xref: /freebsd/sys/contrib/openzfs/module/zfs/dsl_scan.c (revision 2008043f386721d58158e37e0d7e50df8095942d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or https://opensource.org/licenses/CDDL-1.0.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2011, 2021 by Delphix. All rights reserved.
24  * Copyright 2016 Gary Mills
25  * Copyright (c) 2017, 2019, Datto Inc. All rights reserved.
26  * Copyright (c) 2015, Nexenta Systems, Inc. All rights reserved.
27  * Copyright 2019 Joyent, Inc.
28  */
29 
30 #include <sys/dsl_scan.h>
31 #include <sys/dsl_pool.h>
32 #include <sys/dsl_dataset.h>
33 #include <sys/dsl_prop.h>
34 #include <sys/dsl_dir.h>
35 #include <sys/dsl_synctask.h>
36 #include <sys/dnode.h>
37 #include <sys/dmu_tx.h>
38 #include <sys/dmu_objset.h>
39 #include <sys/arc.h>
40 #include <sys/arc_impl.h>
41 #include <sys/zap.h>
42 #include <sys/zio.h>
43 #include <sys/zfs_context.h>
44 #include <sys/fs/zfs.h>
45 #include <sys/zfs_znode.h>
46 #include <sys/spa_impl.h>
47 #include <sys/vdev_impl.h>
48 #include <sys/zil_impl.h>
49 #include <sys/zio_checksum.h>
50 #include <sys/brt.h>
51 #include <sys/ddt.h>
52 #include <sys/sa.h>
53 #include <sys/sa_impl.h>
54 #include <sys/zfeature.h>
55 #include <sys/abd.h>
56 #include <sys/range_tree.h>
57 #include <sys/dbuf.h>
58 #ifdef _KERNEL
59 #include <sys/zfs_vfsops.h>
60 #endif
61 
62 /*
63  * Grand theory statement on scan queue sorting
64  *
65  * Scanning is implemented by recursively traversing all indirection levels
66  * in an object and reading all blocks referenced from said objects. This
67  * results in us approximately traversing the object from lowest logical
68  * offset to the highest. For best performance, we would want the logical
69  * blocks to be physically contiguous. However, this is frequently not the
70  * case with pools given the allocation patterns of copy-on-write filesystems.
71  * So instead, we put the I/Os into a reordering queue and issue them in a
72  * way that will most benefit physical disks (LBA-order).
73  *
74  * Queue management:
75  *
76  * Ideally, we would want to scan all metadata and queue up all block I/O
77  * prior to starting to issue it, because that allows us to do an optimal
78  * sorting job. This can however consume large amounts of memory. Therefore
79  * we continuously monitor the size of the queues and constrain them to 5%
80  * (zfs_scan_mem_lim_fact) of physmem. If the queues grow larger than this
81  * limit, we clear out a few of the largest extents at the head of the queues
82  * to make room for more scanning. Hopefully, these extents will be fairly
83  * large and contiguous, allowing us to approach sequential I/O throughput
84  * even without a fully sorted tree.
85  *
86  * Metadata scanning takes place in dsl_scan_visit(), which is called from
87  * dsl_scan_sync() every spa_sync(). If we have either fully scanned all
88  * metadata on the pool, or we need to make room in memory because our
89  * queues are too large, dsl_scan_visit() is postponed and
90  * scan_io_queues_run() is called from dsl_scan_sync() instead. This implies
91  * that metadata scanning and queued I/O issuing are mutually exclusive. This
92  * allows us to provide maximum sequential I/O throughput for the majority of
93  * I/O's issued since sequential I/O performance is significantly negatively
94  * impacted if it is interleaved with random I/O.
95  *
96  * Implementation Notes
97  *
98  * One side effect of the queued scanning algorithm is that the scanning code
99  * needs to be notified whenever a block is freed. This is needed to allow
100  * the scanning code to remove these I/Os from the issuing queue. Additionally,
101  * we do not attempt to queue gang blocks to be issued sequentially since this
102  * is very hard to do and would have an extremely limited performance benefit.
103  * Instead, we simply issue gang I/Os as soon as we find them using the legacy
104  * algorithm.
105  *
106  * Backwards compatibility
107  *
108  * This new algorithm is backwards compatible with the legacy on-disk data
109  * structures (and therefore does not require a new feature flag).
110  * Periodically during scanning (see zfs_scan_checkpoint_intval), the scan
111  * will stop scanning metadata (in logical order) and wait for all outstanding
112  * sorted I/O to complete. Once this is done, we write out a checkpoint
113  * bookmark, indicating that we have scanned everything logically before it.
114  * If the pool is imported on a machine without the new sorting algorithm,
115  * the scan simply resumes from the last checkpoint using the legacy algorithm.
116  */
117 
118 typedef int (scan_cb_t)(dsl_pool_t *, const blkptr_t *,
119     const zbookmark_phys_t *);
120 
121 static scan_cb_t dsl_scan_scrub_cb;
122 
123 static int scan_ds_queue_compare(const void *a, const void *b);
124 static int scan_prefetch_queue_compare(const void *a, const void *b);
125 static void scan_ds_queue_clear(dsl_scan_t *scn);
126 static void scan_ds_prefetch_queue_clear(dsl_scan_t *scn);
127 static boolean_t scan_ds_queue_contains(dsl_scan_t *scn, uint64_t dsobj,
128     uint64_t *txg);
129 static void scan_ds_queue_insert(dsl_scan_t *scn, uint64_t dsobj, uint64_t txg);
130 static void scan_ds_queue_remove(dsl_scan_t *scn, uint64_t dsobj);
131 static void scan_ds_queue_sync(dsl_scan_t *scn, dmu_tx_t *tx);
132 static uint64_t dsl_scan_count_data_disks(spa_t *spa);
133 static void read_by_block_level(dsl_scan_t *scn, zbookmark_phys_t zb);
134 
135 extern uint_t zfs_vdev_async_write_active_min_dirty_percent;
136 static int zfs_scan_blkstats = 0;
137 
138 /*
139  * 'zpool status' uses bytes processed per pass to report throughput and
140  * estimate time remaining.  We define a pass to start when the scanning
141  * phase completes for a sequential resilver.  Optionally, this value
142  * may be used to reset the pass statistics every N txgs to provide an
143  * estimated completion time based on currently observed performance.
144  */
145 static uint_t zfs_scan_report_txgs = 0;
146 
147 /*
148  * By default zfs will check to ensure it is not over the hard memory
149  * limit before each txg. If finer-grained control of this is needed
150  * this value can be set to 1 to enable checking before scanning each
151  * block.
152  */
153 static int zfs_scan_strict_mem_lim = B_FALSE;
154 
155 /*
156  * Maximum number of parallelly executed bytes per leaf vdev. We attempt
157  * to strike a balance here between keeping the vdev queues full of I/Os
158  * at all times and not overflowing the queues to cause long latency,
159  * which would cause long txg sync times. No matter what, we will not
160  * overload the drives with I/O, since that is protected by
161  * zfs_vdev_scrub_max_active.
162  */
163 static uint64_t zfs_scan_vdev_limit = 16 << 20;
164 
165 static uint_t zfs_scan_issue_strategy = 0;
166 
167 /* don't queue & sort zios, go direct */
168 static int zfs_scan_legacy = B_FALSE;
169 static uint64_t zfs_scan_max_ext_gap = 2 << 20; /* in bytes */
170 
171 /*
172  * fill_weight is non-tunable at runtime, so we copy it at module init from
173  * zfs_scan_fill_weight. Runtime adjustments to zfs_scan_fill_weight would
174  * break queue sorting.
175  */
176 static uint_t zfs_scan_fill_weight = 3;
177 static uint64_t fill_weight;
178 
179 /* See dsl_scan_should_clear() for details on the memory limit tunables */
180 static const uint64_t zfs_scan_mem_lim_min = 16 << 20;	/* bytes */
181 static const uint64_t zfs_scan_mem_lim_soft_max = 128 << 20;	/* bytes */
182 
183 
184 /* fraction of physmem */
185 static uint_t zfs_scan_mem_lim_fact = 20;
186 
187 /* fraction of mem lim above */
188 static uint_t zfs_scan_mem_lim_soft_fact = 20;
189 
190 /* minimum milliseconds to scrub per txg */
191 static uint_t zfs_scrub_min_time_ms = 1000;
192 
193 /* minimum milliseconds to obsolete per txg */
194 static uint_t zfs_obsolete_min_time_ms = 500;
195 
196 /* minimum milliseconds to free per txg */
197 static uint_t zfs_free_min_time_ms = 1000;
198 
199 /* minimum milliseconds to resilver per txg */
200 static uint_t zfs_resilver_min_time_ms = 3000;
201 
202 static uint_t zfs_scan_checkpoint_intval = 7200; /* in seconds */
203 int zfs_scan_suspend_progress = 0; /* set to prevent scans from progressing */
204 static int zfs_no_scrub_io = B_FALSE; /* set to disable scrub i/o */
205 static int zfs_no_scrub_prefetch = B_FALSE; /* set to disable scrub prefetch */
206 static const enum ddt_class zfs_scrub_ddt_class_max = DDT_CLASS_DUPLICATE;
207 /* max number of blocks to free in a single TXG */
208 static uint64_t zfs_async_block_max_blocks = UINT64_MAX;
209 /* max number of dedup blocks to free in a single TXG */
210 static uint64_t zfs_max_async_dedup_frees = 100000;
211 
212 /* set to disable resilver deferring */
213 static int zfs_resilver_disable_defer = B_FALSE;
214 
215 /*
216  * We wait a few txgs after importing a pool to begin scanning so that
217  * the import / mounting code isn't held up by scrub / resilver IO.
218  * Unfortunately, it is a bit difficult to determine exactly how long
219  * this will take since userspace will trigger fs mounts asynchronously
220  * and the kernel will create zvol minors asynchronously. As a result,
221  * the value provided here is a bit arbitrary, but represents a
222  * reasonable estimate of how many txgs it will take to finish fully
223  * importing a pool
224  */
225 #define	SCAN_IMPORT_WAIT_TXGS 		5
226 
227 #define	DSL_SCAN_IS_SCRUB_RESILVER(scn) \
228 	((scn)->scn_phys.scn_func == POOL_SCAN_SCRUB || \
229 	(scn)->scn_phys.scn_func == POOL_SCAN_RESILVER)
230 
231 /*
232  * Enable/disable the processing of the free_bpobj object.
233  */
234 static int zfs_free_bpobj_enabled = 1;
235 
236 /* Error blocks to be scrubbed in one txg. */
237 static uint_t zfs_scrub_error_blocks_per_txg = 1 << 12;
238 
239 /* the order has to match pool_scan_type */
240 static scan_cb_t *scan_funcs[POOL_SCAN_FUNCS] = {
241 	NULL,
242 	dsl_scan_scrub_cb,	/* POOL_SCAN_SCRUB */
243 	dsl_scan_scrub_cb,	/* POOL_SCAN_RESILVER */
244 };
245 
246 /* In core node for the scn->scn_queue. Represents a dataset to be scanned */
247 typedef struct {
248 	uint64_t	sds_dsobj;
249 	uint64_t	sds_txg;
250 	avl_node_t	sds_node;
251 } scan_ds_t;
252 
253 /*
254  * This controls what conditions are placed on dsl_scan_sync_state():
255  * SYNC_OPTIONAL) write out scn_phys iff scn_queues_pending == 0
256  * SYNC_MANDATORY) write out scn_phys always. scn_queues_pending must be 0.
257  * SYNC_CACHED) if scn_queues_pending == 0, write out scn_phys. Otherwise
258  *	write out the scn_phys_cached version.
259  * See dsl_scan_sync_state for details.
260  */
261 typedef enum {
262 	SYNC_OPTIONAL,
263 	SYNC_MANDATORY,
264 	SYNC_CACHED
265 } state_sync_type_t;
266 
267 /*
268  * This struct represents the minimum information needed to reconstruct a
269  * zio for sequential scanning. This is useful because many of these will
270  * accumulate in the sequential IO queues before being issued, so saving
271  * memory matters here.
272  */
273 typedef struct scan_io {
274 	/* fields from blkptr_t */
275 	uint64_t		sio_blk_prop;
276 	uint64_t		sio_phys_birth;
277 	uint64_t		sio_birth;
278 	zio_cksum_t		sio_cksum;
279 	uint32_t		sio_nr_dvas;
280 
281 	/* fields from zio_t */
282 	uint32_t		sio_flags;
283 	zbookmark_phys_t	sio_zb;
284 
285 	/* members for queue sorting */
286 	union {
287 		avl_node_t	sio_addr_node; /* link into issuing queue */
288 		list_node_t	sio_list_node; /* link for issuing to disk */
289 	} sio_nodes;
290 
291 	/*
292 	 * There may be up to SPA_DVAS_PER_BP DVAs here from the bp,
293 	 * depending on how many were in the original bp. Only the
294 	 * first DVA is really used for sorting and issuing purposes.
295 	 * The other DVAs (if provided) simply exist so that the zio
296 	 * layer can find additional copies to repair from in the
297 	 * event of an error. This array must go at the end of the
298 	 * struct to allow this for the variable number of elements.
299 	 */
300 	dva_t			sio_dva[];
301 } scan_io_t;
302 
303 #define	SIO_SET_OFFSET(sio, x)		DVA_SET_OFFSET(&(sio)->sio_dva[0], x)
304 #define	SIO_SET_ASIZE(sio, x)		DVA_SET_ASIZE(&(sio)->sio_dva[0], x)
305 #define	SIO_GET_OFFSET(sio)		DVA_GET_OFFSET(&(sio)->sio_dva[0])
306 #define	SIO_GET_ASIZE(sio)		DVA_GET_ASIZE(&(sio)->sio_dva[0])
307 #define	SIO_GET_END_OFFSET(sio)		\
308 	(SIO_GET_OFFSET(sio) + SIO_GET_ASIZE(sio))
309 #define	SIO_GET_MUSED(sio)		\
310 	(sizeof (scan_io_t) + ((sio)->sio_nr_dvas * sizeof (dva_t)))
311 
312 struct dsl_scan_io_queue {
313 	dsl_scan_t	*q_scn; /* associated dsl_scan_t */
314 	vdev_t		*q_vd; /* top-level vdev that this queue represents */
315 	zio_t		*q_zio; /* scn_zio_root child for waiting on IO */
316 
317 	/* trees used for sorting I/Os and extents of I/Os */
318 	range_tree_t	*q_exts_by_addr;
319 	zfs_btree_t	q_exts_by_size;
320 	avl_tree_t	q_sios_by_addr;
321 	uint64_t	q_sio_memused;
322 	uint64_t	q_last_ext_addr;
323 
324 	/* members for zio rate limiting */
325 	uint64_t	q_maxinflight_bytes;
326 	uint64_t	q_inflight_bytes;
327 	kcondvar_t	q_zio_cv; /* used under vd->vdev_scan_io_queue_lock */
328 
329 	/* per txg statistics */
330 	uint64_t	q_total_seg_size_this_txg;
331 	uint64_t	q_segs_this_txg;
332 	uint64_t	q_total_zio_size_this_txg;
333 	uint64_t	q_zios_this_txg;
334 };
335 
336 /* private data for dsl_scan_prefetch_cb() */
337 typedef struct scan_prefetch_ctx {
338 	zfs_refcount_t spc_refcnt;	/* refcount for memory management */
339 	dsl_scan_t *spc_scn;		/* dsl_scan_t for the pool */
340 	boolean_t spc_root;		/* is this prefetch for an objset? */
341 	uint8_t spc_indblkshift;	/* dn_indblkshift of current dnode */
342 	uint16_t spc_datablkszsec;	/* dn_idatablkszsec of current dnode */
343 } scan_prefetch_ctx_t;
344 
345 /* private data for dsl_scan_prefetch() */
346 typedef struct scan_prefetch_issue_ctx {
347 	avl_node_t spic_avl_node;	/* link into scn->scn_prefetch_queue */
348 	scan_prefetch_ctx_t *spic_spc;	/* spc for the callback */
349 	blkptr_t spic_bp;		/* bp to prefetch */
350 	zbookmark_phys_t spic_zb;	/* bookmark to prefetch */
351 } scan_prefetch_issue_ctx_t;
352 
353 static void scan_exec_io(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
354     const zbookmark_phys_t *zb, dsl_scan_io_queue_t *queue);
355 static void scan_io_queue_insert_impl(dsl_scan_io_queue_t *queue,
356     scan_io_t *sio);
357 
358 static dsl_scan_io_queue_t *scan_io_queue_create(vdev_t *vd);
359 static void scan_io_queues_destroy(dsl_scan_t *scn);
360 
361 static kmem_cache_t *sio_cache[SPA_DVAS_PER_BP];
362 
363 /* sio->sio_nr_dvas must be set so we know which cache to free from */
364 static void
365 sio_free(scan_io_t *sio)
366 {
367 	ASSERT3U(sio->sio_nr_dvas, >, 0);
368 	ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);
369 
370 	kmem_cache_free(sio_cache[sio->sio_nr_dvas - 1], sio);
371 }
372 
373 /* It is up to the caller to set sio->sio_nr_dvas for freeing */
374 static scan_io_t *
375 sio_alloc(unsigned short nr_dvas)
376 {
377 	ASSERT3U(nr_dvas, >, 0);
378 	ASSERT3U(nr_dvas, <=, SPA_DVAS_PER_BP);
379 
380 	return (kmem_cache_alloc(sio_cache[nr_dvas - 1], KM_SLEEP));
381 }
382 
383 void
384 scan_init(void)
385 {
386 	/*
387 	 * This is used in ext_size_compare() to weight segments
388 	 * based on how sparse they are. This cannot be changed
389 	 * mid-scan and the tree comparison functions don't currently
390 	 * have a mechanism for passing additional context to the
391 	 * compare functions. Thus we store this value globally and
392 	 * we only allow it to be set at module initialization time
393 	 */
394 	fill_weight = zfs_scan_fill_weight;
395 
396 	for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
397 		char name[36];
398 
399 		(void) snprintf(name, sizeof (name), "sio_cache_%d", i);
400 		sio_cache[i] = kmem_cache_create(name,
401 		    (sizeof (scan_io_t) + ((i + 1) * sizeof (dva_t))),
402 		    0, NULL, NULL, NULL, NULL, NULL, 0);
403 	}
404 }
405 
406 void
407 scan_fini(void)
408 {
409 	for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
410 		kmem_cache_destroy(sio_cache[i]);
411 	}
412 }
413 
414 static inline boolean_t
415 dsl_scan_is_running(const dsl_scan_t *scn)
416 {
417 	return (scn->scn_phys.scn_state == DSS_SCANNING);
418 }
419 
420 boolean_t
421 dsl_scan_resilvering(dsl_pool_t *dp)
422 {
423 	return (dsl_scan_is_running(dp->dp_scan) &&
424 	    dp->dp_scan->scn_phys.scn_func == POOL_SCAN_RESILVER);
425 }
426 
427 static inline void
428 sio2bp(const scan_io_t *sio, blkptr_t *bp)
429 {
430 	memset(bp, 0, sizeof (*bp));
431 	bp->blk_prop = sio->sio_blk_prop;
432 	bp->blk_phys_birth = sio->sio_phys_birth;
433 	bp->blk_birth = sio->sio_birth;
434 	bp->blk_fill = 1;	/* we always only work with data pointers */
435 	bp->blk_cksum = sio->sio_cksum;
436 
437 	ASSERT3U(sio->sio_nr_dvas, >, 0);
438 	ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);
439 
440 	memcpy(bp->blk_dva, sio->sio_dva, sio->sio_nr_dvas * sizeof (dva_t));
441 }
442 
443 static inline void
444 bp2sio(const blkptr_t *bp, scan_io_t *sio, int dva_i)
445 {
446 	sio->sio_blk_prop = bp->blk_prop;
447 	sio->sio_phys_birth = bp->blk_phys_birth;
448 	sio->sio_birth = bp->blk_birth;
449 	sio->sio_cksum = bp->blk_cksum;
450 	sio->sio_nr_dvas = BP_GET_NDVAS(bp);
451 
452 	/*
453 	 * Copy the DVAs to the sio. We need all copies of the block so
454 	 * that the self healing code can use the alternate copies if the
455 	 * first is corrupted. We want the DVA at index dva_i to be first
456 	 * in the sio since this is the primary one that we want to issue.
