1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or https://opensource.org/licenses/CDDL-1.0.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2012, 2020 by Delphix. All rights reserved.
25  * Copyright (c) 2017, Intel Corporation.
26  */
27 
28 /*
29  * Virtual Device Labels
30  * ---------------------
31  *
32  * The vdev label serves several distinct purposes:
33  *
34  *	1. Uniquely identify this device as part of a ZFS pool and confirm its
35  *	   identity within the pool.
36  *
37  *	2. Verify that all the devices given in a configuration are present
38  *         within the pool.
39  *
40  *	3. Determine the uberblock for the pool.
41  *
42  *	4. In case of an import operation, determine the configuration of the
43  *         toplevel vdev of which it is a part.
44  *
45  *	5. If an import operation cannot find all the devices in the pool,
46  *         provide enough information to the administrator to determine which
47  *         devices are missing.
48  *
49  * It is important to note that while the kernel is responsible for writing the
50  * label, it only consumes the information in the first three cases.  The
51  * latter information is only consumed in userland when determining the
52  * configuration to import a pool.
53  *
54  *
55  * Label Organization
56  * ------------------
57  *
58  * Before describing the contents of the label, it's important to understand how
59  * the labels are written and updated with respect to the uberblock.
60  *
61  * When the pool configuration is altered, either because it was newly created
62  * or a device was added, we want to update all the labels such that we can deal
63  * with fatal failure at any point.  To this end, each disk has two labels which
64  * are updated before and after the uberblock is synced.  Assuming we have
65  * labels and an uberblock with the following transaction groups:
66  *
67  *              L1          UB          L2
68  *           +------+    +------+    +------+
69  *           |      |    |      |    |      |
70  *           | t10  |    | t10  |    | t10  |
71  *           |      |    |      |    |      |
72  *           +------+    +------+    +------+
73  *
74  * In this stable state, the labels and the uberblock were all updated within
75  * the same transaction group (10).  Each label is mirrored and checksummed, so
76  * that we can detect when we fail partway through writing the label.
77  *
78  * In order to identify which labels are valid, the labels are written in the
79  * following manner:
80  *
81  *	1. For each vdev, update 'L1' to the new label
82  *	2. Update the uberblock
83  *	3. For each vdev, update 'L2' to the new label
84  *
85  * Given arbitrary failure, we can determine the correct label to use based on
86  * the transaction group.  If we fail after updating L1 but before updating the
87  * UB, we will notice that L1's transaction group is greater than the uberblock,
88  * so L2 must be valid.  If we fail after writing the uberblock but before
89  * writing L2, we will notice that L2's transaction group is less than L1, and
90  * therefore L1 is valid.
91  *
92  * Another added complexity is that not every label is updated when the config
93  * is synced.  If we add a single device, we do not want to have to re-write
94  * every label for every device in the pool.  This means that both L1 and L2 may
95  * be older than the pool uberblock, because the necessary information is stored
96  * on another vdev.
97  *
98  *
99  * On-disk Format
100  * --------------
101  *
102  * The vdev label consists of two distinct parts, and is wrapped within the
103  * vdev_label_t structure.  The label includes 8k of padding to permit legacy
104  * VTOC disk labels, but is otherwise ignored.
105  *
106  * The first half of the label is a packed nvlist which contains pool wide
107  * properties, per-vdev properties, and configuration information.  It is
108  * described in more detail below.
109  *
110  * The latter half of the label consists of a redundant array of uberblocks.
111  * These uberblocks are updated whenever a transaction group is committed,
112  * or when the configuration is updated.  When a pool is loaded, we scan each
113  * vdev for the 'best' uberblock.
114  *
115  *
116  * Configuration Information
117  * -------------------------
118  *
119  * The nvlist describing the pool and vdev contains the following elements:
120  *
121  *	version		ZFS on-disk version
122  *	name		Pool name
123  *	state		Pool state
124  *	txg		Transaction group in which this label was written
125  *	pool_guid	Unique identifier for this pool
126  *	vdev_tree	An nvlist describing vdev tree.
127  *	features_for_read
128  *			An nvlist of the features necessary for reading the MOS.
129  *
130  * Each leaf device label also contains the following:
131  *
132  *	top_guid	Unique ID for top-level vdev in which this is contained
133  *	guid		Unique ID for the leaf vdev
134  *
135  * The 'vs' configuration follows the format described in 'spa_config.c'.
136  */
137 
138 #include <sys/zfs_context.h>
139 #include <sys/spa.h>
140 #include <sys/spa_impl.h>
141 #include <sys/dmu.h>
142 #include <sys/zap.h>
143 #include <sys/vdev.h>
144 #include <sys/vdev_impl.h>
145 #include <sys/vdev_draid.h>
146 #include <sys/uberblock_impl.h>
147 #include <sys/metaslab.h>
148 #include <sys/metaslab_impl.h>
149 #include <sys/zio.h>
150 #include <sys/dsl_scan.h>
151 #include <sys/abd.h>
152 #include <sys/fs/zfs.h>
153 #include <sys/byteorder.h>
154 #include <sys/zfs_bootenv.h>
155 
156 /*
157  * Basic routines to read and write from a vdev label.
158  * Used throughout the rest of this file.
159  */
160 uint64_t
161 vdev_label_offset(uint64_t psize, int l, uint64_t offset)
162 {
163 	ASSERT(offset < sizeof (vdev_label_t));
164 	ASSERT(P2PHASE_TYPED(psize, sizeof (vdev_label_t), uint64_t) == 0);
165 
166 	return (offset + l * sizeof (vdev_label_t) + (l < VDEV_LABELS / 2 ?
167 	    0 : psize - VDEV_LABELS * sizeof (vdev_label_t)));
168 }
169 
170 /*
171  * Returns back the vdev label associated with the passed in offset.
172  */
173 int
174 vdev_label_number(uint64_t psize, uint64_t offset)
175 {
176 	int l;
177 
178 	if (offset >= psize - VDEV_LABEL_END_SIZE) {
179 		offset -= psize - VDEV_LABEL_END_SIZE;
180 		offset += (VDEV_LABELS / 2) * sizeof (vdev_label_t);
181 	}
182 	l = offset / sizeof (vdev_label_t);
183 	return (l < VDEV_LABELS ? l : -1);
184 }
185 
186 static void
187 vdev_label_read(zio_t *zio, vdev_t *vd, int l, abd_t *buf, uint64_t offset,
188     uint64_t size, zio_done_func_t *done, void *private, int flags)
189 {
190 	ASSERT(
191 	    spa_config_held(zio->io_spa, SCL_STATE, RW_READER) == SCL_STATE ||
192 	    spa_config_held(zio->io_spa, SCL_STATE, RW_WRITER) == SCL_STATE);
193 	ASSERT(flags & ZIO_FLAG_CONFIG_WRITER);
194 
195 	zio_nowait(zio_read_phys(zio, vd,
196 	    vdev_label_offset(vd->vdev_psize, l, offset),
197 	    size, buf, ZIO_CHECKSUM_LABEL, done, private,
198 	    ZIO_PRIORITY_SYNC_READ, flags, B_TRUE));
199 }
200 
201 void
202 vdev_label_write(zio_t *zio, vdev_t *vd, int l, abd_t *buf, uint64_t offset,
203     uint64_t size, zio_done_func_t *done, void *private, int flags)
204 {
205 	ASSERT(
206 	    spa_config_held(zio->io_spa, SCL_STATE, RW_READER) == SCL_STATE ||
207 	    spa_config_held(zio->io_spa, SCL_STATE, RW_WRITER) == SCL_STATE);
208 	ASSERT(flags & ZIO_FLAG_CONFIG_WRITER);
209 
210 	zio_nowait(zio_write_phys(zio, vd,
211 	    vdev_label_offset(vd->vdev_psize, l, offset),
212 	    size, buf, ZIO_CHECKSUM_LABEL, done, private,
213 	    ZIO_PRIORITY_SYNC_WRITE, flags, B_TRUE));
214 }
215 
216 /*
217  * Generate the nvlist representing this vdev's stats
218  */
219 void
220 vdev_config_generate_stats(vdev_t *vd, nvlist_t *nv)
221 {
222 	nvlist_t *nvx;
223 	vdev_stat_t *vs;
224 	vdev_stat_ex_t *vsx;
225 
226 	vs = kmem_alloc(sizeof (*vs), KM_SLEEP);
227 	vsx = kmem_alloc(sizeof (*vsx), KM_SLEEP);
228 
229 	vdev_get_stats_ex(vd, vs, vsx);
230 	fnvlist_add_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS,
231 	    (uint64_t *)vs, sizeof (*vs) / sizeof (uint64_t));
232 
233 	/*
234 	 * Add extended stats into a special extended stats nvlist.  This keeps
235 	 * all the extended stats nicely grouped together.  The extended stats
236 	 * nvlist is then added to the main nvlist.
