xref: /titanic_44/usr/src/uts/common/fs/zfs/vdev_label.c (revision d291d9f21e8c0417aec99de243dd48bc400002d0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * Virtual Device Labels
31  * ---------------------
32  *
33  * The vdev label serves several distinct purposes:
34  *
35  *	1. Uniquely identify this device as part of a ZFS pool and confirm its
36  *	   identity within the pool.
37  *
38  * 	2. Verify that all the devices given in a configuration are present
39  *         within the pool.
40  *
41  * 	3. Determine the uberblock for the pool.
42  *
43  * 	4. In case of an import operation, determine the configuration of the
44  *         toplevel vdev of which it is a part.
45  *
46  * 	5. If an import operation cannot find all the devices in the pool,
47  *         provide enough information to the administrator to determine which
48  *         devices are missing.
49  *
50  * It is important to note that while the kernel is responsible for writing the
51  * label, it only consumes the information in the first three cases.  The
52  * latter information is only consumed in userland when determining the
53  * configuration to import a pool.
54  *
55  *
56  * Label Organization
57  * ------------------
58  *
59  * Before describing the contents of the label, it's important to understand how
60  * the labels are written and updated with respect to the uberblock.
61  *
62  * When the pool configuration is altered, either because it was newly created
63  * or a device was added, we want to update all the labels such that we can deal
64  * with fatal failure at any point.  To this end, each disk has two labels which
65  * are updated before and after the uberblock is synced.  Assuming we have
66  * labels and an uberblock with the following transacation groups:
67  *
68  *              L1          UB          L2
69  *           +------+    +------+    +------+
70  *           |      |    |      |    |      |
71  *           | t10  |    | t10  |    | t10  |
72  *           |      |    |      |    |      |
73  *           +------+    +------+    +------+
74  *
75  * In this stable state, the labels and the uberblock were all updated within
76  * the same transaction group (10).  Each label is mirrored and checksummed, so
77  * that we can detect when we fail partway through writing the label.
78  *
79  * In order to identify which labels are valid, the labels are written in the
80  * following manner:
81  *
82  * 	1. For each vdev, update 'L1' to the new label
83  * 	2. Update the uberblock
84  * 	3. For each vdev, update 'L2' to the new label
85  *
86  * Given arbitrary failure, we can determine the correct label to use based on
87  * the transaction group.  If we fail after updating L1 but before updating the
88  * UB, we will notice that L1's transaction group is greater than the uberblock,
89  * so L2 must be valid.  If we fail after writing the uberblock but before
90  * writing L2, we will notice that L2's transaction group is less than L1, and
91  * therefore L1 is valid.
92  *
93  * Another added complexity is that not every label is updated when the config
94  * is synced.  If we add a single device, we do not want to have to re-write
95  * every label for every device in the pool.  This means that both L1 and L2 may
96  * be older than the pool uberblock, because the necessary information is stored
97  * on another vdev.
98  *
99  *
100  * On-disk Format
101  * --------------
102  *
103  * The vdev label consists of two distinct parts, and is wrapped within the
104  * vdev_label_t structure.  The label includes 8k of padding to permit legacy
105  * VTOC disk labels, but is otherwise ignored.
106  *
107  * The first half of the label is a packed nvlist which contains pool wide
108  * properties, per-vdev properties, and configuration information.  It is
109  * described in more detail below.
110  *
111  * The latter half of the label consists of a redundant array of uberblocks.
112  * These uberblocks are updated whenever a transaction group is committed,
113  * or when the configuration is updated.  When a pool is loaded, we scan each
114  * vdev for the 'best' uberblock.
115  *
116  *
117  * Configuration Information
118  * -------------------------
119  *
120  * The nvlist describing the pool and vdev contains the following elements:
121  *
122  * 	version		ZFS on-disk version
123  * 	name		Pool name
124  * 	state		Pool state
125  * 	txg		Transaction group in which this label was written
126  * 	pool_guid	Unique identifier for this pool
127  * 	vdev_tree	An nvlist describing vdev tree.