457 	 */
458 	for (int i = 0, j = dva_i; i < sio->sio_nr_dvas; i++, j++) {
459 		sio->sio_dva[i] = bp->blk_dva[j % sio->sio_nr_dvas];
460 	}
461 }
462 
463 int
464 dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
465 {
466 	int err;
467 	dsl_scan_t *scn;
468 	spa_t *spa = dp->dp_spa;
469 	uint64_t f;
470 
471 	scn = dp->dp_scan = kmem_zalloc(sizeof (dsl_scan_t), KM_SLEEP);
472 	scn->scn_dp = dp;
473 
474 	/*
475 	 * It's possible that we're resuming a scan after a reboot so
476 	 * make sure that the scan_async_destroying flag is initialized
477 	 * appropriately.
478 	 */
479 	ASSERT(!scn->scn_async_destroying);
480 	scn->scn_async_destroying = spa_feature_is_active(dp->dp_spa,
481 	    SPA_FEATURE_ASYNC_DESTROY);
482 
483 	/*
484 	 * Calculate the max number of in-flight bytes for pool-wide
485 	 * scanning operations (minimum 1MB, maximum 1/4 of arc_c_max).
486 	 * Limits for the issuing phase are done per top-level vdev and
487 	 * are handled separately.
488 	 */
489 	scn->scn_maxinflight_bytes = MIN(arc_c_max / 4, MAX(1ULL << 20,
490 	    zfs_scan_vdev_limit * dsl_scan_count_data_disks(spa)));
491 
492 	avl_create(&scn->scn_queue, scan_ds_queue_compare, sizeof (scan_ds_t),
493 	    offsetof(scan_ds_t, sds_node));
494 	avl_create(&scn->scn_prefetch_queue, scan_prefetch_queue_compare,
495 	    sizeof (scan_prefetch_issue_ctx_t),
496 	    offsetof(scan_prefetch_issue_ctx_t, spic_avl_node));
497 
498 	err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
499 	    "scrub_func", sizeof (uint64_t), 1, &f);
500 	if (err == 0) {
501 		/*
502 		 * There was an old-style scrub in progress.  Restart a
503 		 * new-style scrub from the beginning.
504 		 */
505 		scn->scn_restart_txg = txg;
506 		zfs_dbgmsg("old-style scrub was in progress for %s; "
507 		    "restarting new-style scrub in txg %llu",
508 		    spa->spa_name,
509 		    (longlong_t)scn->scn_restart_txg);
510 
511 		/*
512 		 * Load the queue obj from the old location so that it
513 		 * can be freed by dsl_scan_done().
514 		 */
515 		(void) zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
516 		    "scrub_queue", sizeof (uint64_t), 1,
517 		    &scn->scn_phys.scn_queue_obj);
518 	} else {
519 		err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
520 		    DMU_POOL_ERRORSCRUB, sizeof (uint64_t),
521 		    ERRORSCRUB_PHYS_NUMINTS, &scn->errorscrub_phys);
522 
523 		if (err != 0 && err != ENOENT)
524 			return (err);
525 
526 		err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
527 		    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
528 		    &scn->scn_phys);
529 
530 		/*
531 		 * Detect if the pool contains the signature of #2094.  If it
532 		 * does properly update the scn->scn_phys structure and notify
533 		 * the administrator by setting an errata for the pool.
534 		 */
535 		if (err == EOVERFLOW) {
536 			uint64_t zaptmp[SCAN_PHYS_NUMINTS + 1];
537 			VERIFY3S(SCAN_PHYS_NUMINTS, ==, 24);
538 			VERIFY3S(offsetof(dsl_scan_phys_t, scn_flags), ==,
539 			    (23 * sizeof (uint64_t)));
540 
541 			err = zap_lookup(dp->dp_meta_objset,
542 			    DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_SCAN,
543 			    sizeof (uint64_t), SCAN_PHYS_NUMINTS + 1, &zaptmp);
544 			if (err == 0) {
545 				uint64_t overflow = zaptmp[SCAN_PHYS_NUMINTS];
546 
547 				if (overflow & ~DSL_SCAN_FLAGS_MASK ||
548 				    scn->scn_async_destroying) {
549 					spa->spa_errata =
550 					    ZPOOL_ERRATA_ZOL_2094_ASYNC_DESTROY;
551 					return (EOVERFLOW);
552 				}
553 
554 				memcpy(&scn->scn_phys, zaptmp,
555 				    SCAN_PHYS_NUMINTS * sizeof (uint64_t));
556 				scn->scn_phys.scn_flags = overflow;
557 
558 				/* Required scrub already in progress. */
559 				if (scn->scn_phys.scn_state == DSS_FINISHED ||
560 				    scn->scn_phys.scn_state == DSS_CANCELED)
561 					spa->spa_errata =
562 					    ZPOOL_ERRATA_ZOL_2094_SCRUB;
563 			}
564 		}
565 
566 		if (err == ENOENT)
567 			return (0);
568 		else if (err)
569 			return (err);
570 
571 		/*
572 		 * We might be restarting after a reboot, so jump the issued
573 		 * counter to how far we've scanned. We know we're consistent
574 		 * up to here.
575 		 */
576 		scn->scn_issued_before_pass = scn->scn_phys.scn_examined -
577 		    scn->scn_phys.scn_skipped;
578 
579 		if (dsl_scan_is_running(scn) &&
580 		    spa_prev_software_version(dp->dp_spa) < SPA_VERSION_SCAN) {
581 			/*
582 			 * A new-type scrub was in progress on an old
583 			 * pool, and the pool was accessed by old
584 			 * software.  Restart from the beginning, since
585 			 * the old software may have changed the pool in
586 			 * the meantime.
587 			 */
588 			scn->scn_restart_txg = txg;
589 			zfs_dbgmsg("new-style scrub for %s was modified "
590 			    "by old software; restarting in txg %llu",
591 			    spa->spa_name,
592 			    (longlong_t)scn->scn_restart_txg);
593 		} else if (dsl_scan_resilvering(dp)) {
594 			/*
595 			 * If a resilver is in progress and there are already
596 			 * errors, restart it instead of finishing this scan and
597 			 * then restarting it. If there haven't been any errors
598 			 * then remember that the incore DTL is valid.
599 			 */
600 			if (scn->scn_phys.scn_errors > 0) {
601 				scn->scn_restart_txg = txg;
602 				zfs_dbgmsg("resilver can't excise DTL_MISSING "
603 				    "when finished; restarting on %s in txg "
604 				    "%llu",
605 				    spa->spa_name,
606 				    (u_longlong_t)scn->scn_restart_txg);
607 			} else {
608 				/* it's safe to excise DTL when finished */
609 				spa->spa_scrub_started = B_TRUE;
610 			}
611 		}
612 	}
613 
614 	memcpy(&scn->scn_phys_cached, &scn->scn_phys, sizeof (scn->scn_phys));
615 
616 	/* reload the queue into the in-core state */
617 	if (scn->scn_phys.scn_queue_obj != 0) {
618 		zap_cursor_t zc;
619 		zap_attribute_t za;
620 
621 		for (zap_cursor_init(&zc, dp->dp_meta_objset,
622 		    scn->scn_phys.scn_queue_obj);
623 		    zap_cursor_retrieve(&zc, &za) == 0;
624 		    (void) zap_cursor_advance(&zc)) {
625 			scan_ds_queue_insert(scn,
626 			    zfs_strtonum(za.za_name, NULL),
627 			    za.za_first_integer);
628 		}
629 		zap_cursor_fini(&zc);
630 	}
631 
632 	spa_scan_stat_init(spa);
633 	vdev_scan_stat_init(spa->spa_root_vdev);
634 
635 	return (0);
636 }
637 
638 void
639 dsl_scan_fini(dsl_pool_t *dp)
640 {
641 	if (dp->dp_scan != NULL) {
642 		dsl_scan_t *scn = dp->dp_scan;
643 
644 		if (scn->scn_taskq != NULL)
645 			taskq_destroy(scn->scn_taskq);
646 
647 		scan_ds_queue_clear(scn);
648 		avl_destroy(&scn->scn_queue);
649 		scan_ds_prefetch_queue_clear(scn);
650 		avl_destroy(&scn->scn_prefetch_queue);
651 
652 		kmem_free(dp->dp_scan, sizeof (dsl_scan_t));
653 		dp->dp_scan = NULL;
654 	}
655 }
656 
657 static boolean_t
658 dsl_scan_restarting(dsl_scan_t *scn, dmu_tx_t *tx)
659 {
660 	return (scn->scn_restart_txg != 0 &&
661 	    scn->scn_restart_txg <= tx->tx_txg);
662 }
663 
664 boolean_t
665 dsl_scan_resilver_scheduled(dsl_pool_t *dp)
666 {
667 	return ((dp->dp_scan && dp->dp_scan->scn_restart_txg != 0) ||
668 	    (spa_async_tasks(dp->dp_spa) & SPA_ASYNC_RESILVER));
669 }
670 
671 boolean_t
672 dsl_scan_scrubbing(const dsl_pool_t *dp)
673 {
674 	dsl_scan_phys_t *scn_phys = &dp->dp_scan->scn_phys;
675 
676 	return (scn_phys->scn_state == DSS_SCANNING &&
677 	    scn_phys->scn_func == POOL_SCAN_SCRUB);
678 }
679 
680 boolean_t
681 dsl_errorscrubbing(const dsl_pool_t *dp)
682 {
683 	dsl_errorscrub_phys_t *errorscrub_phys = &dp->dp_scan->errorscrub_phys;
684 
685 	return (errorscrub_phys->dep_state == DSS_ERRORSCRUBBING &&
686 	    errorscrub_phys->dep_func == POOL_SCAN_ERRORSCRUB);
687 }
688 
689 boolean_t
690 dsl_errorscrub_is_paused(const dsl_scan_t *scn)
691 {
692 	return (dsl_errorscrubbing(scn->scn_dp) &&
693 	    scn->errorscrub_phys.dep_paused_flags);
694 }
695 
696 boolean_t
697 dsl_scan_is_paused_scrub(const dsl_scan_t *scn)
698 {
699 	return (dsl_scan_scrubbing(scn->scn_dp) &&
700 	    scn->scn_phys.scn_flags & DSF_SCRUB_PAUSED);
701 }
702 
703 static void
704 dsl_errorscrub_sync_state(dsl_scan_t *scn, dmu_tx_t *tx)
705 {
706 	scn->errorscrub_phys.dep_cursor =
707 	    zap_cursor_serialize(&scn->errorscrub_cursor);
708 
709 	VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
710 	    DMU_POOL_DIRECTORY_OBJECT,
711 	    DMU_POOL_ERRORSCRUB, sizeof (uint64_t), ERRORSCRUB_PHYS_NUMINTS,
712 	    &scn->errorscrub_phys, tx));
713 }
714 
715 static void
716 dsl_errorscrub_setup_sync(void *arg, dmu_tx_t *tx)
717 {
718 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
719 	pool_scan_func_t *funcp = arg;
720 	dsl_pool_t *dp = scn->scn_dp;
721 	spa_t *spa = dp->dp_spa;
722 
723 	ASSERT(!dsl_scan_is_running(scn));
724 	ASSERT(!dsl_errorscrubbing(scn->scn_dp));
725 	ASSERT(*funcp > POOL_SCAN_NONE && *funcp < POOL_SCAN_FUNCS);
726 
727 	memset(&scn->errorscrub_phys, 0, sizeof (scn->errorscrub_phys));
728 	scn->errorscrub_phys.dep_func = *funcp;
729 	scn->errorscrub_phys.dep_state = DSS_ERRORSCRUBBING;
730 	scn->errorscrub_phys.dep_start_time = gethrestime_sec();
731 	scn->errorscrub_phys.dep_to_examine = spa_get_last_errlog_size(spa);
732 	scn->errorscrub_phys.dep_examined = 0;
733 	scn->errorscrub_phys.dep_errors = 0;
734 	scn->errorscrub_phys.dep_cursor = 0;
735 	zap_cursor_init_serialized(&scn->errorscrub_cursor,
736 	    spa->spa_meta_objset, spa->spa_errlog_last,
737 	    scn->errorscrub_phys.dep_cursor);
738 
739 	vdev_config_dirty(spa->spa_root_vdev);
740 	spa_event_notify(spa, NULL, NULL, ESC_ZFS_ERRORSCRUB_START);
741 
742 	dsl_errorscrub_sync_state(scn, tx);
743 
744 	spa_history_log_internal(spa, "error scrub setup", tx,
745 	    "func=%u mintxg=%u maxtxg=%llu",
746 	    *funcp, 0, (u_longlong_t)tx->tx_txg);
747 }
748 
749 static int
750 dsl_errorscrub_setup_check(void *arg, dmu_tx_t *tx)
751 {
752 	(void) arg;
753 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
754 
755 	if (dsl_scan_is_running(scn) || (dsl_errorscrubbing(scn->scn_dp))) {
756 		return (SET_ERROR(EBUSY));
757 	}
758 
759 	if (spa_get_last_errlog_size(scn->scn_dp->dp_spa) == 0) {
760 		return (ECANCELED);
761 	}
762 	return (0);
763 }
764 
765 /*
766  * Writes out a persistent dsl_scan_phys_t record to the pool directory.