237 	 */
238 	nvx = fnvlist_alloc();
239 
240 	/* ZIOs in flight to disk */
241 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_R_ACTIVE_QUEUE,
242 	    vsx->vsx_active_queue[ZIO_PRIORITY_SYNC_READ]);
243 
244 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_W_ACTIVE_QUEUE,
245 	    vsx->vsx_active_queue[ZIO_PRIORITY_SYNC_WRITE]);
246 
247 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_R_ACTIVE_QUEUE,
248 	    vsx->vsx_active_queue[ZIO_PRIORITY_ASYNC_READ]);
249 
250 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_W_ACTIVE_QUEUE,
251 	    vsx->vsx_active_queue[ZIO_PRIORITY_ASYNC_WRITE]);
252 
253 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SCRUB_ACTIVE_QUEUE,
254 	    vsx->vsx_active_queue[ZIO_PRIORITY_SCRUB]);
255 
256 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_TRIM_ACTIVE_QUEUE,
257 	    vsx->vsx_active_queue[ZIO_PRIORITY_TRIM]);
258 
259 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_REBUILD_ACTIVE_QUEUE,
260 	    vsx->vsx_active_queue[ZIO_PRIORITY_REBUILD]);
261 
262 	/* ZIOs pending */
263 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_R_PEND_QUEUE,
264 	    vsx->vsx_pend_queue[ZIO_PRIORITY_SYNC_READ]);
265 
266 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_W_PEND_QUEUE,
267 	    vsx->vsx_pend_queue[ZIO_PRIORITY_SYNC_WRITE]);
268 
269 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_R_PEND_QUEUE,
270 	    vsx->vsx_pend_queue[ZIO_PRIORITY_ASYNC_READ]);
271 
272 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_W_PEND_QUEUE,
273 	    vsx->vsx_pend_queue[ZIO_PRIORITY_ASYNC_WRITE]);
274 
275 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SCRUB_PEND_QUEUE,
276 	    vsx->vsx_pend_queue[ZIO_PRIORITY_SCRUB]);
277 
278 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_TRIM_PEND_QUEUE,
279 	    vsx->vsx_pend_queue[ZIO_PRIORITY_TRIM]);
280 
281 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_REBUILD_PEND_QUEUE,
282 	    vsx->vsx_pend_queue[ZIO_PRIORITY_REBUILD]);
283 
284 	/* Histograms */
285 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_TOT_R_LAT_HISTO,
286 	    vsx->vsx_total_histo[ZIO_TYPE_READ],
287 	    ARRAY_SIZE(vsx->vsx_total_histo[ZIO_TYPE_READ]));
288 
289 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_TOT_W_LAT_HISTO,
290 	    vsx->vsx_total_histo[ZIO_TYPE_WRITE],
291 	    ARRAY_SIZE(vsx->vsx_total_histo[ZIO_TYPE_WRITE]));
292 
293 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_DISK_R_LAT_HISTO,
294 	    vsx->vsx_disk_histo[ZIO_TYPE_READ],
295 	    ARRAY_SIZE(vsx->vsx_disk_histo[ZIO_TYPE_READ]));
296 
297 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_DISK_W_LAT_HISTO,
298 	    vsx->vsx_disk_histo[ZIO_TYPE_WRITE],
299 	    ARRAY_SIZE(vsx->vsx_disk_histo[ZIO_TYPE_WRITE]));
300 
301 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_R_LAT_HISTO,
302 	    vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_READ],
303 	    ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_READ]));
304 
305 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_W_LAT_HISTO,
306 	    vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_WRITE],
307 	    ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_WRITE]));
308 
309 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_R_LAT_HISTO,
310 	    vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_READ],
311 	    ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_READ]));
312 
313 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_W_LAT_HISTO,
314 	    vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_WRITE],
315 	    ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_WRITE]));
316 
317 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SCRUB_LAT_HISTO,
318 	    vsx->vsx_queue_histo[ZIO_PRIORITY_SCRUB],
319 	    ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_SCRUB]));
320 
321 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_TRIM_LAT_HISTO,
322 	    vsx->vsx_queue_histo[ZIO_PRIORITY_TRIM],
323 	    ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_TRIM]));
324 
325 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_REBUILD_LAT_HISTO,
326 	    vsx->vsx_queue_histo[ZIO_PRIORITY_REBUILD],
327 	    ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_REBUILD]));
328 
329 	/* Request sizes */
330 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_IND_R_HISTO,
331 	    vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_READ],
332 	    ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_READ]));
333 
334 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_IND_W_HISTO,
335 	    vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_WRITE],
336 	    ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_WRITE]));
337 
338 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_IND_R_HISTO,
339 	    vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_READ],
340 	    ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_READ]));
341 
342 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_IND_W_HISTO,
343 	    vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_WRITE],
344 	    ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_WRITE]));
345 
346 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_IND_SCRUB_HISTO,
347 	    vsx->vsx_ind_histo[ZIO_PRIORITY_SCRUB],
348 	    ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_SCRUB]));
349 
350 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_IND_TRIM_HISTO,
351 	    vsx->vsx_ind_histo[ZIO_PRIORITY_TRIM],
352 	    ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_TRIM]));
353 
354 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_IND_REBUILD_HISTO,
355 	    vsx->vsx_ind_histo[ZIO_PRIORITY_REBUILD],
356 	    ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_REBUILD]));
357 
358 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_AGG_R_HISTO,
359 	    vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_READ],
360 	    ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_READ]));
361 
362 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_AGG_W_HISTO,
363 	    vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_WRITE],
364 	    ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_WRITE]));
365 
366 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_AGG_R_HISTO,
367 	    vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_READ],
368 	    ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_READ]));
369 
370 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_AGG_W_HISTO,
371 	    vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_WRITE],
372 	    ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_WRITE]));
373 
374 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_AGG_SCRUB_HISTO,
375 	    vsx->vsx_agg_histo[ZIO_PRIORITY_SCRUB],
376 	    ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_SCRUB]));
377 
378 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_AGG_TRIM_HISTO,
379 	    vsx->vsx_agg_histo[ZIO_PRIORITY_TRIM],
380 	    ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_TRIM]));
381 
382 	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_AGG_REBUILD_HISTO,
383 	    vsx->vsx_agg_histo[ZIO_PRIORITY_REBUILD],
384 	    ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_REBUILD]));
385 
386 	/* IO delays */
387 	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SLOW_IOS, vs->vs_slow_ios);
388 
389 	/* Add extended stats nvlist to main nvlist */
390 	fnvlist_add_nvlist(nv, ZPOOL_CONFIG_VDEV_STATS_EX, nvx);
391 
392 	fnvlist_free(nvx);
393 	kmem_free(vs, sizeof (*vs));
394 	kmem_free(vsx, sizeof (*vsx));
395 }
396 
397 static void
398 root_vdev_actions_getprogress(vdev_t *vd, nvlist_t *nvl)
399 {
400 	spa_t *spa = vd->vdev_spa;
401 
402 	if (vd != spa->spa_root_vdev)
403 		return;
404 
405 	/* provide either current or previous scan information */
406 	pool_scan_stat_t ps;
407 	if (spa_scan_get_stats(spa, &ps) == 0) {
408 		fnvlist_add_uint64_array(nvl,
409 		    ZPOOL_CONFIG_SCAN_STATS, (uint64_t *)&ps,
410 		    sizeof (pool_scan_stat_t) / sizeof (uint64_t));
411 	}
412 
413 	pool_removal_stat_t prs;
414 	if (spa_removal_get_stats(spa, &prs) == 0) {
415 		fnvlist_add_uint64_array(nvl,
416 		    ZPOOL_CONFIG_REMOVAL_STATS, (uint64_t *)&prs,
417 		    sizeof (prs) / sizeof (uint64_t));
418 	}
419 
420 	pool_checkpoint_stat_t pcs;
421 	if (spa_checkpoint_get_stats(spa, &pcs) == 0) {
422 		fnvlist_add_uint64_array(nvl,
423 		    ZPOOL_CONFIG_CHECKPOINT_STATS, (uint64_t *)&pcs,
424 		    sizeof (pcs) / sizeof (uint64_t));
425 	}
426 }
427 
428 static void
429 top_vdev_actions_getprogress(vdev_t *vd, nvlist_t *nvl)
430 {
431 	if (vd == vd->vdev_top) {
432 		vdev_rebuild_stat_t vrs;
433 		if (vdev_rebuild_get_stats(vd, &vrs) == 0) {
434 			fnvlist_add_uint64_array(nvl,
435 			    ZPOOL_CONFIG_REBUILD_STATS, (uint64_t *)&vrs,
436 			    sizeof (vrs) / sizeof (uint64_t));
437 		}
438 	}
439 }
440 
441 /*
442  * Generate the nvlist representing this vdev's config.
443  */
444 nvlist_t *
445 vdev_config_generate(spa_t *spa, vdev_t *vd, boolean_t getstats,
446     vdev_config_flag_t flags)
447 {
448 	nvlist_t *nv = NULL;
449 	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;
450 
451 	nv = fnvlist_alloc();
452 
453 	fnvlist_add_string(nv, ZPOOL_CONFIG_TYPE, vd->vdev_ops->vdev_op_type);
454 	if (!(flags & (VDEV_CONFIG_SPARE | VDEV_CONFIG_L2CACHE)))
455 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_ID, vd->vdev_id);
456 	fnvlist_add_uint64(nv, ZPOOL_CONFIG_GUID, vd->vdev_guid);
457 
458 	if (vd->vdev_path != NULL)
459 		fnvlist_add_string(nv, ZPOOL_CONFIG_PATH, vd->vdev_path);
460 
461 	if (vd->vdev_devid != NULL)
462 		fnvlist_add_string(nv, ZPOOL_CONFIG_DEVID, vd->vdev_devid);
463 
464 	if (vd->vdev_physpath != NULL)
465 		fnvlist_add_string(nv, ZPOOL_CONFIG_PHYS_PATH,
466 		    vd->vdev_physpath);
467 
468 	if (vd->vdev_enc_sysfs_path != NULL)
469 		fnvlist_add_string(nv, ZPOOL_CONFIG_VDEV_ENC_SYSFS_PATH,
470 		    vd->vdev_enc_sysfs_path);
471 
472 	if (vd->vdev_fru != NULL)
473 		fnvlist_add_string(nv, ZPOOL_CONFIG_FRU, vd->vdev_fru);
474 
475 	if (vd->vdev_ops->vdev_op_config_generate != NULL)
476 		vd->vdev_ops->vdev_op_config_generate(vd, nv);
477 
478 	if (vd->vdev_wholedisk != -1ULL) {
479 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_WHOLE_DISK,
480 		    vd->vdev_wholedisk);
481 	}
482 
483 	if (vd->vdev_not_present && !(flags & VDEV_CONFIG_MISSING))
484 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_NOT_PRESENT, 1);
485 
486 	if (vd->vdev_isspare)
487 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_IS_SPARE, 1);
488 
489 	if (!(flags & (VDEV_CONFIG_SPARE | VDEV_CONFIG_L2CACHE)) &&
490 	    vd == vd->vdev_top) {
491 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_ARRAY,
492 		    vd->vdev_ms_array);
493 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_SHIFT,
494 		    vd->vdev_ms_shift);
495 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_ASHIFT, vd->vdev_ashift);
496 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_ASIZE,
497 		    vd->vdev_asize);
498 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_IS_LOG, vd->vdev_islog);
499 		if (vd->vdev_noalloc) {
500 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_NONALLOCATING,
501 			    vd->vdev_noalloc);
502 		}
503 
504 		/*
505 		 * Slog devices are removed synchronously so don't
506 		 * persist the vdev_removing flag to the label.