128  *
129  * Each leaf device label also contains the following:
130  *
131  * 	top_guid	Unique ID for top-level vdev in which this is contained
132  * 	guid		Unique ID for the leaf vdev
133  *
134  * The 'vs' configuration follows the format described in 'spa_config.c'.
135  */
136 
137 #include <sys/zfs_context.h>
138 #include <sys/spa.h>
139 #include <sys/spa_impl.h>
140 #include <sys/dmu.h>
141 #include <sys/zap.h>
142 #include <sys/vdev.h>
143 #include <sys/vdev_impl.h>
144 #include <sys/uberblock_impl.h>
145 #include <sys/metaslab.h>
146 #include <sys/zio.h>
147 #include <sys/fs/zfs.h>
148 
149 /*
150  * Basic routines to read and write from a vdev label.
151  * Used throughout the rest of this file.
152  */
153 uint64_t
154 vdev_label_offset(uint64_t psize, int l, uint64_t offset)
155 {
156 	return (offset + l * sizeof (vdev_label_t) + (l < VDEV_LABELS / 2 ?
157 	    0 : psize - VDEV_LABELS * sizeof (vdev_label_t)));
158 }
159 
160 static void
161 vdev_label_read(zio_t *zio, vdev_t *vd, int l, void *buf, uint64_t offset,
162 	uint64_t size, zio_done_func_t *done, void *private)
163 {
164 	ASSERT(vd->vdev_children == 0);
165 
166 	zio_nowait(zio_read_phys(zio, vd,
167 	    vdev_label_offset(vd->vdev_psize, l, offset),
168 	    size, buf, ZIO_CHECKSUM_LABEL, done, private,
169 	    ZIO_PRIORITY_SYNC_READ, ZIO_FLAG_SPECULATIVE |
170 	    ZIO_FLAG_CANFAIL | ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_DONT_RETRY));
171 }
172 
173 static void
174 vdev_label_write(zio_t *zio, vdev_t *vd, int l, void *buf, uint64_t offset,
175 	uint64_t size, zio_done_func_t *done, void *private)
176 {
177 	ASSERT(vd->vdev_children == 0);
178 
179 	zio_nowait(zio_write_phys(zio, vd,
180 	    vdev_label_offset(vd->vdev_psize, l, offset),
181 	    size, buf, ZIO_CHECKSUM_LABEL, done, private,
182 	    ZIO_PRIORITY_SYNC_WRITE,
183 	    ZIO_FLAG_CANFAIL | ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_DONT_RETRY));
184 }
185 
186 /*
187  * Generate the nvlist representing this vdev's config.
188  */
189 nvlist_t *
190 vdev_config_generate(vdev_t *vd, int getstats)
191 {
192 	nvlist_t *nv = NULL;
193 
194 	VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, 0) == 0);
195 
196 	VERIFY(nvlist_add_string(nv, ZPOOL_CONFIG_TYPE,
197 	    vd->vdev_ops->vdev_op_type) == 0);
198 	VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_ID, vd->vdev_id) == 0);
199 	VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_GUID, vd->vdev_guid) == 0);
200 
201 	if (vd->vdev_path != NULL)
202 		VERIFY(nvlist_add_string(nv, ZPOOL_CONFIG_PATH,
203 		    vd->vdev_path) == 0);
204 
205 	if (vd->vdev_devid != NULL)
206 		VERIFY(nvlist_add_string(nv, ZPOOL_CONFIG_DEVID,
207 		    vd->vdev_devid) == 0);
208 
209 	if (vd == vd->vdev_top) {
210 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_ARRAY,
211 		    vd->vdev_ms_array) == 0);
212 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_SHIFT,
213 		    vd->vdev_ms_shift) == 0);
214 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_ASHIFT,
215 		    vd->vdev_ashift) == 0);
216 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_ASIZE,
