
1564 				    ds->ds_phys->ds_next_snap_obj, tx));
1565 			}
1566 		}
1567 		if (after_branch_point &&
1568 		    ds->ds_phys->ds_next_snap_obj == 0) {
1569 			/* This clone is toast. */
1570 			ASSERT(ds_prev->ds_phys->ds_num_children > 1);
1571 			ds_prev->ds_phys->ds_num_children--;
1572 
1573 			/*
1574 			 * If the clone's origin has no other clones, no
1575 			 * user holds, and has been marked for deferred
1576 			 * deletion, then we should have done the necessary
1577 			 * destroy setup for it.
1578 			 */
1579 			if (ds_prev->ds_phys->ds_num_children == 1 &&
1580 			    ds_prev->ds_userrefs == 0 &&
1581 			    DS_IS_DEFER_DESTROY(ds_prev)) {
1582 				ASSERT3P(dsda->rm_origin, !=, NULL);
1583 			} else {
1584 				ASSERT3P(dsda->rm_origin, ==, NULL);
1585 			}
1586 		} else if (!after_branch_point) {
1587 			ds_prev->ds_phys->ds_next_snap_obj =
1588 			    ds->ds_phys->ds_next_snap_obj;
1589 		}
1590 	}
1591 
1592 	if (ds->ds_phys->ds_next_snap_obj != 0) {
1593 		blkptr_t bp;
1594 		dsl_dataset_t *ds_next;
1595 		uint64_t itor = 0;
1596 		uint64_t old_unique;
1597 		int64_t used = 0, compressed = 0, uncompressed = 0;
1598 
1599 		VERIFY(0 == dsl_dataset_hold_obj(dp,
1600 		    ds->ds_phys->ds_next_snap_obj, FTAG, &ds_next));
1601 		ASSERT3U(ds_next->ds_phys->ds_prev_snap_obj, ==, obj);
1602 
1603 		old_unique = dsl_dataset_unique(ds_next);
1604 
1605 		dmu_buf_will_dirty(ds_next->ds_dbuf, tx);
1606 		ds_next->ds_phys->ds_prev_snap_obj =
1607 		    ds->ds_phys->ds_prev_snap_obj;
1608 		ds_next->ds_phys->ds_prev_snap_txg =
1609 		    ds->ds_phys->ds_prev_snap_txg;
1610 		ASSERT3U(ds->ds_phys->ds_prev_snap_txg, ==,
1611 		    ds_prev ? ds_prev->ds_phys->ds_creation_txg : 0);
1612 
1613 		/*
1614 		 * Transfer to our deadlist (which will become next's
1615 		 * new deadlist) any entries from next's current
1616 		 * deadlist which were born before prev, and free the
1617 		 * other entries.
1618 		 *
1619 		 * XXX we're doing this long task with the config lock held
1620 		 */
1621 		while (bplist_iterate(&ds_next->ds_deadlist, &itor, &bp) == 0) {
1622 			if (bp.blk_birth <= ds->ds_phys->ds_prev_snap_txg) {
1623 				VERIFY(0 == bplist_enqueue(&ds->ds_deadlist,
1624 				    &bp, tx));
1625 				if (ds_prev && !after_branch_point &&
1626 				    bp.blk_birth >
1627 				    ds_prev->ds_phys->ds_prev_snap_txg) {
1628 					ds_prev->ds_phys->ds_unique_bytes +=
1629 					    bp_get_dsize_sync(dp->dp_spa, &bp);
1630 				}
1631 			} else {
1632 				used += bp_get_dsize_sync(dp->dp_spa, &bp);
1633 				compressed += BP_GET_PSIZE(&bp);
1634 				uncompressed += BP_GET_UCSIZE(&bp);
1635 				dsl_free(dp, tx->tx_txg, &bp);
1636 			}
1637 		}
1638 
1639 		ASSERT3U(used, ==, ds->ds_phys->ds_unique_bytes);
1640 
1641 		/* change snapused */
1642 		dsl_dir_diduse_space(ds->ds_dir, DD_USED_SNAP,
1643 		    -used, -compressed, -uncompressed, tx);
1644 
1645 		/* free next's deadlist */
1646 		bplist_close(&ds_next->ds_deadlist);
1647 		bplist_destroy(mos, ds_next->ds_phys->ds_deadlist_obj, tx);
1648 
1649 		/* set next's deadlist to our deadlist */
1650 		bplist_close(&ds->ds_deadlist);
1651 		ds_next->ds_phys->ds_deadlist_obj =
1652 		    ds->ds_phys->ds_deadlist_obj;
1653 		VERIFY(0 == bplist_open(&ds_next->ds_deadlist, mos,
1654 		    ds_next->ds_phys->ds_deadlist_obj));
1655 		ds->ds_phys->ds_deadlist_obj = 0;
1656 
1657 		if (ds_next->ds_phys->ds_next_snap_obj != 0) {
1658 			/*
1659 			 * Update next's unique to include blocks which
1660 			 * were previously shared by only this snapshot
1661 			 * and it.  Those blocks will be born after the
1662 			 * prev snap and before this snap, and will have
1663 			 * died after the next snap and before the one
1664 			 * after that (ie. be on the snap after next's
1665 			 * deadlist).
1666 			 *
1667 			 * XXX we're doing this long task with the
1668 			 * config lock held
1669 			 */
1670 			dsl_dataset_t *ds_after_next;
1671 			uint64_t space;
1672 
1673 			VERIFY(0 == dsl_dataset_hold_obj(dp,
1674 			    ds_next->ds_phys->ds_next_snap_obj,
1675 			    FTAG, &ds_after_next));
1676 
1677 			VERIFY(0 ==
1678 			    bplist_space_birthrange(&ds_after_next->ds_deadlist,
1679 			    ds->ds_phys->ds_prev_snap_txg,
1680 			    ds->ds_phys->ds_creation_txg, &space));
1681 			ds_next->ds_phys->ds_unique_bytes += space;
1682 
1683 			dsl_dataset_rele(ds_after_next, FTAG);
1684 			ASSERT3P(ds_next->ds_prev, ==, NULL);
1685 		} else {
1686 			ASSERT3P(ds_next->ds_prev, ==, ds);
1687 			dsl_dataset_drop_ref(ds_next->ds_prev, ds_next);
1688 			ds_next->ds_prev = NULL;
1689 			if (ds_prev) {
1690 				VERIFY(0 == dsl_dataset_get_ref(dp,
1691 				    ds->ds_phys->ds_prev_snap_obj,
1692 				    ds_next, &ds_next->ds_prev));
1693 			}
1694 
1695 			dsl_dataset_recalc_head_uniq(ds_next);
1696 
1697 			/*
1698 			 * Reduce the amount of our unconsmed refreservation
1699 			 * being charged to our parent by the amount of
1700 			 * new unique data we have gained.
1701 			 */
1702 			if (old_unique < ds_next->ds_reserved) {
1703 				int64_t mrsdelta;
1704 				uint64_t new_unique =
1705 				    ds_next->ds_phys->ds_unique_bytes;
1706 
1707 				ASSERT(old_unique <= new_unique);
1708 				mrsdelta = MIN(new_unique - old_unique,
1709 				    ds_next->ds_reserved - old_unique);
1710 				dsl_dir_diduse_space(ds->ds_dir,
1711 				    DD_USED_REFRSRV, -mrsdelta, 0, 0, tx);
1712 			}
1713 		}
1714 		dsl_dataset_rele(ds_next, FTAG);
1715 	} else {
1716 		/*
1717 		 * There's no next snapshot, so this is a head dataset.
1718 		 * Destroy the deadlist.  Unless it's a clone, the
1719 		 * deadlist should be empty.  (If it's a clone, it's
1720 		 * safe to ignore the deadlist contents.)
1721 		 */
1722 		struct killarg ka;
1723 
1724 		ASSERT(after_branch_point || bplist_empty(&ds->ds_deadlist));
1725 		bplist_close(&ds->ds_deadlist);
1726 		bplist_destroy(mos, ds->ds_phys->ds_deadlist_obj, tx);
1727 		ds->ds_phys->ds_deadlist_obj = 0;
1728 
1729 		/*
1730 		 * Free everything that we point to (that's born after
1731 		 * the previous snapshot, if we are a clone)
1732 		 *
1733 		 * NB: this should be very quick, because we already
1734 		 * freed all the objects in open context.
1735 		 */
1736 		ka.ds = ds;
1737 		ka.tx = tx;
1738 		err = traverse_dataset(ds, ds->ds_phys->ds_prev_snap_txg,
1739 		    TRAVERSE_POST, kill_blkptr, &ka);
1740 		ASSERT3U(err, ==, 0);
1741 		ASSERT(!DS_UNIQUE_IS_ACCURATE(ds) ||
1742 		    ds->ds_phys->ds_unique_bytes == 0);
1743 
1744 		if (ds->ds_prev != NULL) {
1745 			dsl_dataset_rele(ds->ds_prev, ds);
1746 			ds->ds_prev = ds_prev = NULL;
1747 		}
1748 	}
1749 
1750 	if (ds->ds_dir->dd_phys->dd_head_dataset_obj == ds->ds_object) {
1751 		/* Erase the link in the dir */
1752 		dmu_buf_will_dirty(ds->ds_dir->dd_dbuf, tx);
1753 		ds->ds_dir->dd_phys->dd_head_dataset_obj = 0;
1754 		ASSERT(ds->ds_phys->ds_snapnames_zapobj != 0);
1755 		err = zap_destroy(mos, ds->ds_phys->ds_snapnames_zapobj, tx);
1756 		ASSERT(err == 0);
1757 	} else {
1758 		/* remove from snapshot namespace */
1759 		dsl_dataset_t *ds_head;
1760 		ASSERT(ds->ds_phys->ds_snapnames_zapobj == 0);
1761 		VERIFY(0 == dsl_dataset_hold_obj(dp,
1762 		    ds->ds_dir->dd_phys->dd_head_dataset_obj, FTAG, &ds_head));
1763 		VERIFY(0 == dsl_dataset_get_snapname(ds));
1764 #ifdef ZFS_DEBUG
1765 		{
1766 			uint64_t val;
1767 
1768 			err = dsl_dataset_snap_lookup(ds_head,
1769 			    ds->ds_snapname, &val);
1770 			ASSERT3U(err, ==, 0);
1771 			ASSERT3U(val, ==, obj);
1772 		}
1773 #endif
1774 		err = dsl_dataset_snap_remove(ds_head, ds->ds_snapname, tx);
1775 		ASSERT(err == 0);
1776 		dsl_dataset_rele(ds_head, FTAG);
1777 	}
1778 
1779 	if (ds_prev && ds->ds_prev != ds_prev)
1780 		dsl_dataset_rele(ds_prev, FTAG);
1781 
1782 	spa_prop_clear_bootfs(dp->dp_spa, ds->ds_object, tx);
1783 	spa_history_internal_log(LOG_DS_DESTROY, dp->dp_spa, tx,
1784 	    cr, "dataset = %llu", ds->ds_object);
1785 
1786 	if (ds->ds_phys->ds_next_clones_obj != 0) {
1787 		uint64_t count;
1788 		ASSERT(0 == zap_count(mos,
1789 		    ds->ds_phys->ds_next_clones_obj, &count) && count == 0);
1790 		VERIFY(0 == dmu_object_free(mos,
1791 		    ds->ds_phys->ds_next_clones_obj, tx));
1792 	}
1793 	if (ds->ds_phys->ds_props_obj != 0)
1794 		VERIFY(0 == zap_destroy(mos, ds->ds_phys->ds_props_obj, tx));
1795 	if (ds->ds_phys->ds_userrefs_obj != 0)
1796 		VERIFY(0 == zap_destroy(mos, ds->ds_phys->ds_userrefs_obj, tx));
1797 	dsl_dir_close(ds->ds_dir, ds);
1798 	ds->ds_dir = NULL;
1799 	dsl_dataset_drain_refs(ds, tag);
1800 	VERIFY(0 == dmu_object_free(mos, obj, tx));
1801 
1802 	if (dsda->rm_origin) {
1803 		/*
1804 		 * Remove the origin of the clone we just destroyed.