507 		 */
508 		if (vd->vdev_removing && !vd->vdev_islog) {
509 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_REMOVING,
510 			    vd->vdev_removing);
511 		}
512 
513 		/* zpool command expects alloc class data */
514 		if (getstats && vd->vdev_alloc_bias != VDEV_BIAS_NONE) {
515 			const char *bias = NULL;
516 
517 			switch (vd->vdev_alloc_bias) {
518 			case VDEV_BIAS_LOG:
519 				bias = VDEV_ALLOC_BIAS_LOG;
520 				break;
521 			case VDEV_BIAS_SPECIAL:
522 				bias = VDEV_ALLOC_BIAS_SPECIAL;
523 				break;
524 			case VDEV_BIAS_DEDUP:
525 				bias = VDEV_ALLOC_BIAS_DEDUP;
526 				break;
527 			default:
528 				ASSERT3U(vd->vdev_alloc_bias, ==,
529 				    VDEV_BIAS_NONE);
530 			}
531 			fnvlist_add_string(nv, ZPOOL_CONFIG_ALLOCATION_BIAS,
532 			    bias);
533 		}
534 	}
535 
536 	if (vd->vdev_dtl_sm != NULL) {
537 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_DTL,
538 		    space_map_object(vd->vdev_dtl_sm));
539 	}
540 
541 	if (vic->vic_mapping_object != 0) {
542 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_OBJECT,
543 		    vic->vic_mapping_object);
544 	}
545 
546 	if (vic->vic_births_object != 0) {
547 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_BIRTHS,
548 		    vic->vic_births_object);
549 	}
550 
551 	if (vic->vic_prev_indirect_vdev != UINT64_MAX) {
552 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_PREV_INDIRECT_VDEV,
553 		    vic->vic_prev_indirect_vdev);
554 	}
555 
556 	if (vd->vdev_crtxg)
557 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_CREATE_TXG, vd->vdev_crtxg);
558 
559 	if (vd->vdev_expansion_time)
560 		fnvlist_add_uint64(nv, ZPOOL_CONFIG_EXPANSION_TIME,
561 		    vd->vdev_expansion_time);
562 
563 	if (flags & VDEV_CONFIG_MOS) {
564 		if (vd->vdev_leaf_zap != 0) {
565 			ASSERT(vd->vdev_ops->vdev_op_leaf);
566 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_VDEV_LEAF_ZAP,
567 			    vd->vdev_leaf_zap);
568 		}
569 
570 		if (vd->vdev_top_zap != 0) {
571 			ASSERT(vd == vd->vdev_top);
572 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_VDEV_TOP_ZAP,
573 			    vd->vdev_top_zap);
574 		}
575 
576 		if (vd->vdev_resilver_deferred) {
577 			ASSERT(vd->vdev_ops->vdev_op_leaf);
578 			ASSERT(spa->spa_resilver_deferred);
579 			fnvlist_add_boolean(nv, ZPOOL_CONFIG_RESILVER_DEFER);
580 		}
581 	}
582 
583 	if (getstats) {
584 		vdev_config_generate_stats(vd, nv);
585 
586 		root_vdev_actions_getprogress(vd, nv);
587 		top_vdev_actions_getprogress(vd, nv);
588 
589 		/*
590 		 * Note: this can be called from open context
591 		 * (spa_get_stats()), so we need the rwlock to prevent
592 		 * the mapping from being changed by condensing.
593 		 */
594 		rw_enter(&vd->vdev_indirect_rwlock, RW_READER);
595 		if (vd->vdev_indirect_mapping != NULL) {
596 			ASSERT(vd->vdev_indirect_births != NULL);
597 			vdev_indirect_mapping_t *vim =
598 			    vd->vdev_indirect_mapping;
599 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_SIZE,
600 			    vdev_indirect_mapping_size(vim));
601 		}
602 		rw_exit(&vd->vdev_indirect_rwlock);
603 		if (vd->vdev_mg != NULL &&
604 		    vd->vdev_mg->mg_fragmentation != ZFS_FRAG_INVALID) {
605 			/*
606 			 * Compute approximately how much memory would be used
607 			 * for the indirect mapping if this device were to
608 			 * be removed.
609 			 *
610 			 * Note: If the frag metric is invalid, then not
611 			 * enough metaslabs have been converted to have
612 			 * histograms.
613 			 */
614 			uint64_t seg_count = 0;
615 			uint64_t to_alloc = vd->vdev_stat.vs_alloc;
616 
617 			/*
618 			 * There are the same number of allocated segments
619 			 * as free segments, so we will have at least one
620 			 * entry per free segment.  However, small free
621 			 * segments (smaller than vdev_removal_max_span)
622 			 * will be combined with adjacent allocated segments
623 			 * as a single mapping.
624 			 */
625 			for (int i = 0; i < RANGE_TREE_HISTOGRAM_SIZE; i++) {
626 				if (i + 1 < highbit64(vdev_removal_max_span)
627 				    - 1) {
628 					to_alloc +=
629 					    vd->vdev_mg->mg_histogram[i] <<
630 					    (i + 1);
631 				} else {
632 					seg_count +=
633 					    vd->vdev_mg->mg_histogram[i];
634 				}
635 			}
636 
637 			/*
638 			 * The maximum length of a mapping is
639 			 * zfs_remove_max_segment, so we need at least one entry
640 			 * per zfs_remove_max_segment of allocated data.
641 			 */
642 			seg_count += to_alloc / spa_remove_max_segment(spa);
643 
644 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_SIZE,
645 			    seg_count *
646 			    sizeof (vdev_indirect_mapping_entry_phys_t));
647 		}
648 	}
649 
650 	if (!vd->vdev_ops->vdev_op_leaf) {
651 		nvlist_t **child;
652 		uint64_t c;
653 
654 		ASSERT(!vd->vdev_ishole);
655 
656 		child = kmem_alloc(vd->vdev_children * sizeof (nvlist_t *),
657 		    KM_SLEEP);
658 
659 		for (c = 0; c < vd->vdev_children; c++) {
660 			child[c] = vdev_config_generate(spa, vd->vdev_child[c],
661 			    getstats, flags);
662 		}
663 
664 		fnvlist_add_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
665 		    (const nvlist_t * const *)child, vd->vdev_children);
666 
667 		for (c = 0; c < vd->vdev_children; c++)
668 			nvlist_free(child[c]);
669 
670 		kmem_free(child, vd->vdev_children * sizeof (nvlist_t *));
671 
672 	} else {
673 		const char *aux = NULL;
674 
675 		if (vd->vdev_offline && !vd->vdev_tmpoffline)
676 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_OFFLINE, B_TRUE);
677 		if (vd->vdev_resilver_txg != 0)
678 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_RESILVER_TXG,
679 			    vd->vdev_resilver_txg);
680 		if (vd->vdev_rebuild_txg != 0)
681 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_REBUILD_TXG,
682 			    vd->vdev_rebuild_txg);
683 		if (vd->vdev_faulted)
684 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_FAULTED, B_TRUE);
685 		if (vd->vdev_degraded)
686 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_DEGRADED, B_TRUE);
687 		if (vd->vdev_removed)
688 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_REMOVED, B_TRUE);
689 		if (vd->vdev_unspare)
690 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_UNSPARE, B_TRUE);
691 		if (vd->vdev_ishole)
692 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_IS_HOLE, B_TRUE);
693 
694 		/* Set the reason why we're FAULTED/DEGRADED. */
695 		switch (vd->vdev_stat.vs_aux) {
696 		case VDEV_AUX_ERR_EXCEEDED:
697 			aux = "err_exceeded";
698 			break;
699 
700 		case VDEV_AUX_EXTERNAL:
701 			aux = "external";
702 			break;
703 		}
704 
705 		if (aux != NULL && !vd->vdev_tmpoffline) {
706 			fnvlist_add_string(nv, ZPOOL_CONFIG_AUX_STATE, aux);
707 		} else {
708 			/*
709 			 * We're healthy - clear any previous AUX_STATE values.
710 			 */
711 			if (nvlist_exists(nv, ZPOOL_CONFIG_AUX_STATE))
712 				nvlist_remove_all(nv, ZPOOL_CONFIG_AUX_STATE);
713 		}
714 
715 		if (vd->vdev_splitting && vd->vdev_orig_guid != 0LL) {
716 			fnvlist_add_uint64(nv, ZPOOL_CONFIG_ORIG_GUID,
717 			    vd->vdev_orig_guid);
718 		}
719 	}
720 
721 	return (nv);
722 }
723 
724 /*
725  * Generate a view of the top-level vdevs.  If we currently have holes
726  * in the namespace, then generate an array which contains a list of holey
727  * vdevs.  Additionally, add the number of top-level children that currently
728  * exist.
729  */
730 void
731 vdev_top_config_generate(spa_t *spa, nvlist_t *config)
732 {
733 	vdev_t *rvd = spa->spa_root_vdev;
734 	uint64_t *array;
735 	uint_t c, idx;
736 
737 	array = kmem_alloc(rvd->vdev_children * sizeof (uint64_t), KM_SLEEP);
738 
739 	for (c = 0, idx = 0; c < rvd->vdev_children; c++) {
740 		vdev_t *tvd = rvd->vdev_child[c];
741 
742 		if (tvd->vdev_ishole) {
743 			array[idx++] = c;
744 		}
745 	}
746 
747 	if (idx) {
748 		VERIFY(nvlist_add_uint64_array(config, ZPOOL_CONFIG_HOLE_ARRAY,
749 		    array, idx) == 0);
750 	}
751 
752 	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_VDEV_CHILDREN,
753 	    rvd->vdev_children) == 0);
754 
755 	kmem_free(array, rvd->vdev_children * sizeof (uint64_t));
756 }
757 
758 /*
759  * Returns the configuration from the label of the given vdev. For vdevs
760  * which don't have a txg value stored on their label (i.e. spares/cache)
761  * or have not been completely initialized (txg = 0) just return
762  * the configuration from the first valid label we find. Otherwise,
763  * find the most up-to-date label that does not exceed the specified
764  * 'txg' value.
765  */
766 nvlist_t *
767 vdev_label_read_config(vdev_t *vd, uint64_t txg)
768 {
769 	spa_t *spa = vd->vdev_spa;
770 	nvlist_t *config = NULL;
771 	vdev_phys_t *vp[VDEV_LABELS];
772 	abd_t *vp_abd[VDEV_LABELS];
773 	zio_t *zio[VDEV_LABELS];
774 	uint64_t best_txg = 0;
775 	uint64_t label_txg = 0;
776 	int error = 0;
777 	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL |
778 	    ZIO_FLAG_SPECULATIVE;
779 
780 	ASSERT(vd->vdev_validate_thread == curthread ||
781 	    spa_config_held(spa, SCL_STATE_ALL, RW_WRITER) == SCL_STATE_ALL);
782 
783 	if (!vdev_readable(vd))
784 		return (NULL);
785 
786 	/*
787 	 * The label for a dRAID distributed spare is not stored on disk.