217 		    vd->vdev_asize) == 0);
218 	}
219 
220 	if (vd->vdev_dtl.smo_object != 0)
221 		VERIFY(nvlist_add_uint64(nv, ZPOOL_CONFIG_DTL,
222 		    vd->vdev_dtl.smo_object) == 0);
223 
224 	if (getstats) {
225 		vdev_stat_t vs;
226 		vdev_get_stats(vd, &vs);
227 		VERIFY(nvlist_add_uint64_array(nv, ZPOOL_CONFIG_STATS,
228 		    (uint64_t *)&vs, sizeof (vs) / sizeof (uint64_t)) == 0);
229 	}
230 
231 	if (!vd->vdev_ops->vdev_op_leaf) {
232 		nvlist_t **child;
233 		int c;
234 
235 		child = kmem_alloc(vd->vdev_children * sizeof (nvlist_t *),
236 		    KM_SLEEP);
237 
238 		for (c = 0; c < vd->vdev_children; c++)
239 			child[c] = vdev_config_generate(vd->vdev_child[c],
240 			    getstats);
241 
242 		VERIFY(nvlist_add_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
243 		    child, vd->vdev_children) == 0);
244 
245 		for (c = 0; c < vd->vdev_children; c++)
246 			nvlist_free(child[c]);
247 
248 		kmem_free(child, vd->vdev_children * sizeof (nvlist_t *));
249 	}
250 
251 	return (nv);
252 }
253 
254 nvlist_t *
255 vdev_label_read_config(vdev_t *vd)
256 {
257 	nvlist_t *config = NULL;
258 	vdev_phys_t *vp;
259 	uint64_t version;
260 	zio_t *zio;
261 	int l;
262 
263 	if (vdev_is_dead(vd))
264 		return (NULL);
265 
266 	vp = zio_buf_alloc(sizeof (vdev_phys_t));
267 
268 	for (l = 0; l < VDEV_LABELS; l++) {
269 
270 		zio = zio_root(vd->vdev_spa, NULL, NULL,
271 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_CONFIG_HELD);
272 
273 		vdev_label_read(zio, vd, l, vp,
274 		    offsetof(vdev_label_t, vl_vdev_phys),
275 		    sizeof (vdev_phys_t), NULL, NULL);
276 
277 		if (zio_wait(zio) == 0 &&
278 		    nvlist_unpack(vp->vp_nvlist, sizeof (vp->vp_nvlist),
279 		    &config, 0) == 0 &&
280 		    nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION,
281 		    &version) == 0 &&
282 		    version == UBERBLOCK_VERSION)
283 			break;
284 
285 		if (config != NULL) {
286 			nvlist_free(config);
287 			config = NULL;
288 		}
289 	}
290 
291 	zio_buf_free(vp, sizeof (vdev_phys_t));
292 
293 	return (config);
294 }
295 
296 int
297 vdev_label_init(vdev_t *vd, uint64_t crtxg)
298 {
299 	spa_t *spa = vd->vdev_spa;
300 	nvlist_t *label;
301 	vdev_phys_t *vp;
302 	vdev_boot_header_t *vb;
303 	uberblock_phys_t *ubphys;
304 	zio_t *zio;
305 	int l, c, n;
306 	char *buf;
307 	size_t buflen;
308 	int error;
309 
310 	for (c = 0; c < vd->vdev_children; c++)
311 		if ((error = vdev_label_init(vd->vdev_child[c], crtxg)) != 0)
312 			return (error);
313 
314 	if (!vd->vdev_ops->vdev_op_leaf)
315 		return (0);
316 
317 	/*
318 	 * Make sure each leaf device is writable, and zero its initial content.
319 	 * Along the way, also make sure that no leaf is already in use.
320 	 * Note that it's important to do this sequentially, not in parallel,
321 	 * so that we catch cases of multiple use of the same leaf vdev in
322 	 * the vdev we're creating -- e.g. mirroring a disk with itself.
323 	 */
324 	if (vdev_is_dead(vd))
325 		return (EIO);
326 
327 	/*
328 	 * Check whether this device is already in use.
329 	 * Ignore the check if crtxg == 0, which we use for device removal.