1805 		 */
1806 		struct dsl_ds_destroyarg ndsda = {0};
1807 
1808 		ndsda.ds = dsda->rm_origin;
1809 		dsl_dataset_destroy_sync(&ndsda, tag, cr, tx);
1810 	}
1811 }
1812 
1813 static int
1814 dsl_dataset_snapshot_reserve_space(dsl_dataset_t *ds, dmu_tx_t *tx)
1815 {
1816 	uint64_t asize;
1817 
1818 	if (!dmu_tx_is_syncing(tx))
1819 		return (0);
1820 
1821 	/*
1822 	 * If there's an fs-only reservation, any blocks that might become
1823 	 * owned by the snapshot dataset must be accommodated by space
1824 	 * outside of the reservation.
1825 	 */
1826 	asize = MIN(dsl_dataset_unique(ds), ds->ds_reserved);
1827 	if (asize > dsl_dir_space_available(ds->ds_dir, NULL, 0, FALSE))
1828 		return (ENOSPC);
1829 
1830 	/*
1831 	 * Propogate any reserved space for this snapshot to other
1832 	 * snapshot checks in this sync group.
1833 	 */
1834 	if (asize > 0)
1835 		dsl_dir_willuse_space(ds->ds_dir, asize, tx);
1836 
1837 	return (0);
1838 }
1839 
1840 /* ARGSUSED */
1841 int
1842 dsl_dataset_snapshot_check(void *arg1, void *arg2, dmu_tx_t *tx)
1843 {
1844 	dsl_dataset_t *ds = arg1;
1845 	const char *snapname = arg2;
1846 	int err;
1847 	uint64_t value;
1848 
1849 	/*
1850 	 * We don't allow multiple snapshots of the same txg.  If there
1851 	 * is already one, try again.
1852 	 */
1853 	if (ds->ds_phys->ds_prev_snap_txg >= tx->tx_txg)
1854 		return (EAGAIN);
1855 
1856 	/*
1857 	 * Check for conflicting name snapshot name.
1858 	 */
1859 	err = dsl_dataset_snap_lookup(ds, snapname, &value);
1860 	if (err == 0)
1861 		return (EEXIST);
1862 	if (err != ENOENT)
1863 		return (err);
1864 
1865 	/*
1866 	 * Check that the dataset's name is not too long.  Name consists
1867 	 * of the dataset's length + 1 for the @-sign + snapshot name's length
1868 	 */
1869 	if (dsl_dataset_namelen(ds) + 1 + strlen(snapname) >= MAXNAMELEN)
1870 		return (ENAMETOOLONG);
1871 
1872 	err = dsl_dataset_snapshot_reserve_space(ds, tx);
1873 	if (err)
1874 		return (err);
1875 
1876 	ds->ds_trysnap_txg = tx->tx_txg;
1877 	return (0);
1878 }
1879 
1880 void
1881 dsl_dataset_snapshot_sync(void *arg1, void *arg2, cred_t *cr, dmu_tx_t *tx)
1882 {
1883 	dsl_dataset_t *ds = arg1;
1884 	const char *snapname = arg2;
1885 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
1886 	dmu_buf_t *dbuf;
1887 	dsl_dataset_phys_t *dsphys;
1888 	uint64_t dsobj, crtxg;
1889 	objset_t *mos = dp->dp_meta_objset;
1890 	int err;
1891 
1892 	ASSERT(RW_WRITE_HELD(&dp->dp_config_rwlock));
1893 
1894 	/*
1895 	 * The origin's ds_creation_txg has to be < TXG_INITIAL
1896 	 */
1897 	if (strcmp(snapname, ORIGIN_DIR_NAME) == 0)
1898 		crtxg = 1;
1899 	else
1900 		crtxg = tx->tx_txg;
1901 
1902 	dsobj = dmu_object_alloc(mos, DMU_OT_DSL_DATASET, 0,
1903 	    DMU_OT_DSL_DATASET, sizeof (dsl_dataset_phys_t), tx);
1904 	VERIFY(0 == dmu_bonus_hold(mos, dsobj, FTAG, &dbuf));
1905 	dmu_buf_will_dirty(dbuf, tx);
1906 	dsphys = dbuf->db_data;
1907 	bzero(dsphys, sizeof (dsl_dataset_phys_t));
1908 	dsphys->ds_dir_obj = ds->ds_dir->dd_object;
1909 	dsphys->ds_fsid_guid = unique_create();
1910 	(void) random_get_pseudo_bytes((void*)&dsphys->ds_guid,
1911 	    sizeof (dsphys->ds_guid));
1912 	dsphys->ds_prev_snap_obj = ds->ds_phys->ds_prev_snap_obj;
1913 	dsphys->ds_prev_snap_txg = ds->ds_phys->ds_prev_snap_txg;
1914 	dsphys->ds_next_snap_obj = ds->ds_object;
1915 	dsphys->ds_num_children = 1;
1916 	dsphys->ds_creation_time = gethrestime_sec();
1917 	dsphys->ds_creation_txg = crtxg;
1918 	dsphys->ds_deadlist_obj = ds->ds_phys->ds_deadlist_obj;
1919 	dsphys->ds_used_bytes = ds->ds_phys->ds_used_bytes;
1920 	dsphys->ds_compressed_bytes = ds->ds_phys->ds_compressed_bytes;
1921 	dsphys->ds_uncompressed_bytes = ds->ds_phys->ds_uncompressed_bytes;
1922 	dsphys->ds_flags = ds->ds_phys->ds_flags;
1923 	dsphys->ds_bp = ds->ds_phys->ds_bp;
1924 	dmu_buf_rele(dbuf, FTAG);
1925 
1926 	ASSERT3U(ds->ds_prev != 0, ==, ds->ds_phys->ds_prev_snap_obj != 0);
1927 	if (ds->ds_prev) {
1928 		uint64_t next_clones_obj =
1929 		    ds->ds_prev->ds_phys->ds_next_clones_obj;
1930 		ASSERT(ds->ds_prev->ds_phys->ds_next_snap_obj ==
1931 		    ds->ds_object ||
1932 		    ds->ds_prev->ds_phys->ds_num_children > 1);
1933 		if (ds->ds_prev->ds_phys->ds_next_snap_obj == ds->ds_object) {
1934 			dmu_buf_will_dirty(ds->ds_prev->ds_dbuf, tx);
1935 			ASSERT3U(ds->ds_phys->ds_prev_snap_txg, ==,
1936 			    ds->ds_prev->ds_phys->ds_creation_txg);
1937 			ds->ds_prev->ds_phys->ds_next_snap_obj = dsobj;
1938 		} else if (next_clones_obj != 0) {
1939 			remove_from_next_clones(ds->ds_prev,
1940 			    dsphys->ds_next_snap_obj, tx);
1941 			VERIFY3U(0, ==, zap_add_int(mos,
1942 			    next_clones_obj, dsobj, tx));
1943 		}
1944 	}
1945 
1946 	/*
1947 	 * If we have a reference-reservation on this dataset, we will
1948 	 * need to increase the amount of refreservation being charged
1949 	 * since our unique space is going to zero.
1950 	 */
1951 	if (ds->ds_reserved) {
1952 		int64_t add = MIN(dsl_dataset_unique(ds), ds->ds_reserved);
1953 		dsl_dir_diduse_space(ds->ds_dir, DD_USED_REFRSRV,
1954 		    add, 0, 0, tx);
1955 	}
1956 
1957 	bplist_close(&ds->ds_deadlist);
1958 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
1959 	ASSERT3U(ds->ds_phys->ds_prev_snap_txg, <, tx->tx_txg);
1960 	ds->ds_phys->ds_prev_snap_obj = dsobj;
1961 	ds->ds_phys->ds_prev_snap_txg = crtxg;
1962 	ds->ds_phys->ds_unique_bytes = 0;
1963 	if (spa_version(dp->dp_spa) >= SPA_VERSION_UNIQUE_ACCURATE)
1964 		ds->ds_phys->ds_flags |= DS_FLAG_UNIQUE_ACCURATE;
1965 	ds->ds_phys->ds_deadlist_obj =
1966 	    bplist_create(mos, DSL_DEADLIST_BLOCKSIZE, tx);
1967 	VERIFY(0 == bplist_open(&ds->ds_deadlist, mos,
1968 	    ds->ds_phys->ds_deadlist_obj));
1969 
1970 	dprintf("snap '%s' -> obj %llu\n", snapname, dsobj);
1971 	err = zap_add(mos, ds->ds_phys->ds_snapnames_zapobj,
1972 	    snapname, 8, 1, &dsobj, tx);
1973 	ASSERT(err == 0);
1974 
1975 	if (ds->ds_prev)
1976 		dsl_dataset_drop_ref(ds->ds_prev, ds);
1977 	VERIFY(0 == dsl_dataset_get_ref(dp,
1978 	    ds->ds_phys->ds_prev_snap_obj, ds, &ds->ds_prev));
1979 
1980 	dsl_pool_ds_snapshotted(ds, tx);
1981 
1982 	dsl_dir_snap_cmtime_update(ds->ds_dir);
1983 
1984 	spa_history_internal_log(LOG_DS_SNAPSHOT, dp->dp_spa, tx, cr,
1985 	    "dataset = %llu", dsobj);
1986 }
1987 
1988 void
1989 dsl_dataset_sync(dsl_dataset_t *ds, zio_t *zio, dmu_tx_t *tx)
1990 {
1991 	ASSERT(dmu_tx_is_syncing(tx));
1992 	ASSERT(ds->ds_objset != NULL);
1993 	ASSERT(ds->ds_phys->ds_next_snap_obj == 0);
1994 
1995 	/*
1996 	 * in case we had to change ds_fsid_guid when we opened it,
1997 	 * sync it out now.
1998 	 */
1999 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
2000 	ds->ds_phys->ds_fsid_guid = ds->ds_fsid_guid;
2001 
2002 	dsl_dir_dirty(ds->ds_dir, tx);
2003 	dmu_objset_sync(ds->ds_objset, zio, tx);
2004 }
2005 
2006 void
2007 dsl_dataset_stats(dsl_dataset_t *ds, nvlist_t *nv)
2008 {
2009 	uint64_t refd, avail, uobjs, aobjs;
2010 
2011 	dsl_dir_stats(ds->ds_dir, nv);
2012 
2013 	dsl_dataset_space(ds, &refd, &avail, &uobjs, &aobjs);
2014 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_AVAILABLE, avail);
2015 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_REFERENCED, refd);
2016 
2017 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_CREATION,
2018 	    ds->ds_phys->ds_creation_time);
2019 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_CREATETXG,
2020 	    ds->ds_phys->ds_creation_txg);
2021 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_REFQUOTA,
2022 	    ds->ds_quota);
2023 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_REFRESERVATION,
2024 	    ds->ds_reserved);
2025 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_GUID,
2026 	    ds->ds_phys->ds_guid);
2027 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_UNIQUE,
2028 	    dsl_dataset_unique(ds));
2029 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_OBJSETID,
2030 	    ds->ds_object);
2031 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USERREFS,
2032 	    ds->ds_userrefs);
2033 	dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_DEFER_DESTROY,
2034 	    DS_IS_DEFER_DESTROY(ds) ? 1 : 0);
2035 
2036 	if (ds->ds_phys->ds_next_snap_obj) {
2037 		/*
2038 		 * This is a snapshot; override the dd's space used with
2039 		 * our unique space and compression ratio.