767  * Because we can be running in the block sorting algorithm, we do not always
768  * want to write out the record, only when it is "safe" to do so. This safety
769  * condition is achieved by making sure that the sorting queues are empty
770  * (scn_queues_pending == 0). When this condition is not true, the sync'd state
771  * is inconsistent with how much actual scanning progress has been made. The
772  * kind of sync to be performed is specified by the sync_type argument. If the
773  * sync is optional, we only sync if the queues are empty. If the sync is
774  * mandatory, we do a hard ASSERT to make sure that the queues are empty. The
775  * third possible state is a "cached" sync. This is done in response to:
776  * 1) The dataset that was in the last sync'd dsl_scan_phys_t having been
777  *	destroyed, so we wouldn't be able to restart scanning from it.
778  * 2) The snapshot that was in the last sync'd dsl_scan_phys_t having been
779  *	superseded by a newer snapshot.
780  * 3) The dataset that was in the last sync'd dsl_scan_phys_t having been
781  *	swapped with its clone.
782  * In all cases, a cached sync simply rewrites the last record we've written,
783  * just slightly modified. For the modifications that are performed to the
784  * last written dsl_scan_phys_t, see dsl_scan_ds_destroyed,
785  * dsl_scan_ds_snapshotted and dsl_scan_ds_clone_swapped.
786  */
787 static void
788 dsl_scan_sync_state(dsl_scan_t *scn, dmu_tx_t *tx, state_sync_type_t sync_type)
789 {
790 	int i;
791 	spa_t *spa = scn->scn_dp->dp_spa;
792 
793 	ASSERT(sync_type != SYNC_MANDATORY || scn->scn_queues_pending == 0);
794 	if (scn->scn_queues_pending == 0) {
795 		for (i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
796 			vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
797 			dsl_scan_io_queue_t *q = vd->vdev_scan_io_queue;
798 
799 			if (q == NULL)
800 				continue;
801 
802 			mutex_enter(&vd->vdev_scan_io_queue_lock);
803 			ASSERT3P(avl_first(&q->q_sios_by_addr), ==, NULL);
804 			ASSERT3P(zfs_btree_first(&q->q_exts_by_size, NULL), ==,
805 			    NULL);
806 			ASSERT3P(range_tree_first(q->q_exts_by_addr), ==, NULL);
807 			mutex_exit(&vd->vdev_scan_io_queue_lock);
808 		}
809 
810 		if (scn->scn_phys.scn_queue_obj != 0)
811 			scan_ds_queue_sync(scn, tx);
812 		VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
813 		    DMU_POOL_DIRECTORY_OBJECT,
814 		    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
815 		    &scn->scn_phys, tx));
816 		memcpy(&scn->scn_phys_cached, &scn->scn_phys,
817 		    sizeof (scn->scn_phys));
818 
819 		if (scn->scn_checkpointing)
820 			zfs_dbgmsg("finish scan checkpoint for %s",
821 			    spa->spa_name);
822 
823 		scn->scn_checkpointing = B_FALSE;
824 		scn->scn_last_checkpoint = ddi_get_lbolt();
825 	} else if (sync_type == SYNC_CACHED) {
826 		VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
827 		    DMU_POOL_DIRECTORY_OBJECT,
828 		    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
829 		    &scn->scn_phys_cached, tx));
830 	}
831 }
832 
833 int
834 dsl_scan_setup_check(void *arg, dmu_tx_t *tx)
835 {
836 	(void) arg;
837 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
838 	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
839 
840 	if (dsl_scan_is_running(scn) || vdev_rebuild_active(rvd) ||
841 	    dsl_errorscrubbing(scn->scn_dp))
842 		return (SET_ERROR(EBUSY));
843 
844 	return (0);
845 }
846 
847 void
848 dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
849 {
850 	(void) arg;
851 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
852 	pool_scan_func_t *funcp = arg;
853 	dmu_object_type_t ot = 0;
854 	dsl_pool_t *dp = scn->scn_dp;
855 	spa_t *spa = dp->dp_spa;
856 
857 	ASSERT(!dsl_scan_is_running(scn));
858 	ASSERT(*funcp > POOL_SCAN_NONE && *funcp < POOL_SCAN_FUNCS);
859 	memset(&scn->scn_phys, 0, sizeof (scn->scn_phys));
860 
861 	/*
862 	 * If we are starting a fresh scrub, we erase the error scrub
863 	 * information from disk.
864 	 */
865 	memset(&scn->errorscrub_phys, 0, sizeof (scn->errorscrub_phys));
866 	dsl_errorscrub_sync_state(scn, tx);
867 
868 	scn->scn_phys.scn_func = *funcp;
869 	scn->scn_phys.scn_state = DSS_SCANNING;
870 	scn->scn_phys.scn_min_txg = 0;
871 	scn->scn_phys.scn_max_txg = tx->tx_txg;
872 	scn->scn_phys.scn_ddt_class_max = DDT_CLASSES - 1; /* the entire DDT */
873 	scn->scn_phys.scn_start_time = gethrestime_sec();
874 	scn->scn_phys.scn_errors = 0;
875 	scn->scn_phys.scn_to_examine = spa->spa_root_vdev->vdev_stat.vs_alloc;
876 	scn->scn_issued_before_pass = 0;
877 	scn->scn_restart_txg = 0;
878 	scn->scn_done_txg = 0;
879 	scn->scn_last_checkpoint = 0;
880 	scn->scn_checkpointing = B_FALSE;
881 	spa_scan_stat_init(spa);
882 	vdev_scan_stat_init(spa->spa_root_vdev);
883 
884 	if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
885 		scn->scn_phys.scn_ddt_class_max = zfs_scrub_ddt_class_max;
886 
887 		/* rewrite all disk labels */
888 		vdev_config_dirty(spa->spa_root_vdev);
889 
890 		if (vdev_resilver_needed(spa->spa_root_vdev,
891 		    &scn->scn_phys.scn_min_txg, &scn->scn_phys.scn_max_txg)) {
892 			nvlist_t *aux = fnvlist_alloc();
893 			fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
894 			    "healing");
895 			spa_event_notify(spa, NULL, aux,
896 			    ESC_ZFS_RESILVER_START);
897 			nvlist_free(aux);
898 		} else {
899 			spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_START);
900 		}
901 
902 		spa->spa_scrub_started = B_TRUE;
903 		/*
904 		 * If this is an incremental scrub, limit the DDT scrub phase
905 		 * to just the auto-ditto class (for correctness); the rest
906 		 * of the scrub should go faster using top-down pruning.
907 		 */
908 		if (scn->scn_phys.scn_min_txg > TXG_INITIAL)
909 			scn->scn_phys.scn_ddt_class_max = DDT_CLASS_DITTO;
910 
911 		/*
912 		 * When starting a resilver clear any existing rebuild state.
913 		 * This is required to prevent stale rebuild status from
914 		 * being reported when a rebuild is run, then a resilver and
915 		 * finally a scrub.  In which case only the scrub status
916 		 * should be reported by 'zpool status'.
917 		 */
918 		if (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) {
919 			vdev_t *rvd = spa->spa_root_vdev;
920 			for (uint64_t i = 0; i < rvd->vdev_children; i++) {
921 				vdev_t *vd = rvd->vdev_child[i];
922 				vdev_rebuild_clear_sync(
923 				    (void *)(uintptr_t)vd->vdev_id, tx);
924 			}
925 		}
926 	}
927 
928 	/* back to the generic stuff */
929 
930 	if (zfs_scan_blkstats) {
931 		if (dp->dp_blkstats == NULL) {
932 			dp->dp_blkstats =
933 			    vmem_alloc(sizeof (zfs_all_blkstats_t), KM_SLEEP);
934 		}
935 		memset(&dp->dp_blkstats->zab_type, 0,
936 		    sizeof (dp->dp_blkstats->zab_type));
937 	} else {
938 		if (dp->dp_blkstats) {
939 			vmem_free(dp->dp_blkstats, sizeof (zfs_all_blkstats_t));
940 			dp->dp_blkstats = NULL;
941 		}
942 	}
943 
944 	if (spa_version(spa) < SPA_VERSION_DSL_SCRUB)
945 		ot = DMU_OT_ZAP_OTHER;
946 
947 	scn->scn_phys.scn_queue_obj = zap_create(dp->dp_meta_objset,
948 	    ot ? ot : DMU_OT_SCAN_QUEUE, DMU_OT_NONE, 0, tx);
949 
950 	memcpy(&scn->scn_phys_cached, &scn->scn_phys, sizeof (scn->scn_phys));
951 
952 	dsl_scan_sync_state(scn, tx, SYNC_MANDATORY);
953 
954 	spa_history_log_internal(spa, "scan setup", tx,
955 	    "func=%u mintxg=%llu maxtxg=%llu",
956 	    *funcp, (u_longlong_t)scn->scn_phys.scn_min_txg,
957 	    (u_longlong_t)scn->scn_phys.scn_max_txg);
958 }
959 
960 /*
961  * Called by ZFS_IOC_POOL_SCRUB and ZFS_IOC_POOL_SCAN ioctl to start a scrub,
962  * error scrub or resilver. Can also be called to resume a paused scrub or
963  * error scrub.
964  */
965 int
966 dsl_scan(dsl_pool_t *dp, pool_scan_func_t func)
967 {
968 	spa_t *spa = dp->dp_spa;
969 	dsl_scan_t *scn = dp->dp_scan;
970 
971 	/*
972 	 * Purge all vdev caches and probe all devices.  We do this here
973 	 * rather than in sync context because this requires a writer lock
974 	 * on the spa_config lock, which we can't do from sync context.  The
975 	 * spa_scrub_reopen flag indicates that vdev_open() should not
976 	 * attempt to start another scrub.
977 	 */
978 	spa_vdev_state_enter(spa, SCL_NONE);
979 	spa->spa_scrub_reopen = B_TRUE;
980 	vdev_reopen(spa->spa_root_vdev);
981 	spa->spa_scrub_reopen = B_FALSE;
982 	(void) spa_vdev_state_exit(spa, NULL, 0);
983 
984 	if (func == POOL_SCAN_RESILVER) {
985 		dsl_scan_restart_resilver(spa->spa_dsl_pool, 0);
986 		return (0);
987 	}
988 
989 	if (func == POOL_SCAN_ERRORSCRUB) {
990 		if (dsl_errorscrub_is_paused(dp->dp_scan)) {
991 			/*
992 			 * got error scrub start cmd, resume paused error scrub.
993 			 */
994 			int err = dsl_scrub_set_pause_resume(scn->scn_dp,
995 			    POOL_SCRUB_NORMAL);
996 			if (err == 0) {
997 				spa_event_notify(spa, NULL, NULL,
998 				    ESC_ZFS_ERRORSCRUB_RESUME);
999 				return (ECANCELED);
1000 			}
1001 			return (SET_ERROR(err));
1002 		}
1003 
1004 		return (dsl_sync_task(spa_name(dp->dp_spa),
1005 		    dsl_errorscrub_setup_check, dsl_errorscrub_setup_sync,
1006 		    &func, 0, ZFS_SPACE_CHECK_RESERVED));
1007 	}
1008 
1009 	if (func == POOL_SCAN_SCRUB && dsl_scan_is_paused_scrub(scn)) {
1010 		/* got scrub start cmd, resume paused scrub */
1011 		int err = dsl_scrub_set_pause_resume(scn->scn_dp,
1012 		    POOL_SCRUB_NORMAL);
1013 		if (err == 0) {
1014 			spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_RESUME);
1015 			return (SET_ERROR(ECANCELED));
1016 		}
1017 		return (SET_ERROR(err));
1018 	}
1019 
1020 	return (dsl_sync_task(spa_name(spa), dsl_scan_setup_check,
1021 	    dsl_scan_setup_sync, &func, 0, ZFS_SPACE_CHECK_EXTRA_RESERVED));
1022 }
1023 
1024 static void
1025 dsl_errorscrub_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
1026 {
1027 	dsl_pool_t *dp = scn->scn_dp;
1028 	spa_t *spa = dp->dp_spa;
1029 
1030 	if (complete) {
1031 		spa_event_notify(spa, NULL, NULL, ESC_ZFS_ERRORSCRUB_FINISH);
1032 		spa_history_log_internal(spa, "error scrub done", tx,
1033 		    "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
1034 	} else {
1035 		spa_history_log_internal(spa, "error scrub canceled", tx,
1036 		    "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
1037 	}
1038 
1039 	scn->errorscrub_phys.dep_state = complete ? DSS_FINISHED : DSS_CANCELED;
1040 	spa->spa_scrub_active = B_FALSE;
1041 	spa_errlog_rotate(spa);
1042 	scn->errorscrub_phys.dep_end_time = gethrestime_sec();
1043 	zap_cursor_fini(&scn->errorscrub_cursor);
1044 
1045 	if (spa->spa_errata == ZPOOL_ERRATA_ZOL_2094_SCRUB)
1046 		spa->spa_errata = 0;
1047 
1048 	ASSERT(!dsl_errorscrubbing(scn->scn_dp));
1049 }
1050 
1051 static void
1052 dsl_scan_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
1053 {
1054 	static const char *old_names[] = {
1055 		"scrub_bookmark",
1056 		"scrub_ddt_bookmark",
1057 		"scrub_ddt_class_max",
1058 		"scrub_queue",
1059 		"scrub_min_txg",
1060 		"scrub_max_txg",
1061 		"scrub_func",
1062 		"scrub_errors",
1063 		NULL
1064 	};
1065 
1066 	dsl_pool_t *dp = scn->scn_dp;
1067 	spa_t *spa = dp->dp_spa;
1068 	int i;
1069 
1070 	/* Remove any remnants of an old-style scrub. */
1071 	for (i = 0; old_names[i]; i++) {
1072 		(void) zap_remove(dp->dp_meta_objset,
1073 		    DMU_POOL_DIRECTORY_OBJECT, old_names[i], tx);
1074 	}
1075 
1076 	if (scn->scn_phys.scn_queue_obj != 0) {
1077 		VERIFY0(dmu_object_free(dp->dp_meta_objset,
1078 		    scn->scn_phys.scn_queue_obj, tx));
1079 		scn->scn_phys.scn_queue_obj = 0;
1080 	}
1081 	scan_ds_queue_clear(scn);
1082 	scan_ds_prefetch_queue_clear(scn);
1083 
1084 	scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;
1085 
1086 	/*
1087 	 * If we were "restarted" from a stopped state, don't bother
1088 	 * with anything else.
1089 	 */
1090 	if (!dsl_scan_is_running(scn)) {
1091 		ASSERT(!scn->scn_is_sorted);
1092 		return;
1093 	}
1094 
1095 	if (scn->scn_is_sorted) {
1096 		scan_io_queues_destroy(scn);
1097 		scn->scn_is_sorted = B_FALSE;
1098 
1099 		if (scn->scn_taskq != NULL) {
1100 			taskq_destroy(scn->scn_taskq);
1101 			scn->scn_taskq = NULL;
1102 		}
1103 	}
1104 
1105 	scn->scn_phys.scn_state = complete ? DSS_FINISHED : DSS_CANCELED;
1106 
1107 	spa_notify_waiters(spa);
1108 
1109 	if (dsl_scan_restarting(scn, tx))
1110 		spa_history_log_internal(spa, "scan aborted, restarting", tx,
1111 		    "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
1112 	else if (!complete)
1113 		spa_history_log_internal(spa, "scan cancelled", tx,
1114 		    "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
1115 	else
1116 		spa_history_log_internal(spa, "scan done", tx,
1117 		    "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
1118 
1119 	if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
1120 		spa->spa_scrub_active = B_FALSE;
1121 
1122 		/*
1123 		 * If the scrub/resilver completed, update all DTLs to
1124 		 * reflect this.  Whether it succeeded or not, vacate
1125 		 * all temporary scrub DTLs.
1126 		 *
1127 		 * As the scrub does not currently support traversing
1128 		 * data that have been freed but are part of a checkpoint,
1129 		 * we don't mark the scrub as done in the DTLs as faults
1130 		 * may still exist in those vdevs.
1131 		 */
1132 		if (complete &&
1133 		    !spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
1134 			vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
1135 			    scn->scn_phys.scn_max_txg, B_TRUE, B_FALSE);
1136 
1137 			if (scn->scn_phys.scn_min_txg) {
1138 				nvlist_t *aux = fnvlist_alloc();
1139 				fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
1140 				    "healing");
1141 				spa_event_notify(spa, NULL, aux,
1142 				    ESC_ZFS_RESILVER_FINISH);
1143 				nvlist_free(aux);
1144 			} else {
1145 				spa_event_notify(spa, NULL, NULL,
1146 				    ESC_ZFS_SCRUB_FINISH);
1147 			}
1148 		} else {
1149 			vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
1150 			    0, B_TRUE, B_FALSE);
1151 		}
1152 		spa_errlog_rotate(spa);
1153 
1154 		/*
1155 		 * Don't clear flag until after vdev_dtl_reassess to ensure that
1156 		 * DTL_MISSING will get updated when possible.
1157 		 */
1158 		spa->spa_scrub_started = B_FALSE;
1159 
1160 		/*
1161 		 * We may have finished replacing a device.