330 	 */
331 	if (crtxg != 0 && (label = vdev_label_read_config(vd)) != NULL) {
332 		uint64_t version, state, pool_guid, device_guid, txg;
333 		uint64_t mycrtxg = 0;
334 
335 		(void) nvlist_lookup_uint64(label, ZPOOL_CONFIG_CREATE_TXG,
336 		    &mycrtxg);
337 
338 		if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_VERSION,
339 		    &version) == 0 && version == UBERBLOCK_VERSION &&
340 		    nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_STATE,
341 		    &state) == 0 && state == POOL_STATE_ACTIVE &&
342 		    nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_GUID,
343 		    &pool_guid) == 0 &&
344 		    nvlist_lookup_uint64(label, ZPOOL_CONFIG_GUID,
345 		    &device_guid) == 0 &&
346 		    spa_guid_exists(pool_guid, device_guid) &&
347 		    nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_TXG,
348 		    &txg) == 0 && (txg != 0 || mycrtxg == crtxg)) {
349 			dprintf("vdev %s in use, pool_state %d\n",
350 			    vdev_description(vd), state);
351 			nvlist_free(label);
352 			return (EBUSY);
353 		}
354 		nvlist_free(label);
355 	}
356 
357 	/*
358 	 * The device isn't in use, so initialize its label.
359 	 */
360 	vp = zio_buf_alloc(sizeof (vdev_phys_t));
361 	bzero(vp, sizeof (vdev_phys_t));
362 
363 	/*
364 	 * Generate a label describing the pool and our top-level vdev.
365 	 * We mark it as being from txg 0 to indicate that it's not
366 	 * really part of an active pool just yet.  The labels will
367 	 * be written again with a meaningful txg by spa_sync().
368 	 */
369 	label = spa_config_generate(spa, vd, 0ULL, 0);
370 
371 	/*
372 	 * Add our creation time.  This allows us to detect multiple vdev
373 	 * uses as described above, and automatically expires if we fail.
374 	 */
375 	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_CREATE_TXG, crtxg) == 0);
376 
377 	buf = vp->vp_nvlist;
378 	buflen = sizeof (vp->vp_nvlist);
379 
380 	if (nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, 0) != 0) {
381 		nvlist_free(label);
382 		zio_buf_free(vp, sizeof (vdev_phys_t));
383 		return (EINVAL);
384 	}
385 
386 	/*
387 	 * Initialize boot block header.
388 	 */
389 	vb = zio_buf_alloc(sizeof (vdev_boot_header_t));
390 	bzero(vb, sizeof (vdev_boot_header_t));
391 	vb->vb_magic = VDEV_BOOT_MAGIC;
392 	vb->vb_version = VDEV_BOOT_VERSION;
393 	vb->vb_offset = VDEV_BOOT_OFFSET;
394 	vb->vb_size = VDEV_BOOT_SIZE;
395 
396 	/*
397 	 * Initialize uberblock template.
398 	 */
399 	ubphys = zio_buf_alloc(sizeof (uberblock_phys_t));
400 	bzero(ubphys, sizeof (uberblock_phys_t));
401 	ubphys->ubp_uberblock = spa->spa_uberblock;
402 	ubphys->ubp_uberblock.ub_txg = 0;
403 
404 	/*
405 	 * Write everything in parallel.
406 	 */
407 	zio = zio_root(spa, NULL, NULL,
408 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL);
409 
410 	for (l = 0; l < VDEV_LABELS; l++) {
411 
412 		vdev_label_write(zio, vd, l, vp,
413 		    offsetof(vdev_label_t, vl_vdev_phys),
414 		    sizeof (vdev_phys_t), NULL, NULL);
415 
416 		vdev_label_write(zio, vd, l, vb,
417 		    offsetof(vdev_label_t, vl_boot_header),
418 		    sizeof (vdev_boot_header_t), NULL, NULL);
419 
420 		for (n = 0; n < VDEV_UBERBLOCKS; n++) {
421 
422 			vdev_label_write(zio, vd, l, ubphys,
423 			    offsetof(vdev_label_t, vl_uberblock[n]),
424 			    sizeof (uberblock_phys_t), NULL, NULL);
425 
426 		}
427 	}
428 
429 	error = zio_wait(zio);
430 
431 	nvlist_free(label);
432 	zio_buf_free(ubphys, sizeof (uberblock_phys_t));
433 	zio_buf_free(vb, sizeof (vdev_boot_header_t));
434 	zio_buf_free(vp, sizeof (vdev_phys_t));
435 
436 	return (error);
437 }
438 
439 /*
440  * ==========================================================================
441  * uberblock load/sync
442  * ==========================================================================
443  */
444 
445 /*
446  * Consider the following situation: txg is safely synced to disk.  We've
447  * written the first uberblock for txg + 1, and then we lose power.  When we
448  * come back up, we fail to see the uberblock for txg + 1 because, say,
449  * it was on a mirrored device and the replica to which we wrote txg + 1
450  * is now offline.  If we then make some changes and sync txg + 1, and then
451  * the missing replica comes back, then for a new seconds we'll have two
452  * conflicting uberblocks on disk with the same txg.  The solution is simple:
453  * among uberblocks with equal txg, choose the one with the latest timestamp.