2040 		 */
2041 		dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_USED,
2042 		    ds->ds_phys->ds_unique_bytes);
2043 		dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_COMPRESSRATIO,
2044 		    ds->ds_phys->ds_compressed_bytes == 0 ? 100 :
2045 		    (ds->ds_phys->ds_uncompressed_bytes * 100 /
2046 		    ds->ds_phys->ds_compressed_bytes));
2047 	}
2048 }
2049 
2050 void
2051 dsl_dataset_fast_stat(dsl_dataset_t *ds, dmu_objset_stats_t *stat)
2052 {
2053 	stat->dds_creation_txg = ds->ds_phys->ds_creation_txg;
2054 	stat->dds_inconsistent = ds->ds_phys->ds_flags & DS_FLAG_INCONSISTENT;
2055 	stat->dds_guid = ds->ds_phys->ds_guid;
2056 	if (ds->ds_phys->ds_next_snap_obj) {
2057 		stat->dds_is_snapshot = B_TRUE;
2058 		stat->dds_num_clones = ds->ds_phys->ds_num_children - 1;
2059 	} else {
2060 		stat->dds_is_snapshot = B_FALSE;
2061 		stat->dds_num_clones = 0;
2062 	}
2063 
2064 	/* clone origin is really a dsl_dir thing... */
2065 	rw_enter(&ds->ds_dir->dd_pool->dp_config_rwlock, RW_READER);
2066 	if (dsl_dir_is_clone(ds->ds_dir)) {
2067 		dsl_dataset_t *ods;
2068 
2069 		VERIFY(0 == dsl_dataset_get_ref(ds->ds_dir->dd_pool,
2070 		    ds->ds_dir->dd_phys->dd_origin_obj, FTAG, &ods));
2071 		dsl_dataset_name(ods, stat->dds_origin);
2072 		dsl_dataset_drop_ref(ods, FTAG);
2073 	} else {
2074 		stat->dds_origin[0] = '\0';
2075 	}
2076 	rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);
2077 }
2078 
2079 uint64_t
2080 dsl_dataset_fsid_guid(dsl_dataset_t *ds)
2081 {
2082 	return (ds->ds_fsid_guid);
2083 }
2084 
2085 void
2086 dsl_dataset_space(dsl_dataset_t *ds,
2087     uint64_t *refdbytesp, uint64_t *availbytesp,
2088     uint64_t *usedobjsp, uint64_t *availobjsp)
2089 {
2090 	*refdbytesp = ds->ds_phys->ds_used_bytes;
2091 	*availbytesp = dsl_dir_space_available(ds->ds_dir, NULL, 0, TRUE);
2092 	if (ds->ds_reserved > ds->ds_phys->ds_unique_bytes)
2093 		*availbytesp += ds->ds_reserved - ds->ds_phys->ds_unique_bytes;
2094 	if (ds->ds_quota != 0) {
2095 		/*
2096 		 * Adjust available bytes according to refquota
2097 		 */
2098 		if (*refdbytesp < ds->ds_quota)
2099 			*availbytesp = MIN(*availbytesp,
2100 			    ds->ds_quota - *refdbytesp);
2101 		else
2102 			*availbytesp = 0;
2103 	}
2104 	*usedobjsp = ds->ds_phys->ds_bp.blk_fill;
2105 	*availobjsp = DN_MAX_OBJECT - *usedobjsp;
2106 }
2107 
2108 boolean_t
2109 dsl_dataset_modified_since_lastsnap(dsl_dataset_t *ds)
2110 {
2111 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
2112 
2113 	ASSERT(RW_LOCK_HELD(&dp->dp_config_rwlock) ||
2114 	    dsl_pool_sync_context(dp));
2115 	if (ds->ds_prev == NULL)
2116 		return (B_FALSE);
2117 	if (ds->ds_phys->ds_bp.blk_birth >
2118 	    ds->ds_prev->ds_phys->ds_creation_txg)
2119 		return (B_TRUE);
2120 	return (B_FALSE);
2121 }
2122 
2123 /* ARGSUSED */
2124 static int
2125 dsl_dataset_snapshot_rename_check(void *arg1, void *arg2, dmu_tx_t *tx)
2126 {
2127 	dsl_dataset_t *ds = arg1;
2128 	char *newsnapname = arg2;
2129 	dsl_dir_t *dd = ds->ds_dir;
2130 	dsl_dataset_t *hds;
2131 	uint64_t val;
2132 	int err;
2133 
2134 	err = dsl_dataset_hold_obj(dd->dd_pool,
2135 	    dd->dd_phys->dd_head_dataset_obj, FTAG, &hds);
2136 	if (err)
2137 		return (err);
2138 
2139 	/* new name better not be in use */
2140 	err = dsl_dataset_snap_lookup(hds, newsnapname, &val);
2141 	dsl_dataset_rele(hds, FTAG);
2142 
2143 	if (err == 0)
2144 		err = EEXIST;
2145 	else if (err == ENOENT)
2146 		err = 0;
2147 
2148 	/* dataset name + 1 for the "@" + the new snapshot name must fit */
2149 	if (dsl_dir_namelen(ds->ds_dir) + 1 + strlen(newsnapname) >= MAXNAMELEN)
2150 		err = ENAMETOOLONG;
2151 
2152 	return (err);
2153 }
2154 
2155 static void
2156 dsl_dataset_snapshot_rename_sync(void *arg1, void *arg2,
2157     cred_t *cr, dmu_tx_t *tx)
2158 {
2159 	dsl_dataset_t *ds = arg1;
2160 	const char *newsnapname = arg2;
2161 	dsl_dir_t *dd = ds->ds_dir;
2162 	objset_t *mos = dd->dd_pool->dp_meta_objset;
2163 	dsl_dataset_t *hds;
2164 	int err;
2165 
2166 	ASSERT(ds->ds_phys->ds_next_snap_obj != 0);
2167 
2168 	VERIFY(0 == dsl_dataset_hold_obj(dd->dd_pool,
2169 	    dd->dd_phys->dd_head_dataset_obj, FTAG, &hds));
2170 
2171 	VERIFY(0 == dsl_dataset_get_snapname(ds));
2172 	err = dsl_dataset_snap_remove(hds, ds->ds_snapname, tx);
2173 	ASSERT3U(err, ==, 0);
2174 	mutex_enter(&ds->ds_lock);
2175 	(void) strcpy(ds->ds_snapname, newsnapname);
2176 	mutex_exit(&ds->ds_lock);
2177 	err = zap_add(mos, hds->ds_phys->ds_snapnames_zapobj,
2178 	    ds->ds_snapname, 8, 1, &ds->ds_object, tx);
2179 	ASSERT3U(err, ==, 0);
2180 
2181 	spa_history_internal_log(LOG_DS_RENAME, dd->dd_pool->dp_spa, tx,
2182 	    cr, "dataset = %llu", ds->ds_object);
2183 	dsl_dataset_rele(hds, FTAG);
2184 }
2185 
2186 struct renamesnaparg {
2187 	dsl_sync_task_group_t *dstg;
2188 	char failed[MAXPATHLEN];
2189 	char *oldsnap;
2190 	char *newsnap;
2191 };
2192 
2193 static int
2194 dsl_snapshot_rename_one(char *name, void *arg)
2195 {
2196 	struct renamesnaparg *ra = arg;
2197 	dsl_dataset_t *ds = NULL;
2198 	char *cp;
2199 	int err;
2200 
2201 	cp = name + strlen(name);
2202 	*cp = '@';
2203 	(void) strcpy(cp + 1, ra->oldsnap);
2204 
2205 	/*
2206 	 * For recursive snapshot renames the parent won't be changing
2207 	 * so we just pass name for both the to/from argument.
2208 	 */
2209 	err = zfs_secpolicy_rename_perms(name, name, CRED());
2210 	if (err == ENOENT) {
2211 		return (0);
2212 	} else if (err) {
2213 		(void) strcpy(ra->failed, name);
2214 		return (err);
2215 	}
2216 
2217 #ifdef _KERNEL
2218 	/*
2219 	 * For all filesystems undergoing rename, we'll need to unmount it.
2220 	 */
2221 	(void) zfs_unmount_snap(name, NULL);
2222 #endif
2223 	err = dsl_dataset_hold(name, ra->dstg, &ds);
2224 	*cp = '\0';
2225 	if (err == ENOENT) {
2226 		return (0);
2227 	} else if (err) {
2228 		(void) strcpy(ra->failed, name);
2229 		return (err);
2230 	}
2231 
2232 	dsl_sync_task_create(ra->dstg, dsl_dataset_snapshot_rename_check,
2233 	    dsl_dataset_snapshot_rename_sync, ds, ra->newsnap, 0);
2234 
2235 	return (0);
2236 }
2237 
2238 static int
2239 dsl_recursive_rename(char *oldname, const char *newname)
2240 {
2241 	int err;
2242 	struct renamesnaparg *ra;
2243 	dsl_sync_task_t *dst;
2244 	spa_t *spa;
2245 	char *cp, *fsname = spa_strdup(oldname);
2246 	int len = strlen(oldname);
2247 
2248 	/* truncate the snapshot name to get the fsname */
2249 	cp = strchr(fsname, '@');
2250 	*cp = '\0';
2251 
2252 	err = spa_open(fsname, &spa, FTAG);
2253 	if (err) {
2254 		kmem_free(fsname, len + 1);
2255 		return (err);
2256 	}
2257 	ra = kmem_alloc(sizeof (struct renamesnaparg), KM_SLEEP);
2258 	ra->dstg = dsl_sync_task_group_create(spa_get_dsl(spa));
2259 
2260 	ra->oldsnap = strchr(oldname, '@') + 1;
2261 	ra->newsnap = strchr(newname, '@') + 1;
2262 	*ra->failed = '\0';
2263 
2264 	err = dmu_objset_find(fsname, dsl_snapshot_rename_one, ra,
2265 	    DS_FIND_CHILDREN);
2266 	kmem_free(fsname, len + 1);
2267 
2268 	if (err == 0) {
2269 		err = dsl_sync_task_group_wait(ra->dstg);
2270 	}
2271 
2272 	for (dst = list_head(&ra->dstg->dstg_tasks); dst;
2273 	    dst = list_next(&ra->dstg->dstg_tasks, dst)) {
2274 		dsl_dataset_t *ds = dst->dst_arg1;
2275 		if (dst->dst_err) {
2276 			dsl_dir_name(ds->ds_dir, ra->failed);
2277 			(void) strcat(ra->failed, "@");
2278 			(void) strcat(ra->failed, ra->newsnap);
2279 		}
2280 		dsl_dataset_rele(ds, ra->dstg);
2281 	}
2282 
2283 	if (err)
2284 		(void) strcpy(oldname, ra->failed);
2285 
2286 	dsl_sync_task_group_destroy(ra->dstg);
2287 	kmem_free(ra, sizeof (struct renamesnaparg));
2288 	spa_close(spa, FTAG);
2289 	return (err);
2290 }
2291 
2292 static int
2293 dsl_valid_rename(char *oldname, void *arg)
2294 {
2295 	int delta = *(int *)arg;
2296 
2297 	if (strlen(oldname) + delta >= MAXNAMELEN)
2298 		return (ENAMETOOLONG);
2299 
2300 	return (0);
2301 }
2302 
2303 #pragma weak dmu_objset_rename = dsl_dataset_rename
2304 int
2305 dsl_dataset_rename(char *oldname, const char *newname, boolean_t recursive)
2306 {
2307 	dsl_dir_t *dd;
2308 	dsl_dataset_t *ds;
2309 	const char *tail;
2310 	int err;
2311 
2312 	err = dsl_dir_open(oldname, FTAG, &dd, &tail);
2313 	if (err)
2314 		return (err);
2315 	/*
2316 	 * If there are more than 2 references there may be holds
2317 	 * hanging around that haven't been cleared out yet.
