mirror of
https://git.proxmox.com/git/mirror_zfs.git
synced 2024-12-26 03:09:34 +03:00
6cb8e5306d
Some work has been done lately to improve the debugability of the ZFS pool load (and import) process. This includes: 7638 Refactor spa_load_impl into several functions 8961 SPA load/import should tell us why it failed 7277 zdb should be able to print zfs_dbgmsg's To iterate on top of that, there's a few changes that were made to make the import process more resilient and crash free. One of the first tasks during the pool load process is to parse a config provided from userland that describes what devices the pool is composed of. A vdev tree is generated from that config, and then all the vdevs are opened. The Meta Object Set (MOS) of the pool is accessed, and several metadata objects that are necessary to load the pool are read. The exact configuration of the pool is also stored inside the MOS. Since the configuration provided from userland is external and might not accurately describe the vdev tree of the pool at the txg that is being loaded, it cannot be relied upon to safely operate the pool. For that reason, the configuration in the MOS is read early on. In the past, the two configurations were compared together and if there was a mismatch then the load process was aborted and an error was returned. The latter was a good way to ensure a pool does not get corrupted, however it made the pool load process needlessly fragile in cases where the vdev configuration changed or the userland configuration was outdated. Since the MOS is stored in 3 copies, the configuration provided by userland doesn't have to be perfect in order to read its contents. Hence, a new approach has been adopted: The pool is first opened with the untrusted userland configuration just so that the real configuration can be read from the MOS. The trusted MOS configuration is then used to generate a new vdev tree and the pool is re-opened. When the pool is opened with an untrusted configuration, writes are disabled to avoid accidentally damaging it. During reads, some sanity checks are performed on block pointers to see if each DVA points to a known vdev; when the configuration is untrusted, instead of panicking the system if those checks fail we simply avoid issuing reads to the invalid DVAs. This new two-step pool load process now allows rewinding pools accross vdev tree changes such as device replacement, addition, etc. Loading a pool from an external config file in a clustering environment also becomes much safer now since the pool will import even if the config is outdated and didn't, for instance, register a recent device addition. With this code in place, it became relatively easy to implement a long-sought-after feature: the ability to import a pool with missing top level (i.e. non-redundant) devices. Note that since this almost guarantees some loss of data, this feature is for now restricted to a read-only import. Porting notes (ZTS): * Fix 'make dist' target in zpool_import * The maximum path length allowed by tar is 99 characters. Several of the new test cases exceeded this limit resulting in them not being included in the tarball. Shorten the names slightly. * Set/get tunables using accessor functions. * Get last synced txg via the "zfs_txg_history" mechanism. * Clear zinject handlers in cleanup for import_cache_device_replaced and import_rewind_device_replaced in order that the zpool can be exported if there is an error. * Increase FILESIZE to 8G in zfs-test.sh to allow for a larger ext4 file system to be created on ZFS_DISK2. Also, there's no need to partition ZFS_DISK2 at all. The partitioning had already been disabled for multipath devices. Among other things, the partitioning steals some space from the ext4 file system, makes it difficult to accurately calculate the paramters to parted and can make some of the tests fail. * Increase FS_SIZE and FILE_SIZE in the zpool_import test configuration now that FILESIZE is larger. * Write more data in order that device evacuation take lonnger in a couple tests. * Use mkdir -p to avoid errors when the directory already exists. * Remove use of sudo in import_rewind_config_changed. Authored by: Pavel Zakharov <pavel.zakharov@delphix.com> Reviewed by: George Wilson <george.wilson@delphix.com> Reviewed by: Matthew Ahrens <mahrens@delphix.com> Reviewed by: Andrew Stormont <andyjstormont@gmail.com> Approved by: Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org> Ported-by: Tim Chase <tim@chase2k.com> Signed-off-by: Tim Chase <tim@chase2k.com> OpenZFS-issue: https://illumos.org/issues/9075 OpenZFS-commit: https://github.com/openzfs/openzfs/commit/619c0123 Closes #7459
156 lines
3.7 KiB
C
156 lines
3.7 KiB
C
/*
|
|
* CDDL HEADER START
|
|
*
|
|
* The contents of this file are subject to the terms of the
|
|
* Common Development and Distribution License (the "License").
|
|
* You may not use this file except in compliance with the License.
|
|
*
|
|
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
|
|
* or http://www.opensolaris.org/os/licensing.
|
|
* See the License for the specific language governing permissions
|
|
* and limitations under the License.
|
|
*
|
|
* When distributing Covered Code, include this CDDL HEADER in each
|
|
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
|
|
* If applicable, add the following below this CDDL HEADER, with the
|
|
* fields enclosed by brackets "[]" replaced with your own identifying
|
|
* information: Portions Copyright [yyyy] [name of copyright owner]
|
|
*
|
|
* CDDL HEADER END
|
|
*/
|
|
/*
|
|
* Copyright 2010 Sun Microsystems, Inc. All rights reserved.
|
|
* Use is subject to license terms.