788 	 * Instead it is generated when needed which allows us to bypass
789 	 * the pipeline when reading the config from the label.
790 	 */
791 	if (vd->vdev_ops == &vdev_draid_spare_ops)
792 		return (vdev_draid_read_config_spare(vd));
793 
794 	for (int l = 0; l < VDEV_LABELS; l++) {
795 		vp_abd[l] = abd_alloc_linear(sizeof (vdev_phys_t), B_TRUE);
796 		vp[l] = abd_to_buf(vp_abd[l]);
797 	}
798 
799 retry:
800 	for (int l = 0; l < VDEV_LABELS; l++) {
801 		zio[l] = zio_root(spa, NULL, NULL, flags);
802 
803 		vdev_label_read(zio[l], vd, l, vp_abd[l],
804 		    offsetof(vdev_label_t, vl_vdev_phys), sizeof (vdev_phys_t),
805 		    NULL, NULL, flags);
806 	}
807 	for (int l = 0; l < VDEV_LABELS; l++) {
808 		nvlist_t *label = NULL;
809 
810 		if (zio_wait(zio[l]) == 0 &&
811 		    nvlist_unpack(vp[l]->vp_nvlist, sizeof (vp[l]->vp_nvlist),
812 		    &label, 0) == 0) {
813 			/*
814 			 * Auxiliary vdevs won't have txg values in their
815 			 * labels and newly added vdevs may not have been
816 			 * completely initialized so just return the
817 			 * configuration from the first valid label we
818 			 * encounter.
819 			 */
820 			error = nvlist_lookup_uint64(label,
821 			    ZPOOL_CONFIG_POOL_TXG, &label_txg);
822 			if ((error || label_txg == 0) && !config) {
823 				config = label;
824 				for (l++; l < VDEV_LABELS; l++)
825 					zio_wait(zio[l]);
826 				break;
827 			} else if (label_txg <= txg && label_txg > best_txg) {
828 				best_txg = label_txg;
829 				nvlist_free(config);
830 				config = fnvlist_dup(label);
831 			}
832 		}
833 
834 		if (label != NULL) {
835 			nvlist_free(label);
836 			label = NULL;
837 		}
838 	}
839 
840 	if (config == NULL && !(flags & ZIO_FLAG_TRYHARD)) {
841 		flags |= ZIO_FLAG_TRYHARD;
842 		goto retry;
843 	}
844 
845 	/*
846 	 * We found a valid label but it didn't pass txg restrictions.
847 	 */
848 	if (config == NULL && label_txg != 0) {
849 		vdev_dbgmsg(vd, "label discarded as txg is too large "
850 		    "(%llu > %llu)", (u_longlong_t)label_txg,
851 		    (u_longlong_t)txg);
852 	}
853 
854 	for (int l = 0; l < VDEV_LABELS; l++) {
855 		abd_free(vp_abd[l]);
856 	}
857 
858 	return (config);
859 }
860 
861 /*
862  * Determine if a device is in use.  The 'spare_guid' parameter will be filled
863  * in with the device guid if this spare is active elsewhere on the system.
864  */
865 static boolean_t
866 vdev_inuse(vdev_t *vd, uint64_t crtxg, vdev_labeltype_t reason,
867     uint64_t *spare_guid, uint64_t *l2cache_guid)
868 {
869 	spa_t *spa = vd->vdev_spa;
870 	uint64_t state, pool_guid, device_guid, txg, spare_pool;
871 	uint64_t vdtxg = 0;
872 	nvlist_t *label;
873 
874 	if (spare_guid)
875 		*spare_guid = 0ULL;
876 	if (l2cache_guid)
877 		*l2cache_guid = 0ULL;
878 
879 	/*
880 	 * Read the label, if any, and perform some basic sanity checks.
881 	 */
882 	if ((label = vdev_label_read_config(vd, -1ULL)) == NULL)
883 		return (B_FALSE);
884 
885 	(void) nvlist_lookup_uint64(label, ZPOOL_CONFIG_CREATE_TXG,
886 	    &vdtxg);
887 
888 	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_STATE,
889 	    &state) != 0 ||
890 	    nvlist_lookup_uint64(label, ZPOOL_CONFIG_GUID,
891 	    &device_guid) != 0) {
892 		nvlist_free(label);
893 		return (B_FALSE);
894 	}
895 
896 	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
897 	    (nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_GUID,
898 	    &pool_guid) != 0 ||
899 	    nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_TXG,
900 	    &txg) != 0)) {
901 		nvlist_free(label);
902 		return (B_FALSE);
903 	}
904 
905 	nvlist_free(label);
906 
907 	/*
908 	 * Check to see if this device indeed belongs to the pool it claims to
909 	 * be a part of.  The only way this is allowed is if the device is a hot
910 	 * spare (which we check for later on).
911 	 */
912 	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
913 	    !spa_guid_exists(pool_guid, device_guid) &&
914 	    !spa_spare_exists(device_guid, NULL, NULL) &&
915 	    !spa_l2cache_exists(device_guid, NULL))
916 		return (B_FALSE);
917 
918 	/*
919 	 * If the transaction group is zero, then this an initialized (but
920 	 * unused) label.  This is only an error if the create transaction
921 	 * on-disk is the same as the one we're using now, in which case the
922 	 * user has attempted to add the same vdev multiple times in the same
923 	 * transaction.
924 	 */
925 	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
926 	    txg == 0 && vdtxg == crtxg)
927 		return (B_TRUE);
928 
929 	/*
930 	 * Check to see if this is a spare device.  We do an explicit check for
931 	 * spa_has_spare() here because it may be on our pending list of spares
932 	 * to add.
933 	 */
934 	if (spa_spare_exists(device_guid, &spare_pool, NULL) ||
935 	    spa_has_spare(spa, device_guid)) {
936 		if (spare_guid)
937 			*spare_guid = device_guid;
938 
939 		switch (reason) {
940 		case VDEV_LABEL_CREATE:
941 			return (B_TRUE);
942 
943 		case VDEV_LABEL_REPLACE:
944 			return (!spa_has_spare(spa, device_guid) ||
945 			    spare_pool != 0ULL);
946 
947 		case VDEV_LABEL_SPARE:
948 			return (spa_has_spare(spa, device_guid));
949 		default:
950 			break;
951 		}
952 	}
953 
954 	/*
955 	 * Check to see if this is an l2cache device.
956 	 */
957 	if (spa_l2cache_exists(device_guid, NULL) ||
958 	    spa_has_l2cache(spa, device_guid)) {
959 		if (l2cache_guid)
960 			*l2cache_guid = device_guid;
961 
962 		switch (reason) {
963 		case VDEV_LABEL_CREATE:
964 			return (B_TRUE);
965 
966 		case VDEV_LABEL_REPLACE:
967 			return (!spa_has_l2cache(spa, device_guid));
968 
969 		case VDEV_LABEL_L2CACHE:
970 			return (spa_has_l2cache(spa, device_guid));
971 		default:
972 			break;
973 		}
974 	}
975 
976 	/*
977 	 * We can't rely on a pool's state if it's been imported
978 	 * read-only.  Instead we look to see if the pools is marked
979 	 * read-only in the namespace and set the state to active.
980 	 */
981 	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
982 	    (spa = spa_by_guid(pool_guid, device_guid)) != NULL &&
983 	    spa_mode(spa) == SPA_MODE_READ)
984 		state = POOL_STATE_ACTIVE;
985 
986 	/*
987 	 * If the device is marked ACTIVE, then this device is in use by another
988 	 * pool on the system.
989 	 */
990 	return (state == POOL_STATE_ACTIVE);
991 }
992 
993 /*
994  * Initialize a vdev label.  We check to make sure each leaf device is not in
995  * use, and writable.  We put down an initial label which we will later
996  * overwrite with a complete label.  Note that it's important to do this
997  * sequentially, not in parallel, so that we catch cases of multiple use of the
998  * same leaf vdev in the vdev we're creating -- e.g. mirroring a disk with
999  * itself.
1000  */
1001 int
1002 vdev_label_init(vdev_t *vd, uint64_t crtxg, vdev_labeltype_t reason)
1003 {
1004 	spa_t *spa = vd->vdev_spa;
1005 	nvlist_t *label;
1006 	vdev_phys_t *vp;
1007 	abd_t *vp_abd;
1008 	abd_t *bootenv;
1009 	uberblock_t *ub;
1010 	abd_t *ub_abd;
1011 	zio_t *zio;
1012 	char *buf;
1013 	size_t buflen;
1014 	int error;
1015 	uint64_t spare_guid = 0, l2cache_guid = 0;
1016 	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL;
1017 
1018 	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);
1019 
1020 	for (int c = 0; c < vd->vdev_children; c++)
1021 		if ((error = vdev_label_init(vd->vdev_child[c],
1022 		    crtxg, reason)) != 0)
1023 			return (error);
1024 
1025 	/* Track the creation time for this vdev */
1026 	vd->vdev_crtxg = crtxg;
1027 
1028 	if (!vd->vdev_ops->vdev_op_leaf || !spa_writeable(spa))
1029 		return (0);
1030 
1031 	/*
1032 	 * Dead vdevs cannot be initialized.
1033 	 */
1034 	if (vdev_is_dead(vd))
1035 		return (SET_ERROR(EIO));
1036 
1037 	/*
1038 	 * Determine if the vdev is in use.
1039 	 */
1040 	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_SPLIT &&
1041 	    vdev_inuse(vd, crtxg, reason, &spare_guid, &l2cache_guid))
1042 		return (SET_ERROR(EBUSY));
1043 
1044 	/*
1045 	 * If this is a request to add or replace a spare or l2cache device
1046 	 * that is in use elsewhere on the system, then we must update the
1047 	 * guid (which was initialized to a random value) to reflect the
1048 	 * actual GUID (which is shared between multiple pools).