2318 	 */
2319 	if (dmu_buf_refcount(dd->dd_dbuf) > 2)
2320 		txg_wait_synced(dd->dd_pool, 0);
2321 	if (tail == NULL) {
2322 		int delta = strlen(newname) - strlen(oldname);
2323 
2324 		/* if we're growing, validate child name lengths */
2325 		if (delta > 0)
2326 			err = dmu_objset_find(oldname, dsl_valid_rename,
2327 			    &delta, DS_FIND_CHILDREN | DS_FIND_SNAPSHOTS);
2328 
2329 		if (!err)
2330 			err = dsl_dir_rename(dd, newname);
2331 		dsl_dir_close(dd, FTAG);
2332 		return (err);
2333 	}
2334 	if (tail[0] != '@') {
2335 		/* the name ended in a nonexistent component */
2336 		dsl_dir_close(dd, FTAG);
2337 		return (ENOENT);
2338 	}
2339 
2340 	dsl_dir_close(dd, FTAG);
2341 
2342 	/* new name must be snapshot in same filesystem */
2343 	tail = strchr(newname, '@');
2344 	if (tail == NULL)
2345 		return (EINVAL);
2346 	tail++;
2347 	if (strncmp(oldname, newname, tail - newname) != 0)
2348 		return (EXDEV);
2349 
2350 	if (recursive) {
2351 		err = dsl_recursive_rename(oldname, newname);
2352 	} else {
2353 		err = dsl_dataset_hold(oldname, FTAG, &ds);
2354 		if (err)
2355 			return (err);
2356 
2357 		err = dsl_sync_task_do(ds->ds_dir->dd_pool,
2358 		    dsl_dataset_snapshot_rename_check,
2359 		    dsl_dataset_snapshot_rename_sync, ds, (char *)tail, 1);
2360 
2361 		dsl_dataset_rele(ds, FTAG);
2362 	}
2363 
2364 	return (err);
2365 }
2366 
2367 struct promotenode {
2368 	list_node_t link;
2369 	dsl_dataset_t *ds;
2370 };
2371 
2372 struct promotearg {
2373 	list_t shared_snaps, origin_snaps, clone_snaps;
2374 	dsl_dataset_t *origin_origin, *origin_head;
2375 	uint64_t used, comp, uncomp, unique, cloneusedsnap, originusedsnap;
2376 	char *err_ds;
2377 };
2378 
2379 static int snaplist_space(list_t *l, uint64_t mintxg, uint64_t *spacep);
2380 
2381 /* ARGSUSED */
2382 static int
2383 dsl_dataset_promote_check(void *arg1, void *arg2, dmu_tx_t *tx)
2384 {
2385 	dsl_dataset_t *hds = arg1;
2386 	struct promotearg *pa = arg2;
2387 	struct promotenode *snap = list_head(&pa->shared_snaps);
2388 	dsl_dataset_t *origin_ds = snap->ds;
2389 	int err;
2390 
2391 	/* Check that it is a real clone */
2392 	if (!dsl_dir_is_clone(hds->ds_dir))
2393 		return (EINVAL);
2394 
2395 	/* Since this is so expensive, don't do the preliminary check */
2396 	if (!dmu_tx_is_syncing(tx))
2397 		return (0);
2398 
2399 	if (hds->ds_phys->ds_flags & DS_FLAG_NOPROMOTE)
2400 		return (EXDEV);
2401 
2402 	/* compute origin's new unique space */
2403 	snap = list_tail(&pa->clone_snaps);
2404 	ASSERT3U(snap->ds->ds_phys->ds_prev_snap_obj, ==, origin_ds->ds_object);
2405 	err = bplist_space_birthrange(&snap->ds->ds_deadlist,
2406 	    origin_ds->ds_phys->ds_prev_snap_txg, UINT64_MAX, &pa->unique);
2407 	if (err)
2408 		return (err);
2409 
2410 	/*
2411 	 * Walk the snapshots that we are moving
2412 	 *
2413 	 * Compute space to transfer.  Consider the incremental changes
2414 	 * to used for each snapshot:
2415 	 * (my used) = (prev's used) + (blocks born) - (blocks killed)
2416 	 * So each snapshot gave birth to:
2417 	 * (blocks born) = (my used) - (prev's used) + (blocks killed)
2418 	 * So a sequence would look like:
2419 	 * (uN - u(N-1) + kN) + ... + (u1 - u0 + k1) + (u0 - 0 + k0)
2420 	 * Which simplifies to:
2421 	 * uN + kN + kN-1 + ... + k1 + k0
2422 	 * Note however, if we stop before we reach the ORIGIN we get:
2423 	 * uN + kN + kN-1 + ... + kM - uM-1
2424 	 */
2425 	pa->used = origin_ds->ds_phys->ds_used_bytes;
2426 	pa->comp = origin_ds->ds_phys->ds_compressed_bytes;
2427 	pa->uncomp = origin_ds->ds_phys->ds_uncompressed_bytes;
2428 	for (snap = list_head(&pa->shared_snaps); snap;
2429 	    snap = list_next(&pa->shared_snaps, snap)) {
2430 		uint64_t val, dlused, dlcomp, dluncomp;
2431 		dsl_dataset_t *ds = snap->ds;
2432 
2433 		/* Check that the snapshot name does not conflict */
2434 		VERIFY(0 == dsl_dataset_get_snapname(ds));
2435 		err = dsl_dataset_snap_lookup(hds, ds->ds_snapname, &val);
2436 		if (err == 0) {
2437 			err = EEXIST;
2438 			goto out;
2439 		}
2440 		if (err != ENOENT)
2441 			goto out;
2442 
2443 		/* The very first snapshot does not have a deadlist */
2444 		if (ds->ds_phys->ds_prev_snap_obj == 0)
2445 			continue;
2446 
2447 		if (err = bplist_space(&ds->ds_deadlist,
2448 		    &dlused, &dlcomp, &dluncomp))
2449 			goto out;
2450 		pa->used += dlused;
2451 		pa->comp += dlcomp;
2452 		pa->uncomp += dluncomp;
2453 	}
2454 
2455 	/*
2456 	 * If we are a clone of a clone then we never reached ORIGIN,
2457 	 * so we need to subtract out the clone origin's used space.
2458 	 */
2459 	if (pa->origin_origin) {
2460 		pa->used -= pa->origin_origin->ds_phys->ds_used_bytes;
2461 		pa->comp -= pa->origin_origin->ds_phys->ds_compressed_bytes;
2462 		pa->uncomp -= pa->origin_origin->ds_phys->ds_uncompressed_bytes;
2463 	}
2464 
2465 	/* Check that there is enough space here */
2466 	err = dsl_dir_transfer_possible(origin_ds->ds_dir, hds->ds_dir,
2467 	    pa->used);
2468 	if (err)
2469 		return (err);
2470 
2471 	/*
2472 	 * Compute the amounts of space that will be used by snapshots
2473 	 * after the promotion (for both origin and clone).  For each,
2474 	 * it is the amount of space that will be on all of their
2475 	 * deadlists (that was not born before their new origin).
2476 	 */
2477 	if (hds->ds_dir->dd_phys->dd_flags & DD_FLAG_USED_BREAKDOWN) {
2478 		uint64_t space;
2479 
2480 		/*
2481 		 * Note, typically this will not be a clone of a clone,
2482 		 * so snap->ds->ds_origin_txg will be < TXG_INITIAL, so
2483 		 * these snaplist_space() -> bplist_space_birthrange()
2484 		 * calls will be fast because they do not have to
2485 		 * iterate over all bps.
2486 		 */
2487 		snap = list_head(&pa->origin_snaps);
2488 		err = snaplist_space(&pa->shared_snaps,
2489 		    snap->ds->ds_origin_txg, &pa->cloneusedsnap);
2490 		if (err)
2491 			return (err);
2492 
2493 		err = snaplist_space(&pa->clone_snaps,
2494 		    snap->ds->ds_origin_txg, &space);
2495 		if (err)
2496 			return (err);
2497 		pa->cloneusedsnap += space;
2498 	}
2499 	if (origin_ds->ds_dir->dd_phys->dd_flags & DD_FLAG_USED_BREAKDOWN) {
2500 		err = snaplist_space(&pa->origin_snaps,
2501 		    origin_ds->ds_phys->ds_creation_txg, &pa->originusedsnap);
2502 		if (err)
2503 			return (err);
2504 	}
2505 
2506 	return (0);
2507 out:
2508 	pa->err_ds =  snap->ds->ds_snapname;
2509 	return (err);
2510 }
2511 
2512 static void
2513 dsl_dataset_promote_sync(void *arg1, void *arg2, cred_t *cr, dmu_tx_t *tx)
2514 {
2515 	dsl_dataset_t *hds = arg1;
2516 	struct promotearg *pa = arg2;
2517 	struct promotenode *snap = list_head(&pa->shared_snaps);
2518 	dsl_dataset_t *origin_ds = snap->ds;
2519 	dsl_dataset_t *origin_head;
2520 	dsl_dir_t *dd = hds->ds_dir;
2521 	dsl_pool_t *dp = hds->ds_dir->dd_pool;
2522 	dsl_dir_t *odd = NULL;
2523 	uint64_t oldnext_obj;
2524 	int64_t delta;
2525 
2526 	ASSERT(0 == (hds->ds_phys->ds_flags & DS_FLAG_NOPROMOTE));
2527 
2528 	snap = list_head(&pa->origin_snaps);
2529 	origin_head = snap->ds;
2530 
2531 	/*
2532 	 * We need to explicitly open odd, since origin_ds's dd will be
2533 	 * changing.
2534 	 */
2535 	VERIFY(0 == dsl_dir_open_obj(dp, origin_ds->ds_dir->dd_object,
2536 	    NULL, FTAG, &odd));
2537 
2538 	/* change origin's next snap */
2539 	dmu_buf_will_dirty(origin_ds->ds_dbuf, tx);
2540 	oldnext_obj = origin_ds->ds_phys->ds_next_snap_obj;
2541 	snap = list_tail(&pa->clone_snaps);
2542 	ASSERT3U(snap->ds->ds_phys->ds_prev_snap_obj, ==, origin_ds->ds_object);
2543 	origin_ds->ds_phys->ds_next_snap_obj = snap->ds->ds_object;
2544 
2545 	/* change the origin's next clone */
2546 	if (origin_ds->ds_phys->ds_next_clones_obj) {
2547 		remove_from_next_clones(origin_ds, snap->ds->ds_object, tx);
2548 		VERIFY3U(0, ==, zap_add_int(dp->dp_meta_objset,
2549 		    origin_ds->ds_phys->ds_next_clones_obj,
2550 		    oldnext_obj, tx));
2551 	}
2552 
2553 	/* change origin */
2554 	dmu_buf_will_dirty(dd->dd_dbuf, tx);
2555 	ASSERT3U(dd->dd_phys->dd_origin_obj, ==, origin_ds->ds_object);
2556 	dd->dd_phys->dd_origin_obj = odd->dd_phys->dd_origin_obj;
2557 	hds->ds_origin_txg = origin_head->ds_origin_txg;
2558 	dmu_buf_will_dirty(odd->dd_dbuf, tx);
2559 	odd->dd_phys->dd_origin_obj = origin_ds->ds_object;
2560 	origin_head->ds_origin_txg = origin_ds->ds_phys->ds_creation_txg;
2561 
2562 	/* move snapshots to this dir */
2563 	for (snap = list_head(&pa->shared_snaps); snap;
2564 	    snap = list_next(&pa->shared_snaps, snap)) {
2565 		dsl_dataset_t *ds = snap->ds;
2566 
2567 		/* unregister props as dsl_dir is changing */
2568 		if (ds->ds_objset) {
2569 			dmu_objset_evict(ds->ds_objset);
2570 			ds->ds_objset = NULL;
2571 		}
2572 		/* move snap name entry */
2573 		VERIFY(0 == dsl_dataset_get_snapname(ds));
2574 		VERIFY(0 == dsl_dataset_snap_remove(origin_head,
2575 		    ds->ds_snapname, tx));
2576 		VERIFY(0 == zap_add(dp->dp_meta_objset,
2577 		    hds->ds_phys->ds_snapnames_zapobj, ds->ds_snapname,
2578 		    8, 1, &ds->ds_object, tx));
2579 		/* change containing dsl_dir */
2580 		dmu_buf_will_dirty(ds->ds_dbuf, tx);
2581 		ASSERT3U(ds->ds_phys->ds_dir_obj, ==, odd->dd_object);
2582 		ds->ds_phys->ds_dir_obj = dd->dd_object;
2583 		ASSERT3P(ds->ds_dir, ==, odd);
2584 		dsl_dir_close(ds->ds_dir, ds);
2585 		VERIFY(0 == dsl_dir_open_obj(dp, dd->dd_object,
2586 		    NULL, ds, &ds->ds_dir));
2587 
2588 		ASSERT3U(dsl_prop_numcb(ds), ==, 0);
2589 	}
2590 
2591 	/*
2592 	 * Change space accounting.
2593 	 * Note, pa->*usedsnap and dd_used_breakdown[SNAP] will either
2594 	 * both be valid, or both be 0 (resulting in delta == 0).  This
2595 	 * is true for each of {clone,origin} independently.