454  */
455 static int
456 vdev_uberblock_compare(uberblock_t *ub1, uberblock_t *ub2)
457 {
458 	if (ub1->ub_txg < ub2->ub_txg)
459 		return (-1);
460 	if (ub1->ub_txg > ub2->ub_txg)
461 		return (1);
462 
463 	if (ub1->ub_timestamp < ub2->ub_timestamp)
464 		return (-1);
465 	if (ub1->ub_timestamp > ub2->ub_timestamp)
466 		return (1);
467 
468 	return (0);
469 }
470 
471 static void
472 vdev_uberblock_load_done(zio_t *zio)
473 {
474 	uberblock_phys_t *ubphys = zio->io_data;
475 	uberblock_t *ub = &ubphys->ubp_uberblock;
476 	uberblock_t *ubbest = zio->io_private;
477 	spa_t *spa = zio->io_spa;
478 
479 	ASSERT3U(zio->io_size, ==, sizeof (uberblock_phys_t));
480 
481 	if (uberblock_verify(ub) == 0) {
482 		mutex_enter(&spa->spa_uberblock_lock);
483 		if (vdev_uberblock_compare(ub, ubbest) > 0)
484 			*ubbest = *ub;
485 		mutex_exit(&spa->spa_uberblock_lock);
486 	}
487 
488 	zio_buf_free(zio->io_data, zio->io_size);
489 }
490 
491 void
492 vdev_uberblock_load(zio_t *zio, vdev_t *vd, uberblock_t *ubbest)
493 {
494 	int l, c, n;
495 
496 	for (c = 0; c < vd->vdev_children; c++)
497 		vdev_uberblock_load(zio, vd->vdev_child[c], ubbest);
498 
499 	if (!vd->vdev_ops->vdev_op_leaf)
500 		return;
501 
502 	if (vdev_is_dead(vd))
503 		return;
504 
505 	for (l = 0; l < VDEV_LABELS; l++) {
506 		for (n = 0; n < VDEV_UBERBLOCKS; n++) {
507 			vdev_label_read(zio, vd, l,
508 			    zio_buf_alloc(sizeof (uberblock_phys_t)),
509 			    offsetof(vdev_label_t, vl_uberblock[n]),
510 			    sizeof (uberblock_phys_t),
511 			    vdev_uberblock_load_done, ubbest);
512 		}
513 	}
514 }
515 
516 /*
517  * Write the uberblock to both labels of all leaves of the specified vdev.