1049 	 */
1050 	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_L2CACHE &&
1051 	    spare_guid != 0ULL) {
1052 		uint64_t guid_delta = spare_guid - vd->vdev_guid;
1053 
1054 		vd->vdev_guid += guid_delta;
1055 
1056 		for (vdev_t *pvd = vd; pvd != NULL; pvd = pvd->vdev_parent)
1057 			pvd->vdev_guid_sum += guid_delta;
1058 
1059 		/*
1060 		 * If this is a replacement, then we want to fallthrough to the
1061 		 * rest of the code.  If we're adding a spare, then it's already
1062 		 * labeled appropriately and we can just return.
1063 		 */
1064 		if (reason == VDEV_LABEL_SPARE)
1065 			return (0);
1066 		ASSERT(reason == VDEV_LABEL_REPLACE ||
1067 		    reason == VDEV_LABEL_SPLIT);
1068 	}
1069 
1070 	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_SPARE &&
1071 	    l2cache_guid != 0ULL) {
1072 		uint64_t guid_delta = l2cache_guid - vd->vdev_guid;
1073 
1074 		vd->vdev_guid += guid_delta;
1075 
1076 		for (vdev_t *pvd = vd; pvd != NULL; pvd = pvd->vdev_parent)
1077 			pvd->vdev_guid_sum += guid_delta;
1078 
1079 		/*
1080 		 * If this is a replacement, then we want to fallthrough to the
1081 		 * rest of the code.  If we're adding an l2cache, then it's
1082 		 * already labeled appropriately and we can just return.
1083 		 */
1084 		if (reason == VDEV_LABEL_L2CACHE)
1085 			return (0);
1086 		ASSERT(reason == VDEV_LABEL_REPLACE);
1087 	}
1088 
1089 	/*
1090 	 * Initialize its label.
1091 	 */
1092 	vp_abd = abd_alloc_linear(sizeof (vdev_phys_t), B_TRUE);
1093 	abd_zero(vp_abd, sizeof (vdev_phys_t));
1094 	vp = abd_to_buf(vp_abd);
1095 
1096 	/*
1097 	 * Generate a label describing the pool and our top-level vdev.
1098 	 * We mark it as being from txg 0 to indicate that it's not
1099 	 * really part of an active pool just yet.  The labels will
1100 	 * be written again with a meaningful txg by spa_sync().
1101 	 */
1102 	if (reason == VDEV_LABEL_SPARE ||
1103 	    (reason == VDEV_LABEL_REMOVE && vd->vdev_isspare)) {
1104 		/*
1105 		 * For inactive hot spares, we generate a special label that
1106 		 * identifies as a mutually shared hot spare.  We write the
1107 		 * label if we are adding a hot spare, or if we are removing an
1108 		 * active hot spare (in which case we want to revert the
1109 		 * labels).
1110 		 */
1111 		VERIFY(nvlist_alloc(&label, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1112 
1113 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_VERSION,
1114 		    spa_version(spa)) == 0);
1115 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_POOL_STATE,
1116 		    POOL_STATE_SPARE) == 0);
1117 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_GUID,
1118 		    vd->vdev_guid) == 0);
1119 	} else if (reason == VDEV_LABEL_L2CACHE ||
1120 	    (reason == VDEV_LABEL_REMOVE && vd->vdev_isl2cache)) {
1121 		/*
1122 		 * For level 2 ARC devices, add a special label.
1123 		 */
1124 		VERIFY(nvlist_alloc(&label, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1125 
1126 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_VERSION,
1127 		    spa_version(spa)) == 0);
1128 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_POOL_STATE,
1129 		    POOL_STATE_L2CACHE) == 0);
1130 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_GUID,
1131 		    vd->vdev_guid) == 0);
1132 	} else {
1133 		uint64_t txg = 0ULL;
1134 
1135 		if (reason == VDEV_LABEL_SPLIT)
1136 			txg = spa->spa_uberblock.ub_txg;
1137 		label = spa_config_generate(spa, vd, txg, B_FALSE);
1138 
1139 		/*
1140 		 * Add our creation time.  This allows us to detect multiple
1141 		 * vdev uses as described above, and automatically expires if we
1142 		 * fail.
1143 		 */
1144 		VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_CREATE_TXG,
1145 		    crtxg) == 0);
1146 	}
1147 
1148 	buf = vp->vp_nvlist;
1149 	buflen = sizeof (vp->vp_nvlist);
1150 
1151 	error = nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, KM_SLEEP);
1152 	if (error != 0) {
1153 		nvlist_free(label);
1154 		abd_free(vp_abd);
1155 		/* EFAULT means nvlist_pack ran out of room */
1156 		return (SET_ERROR(error == EFAULT ? ENAMETOOLONG : EINVAL));
1157 	}
1158 
1159 	/*
1160 	 * Initialize uberblock template.
1161 	 */
1162 	ub_abd = abd_alloc_linear(VDEV_UBERBLOCK_RING, B_TRUE);
1163 	abd_zero(ub_abd, VDEV_UBERBLOCK_RING);
1164 	abd_copy_from_buf(ub_abd, &spa->spa_uberblock, sizeof (uberblock_t));
1165 	ub = abd_to_buf(ub_abd);
1166 	ub->ub_txg = 0;
1167 
1168 	/* Initialize the 2nd padding area. */
1169 	bootenv = abd_alloc_for_io(VDEV_PAD_SIZE, B_TRUE);
1170 	abd_zero(bootenv, VDEV_PAD_SIZE);
1171 
1172 	/*
1173 	 * Write everything in parallel.
1174 	 */
1175 retry:
1176 	zio = zio_root(spa, NULL, NULL, flags);
1177 
1178 	for (int l = 0; l < VDEV_LABELS; l++) {
1179 
1180 		vdev_label_write(zio, vd, l, vp_abd,
1181 		    offsetof(vdev_label_t, vl_vdev_phys),
1182 		    sizeof (vdev_phys_t), NULL, NULL, flags);
1183 
1184 		/*
1185 		 * Skip the 1st padding area.
1186 		 * Zero out the 2nd padding area where it might have
1187 		 * left over data from previous filesystem format.
1188 		 */
1189 		vdev_label_write(zio, vd, l, bootenv,
1190 		    offsetof(vdev_label_t, vl_be),
1191 		    VDEV_PAD_SIZE, NULL, NULL, flags);
1192 
1193 		vdev_label_write(zio, vd, l, ub_abd,
1194 		    offsetof(vdev_label_t, vl_uberblock),
1195 		    VDEV_UBERBLOCK_RING, NULL, NULL, flags);
1196 	}
1197 
1198 	error = zio_wait(zio);
1199 
1200 	if (error != 0 && !(flags & ZIO_FLAG_TRYHARD)) {
1201 		flags |= ZIO_FLAG_TRYHARD;
1202 		goto retry;
1203 	}
1204 
1205 	nvlist_free(label);
1206 	abd_free(bootenv);
1207 	abd_free(ub_abd);
1208 	abd_free(vp_abd);
1209 
1210 	/*
1211 	 * If this vdev hasn't been previously identified as a spare, then we
1212 	 * mark it as such only if a) we are labeling it as a spare, or b) it
1213 	 * exists as a spare elsewhere in the system.  Do the same for
1214 	 * level 2 ARC devices.
1215 	 */
1216 	if (error == 0 && !vd->vdev_isspare &&
1217 	    (reason == VDEV_LABEL_SPARE ||
1218 	    spa_spare_exists(vd->vdev_guid, NULL, NULL)))
1219 		spa_spare_add(vd);
1220 
1221 	if (error == 0 && !vd->vdev_isl2cache &&
1222 	    (reason == VDEV_LABEL_L2CACHE ||
1223 	    spa_l2cache_exists(vd->vdev_guid, NULL)))
1224 		spa_l2cache_add(vd);
1225 
1226 	return (error);
1227 }
1228 
1229 /*
1230  * Done callback for vdev_label_read_bootenv_impl. If this is the first
1231  * callback to finish, store our abd in the callback pointer. Otherwise, we
1232  * just free our abd and return.
1233  */
1234 static void
1235 vdev_label_read_bootenv_done(zio_t *zio)
1236 {
1237 	zio_t *rio = zio->io_private;
1238 	abd_t **cbp = rio->io_private;
1239 
1240 	ASSERT3U(zio->io_size, ==, VDEV_PAD_SIZE);
1241 
1242 	if (zio->io_error == 0) {
1243 		mutex_enter(&rio->io_lock);
1244 		if (*cbp == NULL) {
1245 			/* Will free this buffer in vdev_label_read_bootenv. */
1246 			*cbp = zio->io_abd;
1247 		} else {
1248 			abd_free(zio->io_abd);
1249 		}
1250 		mutex_exit(&rio->io_lock);
1251 	} else {
1252 		abd_free(zio->io_abd);
1253 	}
1254 }
1255 
1256 static void
1257 vdev_label_read_bootenv_impl(zio_t *zio, vdev_t *vd, int flags)
1258 {
1259 	for (int c = 0; c < vd->vdev_children; c++)
1260 		vdev_label_read_bootenv_impl(zio, vd->vdev_child[c], flags);
1261 
1262 	/*
1263 	 * We just use the first label that has a correct checksum; the
1264 	 * bootloader should have rewritten them all to be the same on boot,
1265 	 * and any changes we made since boot have been the same across all
1266 	 * labels.
1267 	 */
1268 	if (vd->vdev_ops->vdev_op_leaf && vdev_readable(vd)) {
1269 		for (int l = 0; l < VDEV_LABELS; l++) {
1270 			vdev_label_read(zio, vd, l,
1271 			    abd_alloc_linear(VDEV_PAD_SIZE, B_FALSE),
1272 			    offsetof(vdev_label_t, vl_be), VDEV_PAD_SIZE,
1273 			    vdev_label_read_bootenv_done, zio, flags);
1274 		}
1275 	}
1276 }
1277 
1278 int
1279 vdev_label_read_bootenv(vdev_t *rvd, nvlist_t *bootenv)
1280 {
1281 	nvlist_t *config;
1282 	spa_t *spa = rvd->vdev_spa;
1283 	abd_t *abd = NULL;
1284 	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL |
1285 	    ZIO_FLAG_SPECULATIVE | ZIO_FLAG_TRYHARD;
1286 
1287 	ASSERT(bootenv);
1288 	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);
1289 
1290 	zio_t *zio = zio_root(spa, NULL, &abd, flags);
1291 	vdev_label_read_bootenv_impl(zio, rvd, flags);
1292 	int err = zio_wait(zio);
1293 
1294 	if (abd != NULL) {
1295 		char *buf;
1296 		vdev_boot_envblock_t *vbe = abd_to_buf(abd);
1297 
1298 		vbe->vbe_version = ntohll(vbe->vbe_version);
1299 		switch (vbe->vbe_version) {
1300 		case VB_RAW:
1301 			/*
1302 			 * if we have textual data in vbe_bootenv, create nvlist
1303 			 * with key "envmap".