2596 	 */
2597 
2598 	delta = pa->cloneusedsnap -
2599 	    dd->dd_phys->dd_used_breakdown[DD_USED_SNAP];
2600 	ASSERT3S(delta, >=, 0);
2601 	ASSERT3U(pa->used, >=, delta);
2602 	dsl_dir_diduse_space(dd, DD_USED_SNAP, delta, 0, 0, tx);
2603 	dsl_dir_diduse_space(dd, DD_USED_HEAD,
2604 	    pa->used - delta, pa->comp, pa->uncomp, tx);
2605 
2606 	delta = pa->originusedsnap -
2607 	    odd->dd_phys->dd_used_breakdown[DD_USED_SNAP];
2608 	ASSERT3S(delta, <=, 0);
2609 	ASSERT3U(pa->used, >=, -delta);
2610 	dsl_dir_diduse_space(odd, DD_USED_SNAP, delta, 0, 0, tx);
2611 	dsl_dir_diduse_space(odd, DD_USED_HEAD,
2612 	    -pa->used - delta, -pa->comp, -pa->uncomp, tx);
2613 
2614 	origin_ds->ds_phys->ds_unique_bytes = pa->unique;
2615 
2616 	/* log history record */
2617 	spa_history_internal_log(LOG_DS_PROMOTE, dd->dd_pool->dp_spa, tx,
2618 	    cr, "dataset = %llu", hds->ds_object);
2619 
2620 	dsl_dir_close(odd, FTAG);
2621 }
2622 
2623 static char *snaplist_tag = "snaplist";
2624 /*
2625  * Make a list of dsl_dataset_t's for the snapshots between first_obj
2626  * (exclusive) and last_obj (inclusive).  The list will be in reverse
2627  * order (last_obj will be the list_head()).  If first_obj == 0, do all
2628  * snapshots back to this dataset's origin.
2629  */
2630 static int
2631 snaplist_make(dsl_pool_t *dp, boolean_t own,
2632     uint64_t first_obj, uint64_t last_obj, list_t *l)
2633 {
2634 	uint64_t obj = last_obj;
2635 
2636 	ASSERT(RW_LOCK_HELD(&dp->dp_config_rwlock));
2637 
2638 	list_create(l, sizeof (struct promotenode),
2639 	    offsetof(struct promotenode, link));
2640 
2641 	while (obj != first_obj) {
2642 		dsl_dataset_t *ds;
2643 		struct promotenode *snap;
2644 		int err;
2645 
2646 		if (own) {
2647 			err = dsl_dataset_own_obj(dp, obj,
2648 			    0, snaplist_tag, &ds);
2649 			if (err == 0)
2650 				dsl_dataset_make_exclusive(ds, snaplist_tag);
2651 		} else {
2652 			err = dsl_dataset_hold_obj(dp, obj, snaplist_tag, &ds);
2653 		}
2654 		if (err == ENOENT) {
2655 			/* lost race with snapshot destroy */
2656 			struct promotenode *last = list_tail(l);
2657 			ASSERT(obj != last->ds->ds_phys->ds_prev_snap_obj);
2658 			obj = last->ds->ds_phys->ds_prev_snap_obj;
2659 			continue;
2660 		} else if (err) {
2661 			return (err);
2662 		}
2663 
2664 		if (first_obj == 0)
2665 			first_obj = ds->ds_dir->dd_phys->dd_origin_obj;
2666 
2667 		snap = kmem_alloc(sizeof (struct promotenode), KM_SLEEP);
2668 		snap->ds = ds;
2669 		list_insert_tail(l, snap);
2670 		obj = ds->ds_phys->ds_prev_snap_obj;
2671 	}
2672 
2673 	return (0);
2674 }
2675 
2676 static int
2677 snaplist_space(list_t *l, uint64_t mintxg, uint64_t *spacep)
2678 {
2679 	struct promotenode *snap;
2680 
2681 	*spacep = 0;
2682 	for (snap = list_head(l); snap; snap = list_next(l, snap)) {
2683 		uint64_t used;
2684 		int err = bplist_space_birthrange(&snap->ds->ds_deadlist,
2685 		    mintxg, UINT64_MAX, &used);
2686 		if (err)
2687 			return (err);
2688 		*spacep += used;
2689 	}
2690 	return (0);
2691 }
2692 
2693 static void
2694 snaplist_destroy(list_t *l, boolean_t own)
2695 {
2696 	struct promotenode *snap;
2697 
2698 	if (!l || !list_link_active(&l->list_head))
2699 		return;
2700 
2701 	while ((snap = list_tail(l)) != NULL) {
2702 		list_remove(l, snap);
2703 		if (own)
2704 			dsl_dataset_disown(snap->ds, snaplist_tag);
2705 		else
2706 			dsl_dataset_rele(snap->ds, snaplist_tag);
2707 		kmem_free(snap, sizeof (struct promotenode));
2708 	}
2709 	list_destroy(l);
2710 }
2711 
2712 /*
2713  * Promote a clone.  Nomenclature note:
2714  * "clone" or "cds": the original clone which is being promoted
2715  * "origin" or "ods": the snapshot which is originally clone's origin
2716  * "origin head" or "ohds": the dataset which is the head
2717  * (filesystem/volume) for the origin
2718  * "origin origin": the origin of the origin's filesystem (typically
2719  * NULL, indicating that the clone is not a clone of a clone).
2720  */
2721 int
2722 dsl_dataset_promote(const char *name, char *conflsnap)
2723 {
2724 	dsl_dataset_t *ds;
2725 	dsl_dir_t *dd;
2726 	dsl_pool_t *dp;
2727 	dmu_object_info_t doi;
2728 	struct promotearg pa = { 0 };
2729 	struct promotenode *snap;
2730 	int err;
2731 
2732 	err = dsl_dataset_hold(name, FTAG, &ds);
2733 	if (err)
2734 		return (err);
2735 	dd = ds->ds_dir;
2736 	dp = dd->dd_pool;
2737 
2738 	err = dmu_object_info(dp->dp_meta_objset,
2739 	    ds->ds_phys->ds_snapnames_zapobj, &doi);
2740 	if (err) {
2741 		dsl_dataset_rele(ds, FTAG);
2742 		return (err);
2743 	}
2744 
2745 	if (dsl_dataset_is_snapshot(ds) || dd->dd_phys->dd_origin_obj == 0) {
2746 		dsl_dataset_rele(ds, FTAG);
2747 		return (EINVAL);
2748 	}
2749 
2750 	/*
2751 	 * We are going to inherit all the snapshots taken before our
2752 	 * origin (i.e., our new origin will be our parent's origin).
2753 	 * Take ownership of them so that we can rename them into our
2754 	 * namespace.
2755 	 */
2756 	rw_enter(&dp->dp_config_rwlock, RW_READER);
2757 
2758 	err = snaplist_make(dp, B_TRUE, 0, dd->dd_phys->dd_origin_obj,
2759 	    &pa.shared_snaps);
2760 	if (err != 0)
2761 		goto out;
2762 
2763 	err = snaplist_make(dp, B_FALSE, 0, ds->ds_object, &pa.clone_snaps);
2764 	if (err != 0)
2765 		goto out;
2766 
2767 	snap = list_head(&pa.shared_snaps);
2768 	ASSERT3U(snap->ds->ds_object, ==, dd->dd_phys->dd_origin_obj);
2769 	err = snaplist_make(dp, B_FALSE, dd->dd_phys->dd_origin_obj,
2770 	    snap->ds->ds_dir->dd_phys->dd_head_dataset_obj, &pa.origin_snaps);
2771 	if (err != 0)
2772 		goto out;
2773 
2774 	if (dsl_dir_is_clone(snap->ds->ds_dir)) {
2775 		err = dsl_dataset_own_obj(dp,
2776 		    snap->ds->ds_dir->dd_phys->dd_origin_obj,
2777 		    0, FTAG, &pa.origin_origin);
2778 		if (err != 0)
2779 			goto out;
2780 	}
2781 
2782 out:
2783 	rw_exit(&dp->dp_config_rwlock);
2784 
2785 	/*
2786 	 * Add in 128x the snapnames zapobj size, since we will be moving
2787 	 * a bunch of snapnames to the promoted ds, and dirtying their
2788 	 * bonus buffers.
2789 	 */
2790 	if (err == 0) {
2791 		err = dsl_sync_task_do(dp, dsl_dataset_promote_check,
2792 		    dsl_dataset_promote_sync, ds, &pa,
2793 		    2 + 2 * doi.doi_physical_blocks_512);
2794 		if (err && pa.err_ds && conflsnap)
2795 			(void) strncpy(conflsnap, pa.err_ds, MAXNAMELEN);
2796 	}
2797 
2798 	snaplist_destroy(&pa.shared_snaps, B_TRUE);
2799 	snaplist_destroy(&pa.clone_snaps, B_FALSE);
2800 	snaplist_destroy(&pa.origin_snaps, B_FALSE);
2801 	if (pa.origin_origin)
2802 		dsl_dataset_disown(pa.origin_origin, FTAG);
2803 	dsl_dataset_rele(ds, FTAG);
2804 	return (err);
2805 }
2806 
2807 struct cloneswaparg {
2808 	dsl_dataset_t *cds; /* clone dataset */
2809 	dsl_dataset_t *ohds; /* origin's head dataset */
2810 	boolean_t force;
2811 	int64_t unused_refres_delta; /* change in unconsumed refreservation */
2812 };
2813 
2814 /* ARGSUSED */
2815 static int
2816 dsl_dataset_clone_swap_check(void *arg1, void *arg2, dmu_tx_t *tx)
2817 {
2818 	struct cloneswaparg *csa = arg1;
2819 
2820 	/* they should both be heads */
2821 	if (dsl_dataset_is_snapshot(csa->cds) ||
2822 	    dsl_dataset_is_snapshot(csa->ohds))
2823 		return (EINVAL);
2824 
2825 	/* the branch point should be just before them */
2826 	if (csa->cds->ds_prev != csa->ohds->ds_prev)
2827 		return (EINVAL);
2828 
2829 	/* cds should be the clone (unless they are unrelated) */
2830 	if (csa->cds->ds_prev != NULL &&
2831 	    csa->cds->ds_prev != csa->cds->ds_dir->dd_pool->dp_origin_snap &&
2832 	    csa->ohds->ds_object !=
2833 	    csa->cds->ds_prev->ds_phys->ds_next_snap_obj)
2834 		return (EINVAL);
2835 
2836 	/* the clone should be a child of the origin */
2837 	if (csa->cds->ds_dir->dd_parent != csa->ohds->ds_dir)
2838 		return (EINVAL);
2839 
2840 	/* ohds shouldn't be modified unless 'force' */
2841 	if (!csa->force && dsl_dataset_modified_since_lastsnap(csa->ohds))
2842 		return (ETXTBSY);
2843 
2844 	/* adjust amount of any unconsumed refreservation */
2845 	csa->unused_refres_delta =
2846 	    (int64_t)MIN(csa->ohds->ds_reserved,
2847 	    csa->ohds->ds_phys->ds_unique_bytes) -
2848 	    (int64_t)MIN(csa->ohds->ds_reserved,
2849 	    csa->cds->ds_phys->ds_unique_bytes);
2850 
2851 	if (csa->unused_refres_delta > 0 &&
2852 	    csa->unused_refres_delta >
2853 	    dsl_dir_space_available(csa->ohds->ds_dir, NULL, 0, TRUE))
2854 		return (ENOSPC);
2855 
2856 	if (csa->ohds->ds_quota != 0 &&
2857 	    csa->cds->ds_phys->ds_unique_bytes > csa->ohds->ds_quota)
2858 		return (EDQUOT);
2859 
2860 	return (0);
2861 }
2862 
2863 /* ARGSUSED */
2864 static void
2865 dsl_dataset_clone_swap_sync(void *arg1, void *arg2, cred_t *cr, dmu_tx_t *tx)
2866 {
2867 	struct cloneswaparg *csa = arg1;
2868 	dsl_pool_t *dp = csa->cds->ds_dir->dd_pool;
2869 
2870 	ASSERT(csa->cds->ds_reserved == 0);
2871 	ASSERT(csa->ohds->ds_quota == 0 ||
2872 	    csa->cds->ds_phys->ds_unique_bytes <= csa->ohds->ds_quota);
2873 
2874 	dmu_buf_will_dirty(csa->cds->ds_dbuf, tx);
2875 	dmu_buf_will_dirty(csa->ohds->ds_dbuf, tx);
2876 
2877 	if (csa->cds->ds_objset != NULL) {
2878 		dmu_objset_evict(csa->cds->ds_objset);
2879 		csa->cds->ds_objset = NULL;
2880 	}
2881 
2882 	if (csa->ohds->ds_objset != NULL) {
2883 		dmu_objset_evict(csa->ohds->ds_objset);
2884 		csa->ohds->ds_objset = NULL;
2885 	}
2886 
2887 	/*
2888 	 * Reset origin's unique bytes, if it exists.