|
|
*/
|
|
|
|
/*
|
|
* Copyright (c) 2012, 2014 by Delphix. All rights reserved.
|
|
*/
|
|
|
|
#include <sys/zfs_context.h>
|
|
#include <sys/spa.h>
|
|
#include <sys/vdev_impl.h>
|
|
#include <sys/zio.h>
|
|
#include <sys/fs/zfs.h>
|
|
|
|
/*
|
|
* Virtual device vector for the pool's root vdev.
|
|
*/
|
|
|
|
static uint64_t
|
|
vdev_root_core_tvds(vdev_t *vd)
|
|
{
|
|
uint64_t tvds = 0;
|
|
|
|
for (uint64_t c = 0; c < vd->vdev_children; c++) {
|
|
vdev_t *cvd = vd->vdev_child[c];
|
|
|
|
if (!cvd->vdev_ishole && !cvd->vdev_islog &&
|
|
cvd->vdev_ops != &vdev_indirect_ops) {
|
|
tvds++;
|
|
}
|
|
}
|
|
|
|
return (tvds);
|
|
}
|
|
|
|
/*
|
|
* We should be able to tolerate one failure with absolutely no damage
|
|
* to our metadata. Two failures will take out space maps, a bunch of
|
|
* indirect block trees, meta dnodes, dnodes, etc. Probably not a happy
|
|
* place to live. When we get smarter, we can liberalize this policy.
|
|
* e.g. If we haven't lost two consecutive top-level vdevs, then we are
|
|
* probably fine. Adding bean counters during alloc/free can make this
|
|
* future guesswork more accurate.
|
|
*/
|
|
static boolean_t
|
|
too_many_errors(vdev_t *vd, uint64_t numerrors)
|
|
{
|
|
uint64_t tvds;
|
|
|
|
if (numerrors == 0)
|
|
return (B_FALSE);
|
|
|
|
tvds = vdev_root_core_tvds(vd);
|
|
ASSERT3U(numerrors, <=, tvds);
|
|
|
|
if (numerrors == tvds)
|
|
return (B_TRUE);
|
|
|
|
return (numerrors > spa_missing_tvds_allowed(vd->vdev_spa));
|
|
}
|
|
|
|
static int
|
|
vdev_root_open(vdev_t *vd, uint64_t *asize, uint64_t *max_asize,
|
|
uint64_t *ashift)
|
|
{
|
|
spa_t *spa = vd->vdev_spa;
|
|
int lasterror = 0;
|
|
int numerrors = 0;
|
|
|
|
if (vd->vdev_children == 0) {
|
|
vd->vdev_stat.vs_aux = VDEV_AUX_BAD_LABEL;
|
|
return (SET_ERROR(EINVAL));
|
|
}
|
|
|
|
vdev_open_children(vd);
|
|
|
|
for (int c = 0; c < vd->vdev_children; c++) {
|
|
vdev_t *cvd = vd->vdev_child[c];
|
|
|
|
if (cvd->vdev_open_error && !cvd->vdev_islog) {
|
|
lasterror = cvd->vdev_open_error;
|
|
numerrors++;
|
|
}
|
|
}
|
|
|
|
if (spa_load_state(spa) != SPA_LOAD_NONE)
|
|
spa_set_missing_tvds(spa, numerrors);
|
|
|
|
if (too_many_errors(vd, numerrors)) {
|
|
vd->vdev_stat.vs_aux = VDEV_AUX_NO_REPLICAS;
|
|
return (lasterror);
|
|
}
|
|
|
|
*asize = 0;
|
|
*max_asize = 0;
|
|
*ashift = 0;
|
|
|
|
return (0);
|
|
}
|
|
|
|
static void
|
|
vdev_root_close(vdev_t *vd)
|
|
{
|
|
for (int c = 0; c < vd->vdev_children; c++)
|
|
vdev_close(vd->vdev_child[c]);
|
|
}
|
|
|
|
static void
|
|
vdev_root_state_change(vdev_t *vd, int faulted, int degraded)
|
|
{
|
|
if (too_many_errors(vd, faulted)) {
|
|
vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
|
|
VDEV_AUX_NO_REPLICAS);
|
|
} else if (degraded || faulted) {
|
|
vdev_set_state(vd, B_FALSE, VDEV_STATE_DEGRADED, VDEV_AUX_NONE);
|
|
} else {
|
|
vdev_set_state(vd, B_FALSE, VDEV_STATE_HEALTHY, VDEV_AUX_NONE);
|
|
}
|
|
}
|
|
|
|
vdev_ops_t vdev_root_ops = {
|
|
vdev_root_open,
|
|
vdev_root_close,
|
|
vdev_default_asize,
|
|
NULL, /* io_start - not applicable to the root */
|
|
NULL, /* io_done - not applicable to the root */
|
|
vdev_root_state_change,
|
|
NULL,
|
|
NULL,
|
|
NULL,
|
|
NULL,
|
|
VDEV_TYPE_ROOT, /* name of this vdev type */
|
|
B_FALSE /* not a leaf vdev */
|
|
};
|