1304 			 */
1305 			fnvlist_add_uint64(bootenv, BOOTENV_VERSION, VB_RAW);
1306 			vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0';
1307 			fnvlist_add_string(bootenv, GRUB_ENVMAP,
1308 			    vbe->vbe_bootenv);
1309 			break;
1310 
1311 		case VB_NVLIST:
1312 			err = nvlist_unpack(vbe->vbe_bootenv,
1313 			    sizeof (vbe->vbe_bootenv), &config, 0);
1314 			if (err == 0) {
1315 				fnvlist_merge(bootenv, config);
1316 				nvlist_free(config);
1317 				break;
1318 			}
1319 			zfs_fallthrough;
1320 		default:
1321 			/* Check for FreeBSD zfs bootonce command string */
1322 			buf = abd_to_buf(abd);
1323 			if (*buf == '\0') {
1324 				fnvlist_add_uint64(bootenv, BOOTENV_VERSION,
1325 				    VB_NVLIST);
1326 				break;
1327 			}
1328 			fnvlist_add_string(bootenv, FREEBSD_BOOTONCE, buf);
1329 		}
1330 
1331 		/*
1332 		 * abd was allocated in vdev_label_read_bootenv_impl()
1333 		 */
1334 		abd_free(abd);
1335 		/*
1336 		 * If we managed to read any successfully,
1337 		 * return success.
1338 		 */
1339 		return (0);
1340 	}
1341 	return (err);
1342 }
1343 
1344 int
1345 vdev_label_write_bootenv(vdev_t *vd, nvlist_t *env)
1346 {
1347 	zio_t *zio;
1348 	spa_t *spa = vd->vdev_spa;
1349 	vdev_boot_envblock_t *bootenv;
1350 	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL;
1351 	int error;
1352 	size_t nvsize;
1353 	char *nvbuf;
1354 	const char *tmp;
1355 
1356 	error = nvlist_size(env, &nvsize, NV_ENCODE_XDR);
1357 	if (error != 0)
1358 		return (SET_ERROR(error));
1359 
1360 	if (nvsize >= sizeof (bootenv->vbe_bootenv)) {
1361 		return (SET_ERROR(E2BIG));
1362 	}
1363 
1364 	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);
1365 
1366 	error = ENXIO;
1367 	for (int c = 0; c < vd->vdev_children; c++) {
1368 		int child_err;
1369 
1370 		child_err = vdev_label_write_bootenv(vd->vdev_child[c], env);
1371 		/*
1372 		 * As long as any of the disks managed to write all of their
1373 		 * labels successfully, return success.
1374 		 */
1375 		if (child_err == 0)
1376 			error = child_err;
1377 	}
1378 
1379 	if (!vd->vdev_ops->vdev_op_leaf || vdev_is_dead(vd) ||
1380 	    !vdev_writeable(vd)) {
1381 		return (error);
1382 	}
1383 	ASSERT3U(sizeof (*bootenv), ==, VDEV_PAD_SIZE);
1384 	abd_t *abd = abd_alloc_for_io(VDEV_PAD_SIZE, B_TRUE);
1385 	abd_zero(abd, VDEV_PAD_SIZE);
1386 
1387 	bootenv = abd_borrow_buf_copy(abd, VDEV_PAD_SIZE);
1388 	nvbuf = bootenv->vbe_bootenv;
1389 	nvsize = sizeof (bootenv->vbe_bootenv);
1390 
1391 	bootenv->vbe_version = fnvlist_lookup_uint64(env, BOOTENV_VERSION);
1392 	switch (bootenv->vbe_version) {
1393 	case VB_RAW:
1394 		if (nvlist_lookup_string(env, GRUB_ENVMAP, &tmp) == 0) {
1395 			(void) strlcpy(bootenv->vbe_bootenv, tmp, nvsize);
1396 		}
1397 		error = 0;
1398 		break;
1399 
1400 	case VB_NVLIST:
1401 		error = nvlist_pack(env, &nvbuf, &nvsize, NV_ENCODE_XDR,
1402 		    KM_SLEEP);
1403 		break;
1404 
1405 	default:
1406 		error = EINVAL;
1407 		break;
1408 	}
1409 
1410 	if (error == 0) {
1411 		bootenv->vbe_version = htonll(bootenv->vbe_version);
1412 		abd_return_buf_copy(abd, bootenv, VDEV_PAD_SIZE);
1413 	} else {
1414 		abd_free(abd);
1415 		return (SET_ERROR(error));
1416 	}
1417 
1418 retry:
1419 	zio = zio_root(spa, NULL, NULL, flags);
1420 	for (int l = 0; l < VDEV_LABELS; l++) {
1421 		vdev_label_write(zio, vd, l, abd,
1422 		    offsetof(vdev_label_t, vl_be),
1423 		    VDEV_PAD_SIZE, NULL, NULL, flags);
1424 	}
1425 
1426 	error = zio_wait(zio);
1427 	if (error != 0 && !(flags & ZIO_FLAG_TRYHARD)) {
1428 		flags |= ZIO_FLAG_TRYHARD;
1429 		goto retry;
1430 	}
1431 
1432 	abd_free(abd);
1433 	return (error);
1434 }
1435 
1436 /*
1437  * ==========================================================================
1438  * uberblock load/sync
1439  * ==========================================================================
1440  */
1441 
1442 /*
1443  * Consider the following situation: txg is safely synced to disk.  We've
1444  * written the first uberblock for txg + 1, and then we lose power.  When we
1445  * come back up, we fail to see the uberblock for txg + 1 because, say,
1446  * it was on a mirrored device and the replica to which we wrote txg + 1
1447  * is now offline.  If we then make some changes and sync txg + 1, and then
1448  * the missing replica comes back, then for a few seconds we'll have two
1449  * conflicting uberblocks on disk with the same txg.  The solution is simple:
1450  * among uberblocks with equal txg, choose the one with the latest timestamp.
1451  */
1452 static int
1453 vdev_uberblock_compare(const uberblock_t *ub1, const uberblock_t *ub2)
1454 {
1455 	int cmp = TREE_CMP(ub1->ub_txg, ub2->ub_txg);
1456 
1457 	if (likely(cmp))
1458 		return (cmp);
1459 
1460 	cmp = TREE_CMP(ub1->ub_timestamp, ub2->ub_timestamp);
1461 	if (likely(cmp))
1462 		return (cmp);
1463 
1464 	/*
1465 	 * If MMP_VALID(ub) && MMP_SEQ_VALID(ub) then the host has an MMP-aware
1466 	 * ZFS, e.g. OpenZFS >= 0.7.
1467 	 *
1468 	 * If one ub has MMP and the other does not, they were written by
1469 	 * different hosts, which matters for MMP.  So we treat no MMP/no SEQ as
1470 	 * a 0 value.
1471 	 *
1472 	 * Since timestamp and txg are the same if we get this far, either is
1473 	 * acceptable for importing the pool.
1474 	 */
1475 	unsigned int seq1 = 0;
1476 	unsigned int seq2 = 0;
1477 
1478 	if (MMP_VALID(ub1) && MMP_SEQ_VALID(ub1))
1479 		seq1 = MMP_SEQ(ub1);
1480 
1481 	if (MMP_VALID(ub2) && MMP_SEQ_VALID(ub2))
1482 		seq2 = MMP_SEQ(ub2);
1483 
1484 	return (TREE_CMP(seq1, seq2));
1485 }
1486 
1487 struct ubl_cbdata {
1488 	uberblock_t	*ubl_ubbest;	/* Best uberblock */
1489 	vdev_t		*ubl_vd;	/* vdev associated with the above */
1490 };
1491 
1492 static void
1493 vdev_uberblock_load_done(zio_t *zio)
1494 {
1495 	vdev_t *vd = zio->io_vd;
1496 	spa_t *spa = zio->io_spa;
1497 	zio_t *rio = zio->io_private;
1498 	uberblock_t *ub = abd_to_buf(zio->io_abd);
1499 	struct ubl_cbdata *cbp = rio->io_private;
1500 
1501 	ASSERT3U(zio->io_size, ==, VDEV_UBERBLOCK_SIZE(vd));
1502 
1503 	if (zio->io_error == 0 && uberblock_verify(ub) == 0) {
1504 		mutex_enter(&rio->io_lock);
1505 		if (ub->ub_txg <= spa->spa_load_max_txg &&
1506 		    vdev_uberblock_compare(ub, cbp->ubl_ubbest) > 0) {
1507 			/*
1508 			 * Keep track of the vdev in which this uberblock
1509 			 * was found. We will use this information later
1510 			 * to obtain the config nvlist associated with
1511 			 * this uberblock.
1512 			 */
1513 			*cbp->ubl_ubbest = *ub;
1514 			cbp->ubl_vd = vd;
1515 		}
1516 		mutex_exit(&rio->io_lock);
1517 	}
1518 
1519 	abd_free(zio->io_abd);
1520 }
1521 
1522 static void
1523 vdev_uberblock_load_impl(zio_t *zio, vdev_t *vd, int flags,
1524     struct ubl_cbdata *cbp)
1525 {
1526 	for (int c = 0; c < vd->vdev_children; c++)
1527 		vdev_uberblock_load_impl(zio, vd->vdev_child[c], flags, cbp);
1528 
1529 	if (vd->vdev_ops->vdev_op_leaf && vdev_readable(vd) &&
1530 	    vd->vdev_ops != &vdev_draid_spare_ops) {
1531 		for (int l = 0; l < VDEV_LABELS; l++) {
1532 			for (int n = 0; n < VDEV_UBERBLOCK_COUNT(vd); n++) {
1533 				vdev_label_read(zio, vd, l,
1534 				    abd_alloc_linear(VDEV_UBERBLOCK_SIZE(vd),
1535 				    B_TRUE), VDEV_UBERBLOCK_OFFSET(vd, n),
1536 				    VDEV_UBERBLOCK_SIZE(vd),
1537 				    vdev_uberblock_load_done, zio, flags);
1538 			}
1539 		}
1540 	}
1541 }
1542 
1543 /*
1544  * Reads the 'best' uberblock from disk along with its associated
1545  * configuration. First, we read the uberblock array of each label of each
1546  * vdev, keeping track of the uberblock with the highest txg in each array.