1162 		 * Let the async thread assess this and handle the detach.
1163 		 */
1164 		spa_async_request(spa, SPA_ASYNC_RESILVER_DONE);
1165 
1166 		/*
1167 		 * Clear any resilver_deferred flags in the config.
1168 		 * If there are drives that need resilvering, kick
1169 		 * off an asynchronous request to start resilver.
1170 		 * vdev_clear_resilver_deferred() may update the config
1171 		 * before the resilver can restart. In the event of
1172 		 * a crash during this period, the spa loading code
1173 		 * will find the drives that need to be resilvered
1174 		 * and start the resilver then.
1175 		 */
1176 		if (spa_feature_is_enabled(spa, SPA_FEATURE_RESILVER_DEFER) &&
1177 		    vdev_clear_resilver_deferred(spa->spa_root_vdev, tx)) {
1178 			spa_history_log_internal(spa,
1179 			    "starting deferred resilver", tx, "errors=%llu",
1180 			    (u_longlong_t)spa_approx_errlog_size(spa));
1181 			spa_async_request(spa, SPA_ASYNC_RESILVER);
1182 		}
1183 
1184 		/* Clear recent error events (i.e. duplicate events tracking) */
1185 		if (complete)
1186 			zfs_ereport_clear(spa, NULL);
1187 	}
1188 
1189 	scn->scn_phys.scn_end_time = gethrestime_sec();
1190 
1191 	if (spa->spa_errata == ZPOOL_ERRATA_ZOL_2094_SCRUB)
1192 		spa->spa_errata = 0;
1193 
1194 	ASSERT(!dsl_scan_is_running(scn));
1195 }
1196 
1197 static int
1198 dsl_errorscrub_pause_resume_check(void *arg, dmu_tx_t *tx)
1199 {
1200 	pool_scrub_cmd_t *cmd = arg;
1201 	dsl_pool_t *dp = dmu_tx_pool(tx);
1202 	dsl_scan_t *scn = dp->dp_scan;
1203 
1204 	if (*cmd == POOL_SCRUB_PAUSE) {
1205 		/*
1206 		 * can't pause a error scrub when there is no in-progress
1207 		 * error scrub.
1208 		 */
1209 		if (!dsl_errorscrubbing(dp))
1210 			return (SET_ERROR(ENOENT));
1211 
1212 		/* can't pause a paused error scrub */
1213 		if (dsl_errorscrub_is_paused(scn))
1214 			return (SET_ERROR(EBUSY));
1215 	} else if (*cmd != POOL_SCRUB_NORMAL) {
1216 		return (SET_ERROR(ENOTSUP));
1217 	}
1218 
1219 	return (0);
1220 }
1221 
1222 static void
1223 dsl_errorscrub_pause_resume_sync(void *arg, dmu_tx_t *tx)
1224 {
1225 	pool_scrub_cmd_t *cmd = arg;
1226 	dsl_pool_t *dp = dmu_tx_pool(tx);
1227 	spa_t *spa = dp->dp_spa;
1228 	dsl_scan_t *scn = dp->dp_scan;
1229 
1230 	if (*cmd == POOL_SCRUB_PAUSE) {
1231 		spa->spa_scan_pass_errorscrub_pause = gethrestime_sec();
1232 		scn->errorscrub_phys.dep_paused_flags = B_TRUE;
1233 		dsl_errorscrub_sync_state(scn, tx);
1234 		spa_event_notify(spa, NULL, NULL, ESC_ZFS_ERRORSCRUB_PAUSED);
1235 	} else {
1236 		ASSERT3U(*cmd, ==, POOL_SCRUB_NORMAL);
1237 		if (dsl_errorscrub_is_paused(scn)) {
1238 			/*
1239 			 * We need to keep track of how much time we spend
1240 			 * paused per pass so that we can adjust the error scrub
1241 			 * rate shown in the output of 'zpool status'.
1242 			 */
1243 			spa->spa_scan_pass_errorscrub_spent_paused +=
1244 			    gethrestime_sec() -
1245 			    spa->spa_scan_pass_errorscrub_pause;
1246 
1247 			spa->spa_scan_pass_errorscrub_pause = 0;
1248 			scn->errorscrub_phys.dep_paused_flags = B_FALSE;
1249 
1250 			zap_cursor_init_serialized(
1251 			    &scn->errorscrub_cursor,
1252 			    spa->spa_meta_objset, spa->spa_errlog_last,
1253 			    scn->errorscrub_phys.dep_cursor);
1254 
1255 			dsl_errorscrub_sync_state(scn, tx);
1256 		}
1257 	}
1258 }
1259 
1260 static int
1261 dsl_errorscrub_cancel_check(void *arg, dmu_tx_t *tx)
1262 {
1263 	(void) arg;
1264 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
1265 	/* can't cancel a error scrub when there is no one in-progress */
1266 	if (!dsl_errorscrubbing(scn->scn_dp))
1267 		return (SET_ERROR(ENOENT));
1268 	return (0);
1269 }
1270 
1271 static void
1272 dsl_errorscrub_cancel_sync(void *arg, dmu_tx_t *tx)
1273 {
1274 	(void) arg;
1275 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
1276 
1277 	dsl_errorscrub_done(scn, B_FALSE, tx);
1278 	dsl_errorscrub_sync_state(scn, tx);
1279 	spa_event_notify(scn->scn_dp->dp_spa, NULL, NULL,
1280 	    ESC_ZFS_ERRORSCRUB_ABORT);
1281 }
1282 
1283 static int
1284 dsl_scan_cancel_check(void *arg, dmu_tx_t *tx)
1285 {
1286 	(void) arg;
1287 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
1288 
1289 	if (!dsl_scan_is_running(scn))
1290 		return (SET_ERROR(ENOENT));
1291 	return (0);
1292 }
1293 
1294 static void
1295 dsl_scan_cancel_sync(void *arg, dmu_tx_t *tx)
1296 {
1297 	(void) arg;
1298 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
1299 
1300 	dsl_scan_done(scn, B_FALSE, tx);
1301 	dsl_scan_sync_state(scn, tx, SYNC_MANDATORY);
1302 	spa_event_notify(scn->scn_dp->dp_spa, NULL, NULL, ESC_ZFS_SCRUB_ABORT);
1303 }
1304 
1305 int
1306 dsl_scan_cancel(dsl_pool_t *dp)
1307 {
1308 	if (dsl_errorscrubbing(dp)) {
1309 		return (dsl_sync_task(spa_name(dp->dp_spa),
1310 		    dsl_errorscrub_cancel_check, dsl_errorscrub_cancel_sync,
1311 		    NULL, 3, ZFS_SPACE_CHECK_RESERVED));
1312 	}
1313 	return (dsl_sync_task(spa_name(dp->dp_spa), dsl_scan_cancel_check,
1314 	    dsl_scan_cancel_sync, NULL, 3, ZFS_SPACE_CHECK_RESERVED));
1315 }
1316 
1317 static int
1318 dsl_scrub_pause_resume_check(void *arg, dmu_tx_t *tx)
1319 {
1320 	pool_scrub_cmd_t *cmd = arg;
1321 	dsl_pool_t *dp = dmu_tx_pool(tx);
1322 	dsl_scan_t *scn = dp->dp_scan;
1323 
1324 	if (*cmd == POOL_SCRUB_PAUSE) {
1325 		/* can't pause a scrub when there is no in-progress scrub */
1326 		if (!dsl_scan_scrubbing(dp))
1327 			return (SET_ERROR(ENOENT));
1328 
1329 		/* can't pause a paused scrub */
1330 		if (dsl_scan_is_paused_scrub(scn))
1331 			return (SET_ERROR(EBUSY));
1332 	} else if (*cmd != POOL_SCRUB_NORMAL) {
1333 		return (SET_ERROR(ENOTSUP));
1334 	}
1335 
1336 	return (0);
1337 }
1338 
1339 static void
1340 dsl_scrub_pause_resume_sync(void *arg, dmu_tx_t *tx)
1341 {
1342 	pool_scrub_cmd_t *cmd = arg;
1343 	dsl_pool_t *dp = dmu_tx_pool(tx);
1344 	spa_t *spa = dp->dp_spa;
1345 	dsl_scan_t *scn = dp->dp_scan;
1346 
1347 	if (*cmd == POOL_SCRUB_PAUSE) {
1348 		/* can't pause a scrub when there is no in-progress scrub */
1349 		spa->spa_scan_pass_scrub_pause = gethrestime_sec();
1350 		scn->scn_phys.scn_flags |= DSF_SCRUB_PAUSED;
1351 		scn->scn_phys_cached.scn_flags |= DSF_SCRUB_PAUSED;
1352 		dsl_scan_sync_state(scn, tx, SYNC_CACHED);
1353 		spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_PAUSED);
1354 		spa_notify_waiters(spa);
1355 	} else {
1356 		ASSERT3U(*cmd, ==, POOL_SCRUB_NORMAL);
1357 		if (dsl_scan_is_paused_scrub(scn)) {
1358 			/*
1359 			 * We need to keep track of how much time we spend
1360 			 * paused per pass so that we can adjust the scrub rate
1361 			 * shown in the output of 'zpool status'
1362 			 */
1363 			spa->spa_scan_pass_scrub_spent_paused +=
1364 			    gethrestime_sec() - spa->spa_scan_pass_scrub_pause;
1365 			spa->spa_scan_pass_scrub_pause = 0;
1366 			scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;
1367 			scn->scn_phys_cached.scn_flags &= ~DSF_SCRUB_PAUSED;
1368 			dsl_scan_sync_state(scn, tx, SYNC_CACHED);
1369 		}
1370 	}
1371 }
1372 
1373 /*
1374  * Set scrub pause/resume state if it makes sense to do so
1375  */
1376 int
1377 dsl_scrub_set_pause_resume(const dsl_pool_t *dp, pool_scrub_cmd_t cmd)
1378 {
1379 	if (dsl_errorscrubbing(dp)) {
1380 		return (dsl_sync_task(spa_name(dp->dp_spa),
1381 		    dsl_errorscrub_pause_resume_check,
1382 		    dsl_errorscrub_pause_resume_sync, &cmd, 3,
1383 		    ZFS_SPACE_CHECK_RESERVED));
1384 	}
1385 	return (dsl_sync_task(spa_name(dp->dp_spa),
1386 	    dsl_scrub_pause_resume_check, dsl_scrub_pause_resume_sync, &cmd, 3,
1387 	    ZFS_SPACE_CHECK_RESERVED));
1388 }
1389 
1390 
1391 /* start a new scan, or restart an existing one. */
1392 void
1393 dsl_scan_restart_resilver(dsl_pool_t *dp, uint64_t txg)
1394 {
1395 	if (txg == 0) {
1396 		dmu_tx_t *tx;
1397 		tx = dmu_tx_create_dd(dp->dp_mos_dir);
1398 		VERIFY(0 == dmu_tx_assign(tx, TXG_WAIT));
1399 
1400 		txg = dmu_tx_get_txg(tx);
1401 		dp->dp_scan->scn_restart_txg = txg;
1402 		dmu_tx_commit(tx);
1403 	} else {
1404 		dp->dp_scan->scn_restart_txg = txg;
1405 	}
1406 	zfs_dbgmsg("restarting resilver for %s at txg=%llu",
1407 	    dp->dp_spa->spa_name, (longlong_t)txg);
1408 }
1409 
1410 void
1411 dsl_free(dsl_pool_t *dp, uint64_t txg, const blkptr_t *bp)
1412 {
1413 	zio_free(dp->dp_spa, txg, bp);
1414 }
1415 
1416 void
1417 dsl_free_sync(zio_t *pio, dsl_pool_t *dp, uint64_t txg, const blkptr_t *bpp)
1418 {
1419 	ASSERT(dsl_pool_sync_context(dp));
1420 	zio_nowait(zio_free_sync(pio, dp->dp_spa, txg, bpp, pio->io_flags));
1421 }
1422 
1423 static int
1424 scan_ds_queue_compare(const void *a, const void *b)
1425 {
1426 	const scan_ds_t *sds_a = a, *sds_b = b;
1427 
1428 	if (sds_a->sds_dsobj < sds_b->sds_dsobj)
1429 		return (-1);
1430 	if (sds_a->sds_dsobj == sds_b->sds_dsobj)
1431 		return (0);
1432 	return (1);
1433 }
1434 
1435 static void
1436 scan_ds_queue_clear(dsl_scan_t *scn)
1437 {
1438 	void *cookie = NULL;
1439 	scan_ds_t *sds;
1440 	while ((sds = avl_destroy_nodes(&scn->scn_queue, &cookie)) != NULL) {
1441 		kmem_free(sds, sizeof (*sds));
1442 	}
1443 }
1444 
1445 static boolean_t
1446 scan_ds_queue_contains(dsl_scan_t *scn, uint64_t dsobj, uint64_t *txg)
1447 {
1448 	scan_ds_t srch, *sds;
1449 
1450 	srch.sds_dsobj = dsobj;
1451 	sds = avl_find(&scn->scn_queue, &srch, NULL);
1452 	if (sds != NULL && txg != NULL)
1453 		*txg = sds->sds_txg;
1454 	return (sds != NULL);
1455 }
1456 
1457 static void
1458 scan_ds_queue_insert(dsl_scan_t *scn, uint64_t dsobj, uint64_t txg)
1459 {
1460 	scan_ds_t *sds;
1461 	avl_index_t where;
1462 
1463 	sds = kmem_zalloc(sizeof (*sds), KM_SLEEP);
1464 	sds->sds_dsobj = dsobj;
1465 	sds->sds_txg = txg;
1466 
1467 	VERIFY3P(avl_find(&scn->scn_queue, sds, &where), ==, NULL);
1468 	avl_insert(&scn->scn_queue, sds, where);
1469 }
1470 
1471 static void
1472 scan_ds_queue_remove(dsl_scan_t *scn, uint64_t dsobj)
1473 {
1474 	scan_ds_t srch, *sds;
1475 
1476 	srch.sds_dsobj = dsobj;
1477 
1478 	sds = avl_find(&scn->scn_queue, &srch, NULL);
1479 	VERIFY(sds != NULL);
1480 	avl_remove(&scn->scn_queue, sds);
1481 	kmem_free(sds, sizeof (*sds));
1482 }
1483 
1484 static void
1485 scan_ds_queue_sync(dsl_scan_t *scn, dmu_tx_t *tx)
1486 {
1487 	dsl_pool_t *dp = scn->scn_dp;
1488 	spa_t *spa = dp->dp_spa;
1489 	dmu_object_type_t ot = (spa_version(spa) >= SPA_VERSION_DSL_SCRUB) ?
1490 	    DMU_OT_SCAN_QUEUE : DMU_OT_ZAP_OTHER;
1491 
1492 	ASSERT0(scn->scn_queues_pending);
1493 	ASSERT(scn->scn_phys.scn_queue_obj != 0);
1494 
1495 	VERIFY0(dmu_object_free(dp->dp_meta_objset,
1496 	    scn->scn_phys.scn_queue_obj, tx));
1497 	scn->scn_phys.scn_queue_obj = zap_create(dp->dp_meta_objset, ot,
1498 	    DMU_OT_NONE, 0, tx);
1499 	for (scan_ds_t *sds = avl_first(&scn->scn_queue);
1500 	    sds != NULL; sds = AVL_NEXT(&scn->scn_queue, sds)) {
1501 		VERIFY0(zap_add_int_key(dp->dp_meta_objset,
1502 		    scn->scn_phys.scn_queue_obj, sds->sds_dsobj,
1503 		    sds->sds_txg, tx));
1504 	}
1505 }
1506 
1507 /*
1508  * Computes the memory limit state that we're currently in. A sorted scan
1509  * needs quite a bit of memory to hold the sorting queue, so we need to
1510  * reasonably constrain the size so it doesn't impact overall system
1511  * performance. We compute two limits:
1512  * 1) Hard memory limit: if the amount of memory used by the sorting
1513  *	queues on a pool gets above this value, we stop the metadata
1514  *	scanning portion and start issuing the queued up and sorted
1515  *	I/Os to reduce memory usage.
1516  *	This limit is calculated as a fraction of physmem (by default 5%).
1517  *	We constrain the lower bound of the hard limit to an absolute
1518  *	minimum of zfs_scan_mem_lim_min (default: 16 MiB). We also constrain
1519  *	the upper bound to 5% of the total pool size - no chance we'll
1520  *	ever need that much memory, but just to keep the value in check.
1521  * 2) Soft memory limit: once we hit the hard memory limit, we start
1522  *	issuing I/O to reduce queue memory usage, but we don't want to
1523  *	completely empty out the queues, since we might be able to find I/Os
1524  *	that will fill in the gaps of our non-sequential IOs at some point
1525  *	in the future. So we stop the issuing of I/Os once the amount of
1526  *	memory used drops below the soft limit (at which point we stop issuing
1527  *	I/O and start scanning metadata again).