518  */
519 static void
520 vdev_uberblock_sync_done(zio_t *zio)
521 {
522 	uint64_t *good_writes = zio->io_root->io_private;
523 
524 	if (zio->io_error == 0)
525 		atomic_add_64(good_writes, 1);
526 }
527 
528 static void
529 vdev_uberblock_sync(zio_t *zio, uberblock_phys_t *ubphys, vdev_t *vd,
530 	uint64_t txg)
531 {
532 	int l, c, n;
533 
534 	for (c = 0; c < vd->vdev_children; c++)
535 		vdev_uberblock_sync(zio, ubphys, vd->vdev_child[c], txg);
536 
537 	if (!vd->vdev_ops->vdev_op_leaf)
538 		return;
539 
540 	if (vdev_is_dead(vd))
541 		return;
542 
543 	n = txg & (VDEV_UBERBLOCKS - 1);
544 
545 	ASSERT(ubphys->ubp_uberblock.ub_txg == txg);
546 
547 	for (l = 0; l < VDEV_LABELS; l++)
548 		vdev_label_write(zio, vd, l, ubphys,
549 		    offsetof(vdev_label_t, vl_uberblock[n]),
550 		    sizeof (uberblock_phys_t), vdev_uberblock_sync_done, NULL);
551 
552 	dprintf("vdev %s in txg %llu\n", vdev_description(vd), txg);
553 }
554 
555 static int
556 vdev_uberblock_sync_tree(spa_t *spa, uberblock_t *ub, vdev_t *uvd, uint64_t txg)
557 {
558 	uberblock_phys_t *ubphys;
559 	uint64_t *good_writes;
560 	zio_t *zio;
561 	int error;
562 
563 	ubphys = zio_buf_alloc(sizeof (uberblock_phys_t));
564 	bzero(ubphys, sizeof (uberblock_phys_t));
565 	ubphys->ubp_uberblock = *ub;
566 
567 	good_writes = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
568 
569 	zio = zio_root(spa, NULL, good_writes,
570 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL);
571 
572 	vdev_uberblock_sync(zio, ubphys, uvd, txg);
573 
574 	error = zio_wait(zio);
575 
576 	if (error && *good_writes != 0) {
577 		dprintf("partial success: good_writes = %llu\n", *good_writes);
578 		error = 0;
579 	}
580 
581 	/*
582 	 * It's possible to have no good writes and no error if every vdev is in
583 	 * the CANT_OPEN state.
584 	 */
585 	if (*good_writes == 0 && error == 0)
586 		error = EIO;
587 
588 	kmem_free(good_writes, sizeof (uint64_t));
589 	zio_buf_free(ubphys, sizeof (uberblock_phys_t));
590 
591 	return (error);
592 }
593 
594 /*
595  * Sync out an individual vdev.
596  */
597 static void
598 vdev_sync_label_done(zio_t *zio)
599 {
600 	uint64_t *good_writes = zio->io_root->io_private;
601 
602 	if (zio->io_error == 0)
603 		atomic_add_64(good_writes, 1);
604 }
605 
606 static void
607 vdev_sync_label(zio_t *zio, vdev_t *vd, int l, uint64_t txg)
608 {
609 	nvlist_t *label;
610 	vdev_phys_t *vp;
611 	char *buf;
612 	size_t buflen;
613 	int c;
614 
615 	for (c = 0; c < vd->vdev_children; c++)
616 		vdev_sync_label(zio, vd->vdev_child[c], l, txg);
617 
618 	if (!vd->vdev_ops->vdev_op_leaf)
619 		return;
620 
621 	if (vdev_is_dead(vd))
622 		return;
623 
624 	/*
625 	 * Generate a label describing the top-level config to which we belong.
626 	 */
627 	label = spa_config_generate(vd->vdev_spa, vd, txg, 0);
628 
629 	vp = zio_buf_alloc(sizeof (vdev_phys_t));
630 	bzero(vp, sizeof (vdev_phys_t));
631 
632 	buf = vp->vp_nvlist;
633 	buflen = sizeof (vp->vp_nvlist);
634 
635 	if (nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, 0) == 0)
636 		vdev_label_write(zio, vd, l, vp,
637 		    offsetof(vdev_label_t, vl_vdev_phys), sizeof (vdev_phys_t),
638 		    vdev_sync_label_done, NULL);
639 
640 	zio_buf_free(vp, sizeof (vdev_phys_t));
641 	nvlist_free(label);
642 
643 	dprintf("%s label %d txg %llu\n", vdev_description(vd), l, txg);
644 }
645 
646 static int
647 vdev_sync_labels(vdev_t *vd, int l, uint64_t txg)
648 {
649 	uint64_t *good_writes;
650 	zio_t *zio;
651 	int error;
652 
653 	ASSERT(vd == vd->vdev_top);
654 
655 	good_writes = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
656 
657 	zio = zio_root(vd->vdev_spa, NULL, good_writes,
658 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL);
659 
660 	/*
661 	 * Recursively kick off writes to all labels.