2889 	 */
2890 	if (csa->cds->ds_prev) {
2891 		dsl_dataset_t *origin = csa->cds->ds_prev;
2892 		dmu_buf_will_dirty(origin->ds_dbuf, tx);
2893 		VERIFY(0 == bplist_space_birthrange(&csa->cds->ds_deadlist,
2894 		    origin->ds_phys->ds_prev_snap_txg, UINT64_MAX,
2895 		    &origin->ds_phys->ds_unique_bytes));
2896 	}
2897 
2898 	/* swap blkptrs */
2899 	{
2900 		blkptr_t tmp;
2901 		tmp = csa->ohds->ds_phys->ds_bp;
2902 		csa->ohds->ds_phys->ds_bp = csa->cds->ds_phys->ds_bp;
2903 		csa->cds->ds_phys->ds_bp = tmp;
2904 	}
2905 
2906 	/* set dd_*_bytes */
2907 	{
2908 		int64_t dused, dcomp, duncomp;
2909 		uint64_t cdl_used, cdl_comp, cdl_uncomp;
2910 		uint64_t odl_used, odl_comp, odl_uncomp;
2911 
2912 		ASSERT3U(csa->cds->ds_dir->dd_phys->
2913 		    dd_used_breakdown[DD_USED_SNAP], ==, 0);
2914 
2915 		VERIFY(0 == bplist_space(&csa->cds->ds_deadlist, &cdl_used,
2916 		    &cdl_comp, &cdl_uncomp));
2917 		VERIFY(0 == bplist_space(&csa->ohds->ds_deadlist, &odl_used,
2918 		    &odl_comp, &odl_uncomp));
2919 
2920 		dused = csa->cds->ds_phys->ds_used_bytes + cdl_used -
2921 		    (csa->ohds->ds_phys->ds_used_bytes + odl_used);
2922 		dcomp = csa->cds->ds_phys->ds_compressed_bytes + cdl_comp -
2923 		    (csa->ohds->ds_phys->ds_compressed_bytes + odl_comp);
2924 		duncomp = csa->cds->ds_phys->ds_uncompressed_bytes +
2925 		    cdl_uncomp -
2926 		    (csa->ohds->ds_phys->ds_uncompressed_bytes + odl_uncomp);
2927 
2928 		dsl_dir_diduse_space(csa->ohds->ds_dir, DD_USED_HEAD,
2929 		    dused, dcomp, duncomp, tx);
2930 		dsl_dir_diduse_space(csa->cds->ds_dir, DD_USED_HEAD,
2931 		    -dused, -dcomp, -duncomp, tx);
2932 
2933 		/*
2934 		 * The difference in the space used by snapshots is the
2935 		 * difference in snapshot space due to the head's
2936 		 * deadlist (since that's the only thing that's
2937 		 * changing that affects the snapused).
2938 		 */
2939 		VERIFY(0 == bplist_space_birthrange(&csa->cds->ds_deadlist,
2940 		    csa->ohds->ds_origin_txg, UINT64_MAX, &cdl_used));
2941 		VERIFY(0 == bplist_space_birthrange(&csa->ohds->ds_deadlist,
2942 		    csa->ohds->ds_origin_txg, UINT64_MAX, &odl_used));
2943 		dsl_dir_transfer_space(csa->ohds->ds_dir, cdl_used - odl_used,
2944 		    DD_USED_HEAD, DD_USED_SNAP, tx);
2945 	}
2946 
2947 #define	SWITCH64(x, y) \
2948 	{ \
2949 		uint64_t __tmp = (x); \
2950 		(x) = (y); \
2951 		(y) = __tmp; \
2952 	}
2953 
2954 	/* swap ds_*_bytes */
2955 	SWITCH64(csa->ohds->ds_phys->ds_used_bytes,
2956 	    csa->cds->ds_phys->ds_used_bytes);
2957 	SWITCH64(csa->ohds->ds_phys->ds_compressed_bytes,
2958 	    csa->cds->ds_phys->ds_compressed_bytes);
2959 	SWITCH64(csa->ohds->ds_phys->ds_uncompressed_bytes,
2960 	    csa->cds->ds_phys->ds_uncompressed_bytes);
2961 	SWITCH64(csa->ohds->ds_phys->ds_unique_bytes,
2962 	    csa->cds->ds_phys->ds_unique_bytes);
2963 
2964 	/* apply any parent delta for change in unconsumed refreservation */
2965 	dsl_dir_diduse_space(csa->ohds->ds_dir, DD_USED_REFRSRV,
2966 	    csa->unused_refres_delta, 0, 0, tx);
2967 
2968 	/* swap deadlists */
2969 	bplist_close(&csa->cds->ds_deadlist);
2970 	bplist_close(&csa->ohds->ds_deadlist);
2971 	SWITCH64(csa->ohds->ds_phys->ds_deadlist_obj,
2972 	    csa->cds->ds_phys->ds_deadlist_obj);
2973 	VERIFY(0 == bplist_open(&csa->cds->ds_deadlist, dp->dp_meta_objset,
2974 	    csa->cds->ds_phys->ds_deadlist_obj));
2975 	VERIFY(0 == bplist_open(&csa->ohds->ds_deadlist, dp->dp_meta_objset,
2976 	    csa->ohds->ds_phys->ds_deadlist_obj));
2977 
2978 	dsl_pool_ds_clone_swapped(csa->ohds, csa->cds, tx);
2979 }
2980 
2981 /*
2982  * Swap 'clone' with its origin head datasets.  Used at the end of "zfs
2983  * recv" into an existing fs to swizzle the file system to the new
2984  * version, and by "zfs rollback".  Can also be used to swap two
2985  * independent head datasets if neither has any snapshots.
2986  */
2987 int
2988 dsl_dataset_clone_swap(dsl_dataset_t *clone, dsl_dataset_t *origin_head,
2989     boolean_t force)
2990 {
2991 	struct cloneswaparg csa;
2992 	int error;
2993 
2994 	ASSERT(clone->ds_owner);
2995 	ASSERT(origin_head->ds_owner);
2996 retry:
2997 	/* Need exclusive access for the swap */
2998 	rw_enter(&clone->ds_rwlock, RW_WRITER);
2999 	if (!rw_tryenter(&origin_head->ds_rwlock, RW_WRITER)) {
3000 		rw_exit(&clone->ds_rwlock);
3001 		rw_enter(&origin_head->ds_rwlock, RW_WRITER);
3002 		if (!rw_tryenter(&clone->ds_rwlock, RW_WRITER)) {
3003 			rw_exit(&origin_head->ds_rwlock);
3004 			goto retry;
3005 		}
3006 	}
3007 	csa.cds = clone;
3008 	csa.ohds = origin_head;
3009 	csa.force = force;
3010 	error = dsl_sync_task_do(clone->ds_dir->dd_pool,
3011 	    dsl_dataset_clone_swap_check,
3012 	    dsl_dataset_clone_swap_sync, &csa, NULL, 9);
3013 	return (error);
3014 }
3015 
3016 /*
3017  * Given a pool name and a dataset object number in that pool,
3018  * return the name of that dataset.
3019  */
3020 int
3021 dsl_dsobj_to_dsname(char *pname, uint64_t obj, char *buf)
3022 {
3023 	spa_t *spa;
3024 	dsl_pool_t *dp;
3025 	dsl_dataset_t *ds;
3026 	int error;
3027 
3028 	if ((error = spa_open(pname, &spa, FTAG)) != 0)
3029 		return (error);
3030 	dp = spa_get_dsl(spa);
3031 	rw_enter(&dp->dp_config_rwlock, RW_READER);
3032 	if ((error = dsl_dataset_hold_obj(dp, obj, FTAG, &ds)) == 0) {
3033 		dsl_dataset_name(ds, buf);
3034 		dsl_dataset_rele(ds, FTAG);
3035 	}
3036 	rw_exit(&dp->dp_config_rwlock);
3037 	spa_close(spa, FTAG);
3038 
3039 	return (error);
3040 }
3041 
3042 int
3043 dsl_dataset_check_quota(dsl_dataset_t *ds, boolean_t check_quota,
3044     uint64_t asize, uint64_t inflight, uint64_t *used, uint64_t *ref_rsrv)
3045 {
3046 	int error = 0;
3047 
3048 	ASSERT3S(asize, >, 0);
3049 
3050 	/*
3051 	 * *ref_rsrv is the portion of asize that will come from any
3052 	 * unconsumed refreservation space.
3053 	 */
3054 	*ref_rsrv = 0;
3055 
3056 	mutex_enter(&ds->ds_lock);
3057 	/*
3058 	 * Make a space adjustment for reserved bytes.
3059 	 */
3060 	if (ds->ds_reserved > ds->ds_phys->ds_unique_bytes) {
3061 		ASSERT3U(*used, >=,
3062 		    ds->ds_reserved - ds->ds_phys->ds_unique_bytes);
3063 		*used -= (ds->ds_reserved - ds->ds_phys->ds_unique_bytes);
3064 		*ref_rsrv =
3065 		    asize - MIN(asize, parent_delta(ds, asize + inflight));
3066 	}
3067 
3068 	if (!check_quota || ds->ds_quota == 0) {
3069 		mutex_exit(&ds->ds_lock);
3070 		return (0);
3071 	}
3072 	/*
3073 	 * If they are requesting more space, and our current estimate
3074 	 * is over quota, they get to try again unless the actual
3075 	 * on-disk is over quota and there are no pending changes (which
3076 	 * may free up space for us).
3077 	 */
3078 	if (ds->ds_phys->ds_used_bytes + inflight >= ds->ds_quota) {
3079 		if (inflight > 0 || ds->ds_phys->ds_used_bytes < ds->ds_quota)
3080 			error = ERESTART;
3081 		else
3082 			error = EDQUOT;
3083 	}
3084 	mutex_exit(&ds->ds_lock);
3085 
3086 	return (error);
3087 }
3088 
3089 /* ARGSUSED */
3090 static int
3091 dsl_dataset_set_quota_check(void *arg1, void *arg2, dmu_tx_t *tx)
3092 {
3093 	dsl_dataset_t *ds = arg1;
3094 	dsl_prop_setarg_t *psa = arg2;
3095 	int err;
3096 
3097 	if (spa_version(ds->ds_dir->dd_pool->dp_spa) < SPA_VERSION_REFQUOTA)
3098 		return (ENOTSUP);
3099 
3100 	if ((err = dsl_prop_predict_sync(ds->ds_dir, psa)) != 0)
3101 		return (err);
3102 
3103 	if (psa->psa_effective_value == 0)
3104 		return (0);
3105 
3106 	if (psa->psa_effective_value < ds->ds_phys->ds_used_bytes ||
3107 	    psa->psa_effective_value < ds->ds_reserved)
3108 		return (ENOSPC);
3109 
3110 	return (0);
3111 }
3112 
3113 extern void dsl_prop_set_sync(void *, void *, cred_t *, dmu_tx_t *);
3114 
3115 void
3116 dsl_dataset_set_quota_sync(void *arg1, void *arg2, cred_t *cr, dmu_tx_t *tx)
3117 {
3118 	dsl_dataset_t *ds = arg1;
3119 	dsl_prop_setarg_t *psa = arg2;
3120 	uint64_t effective_value = psa->psa_effective_value;
3121 
3122 	dsl_prop_set_sync(ds, psa, cr, tx);
3123 	DSL_PROP_CHECK_PREDICTION(ds->ds_dir, psa);
3124 
3125 	if (ds->ds_quota != effective_value) {
3126 		dmu_buf_will_dirty(ds->ds_dbuf, tx);
3127 		ds->ds_quota = effective_value;
3128 
3129 		spa_history_internal_log(LOG_DS_REFQUOTA,
3130 		    ds->ds_dir->dd_pool->dp_spa, tx, cr, "%lld dataset = %llu ",
3131 		    (longlong_t)ds->ds_quota, ds->ds_object);
3132 	}
3133 }
3134 
3135 int
3136 dsl_dataset_set_quota(const char *dsname, zprop_source_t source, uint64_t quota)
3137 {
3138 	dsl_dataset_t *ds;
3139 	dsl_prop_setarg_t psa;
3140 	int err;
3141 
3142 	dsl_prop_setarg_init_uint64(&psa, "refquota", source, &quota);
3143 
3144 	err = dsl_dataset_hold(dsname, FTAG, &ds);
3145 	if (err)
3146 		return (err);
3147 
3148 	/*
3149 	 * If someone removes a file, then tries to set the quota, we
3150 	 * want to make sure the file freeing takes effect.