1528  *
1529  *	This limit is calculated by subtracting a fraction of the hard
1530  *	limit from the hard limit. By default this fraction is 5%, so
1531  *	the soft limit is 95% of the hard limit. We cap the size of the
1532  *	difference between the hard and soft limits at an absolute
1533  *	maximum of zfs_scan_mem_lim_soft_max (default: 128 MiB) - this is
1534  *	sufficient to not cause too frequent switching between the
1535  *	metadata scan and I/O issue (even at 2k recordsize, 128 MiB's
1536  *	worth of queues is about 1.2 GiB of on-pool data, so scanning
1537  *	that should take at least a decent fraction of a second).
1538  */
1539 static boolean_t
1540 dsl_scan_should_clear(dsl_scan_t *scn)
1541 {
1542 	spa_t *spa = scn->scn_dp->dp_spa;
1543 	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
1544 	uint64_t alloc, mlim_hard, mlim_soft, mused;
1545 
1546 	alloc = metaslab_class_get_alloc(spa_normal_class(spa));
1547 	alloc += metaslab_class_get_alloc(spa_special_class(spa));
1548 	alloc += metaslab_class_get_alloc(spa_dedup_class(spa));
1549 
1550 	mlim_hard = MAX((physmem / zfs_scan_mem_lim_fact) * PAGESIZE,
1551 	    zfs_scan_mem_lim_min);
1552 	mlim_hard = MIN(mlim_hard, alloc / 20);
1553 	mlim_soft = mlim_hard - MIN(mlim_hard / zfs_scan_mem_lim_soft_fact,
1554 	    zfs_scan_mem_lim_soft_max);
1555 	mused = 0;
1556 	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
1557 		vdev_t *tvd = rvd->vdev_child[i];
1558 		dsl_scan_io_queue_t *queue;
1559 
1560 		mutex_enter(&tvd->vdev_scan_io_queue_lock);
1561 		queue = tvd->vdev_scan_io_queue;
1562 		if (queue != NULL) {
1563 			/*
1564 			 * # of extents in exts_by_addr = # in exts_by_size.
1565 			 * B-tree efficiency is ~75%, but can be as low as 50%.
1566 			 */
1567 			mused += zfs_btree_numnodes(&queue->q_exts_by_size) *
1568 			    ((sizeof (range_seg_gap_t) + sizeof (uint64_t)) *
1569 			    3 / 2) + queue->q_sio_memused;
1570 		}
1571 		mutex_exit(&tvd->vdev_scan_io_queue_lock);
1572 	}
1573 
1574 	dprintf("current scan memory usage: %llu bytes\n", (longlong_t)mused);
1575 
1576 	if (mused == 0)
1577 		ASSERT0(scn->scn_queues_pending);
1578 
1579 	/*
1580 	 * If we are above our hard limit, we need to clear out memory.
1581 	 * If we are below our soft limit, we need to accumulate sequential IOs.
1582 	 * Otherwise, we should keep doing whatever we are currently doing.
1583 	 */
1584 	if (mused >= mlim_hard)
1585 		return (B_TRUE);
1586 	else if (mused < mlim_soft)
1587 		return (B_FALSE);
1588 	else
1589 		return (scn->scn_clearing);
1590 }
1591 
1592 static boolean_t
1593 dsl_scan_check_suspend(dsl_scan_t *scn, const zbookmark_phys_t *zb)
1594 {
1595 	/* we never skip user/group accounting objects */
1596 	if (zb && (int64_t)zb->zb_object < 0)
1597 		return (B_FALSE);
1598 
1599 	if (scn->scn_suspending)
1600 		return (B_TRUE); /* we're already suspending */
1601 
1602 	if (!ZB_IS_ZERO(&scn->scn_phys.scn_bookmark))
1603 		return (B_FALSE); /* we're resuming */
1604 
1605 	/* We only know how to resume from level-0 and objset blocks. */
1606 	if (zb && (zb->zb_level != 0 && zb->zb_level != ZB_ROOT_LEVEL))
1607 		return (B_FALSE);
1608 
1609 	/*
1610 	 * We suspend if:
1611 	 *  - we have scanned for at least the minimum time (default 1 sec
1612 	 *    for scrub, 3 sec for resilver), and either we have sufficient
1613 	 *    dirty data that we are starting to write more quickly
1614 	 *    (default 30%), someone is explicitly waiting for this txg
1615 	 *    to complete, or we have used up all of the time in the txg
1616 	 *    timeout (default 5 sec).
1617 	 *  or
1618 	 *  - the spa is shutting down because this pool is being exported
1619 	 *    or the machine is rebooting.
1620 	 *  or
1621 	 *  - the scan queue has reached its memory use limit
1622 	 */
1623 	uint64_t curr_time_ns = gethrtime();
1624 	uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
1625 	uint64_t sync_time_ns = curr_time_ns -
1626 	    scn->scn_dp->dp_spa->spa_sync_starttime;
1627 	uint64_t dirty_min_bytes = zfs_dirty_data_max *
1628 	    zfs_vdev_async_write_active_min_dirty_percent / 100;
1629 	uint_t mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
1630 	    zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;
1631 
1632 	if ((NSEC2MSEC(scan_time_ns) > mintime &&
1633 	    (scn->scn_dp->dp_dirty_total >= dirty_min_bytes ||
1634 	    txg_sync_waiting(scn->scn_dp) ||
1635 	    NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
1636 	    spa_shutting_down(scn->scn_dp->dp_spa) ||
1637 	    (zfs_scan_strict_mem_lim && dsl_scan_should_clear(scn))) {
1638 		if (zb && zb->zb_level == ZB_ROOT_LEVEL) {
1639 			dprintf("suspending at first available bookmark "
1640 			    "%llx/%llx/%llx/%llx\n",
1641 			    (longlong_t)zb->zb_objset,
1642 			    (longlong_t)zb->zb_object,
1643 			    (longlong_t)zb->zb_level,
1644 			    (longlong_t)zb->zb_blkid);
1645 			SET_BOOKMARK(&scn->scn_phys.scn_bookmark,
1646 			    zb->zb_objset, 0, 0, 0);
1647 		} else if (zb != NULL) {
1648 			dprintf("suspending at bookmark %llx/%llx/%llx/%llx\n",
1649 			    (longlong_t)zb->zb_objset,
1650 			    (longlong_t)zb->zb_object,
1651 			    (longlong_t)zb->zb_level,
1652 			    (longlong_t)zb->zb_blkid);
1653 			scn->scn_phys.scn_bookmark = *zb;
1654 		} else {
1655 #ifdef ZFS_DEBUG
1656 			dsl_scan_phys_t *scnp = &scn->scn_phys;
1657 			dprintf("suspending at at DDT bookmark "
1658 			    "%llx/%llx/%llx/%llx\n",
1659 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_class,
1660 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_type,
1661 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_checksum,
1662 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_cursor);
1663 #endif
1664 		}
1665 		scn->scn_suspending = B_TRUE;
1666 		return (B_TRUE);
1667 	}
1668 	return (B_FALSE);
1669 }
1670 
1671 static boolean_t
1672 dsl_error_scrub_check_suspend(dsl_scan_t *scn, const zbookmark_phys_t *zb)
1673 {
1674 	/*
1675 	 * We suspend if:
1676 	 *  - we have scrubbed for at least the minimum time (default 1 sec
1677 	 *    for error scrub), someone is explicitly waiting for this txg
1678 	 *    to complete, or we have used up all of the time in the txg
1679 	 *    timeout (default 5 sec).
1680 	 *  or
1681 	 *  - the spa is shutting down because this pool is being exported
1682 	 *    or the machine is rebooting.
1683 	 */
1684 	uint64_t curr_time_ns = gethrtime();
1685 	uint64_t error_scrub_time_ns = curr_time_ns - scn->scn_sync_start_time;
1686 	uint64_t sync_time_ns = curr_time_ns -
1687 	    scn->scn_dp->dp_spa->spa_sync_starttime;
1688 	int mintime = zfs_scrub_min_time_ms;
1689 
1690 	if ((NSEC2MSEC(error_scrub_time_ns) > mintime &&
1691 	    (txg_sync_waiting(scn->scn_dp) ||
1692 	    NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
1693 	    spa_shutting_down(scn->scn_dp->dp_spa)) {
1694 		if (zb) {
1695 			dprintf("error scrub suspending at bookmark "
1696 			    "%llx/%llx/%llx/%llx\n",
1697 			    (longlong_t)zb->zb_objset,
1698 			    (longlong_t)zb->zb_object,
1699 			    (longlong_t)zb->zb_level,
1700 			    (longlong_t)zb->zb_blkid);
1701 		}
1702 		return (B_TRUE);
1703 	}
1704 	return (B_FALSE);
1705 }
1706 
1707 typedef struct zil_scan_arg {
1708 	dsl_pool_t	*zsa_dp;
1709 	zil_header_t	*zsa_zh;
1710 } zil_scan_arg_t;
1711 
1712 static int
1713 dsl_scan_zil_block(zilog_t *zilog, const blkptr_t *bp, void *arg,
1714     uint64_t claim_txg)
1715 {
1716 	(void) zilog;
1717 	zil_scan_arg_t *zsa = arg;
1718 	dsl_pool_t *dp = zsa->zsa_dp;
1719 	dsl_scan_t *scn = dp->dp_scan;
1720 	zil_header_t *zh = zsa->zsa_zh;
1721 	zbookmark_phys_t zb;
1722 
1723 	ASSERT(!BP_IS_REDACTED(bp));
1724 	if (BP_IS_HOLE(bp) || bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
1725 		return (0);
1726 
1727 	/*
1728 	 * One block ("stubby") can be allocated a long time ago; we
1729 	 * want to visit that one because it has been allocated
1730 	 * (on-disk) even if it hasn't been claimed (even though for
1731 	 * scrub there's nothing to do to it).
1732 	 */
1733 	if (claim_txg == 0 && bp->blk_birth >= spa_min_claim_txg(dp->dp_spa))
1734 		return (0);
1735 
1736 	SET_BOOKMARK(&zb, zh->zh_log.blk_cksum.zc_word[ZIL_ZC_OBJSET],
1737 	    ZB_ZIL_OBJECT, ZB_ZIL_LEVEL, bp->blk_cksum.zc_word[ZIL_ZC_SEQ]);
1738 
1739 	VERIFY(0 == scan_funcs[scn->scn_phys.scn_func](dp, bp, &zb));
1740 	return (0);
1741 }
1742 
1743 static int
1744 dsl_scan_zil_record(zilog_t *zilog, const lr_t *lrc, void *arg,
1745     uint64_t claim_txg)
1746 {
1747 	(void) zilog;
1748 	if (lrc->lrc_txtype == TX_WRITE) {
1749 		zil_scan_arg_t *zsa = arg;
1750 		dsl_pool_t *dp = zsa->zsa_dp;
1751 		dsl_scan_t *scn = dp->dp_scan;
1752 		zil_header_t *zh = zsa->zsa_zh;
1753 		const lr_write_t *lr = (const lr_write_t *)lrc;
1754 		const blkptr_t *bp = &lr->lr_blkptr;
1755 		zbookmark_phys_t zb;
1756 
1757 		ASSERT(!BP_IS_REDACTED(bp));
1758 		if (BP_IS_HOLE(bp) ||
1759 		    bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
1760 			return (0);
1761 
1762 		/*
1763 		 * birth can be < claim_txg if this record's txg is
1764 		 * already txg sync'ed (but this log block contains
1765 		 * other records that are not synced)
1766 		 */
1767 		if (claim_txg == 0 || bp->blk_birth < claim_txg)
1768 			return (0);
1769 
1770 		ASSERT3U(BP_GET_LSIZE(bp), !=, 0);
1771 		SET_BOOKMARK(&zb, zh->zh_log.blk_cksum.zc_word[ZIL_ZC_OBJSET],
1772 		    lr->lr_foid, ZB_ZIL_LEVEL,
1773 		    lr->lr_offset / BP_GET_LSIZE(bp));
1774 
1775 		VERIFY(0 == scan_funcs[scn->scn_phys.scn_func](dp, bp, &zb));
1776 	}
1777 	return (0);
1778 }
1779 
1780 static void
1781 dsl_scan_zil(dsl_pool_t *dp, zil_header_t *zh)
1782 {
1783 	uint64_t claim_txg = zh->zh_claim_txg;
1784 	zil_scan_arg_t zsa = { dp, zh };
1785 	zilog_t *zilog;
1786 
1787 	ASSERT(spa_writeable(dp->dp_spa));
1788 
1789 	/*
1790 	 * We only want to visit blocks that have been claimed but not yet
1791 	 * replayed (or, in read-only mode, blocks that *would* be claimed).
1792 	 */
1793 	if (claim_txg == 0)
1794 		return;
1795 
1796 	zilog = zil_alloc(dp->dp_meta_objset, zh);
1797 
1798 	(void) zil_parse(zilog, dsl_scan_zil_block, dsl_scan_zil_record, &zsa,
1799 	    claim_txg, B_FALSE);
1800 
1801 	zil_free(zilog);
1802 }
1803 
1804 /*
1805  * We compare scan_prefetch_issue_ctx_t's based on their bookmarks. The idea
1806  * here is to sort the AVL tree by the order each block will be needed.
1807  */
1808 static int
1809 scan_prefetch_queue_compare(const void *a, const void *b)
1810 {
1811 	const scan_prefetch_issue_ctx_t *spic_a = a, *spic_b = b;
1812 	const scan_prefetch_ctx_t *spc_a = spic_a->spic_spc;
1813 	const scan_prefetch_ctx_t *spc_b = spic_b->spic_spc;
1814 
1815 	return (zbookmark_compare(spc_a->spc_datablkszsec,
1816 	    spc_a->spc_indblkshift, spc_b->spc_datablkszsec,
1817 	    spc_b->spc_indblkshift, &spic_a->spic_zb, &spic_b->spic_zb));
1818 }
1819 
1820 static void
1821 scan_prefetch_ctx_rele(scan_prefetch_ctx_t *spc, const void *tag)
1822 {
1823 	if (zfs_refcount_remove(&spc->spc_refcnt, tag) == 0) {
1824 		zfs_refcount_destroy(&spc->spc_refcnt);
1825 		kmem_free(spc, sizeof (scan_prefetch_ctx_t));
1826 	}
1827 }
1828 
1829 static scan_prefetch_ctx_t *
1830 scan_prefetch_ctx_create(dsl_scan_t *scn, dnode_phys_t *dnp, const void *tag)
1831 {
1832 	scan_prefetch_ctx_t *spc;
1833 
1834 	spc = kmem_alloc(sizeof (scan_prefetch_ctx_t), KM_SLEEP);
1835 	zfs_refcount_create(&spc->spc_refcnt);
1836 	zfs_refcount_add(&spc->spc_refcnt, tag);
1837 	spc->spc_scn = scn;
1838 	if (dnp != NULL) {
1839 		spc->spc_datablkszsec = dnp->dn_datablkszsec;
1840 		spc->spc_indblkshift = dnp->dn_indblkshift;
1841 		spc->spc_root = B_FALSE;
1842 	} else {
1843 		spc->spc_datablkszsec = 0;
1844 		spc->spc_indblkshift = 0;
1845 		spc->spc_root = B_TRUE;
1846 	}
1847 
1848 	return (spc);
1849 }
1850 
1851 static void
1852 scan_prefetch_ctx_add_ref(scan_prefetch_ctx_t *spc, const void *tag)
1853 {
1854 	zfs_refcount_add(&spc->spc_refcnt, tag);
1855 }
1856 
1857 static void
1858 scan_ds_prefetch_queue_clear(dsl_scan_t *scn)
1859 {
1860 	spa_t *spa = scn->scn_dp->dp_spa;
1861 	void *cookie = NULL;
1862 	scan_prefetch_issue_ctx_t *spic = NULL;
1863 
1864 	mutex_enter(&spa->spa_scrub_lock);
1865 	while ((spic = avl_destroy_nodes(&scn->scn_prefetch_queue,
1866 	    &cookie)) != NULL) {
1867 		scan_prefetch_ctx_rele(spic->spic_spc, scn);
1868 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
1869 	}
1870 	mutex_exit(&spa->spa_scrub_lock);
1871 }
1872 
1873 static boolean_t
1874 dsl_scan_check_prefetch_resume(scan_prefetch_ctx_t *spc,
1875     const zbookmark_phys_t *zb)
1876 {
1877 	zbookmark_phys_t *last_zb = &spc->spc_scn->scn_prefetch_bookmark;
1878 	dnode_phys_t tmp_dnp;
1879 	dnode_phys_t *dnp = (spc->spc_root) ? NULL : &tmp_dnp;
1880 
1881 	if (zb->zb_objset != last_zb->zb_objset)
1882 		return (B_TRUE);
1883 	if ((int64_t)zb->zb_object < 0)
1884 		return (B_FALSE);
1885 
1886 	tmp_dnp.dn_datablkszsec = spc->spc_datablkszsec;
1887 	tmp_dnp.dn_indblkshift = spc->spc_indblkshift;
1888 
1889 	if (zbookmark_subtree_completed(dnp, zb, last_zb))
1890 		return (B_TRUE);
1891 
1892 	return (B_FALSE);
1893 }
1894 
1895 static void
1896 dsl_scan_prefetch(scan_prefetch_ctx_t *spc, blkptr_t *bp, zbookmark_phys_t *zb)
1897 {
1898 	avl_index_t idx;
1899 	dsl_scan_t *scn = spc->spc_scn;
1900 	spa_t *spa = scn->scn_dp->dp_spa;
1901 	scan_prefetch_issue_ctx_t *spic;
1902 
1903 	if (zfs_no_scrub_prefetch || BP_IS_REDACTED(bp))
1904 		return;
1905 
1906 	if (BP_IS_HOLE(bp) || bp->blk_birth <= scn->scn_phys.scn_cur_min_txg ||
1907 	    (BP_GET_LEVEL(bp) == 0 && BP_GET_TYPE(bp) != DMU_OT_DNODE &&
1908 	    BP_GET_TYPE(bp) != DMU_OT_OBJSET))
1909 		return;
1910 
1911 	if (dsl_scan_check_prefetch_resume(spc, zb))
1912 		return;
1913 
1914 	scan_prefetch_ctx_add_ref(spc, scn);
1915 	spic = kmem_alloc(sizeof (scan_prefetch_issue_ctx_t), KM_SLEEP);
1916 	spic->spic_spc = spc;
1917 	spic->spic_bp = *bp;
1918 	spic->spic_zb = *zb;
1919 
1920 	/*
1921 	 * Add the IO to the queue of blocks to prefetch. This allows us to
1922 	 * prioritize blocks that we will need first for the main traversal
1923 	 * thread.