662 	 */
663 	vdev_sync_label(zio, vd, l, txg);
664 
665 	error = zio_wait(zio);
666 
667 	if (error && *good_writes != 0) {
668 		dprintf("partial success: good_writes = %llu\n", *good_writes);
669 		error = 0;
670 	}
671 
672 	if (*good_writes == 0 && error == 0)
673 		error = ENODEV;
674 
675 	kmem_free(good_writes, sizeof (uint64_t));
676 
677 	return (error);
678 }
679 
680 /*
681  * Sync the entire vdev configuration.
682  *
683  * The order of operations is carefully crafted to ensure that
684  * if the system panics or loses power at any time, the state on disk
685  * is still transactionally consistent.  The in-line comments below
686  * describe the failure semantics at each stage.
687  *
688  * Moreover, it is designed to be idempotent: if spa_sync_labels() fails
689  * at any time, you can just call it again, and it will resume its work.
690  */
691 int
692 spa_sync_labels(spa_t *spa, uint64_t txg)
693 {
694 	uberblock_t *ub = &spa->spa_uberblock;
695 	vdev_t *rvd = spa->spa_root_vdev;
696 	vdev_t *vd, *uvd;
697 	zio_t *zio;
698 	int c, l, error;
699 
700 	ASSERT(ub->ub_txg <= txg);
701 
702 	/*
703 	 * If this isn't a resync due to I/O errors, and nothing changed
704 	 * in this transaction group, and the vdev configuration hasn't changed,
705 	 * and this isn't an explicit sync-all, then there's nothing to do.
706 	 */
707 	if (ub->ub_txg < txg && uberblock_update(ub, rvd, txg) == B_FALSE &&
708 	    list_is_empty(&spa->spa_dirty_list)) {
709 		dprintf("nothing to sync in %s in txg %llu\n",
710 		    spa_name(spa), txg);
711 		return (0);
712 	}
713 
714 	if (txg > spa_freeze_txg(spa))
715 		return (0);
716 
717 	dprintf("syncing %s txg %llu\n", spa_name(spa), txg);
718 
719 	/*
720 	 * Flush the write cache of every disk that's been written to
721 	 * in this transaction group.  This ensures that all blocks
722 	 * written in this txg will be committed to stable storage
723 	 * before any uberblock that references them.
724 	 */
725 	zio = zio_root(spa, NULL, NULL,
726 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL);
727 	for (vd = txg_list_head(&spa->spa_vdev_txg_list, TXG_CLEAN(txg)); vd;
728 	    vd = txg_list_next(&spa->spa_vdev_txg_list, vd, TXG_CLEAN(txg))) {
729 		zio_nowait(zio_ioctl(zio, spa, vd, DKIOCFLUSHWRITECACHE,
730 		    NULL, NULL, ZIO_PRIORITY_NOW,
731 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_RETRY));
732 	}
733 	(void) zio_wait(zio);
734 
735 	/*
736 	 * Sync out the even labels (L0, L2) for every dirty vdev.  If the
737 	 * system dies in the middle of this process, that's OK: all of the
738 	 * even labels that made it to disk will be newer than any uberblock,
739 	 * and will therefore be considered invalid.  The odd labels (L1, L3),
740 	 * which have not yet been touched, will still be valid.
741 	 */
742 	for (vd = list_head(&spa->spa_dirty_list); vd != NULL;
743 	    vd = list_next(&spa->spa_dirty_list, vd)) {
744 		for (l = 0; l < VDEV_LABELS; l++) {
745 			if (l & 1)
746 				continue;
747 			if ((error = vdev_sync_labels(vd, l, txg)) != 0)
748 				return (error);
749 		}
750 	}
751 
752 	/*
753 	 * Flush the new labels to disk.  This ensures that all even-label
754 	 * updates are committed to stable storage before the uberblock update.