3151 	 */
3152 	txg_wait_open(ds->ds_dir->dd_pool, 0);
3153 
3154 	err = dsl_sync_task_do(ds->ds_dir->dd_pool,
3155 	    dsl_dataset_set_quota_check, dsl_dataset_set_quota_sync,
3156 	    ds, &psa, 0);
3157 
3158 	dsl_dataset_rele(ds, FTAG);
3159 	return (err);
3160 }
3161 
3162 static int
3163 dsl_dataset_set_reservation_check(void *arg1, void *arg2, dmu_tx_t *tx)
3164 {
3165 	dsl_dataset_t *ds = arg1;
3166 	dsl_prop_setarg_t *psa = arg2;
3167 	uint64_t effective_value;
3168 	uint64_t unique;
3169 	int err;
3170 
3171 	if (spa_version(ds->ds_dir->dd_pool->dp_spa) <
3172 	    SPA_VERSION_REFRESERVATION)
3173 		return (ENOTSUP);
3174 
3175 	if (dsl_dataset_is_snapshot(ds))
3176 		return (EINVAL);
3177 
3178 	if ((err = dsl_prop_predict_sync(ds->ds_dir, psa)) != 0)
3179 		return (err);
3180 
3181 	effective_value = psa->psa_effective_value;
3182 
3183 	/*
3184 	 * If we are doing the preliminary check in open context, the
3185 	 * space estimates may be inaccurate.
3186 	 */
3187 	if (!dmu_tx_is_syncing(tx))
3188 		return (0);
3189 
3190 	mutex_enter(&ds->ds_lock);
3191 	unique = dsl_dataset_unique(ds);
3192 	mutex_exit(&ds->ds_lock);
3193 
3194 	if (MAX(unique, effective_value) > MAX(unique, ds->ds_reserved)) {
3195 		uint64_t delta = MAX(unique, effective_value) -
3196 		    MAX(unique, ds->ds_reserved);
3197 
3198 		if (delta > dsl_dir_space_available(ds->ds_dir, NULL, 0, TRUE))
3199 			return (ENOSPC);
3200 		if (ds->ds_quota > 0 &&
3201 		    effective_value > ds->ds_quota)
3202 			return (ENOSPC);
3203 	}
3204 
3205 	return (0);
3206 }
3207 
3208 /* ARGSUSED */
3209 static void
3210 dsl_dataset_set_reservation_sync(void *arg1, void *arg2, cred_t *cr,
3211     dmu_tx_t *tx)
3212 {
3213 	dsl_dataset_t *ds = arg1;
3214 	dsl_prop_setarg_t *psa = arg2;
3215 	uint64_t effective_value = psa->psa_effective_value;
3216 	uint64_t unique;
3217 	int64_t delta;
3218 
3219 	dsl_prop_set_sync(ds, psa, cr, tx);
3220 	DSL_PROP_CHECK_PREDICTION(ds->ds_dir, psa);
3221 
3222 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
3223 
3224 	mutex_enter(&ds->ds_dir->dd_lock);
3225 	mutex_enter(&ds->ds_lock);
3226 	unique = dsl_dataset_unique(ds);
3227 	delta = MAX(0, (int64_t)(effective_value - unique)) -
3228 	    MAX(0, (int64_t)(ds->ds_reserved - unique));
3229 	ds->ds_reserved = effective_value;
3230 	mutex_exit(&ds->ds_lock);
3231 
3232 	dsl_dir_diduse_space(ds->ds_dir, DD_USED_REFRSRV, delta, 0, 0, tx);
3233 	mutex_exit(&ds->ds_dir->dd_lock);
3234 
3235 	spa_history_internal_log(LOG_DS_REFRESERV,
3236 	    ds->ds_dir->dd_pool->dp_spa, tx, cr, "%lld dataset = %llu",
3237 	    (longlong_t)effective_value, ds->ds_object);
3238 }
3239 
3240 int
3241 dsl_dataset_set_reservation(const char *dsname, zprop_source_t source,
3242     uint64_t reservation)
3243 {
3244 	dsl_dataset_t *ds;
3245 	dsl_prop_setarg_t psa;
3246 	int err;
3247 
3248 	dsl_prop_setarg_init_uint64(&psa, "refreservation", source,
3249 	    &reservation);
3250 
3251 	err = dsl_dataset_hold(dsname, FTAG, &ds);
3252 	if (err)
3253 		return (err);
3254 
3255 	err = dsl_sync_task_do(ds->ds_dir->dd_pool,
3256 	    dsl_dataset_set_reservation_check,
3257 	    dsl_dataset_set_reservation_sync, ds, &psa, 0);
3258 
3259 	dsl_dataset_rele(ds, FTAG);
3260 	return (err);
3261 }
3262 
3263 struct dsl_ds_holdarg {
3264 	dsl_sync_task_group_t *dstg;
3265 	char *htag;
3266 	char *snapname;
3267 	boolean_t recursive;
3268 	boolean_t gotone;
3269 	boolean_t temphold;
3270 	char failed[MAXPATHLEN];
3271 };
3272 
3273 /*
3274  * The max length of a temporary tag prefix is the number of hex digits
3275  * required to express UINT64_MAX plus one for the hyphen.
3276  */
3277 #define	MAX_TAG_PREFIX_LEN	17
3278 
3279 static int
3280 dsl_dataset_user_hold_check(void *arg1, void *arg2, dmu_tx_t *tx)
3281 {
3282 	dsl_dataset_t *ds = arg1;
3283 	struct dsl_ds_holdarg *ha = arg2;
3284 	char *htag = ha->htag;
3285 	objset_t *mos = ds->ds_dir->dd_pool->dp_meta_objset;
3286 	int error = 0;
3287 
3288 	if (spa_version(ds->ds_dir->dd_pool->dp_spa) < SPA_VERSION_USERREFS)
3289 		return (ENOTSUP);
3290 
3291 	if (!dsl_dataset_is_snapshot(ds))
3292 		return (EINVAL);
3293 
3294 	/* tags must be unique */
3295 	mutex_enter(&ds->ds_lock);
3296 	if (ds->ds_phys->ds_userrefs_obj) {
3297 		error = zap_lookup(mos, ds->ds_phys->ds_userrefs_obj, htag,
3298 		    8, 1, tx);
3299 		if (error == 0)
3300 			error = EEXIST;
3301 		else if (error == ENOENT)
3302 			error = 0;
3303 	}
3304 	mutex_exit(&ds->ds_lock);
3305 
3306 	if (error == 0 && ha->temphold &&
3307 	    strlen(htag) + MAX_TAG_PREFIX_LEN >= MAXNAMELEN)
3308 		error = E2BIG;
3309 
3310 	return (error);
3311 }
3312 
3313 static void
3314 dsl_dataset_user_hold_sync(void *arg1, void *arg2, cred_t *cr, dmu_tx_t *tx)
3315 {
3316 	dsl_dataset_t *ds = arg1;
3317 	struct dsl_ds_holdarg *ha = arg2;
3318 	char *htag = ha->htag;
3319 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
3320 	objset_t *mos = dp->dp_meta_objset;
3321 	uint64_t now = gethrestime_sec();
3322 	uint64_t zapobj;
3323 
3324 	mutex_enter(&ds->ds_lock);
3325 	if (ds->ds_phys->ds_userrefs_obj == 0) {
3326 		/*
3327 		 * This is the first user hold for this dataset.  Create
3328 		 * the userrefs zap object.
3329 		 */
3330 		dmu_buf_will_dirty(ds->ds_dbuf, tx);
3331 		zapobj = ds->ds_phys->ds_userrefs_obj =
3332 		    zap_create(mos, DMU_OT_USERREFS, DMU_OT_NONE, 0, tx);
3333 	} else {
3334 		zapobj = ds->ds_phys->ds_userrefs_obj;
3335 	}
3336 	ds->ds_userrefs++;
3337 	mutex_exit(&ds->ds_lock);
3338 
3339 	VERIFY(0 == zap_add(mos, zapobj, htag, 8, 1, &now, tx));
3340 
3341 	if (ha->temphold) {
3342 		VERIFY(0 == dsl_pool_user_hold(dp, ds->ds_object,
3343 		    htag, &now, tx));
3344 	}
3345 
3346 	spa_history_internal_log(LOG_DS_USER_HOLD,
3347 	    dp->dp_spa, tx, cr, "<%s> temp = %d dataset = %llu", htag,
3348 	    (int)ha->temphold, ds->ds_object);
3349 }
3350 
3351 static int
3352 dsl_dataset_user_hold_one(char *dsname, void *arg)
3353 {
3354 	struct dsl_ds_holdarg *ha = arg;
3355 	dsl_dataset_t *ds;
3356 	int error;
3357 	char *name;
3358 
3359 	/* alloc a buffer to hold dsname@snapname plus terminating NULL */
3360 	name = kmem_asprintf("%s@%s", dsname, ha->snapname);
3361 	error = dsl_dataset_hold(name, ha->dstg, &ds);
3362 	strfree(name);
3363 	if (error == 0) {
3364 		ha->gotone = B_TRUE;
3365 		dsl_sync_task_create(ha->dstg, dsl_dataset_user_hold_check,
3366 		    dsl_dataset_user_hold_sync, ds, ha, 0);
3367 	} else if (error == ENOENT && ha->recursive) {
3368 		error = 0;
3369 	} else {
3370 		(void) strcpy(ha->failed, dsname);
3371 	}
3372 	return (error);
3373 }
3374 
3375 int
3376 dsl_dataset_user_hold(char *dsname, char *snapname, char *htag,
3377     boolean_t recursive, boolean_t temphold)
3378 {
3379 	struct dsl_ds_holdarg *ha;
3380 	dsl_sync_task_t *dst;
3381 	spa_t *spa;
3382 	int error;
3383 
3384 	ha = kmem_zalloc(sizeof (struct dsl_ds_holdarg), KM_SLEEP);
3385 
3386 	(void) strlcpy(ha->failed, dsname, sizeof (ha->failed));
3387 
3388 	error = spa_open(dsname, &spa, FTAG);
3389 	if (error) {
3390 		kmem_free(ha, sizeof (struct dsl_ds_holdarg));
3391 		return (error);
3392 	}
3393 
3394 	ha->dstg = dsl_sync_task_group_create(spa_get_dsl(spa));
3395 	ha->htag = htag;
3396 	ha->snapname = snapname;
3397 	ha->recursive = recursive;
3398 	ha->temphold = temphold;
3399 	if (recursive) {
3400 		error = dmu_objset_find(dsname, dsl_dataset_user_hold_one,
3401 		    ha, DS_FIND_CHILDREN);
3402 	} else {
3403 		error = dsl_dataset_user_hold_one(dsname, ha);
3404 	}
3405 	if (error == 0)
3406 		error = dsl_sync_task_group_wait(ha->dstg);
3407 
3408 	for (dst = list_head(&ha->dstg->dstg_tasks); dst;
3409 	    dst = list_next(&ha->dstg->dstg_tasks, dst)) {
3410 		dsl_dataset_t *ds = dst->dst_arg1;
3411 
3412 		if (dst->dst_err) {
3413 			dsl_dataset_name(ds, ha->failed);
3414 			*strchr(ha->failed, '@') = '\0';
3415 		}
3416 		dsl_dataset_rele(ds, ha->dstg);
3417 	}
3418 
3419 	if (error == 0 && recursive && !ha->gotone)
3420 		error = ENOENT;
3421 
3422 	if (error)
3423 		(void) strcpy(dsname, ha->failed);
3424 
3425 	dsl_sync_task_group_destroy(ha->dstg);
3426 	kmem_free(ha, sizeof (struct dsl_ds_holdarg));
3427 	spa_close(spa, FTAG);
3428 	return (error);
3429 }
3430 
3431 struct dsl_ds_releasearg {
3432 	dsl_dataset_t *ds;
3433 	const char *htag;
3434 	boolean_t own;		/* do we own or just hold ds? */
3435 };
3436 
3437 static int
3438 dsl_dataset_release_might_destroy(dsl_dataset_t *ds, const char *htag,
3439     boolean_t *might_destroy)
3440 {
3441 	objset_t *mos = ds->ds_dir->dd_pool->dp_meta_objset;
3442 	uint64_t zapobj;
3443 	uint64_t tmp;
3444 	int error;
3445 
3446 	*might_destroy = B_FALSE;
3447 
3448 	mutex_enter(&ds->ds_lock);
3449 	zapobj = ds->ds_phys->ds_userrefs_obj;
3450 	if (zapobj == 0) {
3451 		/* The tag can't possibly exist */
3452 		mutex_exit(&ds->ds_lock);
3453 		return (ESRCH);
3454 	}
3455 
3456 	/* Make sure the tag exists */
3457 	error = zap_lookup(mos, zapobj, htag, 8, 1, &tmp);
3458 	if (error) {
3459 		mutex_exit(&ds->ds_lock);
3460 		if (error == ENOENT)
3461 			error = ESRCH;
3462 		return (error);
3463 	}
3464 
3465 	if (ds->ds_userrefs == 1 && ds->ds_phys->ds_num_children == 1 &&
3466 	    DS_IS_DEFER_DESTROY(ds))
3467 		*might_destroy = B_TRUE;
3468 
3469 	mutex_exit(&ds->ds_lock);
3470 	return (0);
3471 }
3472 
3473 static int
3474 dsl_dataset_user_release_check(void *arg1, void *tag, dmu_tx_t *tx)
3475 {
3476 	struct dsl_ds_releasearg *ra = arg1;
3477 	dsl_dataset_t *ds = ra->ds;
3478 	boolean_t might_destroy;
3479 	int error;
3480 
3481 	if (spa_version(ds->ds_dir->dd_pool->dp_spa) < SPA_VERSION_USERREFS)
3482 		return (ENOTSUP);
3483 
3484 	error = dsl_dataset_release_might_destroy(ds, ra->htag, &might_destroy);
3485 	if (error)
3486 		return (error);
3487 
3488 	if (might_destroy) {
3489 		struct dsl_ds_destroyarg dsda = {0};
3490 
3491 		if (dmu_tx_is_syncing(tx)) {
3492 			/*
3493 			 * If we're not prepared to remove the snapshot,
3494 			 * we can't allow the release to happen right now.