1924 	 */
1925 	mutex_enter(&spa->spa_scrub_lock);
1926 	if (avl_find(&scn->scn_prefetch_queue, spic, &idx) != NULL) {
1927 		/* this block is already queued for prefetch */
1928 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
1929 		scan_prefetch_ctx_rele(spc, scn);
1930 		mutex_exit(&spa->spa_scrub_lock);
1931 		return;
1932 	}
1933 
1934 	avl_insert(&scn->scn_prefetch_queue, spic, idx);
1935 	cv_broadcast(&spa->spa_scrub_io_cv);
1936 	mutex_exit(&spa->spa_scrub_lock);
1937 }
1938 
1939 static void
1940 dsl_scan_prefetch_dnode(dsl_scan_t *scn, dnode_phys_t *dnp,
1941     uint64_t objset, uint64_t object)
1942 {
1943 	int i;
1944 	zbookmark_phys_t zb;
1945 	scan_prefetch_ctx_t *spc;
1946 
1947 	if (dnp->dn_nblkptr == 0 && !(dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR))
1948 		return;
1949 
1950 	SET_BOOKMARK(&zb, objset, object, 0, 0);
1951 
1952 	spc = scan_prefetch_ctx_create(scn, dnp, FTAG);
1953 
1954 	for (i = 0; i < dnp->dn_nblkptr; i++) {
1955 		zb.zb_level = BP_GET_LEVEL(&dnp->dn_blkptr[i]);
1956 		zb.zb_blkid = i;
1957 		dsl_scan_prefetch(spc, &dnp->dn_blkptr[i], &zb);
1958 	}
1959 
1960 	if (dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR) {
1961 		zb.zb_level = 0;
1962 		zb.zb_blkid = DMU_SPILL_BLKID;
1963 		dsl_scan_prefetch(spc, DN_SPILL_BLKPTR(dnp), &zb);
1964 	}
1965 
1966 	scan_prefetch_ctx_rele(spc, FTAG);
1967 }
1968 
1969 static void
1970 dsl_scan_prefetch_cb(zio_t *zio, const zbookmark_phys_t *zb, const blkptr_t *bp,
1971     arc_buf_t *buf, void *private)
1972 {
1973 	(void) zio;
1974 	scan_prefetch_ctx_t *spc = private;
1975 	dsl_scan_t *scn = spc->spc_scn;
1976 	spa_t *spa = scn->scn_dp->dp_spa;
1977 
1978 	/* broadcast that the IO has completed for rate limiting purposes */
1979 	mutex_enter(&spa->spa_scrub_lock);
1980 	ASSERT3U(spa->spa_scrub_inflight, >=, BP_GET_PSIZE(bp));
1981 	spa->spa_scrub_inflight -= BP_GET_PSIZE(bp);
1982 	cv_broadcast(&spa->spa_scrub_io_cv);
1983 	mutex_exit(&spa->spa_scrub_lock);
1984 
1985 	/* if there was an error or we are done prefetching, just cleanup */
1986 	if (buf == NULL || scn->scn_prefetch_stop)
1987 		goto out;
1988 
1989 	if (BP_GET_LEVEL(bp) > 0) {
1990 		int i;
1991 		blkptr_t *cbp;
1992 		int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
1993 		zbookmark_phys_t czb;
1994 
1995 		for (i = 0, cbp = buf->b_data; i < epb; i++, cbp++) {
1996 			SET_BOOKMARK(&czb, zb->zb_objset, zb->zb_object,
1997 			    zb->zb_level - 1, zb->zb_blkid * epb + i);
1998 			dsl_scan_prefetch(spc, cbp, &czb);
1999 		}
2000 	} else if (BP_GET_TYPE(bp) == DMU_OT_DNODE) {
2001 		dnode_phys_t *cdnp;
2002 		int i;
2003 		int epb = BP_GET_LSIZE(bp) >> DNODE_SHIFT;
2004 
2005 		for (i = 0, cdnp = buf->b_data; i < epb;
2006 		    i += cdnp->dn_extra_slots + 1,
2007 		    cdnp += cdnp->dn_extra_slots + 1) {
2008 			dsl_scan_prefetch_dnode(scn, cdnp,
2009 			    zb->zb_objset, zb->zb_blkid * epb + i);
2010 		}
2011 	} else if (BP_GET_TYPE(bp) == DMU_OT_OBJSET) {
2012 		objset_phys_t *osp = buf->b_data;
2013 
2014 		dsl_scan_prefetch_dnode(scn, &osp->os_meta_dnode,
2015 		    zb->zb_objset, DMU_META_DNODE_OBJECT);
2016 
2017 		if (OBJSET_BUF_HAS_USERUSED(buf)) {
2018 			if (OBJSET_BUF_HAS_PROJECTUSED(buf)) {
2019 				dsl_scan_prefetch_dnode(scn,
2020 				    &osp->os_projectused_dnode, zb->zb_objset,
2021 				    DMU_PROJECTUSED_OBJECT);
2022 			}
2023 			dsl_scan_prefetch_dnode(scn,
2024 			    &osp->os_groupused_dnode, zb->zb_objset,
2025 			    DMU_GROUPUSED_OBJECT);
2026 			dsl_scan_prefetch_dnode(scn,
2027 			    &osp->os_userused_dnode, zb->zb_objset,
2028 			    DMU_USERUSED_OBJECT);
2029 		}
2030 	}
2031 
2032 out:
2033 	if (buf != NULL)
2034 		arc_buf_destroy(buf, private);
2035 	scan_prefetch_ctx_rele(spc, scn);
2036 }
2037 
2038 static void
2039 dsl_scan_prefetch_thread(void *arg)
2040 {
2041 	dsl_scan_t *scn = arg;
2042 	spa_t *spa = scn->scn_dp->dp_spa;
2043 	scan_prefetch_issue_ctx_t *spic;
2044 
2045 	/* loop until we are told to stop */
2046 	while (!scn->scn_prefetch_stop) {
2047 		arc_flags_t flags = ARC_FLAG_NOWAIT |
2048 		    ARC_FLAG_PRESCIENT_PREFETCH | ARC_FLAG_PREFETCH;
2049 		int zio_flags = ZIO_FLAG_CANFAIL | ZIO_FLAG_SCAN_THREAD;
2050 
2051 		mutex_enter(&spa->spa_scrub_lock);
2052 
2053 		/*
2054 		 * Wait until we have an IO to issue and are not above our
2055 		 * maximum in flight limit.
2056 		 */
2057 		while (!scn->scn_prefetch_stop &&
2058 		    (avl_numnodes(&scn->scn_prefetch_queue) == 0 ||
2059 		    spa->spa_scrub_inflight >= scn->scn_maxinflight_bytes)) {
2060 			cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
2061 		}
2062 
2063 		/* recheck if we should stop since we waited for the cv */
2064 		if (scn->scn_prefetch_stop) {
2065 			mutex_exit(&spa->spa_scrub_lock);
2066 			break;
2067 		}
2068 
2069 		/* remove the prefetch IO from the tree */
2070 		spic = avl_first(&scn->scn_prefetch_queue);
2071 		spa->spa_scrub_inflight += BP_GET_PSIZE(&spic->spic_bp);
2072 		avl_remove(&scn->scn_prefetch_queue, spic);
2073 
2074 		mutex_exit(&spa->spa_scrub_lock);
2075 
2076 		if (BP_IS_PROTECTED(&spic->spic_bp)) {
2077 			ASSERT(BP_GET_TYPE(&spic->spic_bp) == DMU_OT_DNODE ||
2078 			    BP_GET_TYPE(&spic->spic_bp) == DMU_OT_OBJSET);
2079 			ASSERT3U(BP_GET_LEVEL(&spic->spic_bp), ==, 0);
2080 			zio_flags |= ZIO_FLAG_RAW;
2081 		}
2082 
2083 		/* We don't need data L1 buffer since we do not prefetch L0. */
2084 		blkptr_t *bp = &spic->spic_bp;
2085 		if (BP_GET_LEVEL(bp) == 1 && BP_GET_TYPE(bp) != DMU_OT_DNODE &&
2086 		    BP_GET_TYPE(bp) != DMU_OT_OBJSET)
2087 			flags |= ARC_FLAG_NO_BUF;
2088 
2089 		/* issue the prefetch asynchronously */
2090 		(void) arc_read(scn->scn_zio_root, spa, bp,
2091 		    dsl_scan_prefetch_cb, spic->spic_spc, ZIO_PRIORITY_SCRUB,
2092 		    zio_flags, &flags, &spic->spic_zb);
2093 
2094 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
2095 	}
2096 
2097 	ASSERT(scn->scn_prefetch_stop);
2098 
2099 	/* free any prefetches we didn't get to complete */
2100 	mutex_enter(&spa->spa_scrub_lock);
2101 	while ((spic = avl_first(&scn->scn_prefetch_queue)) != NULL) {
2102 		avl_remove(&scn->scn_prefetch_queue, spic);
2103 		scan_prefetch_ctx_rele(spic->spic_spc, scn);
2104 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
2105 	}
2106 	ASSERT0(avl_numnodes(&scn->scn_prefetch_queue));
2107 	mutex_exit(&spa->spa_scrub_lock);
2108 }
2109 
2110 static boolean_t
2111 dsl_scan_check_resume(dsl_scan_t *scn, const dnode_phys_t *dnp,
2112     const zbookmark_phys_t *zb)
2113 {
2114 	/*
2115 	 * We never skip over user/group accounting objects (obj<0)
2116 	 */
2117 	if (!ZB_IS_ZERO(&scn->scn_phys.scn_bookmark) &&
2118 	    (int64_t)zb->zb_object >= 0) {
2119 		/*
2120 		 * If we already visited this bp & everything below (in
2121 		 * a prior txg sync), don't bother doing it again.
2122 		 */
2123 		if (zbookmark_subtree_completed(dnp, zb,
2124 		    &scn->scn_phys.scn_bookmark))
2125 			return (B_TRUE);
2126 
2127 		/*
2128 		 * If we found the block we're trying to resume from, or
2129 		 * we went past it, zero it out to indicate that it's OK
2130 		 * to start checking for suspending again.
2131 		 */
2132 		if (zbookmark_subtree_tbd(dnp, zb,
2133 		    &scn->scn_phys.scn_bookmark)) {
2134 			dprintf("resuming at %llx/%llx/%llx/%llx\n",
2135 			    (longlong_t)zb->zb_objset,
2136 			    (longlong_t)zb->zb_object,
2137 			    (longlong_t)zb->zb_level,
2138 			    (longlong_t)zb->zb_blkid);
2139 			memset(&scn->scn_phys.scn_bookmark, 0, sizeof (*zb));
2140 		}
2141 	}
2142 	return (B_FALSE);
2143 }
2144 
2145 static void dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
2146     dnode_phys_t *dnp, dsl_dataset_t *ds, dsl_scan_t *scn,
2147     dmu_objset_type_t ostype, dmu_tx_t *tx);
2148 inline __attribute__((always_inline)) static void dsl_scan_visitdnode(
2149     dsl_scan_t *, dsl_dataset_t *ds, dmu_objset_type_t ostype,
2150     dnode_phys_t *dnp, uint64_t object, dmu_tx_t *tx);
2151 
2152 /*
2153  * Return nonzero on i/o error.
2154  * Return new buf to write out in *bufp.
2155  */
2156 inline __attribute__((always_inline)) static int
2157 dsl_scan_recurse(dsl_scan_t *scn, dsl_dataset_t *ds, dmu_objset_type_t ostype,
2158     dnode_phys_t *dnp, const blkptr_t *bp,
2159     const zbookmark_phys_t *zb, dmu_tx_t *tx)
2160 {
2161 	dsl_pool_t *dp = scn->scn_dp;
2162 	spa_t *spa = dp->dp_spa;
2163 	int zio_flags = ZIO_FLAG_CANFAIL | ZIO_FLAG_SCAN_THREAD;
2164 	int err;
2165 
2166 	ASSERT(!BP_IS_REDACTED(bp));
2167 
2168 	/*
2169 	 * There is an unlikely case of encountering dnodes with contradicting
2170 	 * dn_bonuslen and DNODE_FLAG_SPILL_BLKPTR flag before in files created
2171 	 * or modified before commit 4254acb was merged. As it is not possible
2172 	 * to know which of the two is correct, report an error.
2173 	 */
2174 	if (dnp != NULL &&
2175 	    dnp->dn_bonuslen > DN_MAX_BONUS_LEN(dnp)) {
2176 		scn->scn_phys.scn_errors++;
2177 		spa_log_error(spa, zb, &bp->blk_birth);
2178 		return (SET_ERROR(EINVAL));
2179 	}
2180 
2181 	if (BP_GET_LEVEL(bp) > 0) {
2182 		arc_flags_t flags = ARC_FLAG_WAIT;
2183 		int i;
2184 		blkptr_t *cbp;
2185 		int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
2186 		arc_buf_t *buf;
2187 
2188 		err = arc_read(NULL, spa, bp, arc_getbuf_func, &buf,
2189 		    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
2190 		if (err) {
2191 			scn->scn_phys.scn_errors++;
2192 			return (err);
2193 		}
2194 		for (i = 0, cbp = buf->b_data; i < epb; i++, cbp++) {
2195 			zbookmark_phys_t czb;
2196 
2197 			SET_BOOKMARK(&czb, zb->zb_objset, zb->zb_object,
2198 			    zb->zb_level - 1,
2199 			    zb->zb_blkid * epb + i);
2200 			dsl_scan_visitbp(cbp, &czb, dnp,
2201 			    ds, scn, ostype, tx);
2202 		}
2203 		arc_buf_destroy(buf, &buf);
2204 	} else if (BP_GET_TYPE(bp) == DMU_OT_DNODE) {
2205 		arc_flags_t flags = ARC_FLAG_WAIT;
2206 		dnode_phys_t *cdnp;
2207 		int i;
2208 		int epb = BP_GET_LSIZE(bp) >> DNODE_SHIFT;
2209 		arc_buf_t *buf;
2210 
2211 		if (BP_IS_PROTECTED(bp)) {
2212 			ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
2213 			zio_flags |= ZIO_FLAG_RAW;
2214 		}
2215 
2216 		err = arc_read(NULL, spa, bp, arc_getbuf_func, &buf,
2217 		    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
2218 		if (err) {
2219 			scn->scn_phys.scn_errors++;
2220 			return (err);
2221 		}
2222 		for (i = 0, cdnp = buf->b_data; i < epb;
2223 		    i += cdnp->dn_extra_slots + 1,
2224 		    cdnp += cdnp->dn_extra_slots + 1) {
2225 			dsl_scan_visitdnode(scn, ds, ostype,
2226 			    cdnp, zb->zb_blkid * epb + i, tx);
2227 		}
2228 
2229 		arc_buf_destroy(buf, &buf);
2230 	} else if (BP_GET_TYPE(bp) == DMU_OT_OBJSET) {
2231 		arc_flags_t flags = ARC_FLAG_WAIT;
2232 		objset_phys_t *osp;
2233 		arc_buf_t *buf;
2234 
2235 		err = arc_read(NULL, spa, bp, arc_getbuf_func, &buf,
2236 		    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
2237 		if (err) {
2238 			scn->scn_phys.scn_errors++;
2239 			return (err);
2240 		}
2241 
2242 		osp = buf->b_data;
2243 
2244 		dsl_scan_visitdnode(scn, ds, osp->os_type,
2245 		    &osp->os_meta_dnode, DMU_META_DNODE_OBJECT, tx);
2246 
2247 		if (OBJSET_BUF_HAS_USERUSED(buf)) {
2248 			/*
2249 			 * We also always visit user/group/project accounting
2250 			 * objects, and never skip them, even if we are
2251 			 * suspending. This is necessary so that the
2252 			 * space deltas from this txg get integrated.