755 	 */
756 	zio = zio_root(spa, NULL, NULL,
757 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL);
758 	for (vd = list_head(&spa->spa_dirty_list); vd != NULL;
759 	    vd = list_next(&spa->spa_dirty_list, vd)) {
760 		zio_nowait(zio_ioctl(zio, spa, vd, DKIOCFLUSHWRITECACHE,
761 		    NULL, NULL, ZIO_PRIORITY_NOW,
762 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_RETRY));
763 	}
764 	(void) zio_wait(zio);
765 
766 	/*
767 	 * If there are any dirty vdevs, sync the uberblock to all vdevs.
768 	 * Otherwise, pick one top-level vdev at random.
769 	 */
770 	if (!list_is_empty(&spa->spa_dirty_list))
771 		uvd = rvd;
772 	else
773 		uvd = rvd->vdev_child[spa_get_random(rvd->vdev_children)];
774 
775 	/*
776 	 * Sync the uberblocks.  If the system dies in the middle of this
777 	 * step, there are two cases to consider, and the on-disk state
778 	 * is consistent either way:
779 	 *
780 	 * (1)	If none of the new uberblocks made it to disk, then the
781 	 *	previous uberblock will be the newest, and the odd labels
782 	 *	(which had not yet been touched) will be valid with respect
783 	 *	to that uberblock.
784 	 *
785 	 * (2)	If one or more new uberblocks made it to disk, then they
786 	 *	will be the newest, and the even labels (which had all
787 	 *	been successfully committed) will be valid with respect
788 	 *	to the new uberblocks.
789 	 */
790 	if ((error = vdev_uberblock_sync_tree(spa, ub, uvd, txg)) != 0)
791 		return (error);
792 
793 	/*
794 	 * Flush the uberblocks to disk.  This ensures that the odd labels
795 	 * are no longer needed (because the new uberblocks and the even
796 	 * labels are safely on disk), so it is safe to overwrite them.
797 	 */
798 	(void) zio_wait(zio_ioctl(NULL, spa, uvd, DKIOCFLUSHWRITECACHE,
799 	    NULL, NULL, ZIO_PRIORITY_NOW,
800 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_RETRY));
801 
802 	/*
803 	 * Sync out odd labels for every dirty vdev.  If the system dies
804 	 * in the middle of this process, the even labels and the new
805 	 * uberblocks will suffice to open the pool.  The next time
806 	 * the pool is opened, the first thing we'll do -- before any
807 	 * user data is modified -- is mark every vdev dirty so that
808 	 * all labels will be brought up to date.
809 	 */
810 	for (vd = list_head(&spa->spa_dirty_list); vd != NULL;
811 	    vd = list_next(&spa->spa_dirty_list, vd)) {
812 		for (l = 0; l < VDEV_LABELS; l++) {
813 			if ((l & 1) == 0)
814 				continue;
815 			if ((error = vdev_sync_labels(vd, l, txg)) != 0)
816 				return (error);
817 		}
818 	}
819 
820 	/*
821 	 * Flush the new labels to disk.  This ensures that all odd-label
822 	 * updates are committed to stable storage before the next
823 	 * transaction group begins.
824 	 */
825 	zio = zio_root(spa, NULL, NULL,
826 	    ZIO_FLAG_CONFIG_HELD | ZIO_FLAG_CANFAIL);
827 	for (vd = list_head(&spa->spa_dirty_list); vd != NULL;
828 	    vd = list_next(&spa->spa_dirty_list, vd)) {
829 		zio_nowait(zio_ioctl(zio, spa, vd, DKIOCFLUSHWRITECACHE,
830 		    NULL, NULL, ZIO_PRIORITY_NOW,
831 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_RETRY));
832 	}
833 	(void) zio_wait(zio);
834 
835 	/*
836 	 * Clear the dirty list.
837 	 */
838 	while (!list_is_empty(&spa->spa_dirty_list))
839 		vdev_config_clean(list_head(&spa->spa_dirty_list));
840 
841 #ifdef DEBUG
842 	for (c = 0; c < rvd->vdev_children; c++) {
843 		ASSERT(rvd->vdev_child[c]->vdev_is_dirty == 0);
844 	}
845 #endif
846 
847 	return (0);
848 }
849