1547  * Then, we read the configuration from the same vdev as the best uberblock.
1548  */
1549 void
1550 vdev_uberblock_load(vdev_t *rvd, uberblock_t *ub, nvlist_t **config)
1551 {
1552 	zio_t *zio;
1553 	spa_t *spa = rvd->vdev_spa;
1554 	struct ubl_cbdata cb;
1555 	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL |
1556 	    ZIO_FLAG_SPECULATIVE | ZIO_FLAG_TRYHARD;
1557 
1558 	ASSERT(ub);
1559 	ASSERT(config);
1560 
1561 	memset(ub, 0, sizeof (uberblock_t));
1562 	*config = NULL;
1563 
1564 	cb.ubl_ubbest = ub;
1565 	cb.ubl_vd = NULL;
1566 
1567 	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
1568 	zio = zio_root(spa, NULL, &cb, flags);
1569 	vdev_uberblock_load_impl(zio, rvd, flags, &cb);
1570 	(void) zio_wait(zio);
1571 
1572 	/*
1573 	 * It's possible that the best uberblock was discovered on a label
1574 	 * that has a configuration which was written in a future txg.
1575 	 * Search all labels on this vdev to find the configuration that
1576 	 * matches the txg for our uberblock.
1577 	 */
1578 	if (cb.ubl_vd != NULL) {
1579 		vdev_dbgmsg(cb.ubl_vd, "best uberblock found for spa %s. "
1580 		    "txg %llu", spa->spa_name, (u_longlong_t)ub->ub_txg);
1581 
1582 		*config = vdev_label_read_config(cb.ubl_vd, ub->ub_txg);
1583 		if (*config == NULL && spa->spa_extreme_rewind) {
1584 			vdev_dbgmsg(cb.ubl_vd, "failed to read label config. "
1585 			    "Trying again without txg restrictions.");
1586 			*config = vdev_label_read_config(cb.ubl_vd, UINT64_MAX);
1587 		}
1588 		if (*config == NULL) {
1589 			vdev_dbgmsg(cb.ubl_vd, "failed to read label config");
1590 		}
1591 	}
1592 	spa_config_exit(spa, SCL_ALL, FTAG);
1593 }
1594 
1595 /*
1596  * For use when a leaf vdev is expanded.
1597  * The location of labels 2 and 3 changed, and at the new location the
1598  * uberblock rings are either empty or contain garbage.  The sync will write
1599  * new configs there because the vdev is dirty, but expansion also needs the
1600  * uberblock rings copied.  Read them from label 0 which did not move.
1601  *
1602  * Since the point is to populate labels {2,3} with valid uberblocks,
1603  * we zero uberblocks we fail to read or which are not valid.
1604  */
1605 
1606 static void
1607 vdev_copy_uberblocks(vdev_t *vd)
1608 {
1609 	abd_t *ub_abd;
1610 	zio_t *write_zio;
1611 	int locks = (SCL_L2ARC | SCL_ZIO);
1612 	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL |
1613 	    ZIO_FLAG_SPECULATIVE;
1614 
1615 	ASSERT(spa_config_held(vd->vdev_spa, SCL_STATE, RW_READER) ==
1616 	    SCL_STATE);
1617 	ASSERT(vd->vdev_ops->vdev_op_leaf);
1618 
1619 	/*
1620 	 * No uberblocks are stored on distributed spares, they may be
1621 	 * safely skipped when expanding a leaf vdev.
1622 	 */
1623 	if (vd->vdev_ops == &vdev_draid_spare_ops)
1624 		return;
1625 
1626 	spa_config_enter(vd->vdev_spa, locks, FTAG, RW_READER);
1627 
1628 	ub_abd = abd_alloc_linear(VDEV_UBERBLOCK_SIZE(vd), B_TRUE);
1629 
1630 	write_zio = zio_root(vd->vdev_spa, NULL, NULL, flags);
1631 	for (int n = 0; n < VDEV_UBERBLOCK_COUNT(vd); n++) {
1632 		const int src_label = 0;
1633 		zio_t *zio;
1634 
1635 		zio = zio_root(vd->vdev_spa, NULL, NULL, flags);
1636 		vdev_label_read(zio, vd, src_label, ub_abd,
1637 		    VDEV_UBERBLOCK_OFFSET(vd, n), VDEV_UBERBLOCK_SIZE(vd),
1638 		    NULL, NULL, flags);
1639 
1640 		if (zio_wait(zio) || uberblock_verify(abd_to_buf(ub_abd)))
1641 			abd_zero(ub_abd, VDEV_UBERBLOCK_SIZE(vd));
1642 
1643 		for (int l = 2; l < VDEV_LABELS; l++)
1644 			vdev_label_write(write_zio, vd, l, ub_abd,
1645 			    VDEV_UBERBLOCK_OFFSET(vd, n),
1646 			    VDEV_UBERBLOCK_SIZE(vd), NULL, NULL,
1647 			    flags | ZIO_FLAG_DONT_PROPAGATE);
1648 	}
1649 	(void) zio_wait(write_zio);
1650 
1651 	spa_config_exit(vd->vdev_spa, locks, FTAG);
1652 
1653 	abd_free(ub_abd);
1654 }
1655 
1656 /*
1657  * On success, increment root zio's count of good writes.
1658  * We only get credit for writes to known-visible vdevs; see spa_vdev_add().
1659  */
1660 static void
1661 vdev_uberblock_sync_done(zio_t *zio)
1662 {
1663 	uint64_t *good_writes = zio->io_private;
1664 
1665 	if (zio->io_error == 0 && zio->io_vd->vdev_top->vdev_ms_array != 0)
1666 		atomic_inc_64(good_writes);
1667 }
1668 
1669 /*
1670  * Write the uberblock to all labels of all leaves of the specified vdev.
1671  */
1672 static void
1673 vdev_uberblock_sync(zio_t *zio, uint64_t *good_writes,
1674     uberblock_t *ub, vdev_t *vd, int flags)
1675 {
1676 	for (uint64_t c = 0; c < vd->vdev_children; c++) {
1677 		vdev_uberblock_sync(zio, good_writes,
1678 		    ub, vd->vdev_child[c], flags);
1679 	}
1680 
1681 	if (!vd->vdev_ops->vdev_op_leaf)
1682 		return;
1683 
1684 	if (!vdev_writeable(vd))
1685 		return;
1686 
1687 	/*
1688 	 * There's no need to write uberblocks to a distributed spare, they
1689 	 * are already stored on all the leaves of the parent dRAID.  For
1690 	 * this same reason vdev_uberblock_load_impl() skips distributed
1691 	 * spares when reading uberblocks.
1692 	 */
1693 	if (vd->vdev_ops == &vdev_draid_spare_ops)
1694 		return;
1695 
1696 	/* If the vdev was expanded, need to copy uberblock rings. */
1697 	if (vd->vdev_state == VDEV_STATE_HEALTHY &&
1698 	    vd->vdev_copy_uberblocks == B_TRUE) {
1699 		vdev_copy_uberblocks(vd);
1700 		vd->vdev_copy_uberblocks = B_FALSE;
1701 	}
1702 
1703 	int m = spa_multihost(vd->vdev_spa) ? MMP_BLOCKS_PER_LABEL : 0;
1704 	int n = ub->ub_txg % (VDEV_UBERBLOCK_COUNT(vd) - m);
1705 
1706 	/* Copy the uberblock_t into the ABD */
1707 	abd_t *ub_abd = abd_alloc_for_io(VDEV_UBERBLOCK_SIZE(vd), B_TRUE);
1708 	abd_zero(ub_abd, VDEV_UBERBLOCK_SIZE(vd));
1709 	abd_copy_from_buf(ub_abd, ub, sizeof (uberblock_t));
1710 
1711 	for (int l = 0; l < VDEV_LABELS; l++)
1712 		vdev_label_write(zio, vd, l, ub_abd,
1713 		    VDEV_UBERBLOCK_OFFSET(vd, n), VDEV_UBERBLOCK_SIZE(vd),
1714 		    vdev_uberblock_sync_done, good_writes,
1715 		    flags | ZIO_FLAG_DONT_PROPAGATE);
1716 
1717 	abd_free(ub_abd);
1718 }
1719 
1720 /* Sync the uberblocks to all vdevs in svd[] */
1721 static int
1722 vdev_uberblock_sync_list(vdev_t **svd, int svdcount, uberblock_t *ub, int flags)
1723 {
1724 	spa_t *spa = svd[0]->vdev_spa;
1725 	zio_t *zio;
1726 	uint64_t good_writes = 0;
1727 
1728 	zio = zio_root(spa, NULL, NULL, flags);
1729 
1730 	for (int v = 0; v < svdcount; v++)
1731 		vdev_uberblock_sync(zio, &good_writes, ub, svd[v], flags);
1732 
1733 	(void) zio_wait(zio);
1734 
1735 	/*
1736 	 * Flush the uberblocks to disk.  This ensures that the odd labels
1737 	 * are no longer needed (because the new uberblocks and the even
1738 	 * labels are safely on disk), so it is safe to overwrite them.
1739 	 */
1740 	zio = zio_root(spa, NULL, NULL, flags);
1741 
1742 	for (int v = 0; v < svdcount; v++) {
1743 		if (vdev_writeable(svd[v])) {
1744 			zio_flush(zio, svd[v]);
1745 		}
1746 	}
1747 
1748 	(void) zio_wait(zio);
1749 
1750 	return (good_writes >= 1 ? 0 : EIO);
1751 }
1752 
1753 /*
1754  * On success, increment the count of good writes for our top-level vdev.
1755  */
1756 static void
1757 vdev_label_sync_done(zio_t *zio)
1758 {
1759 	uint64_t *good_writes = zio->io_private;
1760 
1761 	if (zio->io_error == 0)
1762 		atomic_inc_64(good_writes);
1763 }
1764 
1765 /*
1766  * If there weren't enough good writes, indicate failure to the parent.
1767  */
1768 static void
1769 vdev_label_sync_top_done(zio_t *zio)
1770 {
1771 	uint64_t *good_writes = zio->io_private;
1772 
1773 	if (*good_writes == 0)
1774 		zio->io_error = SET_ERROR(EIO);
1775 
1776 	kmem_free(good_writes, sizeof (uint64_t));
1777 }
1778 
1779 /*
1780  * We ignore errors for log and cache devices, simply free the private data.