2253 			 */
2254 			if (OBJSET_BUF_HAS_PROJECTUSED(buf))
2255 				dsl_scan_visitdnode(scn, ds, osp->os_type,
2256 				    &osp->os_projectused_dnode,
2257 				    DMU_PROJECTUSED_OBJECT, tx);
2258 			dsl_scan_visitdnode(scn, ds, osp->os_type,
2259 			    &osp->os_groupused_dnode,
2260 			    DMU_GROUPUSED_OBJECT, tx);
2261 			dsl_scan_visitdnode(scn, ds, osp->os_type,
2262 			    &osp->os_userused_dnode,
2263 			    DMU_USERUSED_OBJECT, tx);
2264 		}
2265 		arc_buf_destroy(buf, &buf);
2266 	} else if (!zfs_blkptr_verify(spa, bp,
2267 	    BLK_CONFIG_NEEDED, BLK_VERIFY_LOG)) {
2268 		/*
2269 		 * Sanity check the block pointer contents, this is handled
2270 		 * by arc_read() for the cases above.
2271 		 */
2272 		scn->scn_phys.scn_errors++;
2273 		spa_log_error(spa, zb, &bp->blk_birth);
2274 		return (SET_ERROR(EINVAL));
2275 	}
2276 
2277 	return (0);
2278 }
2279 
2280 inline __attribute__((always_inline)) static void
2281 dsl_scan_visitdnode(dsl_scan_t *scn, dsl_dataset_t *ds,
2282     dmu_objset_type_t ostype, dnode_phys_t *dnp,
2283     uint64_t object, dmu_tx_t *tx)
2284 {
2285 	int j;
2286 
2287 	for (j = 0; j < dnp->dn_nblkptr; j++) {
2288 		zbookmark_phys_t czb;
2289 
2290 		SET_BOOKMARK(&czb, ds ? ds->ds_object : 0, object,
2291 		    dnp->dn_nlevels - 1, j);
2292 		dsl_scan_visitbp(&dnp->dn_blkptr[j],
2293 		    &czb, dnp, ds, scn, ostype, tx);
2294 	}
2295 
2296 	if (dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR) {
2297 		zbookmark_phys_t czb;
2298 		SET_BOOKMARK(&czb, ds ? ds->ds_object : 0, object,
2299 		    0, DMU_SPILL_BLKID);
2300 		dsl_scan_visitbp(DN_SPILL_BLKPTR(dnp),
2301 		    &czb, dnp, ds, scn, ostype, tx);
2302 	}
2303 }
2304 
2305 /*
2306  * The arguments are in this order because mdb can only print the
2307  * first 5; we want them to be useful.
2308  */
2309 static void
2310 dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
2311     dnode_phys_t *dnp, dsl_dataset_t *ds, dsl_scan_t *scn,
2312     dmu_objset_type_t ostype, dmu_tx_t *tx)
2313 {
2314 	dsl_pool_t *dp = scn->scn_dp;
2315 	blkptr_t *bp_toread = NULL;
2316 
2317 	if (dsl_scan_check_suspend(scn, zb))
2318 		return;
2319 
2320 	if (dsl_scan_check_resume(scn, dnp, zb))
2321 		return;
2322 
2323 	scn->scn_visited_this_txg++;
2324 
2325 	if (BP_IS_HOLE(bp)) {
2326 		scn->scn_holes_this_txg++;
2327 		return;
2328 	}
2329 
2330 	if (BP_IS_REDACTED(bp)) {
2331 		ASSERT(dsl_dataset_feature_is_active(ds,
2332 		    SPA_FEATURE_REDACTED_DATASETS));
2333 		return;
2334 	}
2335 
2336 	/*
2337 	 * Check if this block contradicts any filesystem flags.
2338 	 */
2339 	spa_feature_t f = SPA_FEATURE_LARGE_BLOCKS;
2340 	if (BP_GET_LSIZE(bp) > SPA_OLD_MAXBLOCKSIZE)
2341 		ASSERT(dsl_dataset_feature_is_active(ds, f));
2342 
2343 	f = zio_checksum_to_feature(BP_GET_CHECKSUM(bp));
2344 	if (f != SPA_FEATURE_NONE)
2345 		ASSERT(dsl_dataset_feature_is_active(ds, f));
2346 
2347 	f = zio_compress_to_feature(BP_GET_COMPRESS(bp));
2348 	if (f != SPA_FEATURE_NONE)
2349 		ASSERT(dsl_dataset_feature_is_active(ds, f));
2350 
2351 	if (bp->blk_birth <= scn->scn_phys.scn_cur_min_txg) {
2352 		scn->scn_lt_min_this_txg++;
2353 		return;
2354 	}
2355 
2356 	bp_toread = kmem_alloc(sizeof (blkptr_t), KM_SLEEP);
2357 	*bp_toread = *bp;
2358 
2359 	if (dsl_scan_recurse(scn, ds, ostype, dnp, bp_toread, zb, tx) != 0)
2360 		goto out;
2361 
2362 	/*
2363 	 * If dsl_scan_ddt() has already visited this block, it will have
2364 	 * already done any translations or scrubbing, so don't call the
2365 	 * callback again.
2366 	 */
2367 	if (ddt_class_contains(dp->dp_spa,
2368 	    scn->scn_phys.scn_ddt_class_max, bp)) {
2369 		scn->scn_ddt_contained_this_txg++;
2370 		goto out;
2371 	}
2372 
2373 	/*
2374 	 * If this block is from the future (after cur_max_txg), then we
2375 	 * are doing this on behalf of a deleted snapshot, and we will
2376 	 * revisit the future block on the next pass of this dataset.
2377 	 * Don't scan it now unless we need to because something
2378 	 * under it was modified.
2379 	 */
2380 	if (BP_PHYSICAL_BIRTH(bp) > scn->scn_phys.scn_cur_max_txg) {
2381 		scn->scn_gt_max_this_txg++;
2382 		goto out;
2383 	}
2384 
2385 	scan_funcs[scn->scn_phys.scn_func](dp, bp, zb);
2386 
2387 out:
2388 	kmem_free(bp_toread, sizeof (blkptr_t));
2389 }
2390 
2391 static void
2392 dsl_scan_visit_rootbp(dsl_scan_t *scn, dsl_dataset_t *ds, blkptr_t *bp,
2393     dmu_tx_t *tx)
2394 {
2395 	zbookmark_phys_t zb;
2396 	scan_prefetch_ctx_t *spc;
2397 
2398 	SET_BOOKMARK(&zb, ds ? ds->ds_object : DMU_META_OBJSET,
2399 	    ZB_ROOT_OBJECT, ZB_ROOT_LEVEL, ZB_ROOT_BLKID);
2400 
2401 	if (ZB_IS_ZERO(&scn->scn_phys.scn_bookmark)) {
2402 		SET_BOOKMARK(&scn->scn_prefetch_bookmark,
2403 		    zb.zb_objset, 0, 0, 0);
2404 	} else {
2405 		scn->scn_prefetch_bookmark = scn->scn_phys.scn_bookmark;
2406 	}
2407 
2408 	scn->scn_objsets_visited_this_txg++;
2409 
2410 	spc = scan_prefetch_ctx_create(scn, NULL, FTAG);
2411 	dsl_scan_prefetch(spc, bp, &zb);
2412 	scan_prefetch_ctx_rele(spc, FTAG);
2413 
2414 	dsl_scan_visitbp(bp, &zb, NULL, ds, scn, DMU_OST_NONE, tx);
2415 
2416 	dprintf_ds(ds, "finished scan%s", "");
2417 }
2418 
2419 static void
2420 ds_destroyed_scn_phys(dsl_dataset_t *ds, dsl_scan_phys_t *scn_phys)
2421 {
2422 	if (scn_phys->scn_bookmark.zb_objset == ds->ds_object) {
2423 		if (ds->ds_is_snapshot) {
2424 			/*
2425 			 * Note:
2426 			 *  - scn_cur_{min,max}_txg stays the same.
2427 			 *  - Setting the flag is not really necessary if
2428 			 *    scn_cur_max_txg == scn_max_txg, because there
2429 			 *    is nothing after this snapshot that we care
2430 			 *    about.  However, we set it anyway and then
2431 			 *    ignore it when we retraverse it in
2432 			 *    dsl_scan_visitds().
2433 			 */
2434 			scn_phys->scn_bookmark.zb_objset =
2435 			    dsl_dataset_phys(ds)->ds_next_snap_obj;
2436 			zfs_dbgmsg("destroying ds %llu on %s; currently "
2437 			    "traversing; reset zb_objset to %llu",
2438 			    (u_longlong_t)ds->ds_object,
2439 			    ds->ds_dir->dd_pool->dp_spa->spa_name,
2440 			    (u_longlong_t)dsl_dataset_phys(ds)->
2441 			    ds_next_snap_obj);
2442 			scn_phys->scn_flags |= DSF_VISIT_DS_AGAIN;
2443 		} else {
2444 			SET_BOOKMARK(&scn_phys->scn_bookmark,
2445 			    ZB_DESTROYED_OBJSET, 0, 0, 0);
2446 			zfs_dbgmsg("destroying ds %llu on %s; currently "
2447 			    "traversing; reset bookmark to -1,0,0,0",
2448 			    (u_longlong_t)ds->ds_object,
2449 			    ds->ds_dir->dd_pool->dp_spa->spa_name);
2450 		}
2451 	}
2452 }
2453 
2454 /*
2455  * Invoked when a dataset is destroyed. We need to make sure that:
2456  *
2457  * 1) If it is the dataset that was currently being scanned, we write
2458  *	a new dsl_scan_phys_t and marking the objset reference in it
2459  *	as destroyed.
2460  * 2) Remove it from the work queue, if it was present.
2461  *
2462  * If the dataset was actually a snapshot, instead of marking the dataset
2463  * as destroyed, we instead substitute the next snapshot in line.
2464  */
2465 void
2466 dsl_scan_ds_destroyed(dsl_dataset_t *ds, dmu_tx_t *tx)
2467 {
2468 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
2469 	dsl_scan_t *scn = dp->dp_scan;
2470 	uint64_t mintxg;
2471 
2472 	if (!dsl_scan_is_running(scn))
2473 		return;
2474 
2475 	ds_destroyed_scn_phys(ds, &scn->scn_phys);
2476 	ds_destroyed_scn_phys(ds, &scn->scn_phys_cached);
2477 
2478 	if (scan_ds_queue_contains(scn, ds->ds_object, &mintxg)) {
2479 		scan_ds_queue_remove(scn, ds->ds_object);
2480 		if (ds->ds_is_snapshot)
2481 			scan_ds_queue_insert(scn,
2482 			    dsl_dataset_phys(ds)->ds_next_snap_obj, mintxg);
2483 	}
2484 
2485 	if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
2486 	    ds->ds_object, &mintxg) == 0) {
2487 		ASSERT3U(dsl_dataset_phys(ds)->ds_num_children, <=, 1);
2488 		VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
2489 		    scn->scn_phys.scn_queue_obj, ds->ds_object, tx));
2490 		if (ds->ds_is_snapshot) {
2491 			/*
2492 			 * We keep the same mintxg; it could be >
2493 			 * ds_creation_txg if the previous snapshot was
2494 			 * deleted too.
2495 			 */
2496 			VERIFY(zap_add_int_key(dp->dp_meta_objset,
2497 			    scn->scn_phys.scn_queue_obj,
2498 			    dsl_dataset_phys(ds)->ds_next_snap_obj,
2499 			    mintxg, tx) == 0);
2500 			zfs_dbgmsg("destroying ds %llu on %s; in queue; "
2501 			    "replacing with %llu",
2502 			    (u_longlong_t)ds->ds_object,
2503 			    dp->dp_spa->spa_name,
2504 			    (u_longlong_t)dsl_dataset_phys(ds)->
2505 			    ds_next_snap_obj);
2506 		} else {
2507 			zfs_dbgmsg("destroying ds %llu on %s; in queue; "
2508 			    "removing",
2509 			    (u_longlong_t)ds->ds_object,
2510 			    dp->dp_spa->spa_name);
2511 		}
2512 	}
2513 
2514 	/*
2515 	 * dsl_scan_sync() should be called after this, and should sync
2516 	 * out our changed state, but just to be safe, do it here.
2517 	 */
2518 	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
2519 }
2520 
2521 static void
2522 ds_snapshotted_bookmark(dsl_dataset_t *ds, zbookmark_phys_t *scn_bookmark)
2523 {
2524 	if (scn_bookmark->zb_objset == ds->ds_object) {
2525 		scn_bookmark->zb_objset =
2526 		    dsl_dataset_phys(ds)->ds_prev_snap_obj;
2527 		zfs_dbgmsg("snapshotting ds %llu on %s; currently traversing; "
2528 		    "reset zb_objset to %llu",
2529 		    (u_longlong_t)ds->ds_object,
2530 		    ds->ds_dir->dd_pool->dp_spa->spa_name,
2531 		    (u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
2532 	}
2533 }
2534 
2535 /*
2536  * Called when a dataset is snapshotted. If we were currently traversing
2537  * this snapshot, we reset our bookmark to point at the newly created
2538  * snapshot. We also modify our work queue to remove the old snapshot and
2539  * replace with the new one.
2540  */
2541 void
2542 dsl_scan_ds_snapshotted(dsl_dataset_t *ds, dmu_tx_t *tx)
2543 {
2544 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
2545 	dsl_scan_t *scn = dp->dp_scan;
2546 	uint64_t mintxg;
2547 
2548 	if (!dsl_scan_is_running(scn))
2549 		return;
2550 
2551 	ASSERT(dsl_dataset_phys(ds)->ds_prev_snap_obj != 0);
2552 
2553 	ds_snapshotted_bookmark(ds, &scn->scn_phys.scn_bookmark);
2554 	ds_snapshotted_bookmark(ds, &scn->scn_phys_cached.scn_bookmark);
2555 
2556 	if (scan_ds_queue_contains(scn, ds->ds_object, &mintxg)) {
2557 		scan_ds_queue_remove(scn, ds->ds_object);
2558 		scan_ds_queue_insert(scn,
2559 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, mintxg);
2560 	}
2561 
2562 	if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
2563 	    ds->ds_object, &mintxg) == 0) {
2564 		VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
2565 		    scn->scn_phys.scn_queue_obj, ds->ds_object, tx));
2566 		VERIFY(zap_add_int_key(dp->dp_meta_objset,
2567 		    scn->scn_phys.scn_queue_obj,
2568 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, mintxg, tx) == 0);
2569 		zfs_dbgmsg("snapshotting ds %llu on %s; in queue; "
2570 		    "replacing with %llu",
2571 		    (u_longlong_t)ds->ds_object,
2572 		    dp->dp_spa->spa_name,
2573 		    (u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
2574 	}
2575 
2576 	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
2577 }
2578 
2579 static void
2580 ds_clone_swapped_bookmark(dsl_dataset_t *ds1, dsl_dataset_t *ds2,
2581     zbookmark_phys_t *scn_bookmark)
2582 {
2583 	if (scn_bookmark->zb_objset == ds1->ds_object) {
2584 		scn_bookmark->zb_objset = ds2->ds_object;
2585 		zfs_dbgmsg("clone_swap ds %llu on %s; currently traversing; "
2586 		    "reset zb_objset to %llu",
2587 		    (u_longlong_t)ds1->ds_object,
2588 		    ds1->ds_dir->dd_pool->dp_spa->spa_name,
2589 		    (u_longlong_t)ds2->ds_object);
2590 	} else if (scn_bookmark->zb_objset == ds2->ds_object) {
2591 		scn_bookmark->zb_objset = ds1->ds_object;
2592 		zfs_dbgmsg("clone_swap ds %llu on %s; currently traversing; "
2593 		    "reset zb_objset to %llu",
2594 		    (u_longlong_t)ds2->ds_object,
2595 		    ds2->ds_dir->dd_pool->dp_spa->spa_name,
2596 		    (u_longlong_t)ds1->ds_object);
2597 	}
2598 }
2599 
2600 /*
2601  * Called when an origin dataset and its clone are swapped.  If we were
2602  * currently traversing the dataset, we need to switch to traversing the
2603  * newly promoted clone.