3495 			 */
3496 			if (!ra->own)
3497 				return (EBUSY);
3498 			if (ds->ds_objset) {
3499 				dmu_objset_evict(ds->ds_objset);
3500 				ds->ds_objset = NULL;
3501 			}
3502 		}
3503 		dsda.ds = ds;
3504 		dsda.releasing = B_TRUE;
3505 		return (dsl_dataset_destroy_check(&dsda, tag, tx));
3506 	}
3507 
3508 	return (0);
3509 }
3510 
3511 static void
3512 dsl_dataset_user_release_sync(void *arg1, void *tag, cred_t *cr, dmu_tx_t *tx)
3513 {
3514 	struct dsl_ds_releasearg *ra = arg1;
3515 	dsl_dataset_t *ds = ra->ds;
3516 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
3517 	objset_t *mos = dp->dp_meta_objset;
3518 	uint64_t zapobj;
3519 	uint64_t dsobj = ds->ds_object;
3520 	uint64_t refs;
3521 	int error;
3522 
3523 	mutex_enter(&ds->ds_lock);
3524 	ds->ds_userrefs--;
3525 	refs = ds->ds_userrefs;
3526 	mutex_exit(&ds->ds_lock);
3527 	error = dsl_pool_user_release(dp, ds->ds_object, ra->htag, tx);
3528 	VERIFY(error == 0 || error == ENOENT);
3529 	zapobj = ds->ds_phys->ds_userrefs_obj;
3530 	VERIFY(0 == zap_remove(mos, zapobj, ra->htag, tx));
3531 	if (ds->ds_userrefs == 0 && ds->ds_phys->ds_num_children == 1 &&
3532 	    DS_IS_DEFER_DESTROY(ds)) {
3533 		struct dsl_ds_destroyarg dsda = {0};
3534 
3535 		ASSERT(ra->own);
3536 		dsda.ds = ds;
3537 		dsda.releasing = B_TRUE;
3538 		/* We already did the destroy_check */
3539 		dsl_dataset_destroy_sync(&dsda, tag, cr, tx);
3540 	}
3541 
3542 	spa_history_internal_log(LOG_DS_USER_RELEASE,
3543 	    dp->dp_spa, tx, cr, "<%s> %lld dataset = %llu",
3544 	    ra->htag, (longlong_t)refs, dsobj);
3545 }
3546 
3547 static int
3548 dsl_dataset_user_release_one(char *dsname, void *arg)
3549 {
3550 	struct dsl_ds_holdarg *ha = arg;
3551 	struct dsl_ds_releasearg *ra;
3552 	dsl_dataset_t *ds;
3553 	int error;
3554 	void *dtag = ha->dstg;
3555 	char *name;
3556 	boolean_t own = B_FALSE;
3557 	boolean_t might_destroy;
3558 
3559 	/* alloc a buffer to hold dsname@snapname, plus the terminating NULL */
3560 	name = kmem_asprintf("%s@%s", dsname, ha->snapname);
3561 	error = dsl_dataset_hold(name, dtag, &ds);
3562 	strfree(name);
3563 	if (error == ENOENT && ha->recursive)
3564 		return (0);
3565 	(void) strcpy(ha->failed, dsname);
3566 	if (error)
3567 		return (error);
3568 
3569 	ha->gotone = B_TRUE;
3570 
3571 	ASSERT(dsl_dataset_is_snapshot(ds));
3572 
3573 	error = dsl_dataset_release_might_destroy(ds, ha->htag, &might_destroy);
3574 	if (error) {
3575 		dsl_dataset_rele(ds, dtag);
3576 		return (error);
3577 	}
3578 
3579 	if (might_destroy) {
3580 #ifdef _KERNEL
3581 		error = zfs_unmount_snap(name, NULL);
3582 		if (error) {
3583 			dsl_dataset_rele(ds, dtag);
3584 			return (error);
3585 		}
3586 #endif
3587 		if (!dsl_dataset_tryown(ds, B_TRUE, dtag)) {
3588 			dsl_dataset_rele(ds, dtag);
3589 			return (EBUSY);
3590 		} else {
3591 			own = B_TRUE;
3592 			dsl_dataset_make_exclusive(ds, dtag);
3593 		}
3594 	}
3595 
3596 	ra = kmem_alloc(sizeof (struct dsl_ds_releasearg), KM_SLEEP);
3597 	ra->ds = ds;
3598 	ra->htag = ha->htag;
3599 	ra->own = own;
3600 	dsl_sync_task_create(ha->dstg, dsl_dataset_user_release_check,
3601 	    dsl_dataset_user_release_sync, ra, dtag, 0);
3602 
3603 	return (0);
3604 }
3605 
3606 int
3607 dsl_dataset_user_release(char *dsname, char *snapname, char *htag,
3608     boolean_t recursive)
3609 {
3610 	struct dsl_ds_holdarg *ha;
3611 	dsl_sync_task_t *dst;
3612 	spa_t *spa;
3613 	int error;
3614 
3615 	ha = kmem_zalloc(sizeof (struct dsl_ds_holdarg), KM_SLEEP);
3616 
3617 	(void) strlcpy(ha->failed, dsname, sizeof (ha->failed));
3618 
3619 	error = spa_open(dsname, &spa, FTAG);
3620 	if (error) {
3621 		kmem_free(ha, sizeof (struct dsl_ds_holdarg));
3622 		return (error);
3623 	}
3624 
3625 	ha->dstg = dsl_sync_task_group_create(spa_get_dsl(spa));
3626 	ha->htag = htag;
3627 	ha->snapname = snapname;
3628 	ha->recursive = recursive;
3629 	if (recursive) {
3630 		error = dmu_objset_find(dsname, dsl_dataset_user_release_one,
3631 		    ha, DS_FIND_CHILDREN);
3632 	} else {
3633 		error = dsl_dataset_user_release_one(dsname, ha);
3634 	}
3635 	if (error == 0)
3636 		error = dsl_sync_task_group_wait(ha->dstg);
3637 
3638 	for (dst = list_head(&ha->dstg->dstg_tasks); dst;
3639 	    dst = list_next(&ha->dstg->dstg_tasks, dst)) {
3640 		struct dsl_ds_releasearg *ra = dst->dst_arg1;
3641 		dsl_dataset_t *ds = ra->ds;
3642 
3643 		if (dst->dst_err)
3644 			dsl_dataset_name(ds, ha->failed);
3645 
3646 		if (ra->own)
3647 			dsl_dataset_disown(ds, ha->dstg);
3648 		else
3649 			dsl_dataset_rele(ds, ha->dstg);
3650 
3651 		kmem_free(ra, sizeof (struct dsl_ds_releasearg));
3652 	}
3653 
3654 	if (error == 0 && recursive && !ha->gotone)
3655 		error = ENOENT;
3656 
3657 	if (error)
3658 		(void) strcpy(dsname, ha->failed);
3659 
3660 	dsl_sync_task_group_destroy(ha->dstg);
3661 	kmem_free(ha, sizeof (struct dsl_ds_holdarg));
3662 	spa_close(spa, FTAG);
3663 	return (error);
3664 }
3665 
3666 /*
3667  * Called at spa_load time to release a stale temporary user hold.
3668  */
3669 int
3670 dsl_dataset_user_release_tmp(dsl_pool_t *dp, uint64_t dsobj, char *htag)
3671 {
3672 	dsl_dataset_t *ds;
3673 	char *snap;
3674 	char *name;
3675 	int namelen;
3676 	int error;
3677 
3678 	rw_enter(&dp->dp_config_rwlock, RW_READER);
3679 	error = dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds);
3680 	rw_exit(&dp->dp_config_rwlock);
3681 	if (error)
3682 		return (error);
3683 	namelen = dsl_dataset_namelen(ds)+1;
3684 	name = kmem_alloc(namelen, KM_SLEEP);
3685 	dsl_dataset_name(ds, name);
3686 	dsl_dataset_rele(ds, FTAG);
3687 
3688 	snap = strchr(name, '@');
3689 	*snap = '\0';
3690 	++snap;
3691 	return (dsl_dataset_user_release(name, snap, htag, B_FALSE));
3692 }
3693 
3694 int
3695 dsl_dataset_get_holds(const char *dsname, nvlist_t **nvp)
3696 {
3697 	dsl_dataset_t *ds;
3698 	int err;
3699 
3700 	err = dsl_dataset_hold(dsname, FTAG, &ds);
3701 	if (err)
3702 		return (err);
3703 
3704 	VERIFY(0 == nvlist_alloc(nvp, NV_UNIQUE_NAME, KM_SLEEP));
3705 	if (ds->ds_phys->ds_userrefs_obj != 0) {
3706 		zap_attribute_t *za;
3707 		zap_cursor_t zc;
3708 
3709 		za = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP);
3710 		for (zap_cursor_init(&zc, ds->ds_dir->dd_pool->dp_meta_objset,
3711 		    ds->ds_phys->ds_userrefs_obj);
3712 		    zap_cursor_retrieve(&zc, za) == 0;
3713 		    zap_cursor_advance(&zc)) {
3714 			VERIFY(0 == nvlist_add_uint64(*nvp, za->za_name,
3715 			    za->za_first_integer));
3716 		}
3717 		zap_cursor_fini(&zc);
3718 		kmem_free(za, sizeof (zap_attribute_t));
3719 	}
3720 	dsl_dataset_rele(ds, FTAG);
3721 	return (0);
3722 }
3723 
3724 /*
3725  * Note, this fuction is used as the callback for dmu_objset_find().  We
3726  * always return 0 so that we will continue to find and process
3727  * inconsistent datasets, even if we encounter an error trying to
3728  * process one of them.
3729  */
3730 /* ARGSUSED */
3731 int
3732 dsl_destroy_inconsistent(char *dsname, void *arg)
3733 {
3734 	dsl_dataset_t *ds;
3735 
3736 	if (dsl_dataset_own(dsname, B_TRUE, FTAG, &ds) == 0) {
3737 		if (DS_IS_INCONSISTENT(ds))
3738 			(void) dsl_dataset_destroy(ds, FTAG, B_FALSE);
3739 		else
3740 			dsl_dataset_disown(ds, FTAG);
3741 	}
3742 	return (0);
3743 }
3744