1781  */
1782 static void
1783 vdev_label_sync_ignore_done(zio_t *zio)
1784 {
1785 	kmem_free(zio->io_private, sizeof (uint64_t));
1786 }
1787 
1788 /*
1789  * Write all even or odd labels to all leaves of the specified vdev.
1790  */
1791 static void
1792 vdev_label_sync(zio_t *zio, uint64_t *good_writes,
1793     vdev_t *vd, int l, uint64_t txg, int flags)
1794 {
1795 	nvlist_t *label;
1796 	vdev_phys_t *vp;
1797 	abd_t *vp_abd;
1798 	char *buf;
1799 	size_t buflen;
1800 
1801 	for (int c = 0; c < vd->vdev_children; c++) {
1802 		vdev_label_sync(zio, good_writes,
1803 		    vd->vdev_child[c], l, txg, flags);
1804 	}
1805 
1806 	if (!vd->vdev_ops->vdev_op_leaf)
1807 		return;
1808 
1809 	if (!vdev_writeable(vd))
1810 		return;
1811 
1812 	/*
1813 	 * The top-level config never needs to be written to a distributed
1814 	 * spare.  When read vdev_dspare_label_read_config() will generate
1815 	 * the config for the vdev_label_read_config().
1816 	 */
1817 	if (vd->vdev_ops == &vdev_draid_spare_ops)
1818 		return;
1819 
1820 	/*
1821 	 * Generate a label describing the top-level config to which we belong.
1822 	 */
1823 	label = spa_config_generate(vd->vdev_spa, vd, txg, B_FALSE);
1824 
1825 	vp_abd = abd_alloc_linear(sizeof (vdev_phys_t), B_TRUE);
1826 	abd_zero(vp_abd, sizeof (vdev_phys_t));
1827 	vp = abd_to_buf(vp_abd);
1828 
1829 	buf = vp->vp_nvlist;
1830 	buflen = sizeof (vp->vp_nvlist);
1831 
1832 	if (!nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, KM_SLEEP)) {
1833 		for (; l < VDEV_LABELS; l += 2) {
1834 			vdev_label_write(zio, vd, l, vp_abd,
1835 			    offsetof(vdev_label_t, vl_vdev_phys),
1836 			    sizeof (vdev_phys_t),
1837 			    vdev_label_sync_done, good_writes,
1838 			    flags | ZIO_FLAG_DONT_PROPAGATE);
1839 		}
1840 	}
1841 
1842 	abd_free(vp_abd);
1843 	nvlist_free(label);
1844 }
1845 
1846 static int
1847 vdev_label_sync_list(spa_t *spa, int l, uint64_t txg, int flags)
1848 {
1849 	list_t *dl = &spa->spa_config_dirty_list;
1850 	vdev_t *vd;
1851 	zio_t *zio;
1852 	int error;
1853 
1854 	/*
1855 	 * Write the new labels to disk.
1856 	 */
1857 	zio = zio_root(spa, NULL, NULL, flags);
1858 
1859 	for (vd = list_head(dl); vd != NULL; vd = list_next(dl, vd)) {
1860 		uint64_t *good_writes;
1861 
1862 		ASSERT(!vd->vdev_ishole);
1863 
1864 		good_writes = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
1865 		zio_t *vio = zio_null(zio, spa, NULL,
1866 		    (vd->vdev_islog || vd->vdev_aux != NULL) ?
1867 		    vdev_label_sync_ignore_done : vdev_label_sync_top_done,
1868 		    good_writes, flags);
1869 		vdev_label_sync(vio, good_writes, vd, l, txg, flags);
1870 		zio_nowait(vio);
1871 	}
1872 
1873 	error = zio_wait(zio);
1874 
1875 	/*
1876 	 * Flush the new labels to disk.
1877 	 */
1878 	zio = zio_root(spa, NULL, NULL, flags);
1879 
1880 	for (vd = list_head(dl); vd != NULL; vd = list_next(dl, vd))
1881 		zio_flush(zio, vd);
1882 
1883 	(void) zio_wait(zio);
1884 
1885 	return (error);
1886 }
1887 
1888 /*
1889  * Sync the uberblock and any changes to the vdev configuration.
1890  *
1891  * The order of operations is carefully crafted to ensure that
1892  * if the system panics or loses power at any time, the state on disk
1893  * is still transactionally consistent.  The in-line comments below
1894  * describe the failure semantics at each stage.
1895  *
1896  * Moreover, vdev_config_sync() is designed to be idempotent: if it fails
1897  * at any time, you can just call it again, and it will resume its work.
1898  */
1899 int
1900 vdev_config_sync(vdev_t **svd, int svdcount, uint64_t txg)
1901 {
1902 	spa_t *spa = svd[0]->vdev_spa;
1903 	uberblock_t *ub = &spa->spa_uberblock;
1904 	int error = 0;
1905 	int flags = ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_CANFAIL;
1906 
1907 	ASSERT(svdcount != 0);
1908 retry:
1909 	/*
1910 	 * Normally, we don't want to try too hard to write every label and
1911 	 * uberblock.  If there is a flaky disk, we don't want the rest of the
1912 	 * sync process to block while we retry.  But if we can't write a
1913 	 * single label out, we should retry with ZIO_FLAG_TRYHARD before
1914 	 * bailing out and declaring the pool faulted.
1915 	 */
1916 	if (error != 0) {
1917 		if ((flags & ZIO_FLAG_TRYHARD) != 0)
1918 			return (error);
1919 		flags |= ZIO_FLAG_TRYHARD;
1920 	}
1921 
1922 	ASSERT(ub->ub_txg <= txg);
1923 
1924 	/*
1925 	 * If this isn't a resync due to I/O errors,
1926 	 * and nothing changed in this transaction group,
1927 	 * and the vdev configuration hasn't changed,
1928 	 * then there's nothing to do.
1929 	 */
1930 	if (ub->ub_txg < txg) {
1931 		boolean_t changed = uberblock_update(ub, spa->spa_root_vdev,
1932 		    txg, spa->spa_mmp.mmp_delay);
1933 
1934 		if (!changed && list_is_empty(&spa->spa_config_dirty_list))
1935 			return (0);
1936 	}
1937 
1938 	if (txg > spa_freeze_txg(spa))
1939 		return (0);
1940 
1941 	ASSERT(txg <= spa->spa_final_txg);
1942 
1943 	/*
1944 	 * Flush the write cache of every disk that's been written to
1945 	 * in this transaction group.  This ensures that all blocks
1946 	 * written in this txg will be committed to stable storage
1947 	 * before any uberblock that references them.
1948 	 */
1949 	zio_t *zio = zio_root(spa, NULL, NULL, flags);
1950 
1951 	for (vdev_t *vd =
1952 	    txg_list_head(&spa->spa_vdev_txg_list, TXG_CLEAN(txg)); vd != NULL;
1953 	    vd = txg_list_next(&spa->spa_vdev_txg_list, vd, TXG_CLEAN(txg)))
1954 		zio_flush(zio, vd);
1955 
1956 	(void) zio_wait(zio);
1957 
1958 	/*
1959 	 * Sync out the even labels (L0, L2) for every dirty vdev.  If the
1960 	 * system dies in the middle of this process, that's OK: all of the
1961 	 * even labels that made it to disk will be newer than any uberblock,
1962 	 * and will therefore be considered invalid.  The odd labels (L1, L3),
1963 	 * which have not yet been touched, will still be valid.  We flush
1964 	 * the new labels to disk to ensure that all even-label updates
1965 	 * are committed to stable storage before the uberblock update.
1966 	 */
1967 	if ((error = vdev_label_sync_list(spa, 0, txg, flags)) != 0) {
1968 		if ((flags & ZIO_FLAG_TRYHARD) != 0) {
1969 			zfs_dbgmsg("vdev_label_sync_list() returned error %d "
1970 			    "for pool '%s' when syncing out the even labels "
1971 			    "of dirty vdevs", error, spa_name(spa));
1972 		}
1973 		goto retry;
1974 	}
1975 
1976 	/*
1977 	 * Sync the uberblocks to all vdevs in svd[].
1978 	 * If the system dies in the middle of this step, there are two cases
1979 	 * to consider, and the on-disk state is consistent either way:
1980 	 *
1981 	 * (1)	If none of the new uberblocks made it to disk, then the
1982 	 *	previous uberblock will be the newest, and the odd labels
1983 	 *	(which had not yet been touched) will be valid with respect
1984 	 *	to that uberblock.
1985 	 *
1986 	 * (2)	If one or more new uberblocks made it to disk, then they
1987 	 *	will be the newest, and the even labels (which had all
1988 	 *	been successfully committed) will be valid with respect
1989 	 *	to the new uberblocks.
1990 	 */
1991 	if ((error = vdev_uberblock_sync_list(svd, svdcount, ub, flags)) != 0) {
1992 		if ((flags & ZIO_FLAG_TRYHARD) != 0) {
1993 			zfs_dbgmsg("vdev_uberblock_sync_list() returned error "
1994 			    "%d for pool '%s'", error, spa_name(spa));
1995 		}
1996 		goto retry;
1997 	}
1998 
1999 	if (spa_multihost(spa))
2000 		mmp_update_uberblock(spa, ub);
2001 
2002 	/*
2003 	 * Sync out odd labels for every dirty vdev.  If the system dies
2004 	 * in the middle of this process, the even labels and the new
2005 	 * uberblocks will suffice to open the pool.  The next time
2006 	 * the pool is opened, the first thing we'll do -- before any
2007 	 * user data is modified -- is mark every vdev dirty so that
2008 	 * all labels will be brought up to date.  We flush the new labels
2009 	 * to disk to ensure that all odd-label updates are committed to
2010 	 * stable storage before the next transaction group begins.
2011 	 */
2012 	if ((error = vdev_label_sync_list(spa, 1, txg, flags)) != 0) {
2013 		if ((flags & ZIO_FLAG_TRYHARD) != 0) {
2014 			zfs_dbgmsg("vdev_label_sync_list() returned error %d "
2015 			    "for pool '%s' when syncing out the odd labels of "
2016 			    "dirty vdevs", error, spa_name(spa));
2017 		}
2018 		goto retry;
2019 	}
2020 
2021 	return (0);
2022 }
2023