2604  */
2605 void
2606 dsl_scan_ds_clone_swapped(dsl_dataset_t *ds1, dsl_dataset_t *ds2, dmu_tx_t *tx)
2607 {
2608 	dsl_pool_t *dp = ds1->ds_dir->dd_pool;
2609 	dsl_scan_t *scn = dp->dp_scan;
2610 	uint64_t mintxg1, mintxg2;
2611 	boolean_t ds1_queued, ds2_queued;
2612 
2613 	if (!dsl_scan_is_running(scn))
2614 		return;
2615 
2616 	ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys.scn_bookmark);
2617 	ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys_cached.scn_bookmark);
2618 
2619 	/*
2620 	 * Handle the in-memory scan queue.
2621 	 */
2622 	ds1_queued = scan_ds_queue_contains(scn, ds1->ds_object, &mintxg1);
2623 	ds2_queued = scan_ds_queue_contains(scn, ds2->ds_object, &mintxg2);
2624 
2625 	/* Sanity checking. */
2626 	if (ds1_queued) {
2627 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2628 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2629 	}
2630 	if (ds2_queued) {
2631 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2632 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2633 	}
2634 
2635 	if (ds1_queued && ds2_queued) {
2636 		/*
2637 		 * If both are queued, we don't need to do anything.
2638 		 * The swapping code below would not handle this case correctly,
2639 		 * since we can't insert ds2 if it is already there. That's
2640 		 * because scan_ds_queue_insert() prohibits a duplicate insert
2641 		 * and panics.
2642 		 */
2643 	} else if (ds1_queued) {
2644 		scan_ds_queue_remove(scn, ds1->ds_object);
2645 		scan_ds_queue_insert(scn, ds2->ds_object, mintxg1);
2646 	} else if (ds2_queued) {
2647 		scan_ds_queue_remove(scn, ds2->ds_object);
2648 		scan_ds_queue_insert(scn, ds1->ds_object, mintxg2);
2649 	}
2650 
2651 	/*
2652 	 * Handle the on-disk scan queue.
2653 	 * The on-disk state is an out-of-date version of the in-memory state,
2654 	 * so the in-memory and on-disk values for ds1_queued and ds2_queued may
2655 	 * be different. Therefore we need to apply the swap logic to the
2656 	 * on-disk state independently of the in-memory state.
2657 	 */
2658 	ds1_queued = zap_lookup_int_key(dp->dp_meta_objset,
2659 	    scn->scn_phys.scn_queue_obj, ds1->ds_object, &mintxg1) == 0;
2660 	ds2_queued = zap_lookup_int_key(dp->dp_meta_objset,
2661 	    scn->scn_phys.scn_queue_obj, ds2->ds_object, &mintxg2) == 0;
2662 
2663 	/* Sanity checking. */
2664 	if (ds1_queued) {
2665 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2666 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2667 	}
2668 	if (ds2_queued) {
2669 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2670 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2671 	}
2672 
2673 	if (ds1_queued && ds2_queued) {
2674 		/*
2675 		 * If both are queued, we don't need to do anything.
2676 		 * Alternatively, we could check for EEXIST from
2677 		 * zap_add_int_key() and back out to the original state, but
2678 		 * that would be more work than checking for this case upfront.
2679 		 */
2680 	} else if (ds1_queued) {
2681 		VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
2682 		    scn->scn_phys.scn_queue_obj, ds1->ds_object, tx));
2683 		VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
2684 		    scn->scn_phys.scn_queue_obj, ds2->ds_object, mintxg1, tx));
2685 		zfs_dbgmsg("clone_swap ds %llu on %s; in queue; "
2686 		    "replacing with %llu",
2687 		    (u_longlong_t)ds1->ds_object,
2688 		    dp->dp_spa->spa_name,
2689 		    (u_longlong_t)ds2->ds_object);
2690 	} else if (ds2_queued) {
2691 		VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
2692 		    scn->scn_phys.scn_queue_obj, ds2->ds_object, tx));
2693 		VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
2694 		    scn->scn_phys.scn_queue_obj, ds1->ds_object, mintxg2, tx));
2695 		zfs_dbgmsg("clone_swap ds %llu on %s; in queue; "
2696 		    "replacing with %llu",
2697 		    (u_longlong_t)ds2->ds_object,
2698 		    dp->dp_spa->spa_name,
2699 		    (u_longlong_t)ds1->ds_object);
2700 	}
2701 
2702 	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
2703 }
2704 
2705 static int
2706 enqueue_clones_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
2707 {
2708 	uint64_t originobj = *(uint64_t *)arg;
2709 	dsl_dataset_t *ds;
2710 	int err;
2711 	dsl_scan_t *scn = dp->dp_scan;
2712 
2713 	if (dsl_dir_phys(hds->ds_dir)->dd_origin_obj != originobj)
2714 		return (0);
2715 
2716 	err = dsl_dataset_hold_obj(dp, hds->ds_object, FTAG, &ds);
2717 	if (err)
2718 		return (err);
2719 
2720 	while (dsl_dataset_phys(ds)->ds_prev_snap_obj != originobj) {
2721 		dsl_dataset_t *prev;
2722 		err = dsl_dataset_hold_obj(dp,
2723 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, FTAG, &prev);
2724 
2725 		dsl_dataset_rele(ds, FTAG);
2726 		if (err)
2727 			return (err);
2728 		ds = prev;
2729 	}
2730 	scan_ds_queue_insert(scn, ds->ds_object,
2731 	    dsl_dataset_phys(ds)->ds_prev_snap_txg);
2732 	dsl_dataset_rele(ds, FTAG);
2733 	return (0);
2734 }
2735 
2736 static void
2737 dsl_scan_visitds(dsl_scan_t *scn, uint64_t dsobj, dmu_tx_t *tx)
2738 {
2739 	dsl_pool_t *dp = scn->scn_dp;
2740 	dsl_dataset_t *ds;
2741 
2742 	VERIFY3U(0, ==, dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds));
2743 
2744 	if (scn->scn_phys.scn_cur_min_txg >=
2745 	    scn->scn_phys.scn_max_txg) {
2746 		/*
2747 		 * This can happen if this snapshot was created after the
2748 		 * scan started, and we already completed a previous snapshot
2749 		 * that was created after the scan started.  This snapshot
2750 		 * only references blocks with:
2751 		 *
2752 		 *	birth < our ds_creation_txg
2753 		 *	cur_min_txg is no less than ds_creation_txg.
2754 		 *	We have already visited these blocks.
2755 		 * or
2756 		 *	birth > scn_max_txg
2757 		 *	The scan requested not to visit these blocks.
2758 		 *
2759 		 * Subsequent snapshots (and clones) can reference our
2760 		 * blocks, or blocks with even higher birth times.
2761 		 * Therefore we do not need to visit them either,
2762 		 * so we do not add them to the work queue.
2763 		 *
2764 		 * Note that checking for cur_min_txg >= cur_max_txg
2765 		 * is not sufficient, because in that case we may need to
2766 		 * visit subsequent snapshots.  This happens when min_txg > 0,
2767 		 * which raises cur_min_txg.  In this case we will visit
2768 		 * this dataset but skip all of its blocks, because the
2769 		 * rootbp's birth time is < cur_min_txg.  Then we will
2770 		 * add the next snapshots/clones to the work queue.
2771 		 */
2772 		char *dsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
2773 		dsl_dataset_name(ds, dsname);
2774 		zfs_dbgmsg("scanning dataset %llu (%s) is unnecessary because "
2775 		    "cur_min_txg (%llu) >= max_txg (%llu)",
2776 		    (longlong_t)dsobj, dsname,
2777 		    (longlong_t)scn->scn_phys.scn_cur_min_txg,
2778 		    (longlong_t)scn->scn_phys.scn_max_txg);
2779 		kmem_free(dsname, MAXNAMELEN);
2780 
2781 		goto out;
2782 	}
2783 
2784 	/*
2785 	 * Only the ZIL in the head (non-snapshot) is valid. Even though
2786 	 * snapshots can have ZIL block pointers (which may be the same
2787 	 * BP as in the head), they must be ignored. In addition, $ORIGIN
2788 	 * doesn't have a objset (i.e. its ds_bp is a hole) so we don't
2789 	 * need to look for a ZIL in it either. So we traverse the ZIL here,
2790 	 * rather than in scan_recurse(), because the regular snapshot
2791 	 * block-sharing rules don't apply to it.
2792 	 */
2793 	if (!dsl_dataset_is_snapshot(ds) &&
2794 	    (dp->dp_origin_snap == NULL ||
2795 	    ds->ds_dir != dp->dp_origin_snap->ds_dir)) {
2796 		objset_t *os;
2797 		if (dmu_objset_from_ds(ds, &os) != 0) {
2798 			goto out;
2799 		}
2800 		dsl_scan_zil(dp, &os->os_zil_header);
2801 	}
2802 
2803 	/*
2804 	 * Iterate over the bps in this ds.
2805 	 */
2806 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
2807 	rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG);
2808 	dsl_scan_visit_rootbp(scn, ds, &dsl_dataset_phys(ds)->ds_bp, tx);
2809 	rrw_exit(&ds->ds_bp_rwlock, FTAG);
2810 
2811 	char *dsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
2812 	dsl_dataset_name(ds, dsname);
2813 	zfs_dbgmsg("scanned dataset %llu (%s) with min=%llu max=%llu; "
2814 	    "suspending=%u",
2815 	    (longlong_t)dsobj, dsname,
2816 	    (longlong_t)scn->scn_phys.scn_cur_min_txg,
2817 	    (longlong_t)scn->scn_phys.scn_cur_max_txg,
2818 	    (int)scn->scn_suspending);
2819 	kmem_free(dsname, ZFS_MAX_DATASET_NAME_LEN);
2820 
2821 	if (scn->scn_suspending)
2822 		goto out;
2823 
2824 	/*
2825 	 * We've finished this pass over this dataset.
2826 	 */
2827 
2828 	/*
2829 	 * If we did not completely visit this dataset, do another pass.
2830 	 */
2831 	if (scn->scn_phys.scn_flags & DSF_VISIT_DS_AGAIN) {
2832 		zfs_dbgmsg("incomplete pass on %s; visiting again",
2833 		    dp->dp_spa->spa_name);
2834 		scn->scn_phys.scn_flags &= ~DSF_VISIT_DS_AGAIN;
2835 		scan_ds_queue_insert(scn, ds->ds_object,
2836 		    scn->scn_phys.scn_cur_max_txg);
2837 		goto out;
2838 	}
2839 
2840 	/*
2841 	 * Add descendant datasets to work queue.
2842 	 */
2843 	if (dsl_dataset_phys(ds)->ds_next_snap_obj != 0) {
2844 		scan_ds_queue_insert(scn,
2845 		    dsl_dataset_phys(ds)->ds_next_snap_obj,
2846 		    dsl_dataset_phys(ds)->ds_creation_txg);
2847 	}
2848 	if (dsl_dataset_phys(ds)->ds_num_children > 1) {
2849 		boolean_t usenext = B_FALSE;
2850 		if (dsl_dataset_phys(ds)->ds_next_clones_obj != 0) {
2851 			uint64_t count;
2852 			/*
2853 			 * A bug in a previous version of the code could
2854 			 * cause upgrade_clones_cb() to not set
2855 			 * ds_next_snap_obj when it should, leading to a
2856 			 * missing entry.  Therefore we can only use the
2857 			 * next_clones_obj when its count is correct.
2858 			 */
2859 			int err = zap_count(dp->dp_meta_objset,
2860 			    dsl_dataset_phys(ds)->ds_next_clones_obj, &count);
2861 			if (err == 0 &&
2862 			    count == dsl_dataset_phys(ds)->ds_num_children - 1)
2863 				usenext = B_TRUE;
2864 		}
2865 
2866 		if (usenext) {
2867 			zap_cursor_t zc;
2868 			zap_attribute_t za;
2869 			for (zap_cursor_init(&zc, dp->dp_meta_objset,
2870 			    dsl_dataset_phys(ds)->ds_next_clones_obj);
2871 			    zap_cursor_retrieve(&zc, &za) == 0;
2872 			    (void) zap_cursor_advance(&zc)) {
2873 				scan_ds_queue_insert(scn,
2874 				    zfs_strtonum(za.za_name, NULL),
2875 				    dsl_dataset_phys(ds)->ds_creation_txg);
2876 			}
2877 			zap_cursor_fini(&zc);
2878 		} else {
2879 			VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
2880 			    enqueue_clones_cb, &ds->ds_object,
2881 			    DS_FIND_CHILDREN));
2882 		}
2883 	}
2884 
2885 out:
2886 	dsl_dataset_rele(ds, FTAG);
2887 }
2888 
2889 static int
2890 enqueue_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
2891 {
2892 	(void) arg;
2893 	dsl_dataset_t *ds;
2894 	int err;
2895 	dsl_scan_t *scn = dp->dp_scan;
2896 
2897 	err = dsl_dataset_hold_obj(dp, hds->ds_object, FTAG, &ds);
2898 	if (err)
2899 		return (err);
2900 
2901 	while (dsl_dataset_phys(ds)->ds_prev_snap_obj != 0) {
2902 		dsl_dataset_t *prev;
2903 		err = dsl_dataset_hold_obj(dp,
2904 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, FTAG, &prev);
2905 		if (err) {
2906 			dsl_dataset_rele(ds, FTAG);
2907 			return (err);
2908 		}
2909 
2910 		/*
2911 		 * If this is a clone, we don't need to worry about it for now.
2912 		 */
2913 		if (dsl_dataset_phys(prev)->ds_next_snap_obj != ds->ds_object) {
2914 			dsl_dataset_rele(ds, FTAG);
2915 			dsl_dataset_rele(prev, FTAG);
2916 			return (0);
2917 		}
2918 		dsl_dataset_rele(ds, FTAG);
2919 		ds = prev;
2920 	}
2921 
2922 	scan_ds_queue_insert(scn, ds->ds_object,
2923 	    dsl_dataset_phys(ds)->ds_prev_snap_txg);
2924 	dsl_dataset_rele(ds, FTAG);
2925 	return (0);
2926 }
2927 
2928 void
2929 dsl_scan_ddt_entry(dsl_scan_t *scn, enum zio_checksum checksum,
2930     ddt_entry_t *dde, dmu_tx_t *tx)
2931 {
2932 	(void) tx;
2933 	const ddt_key_t *ddk = &dde->dde_key;
2934 	ddt_phys_t *ddp = dde->dde_phys;
2935 	blkptr_t bp;
2936 	zbookmark_phys_t zb = { 0 };
2937 
2938 	if (!dsl_scan_is_running(scn))
2939 		return;
2940 
2941 	/*
2942 	 * This function is special because it is the only thing
2943 	 * that can add scan_io_t's to the vdev scan queues from
2944 	 * outside dsl_scan_sync(). For the most part this is ok
2945 	 * as long as it is called from within syncing context.
2946 	 * However, dsl_scan_sync() expects that no new sio's will
2947 	 * be added between when all the work for a scan is done
2948 	 * and the next txg when the scan is actually marked as
2949 	 * completed. This check ensures we do not issue new sio's
2950 	 * during this period.
2951 	 */
2952 	if (scn->scn_done_txg != 0)
2953 		return;
2954 
2955 	for (int p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
2956 		if (ddp->ddp_phys_birth == 0 ||
2957 		    ddp->ddp_phys_birth > scn->scn_phys.scn_max_txg)
2958 			continue;
2959 		ddt_bp_create(checksum, ddk, ddp, &bp);
2960 
2961 		scn->scn_visited_this_txg++;
2962 		scan_funcs[scn->scn_phys.scn_func](scn->scn_dp, &bp, &zb);
2963 	}
2964 }
2965 
2966 /*
2967  * Scrub/dedup interaction.
2968  *
2969  * If there are N references to a deduped block, we don't want to scrub it
2970  * N times -- ideally, we should scrub it exactly once.
2971  *
2972  * We leverage the fact that the dde's replication class (enum ddt_class)
2973  * is ordered from highest replication class (DDT_CLASS_DITTO) to lowest
2974  * (DDT_CLASS_UNIQUE) so that we may walk the DDT in that order.
2975  *
2976  * To prevent excess scrubbing, the scrub begins by walking the DDT
2977  * to find all blocks with refcnt > 1, and scrubs each of these once.
2978  * Since there are two replication classes which contain blocks with
2979  * refcnt > 1, we scrub the highest replication class (DDT_CLASS_DITTO) first.
2980  * Finally the top-down scrub begins, only visiting blocks with refcnt == 1.
2981  *
2982  * There would be nothing more to say if a block's refcnt couldn't change
2983  * during a scrub, but of course it can so we must account for changes
2984  * in a block's replication class.
2985  *
2986  * Here's an example of what can occur:
2987  *
2988  * If a block has refcnt > 1 during the DDT scrub phase, but has refcnt == 1
2989  * when visited during the top-down scrub phase, it will be scrubbed twice.
2990  * This negates our scrub optimization, but is otherwise harmless.
2991  *
2992  * If a block has refcnt == 1 during the DDT scrub phase, but has refcnt > 1
2993  * on each visit during the top-down scrub phase, it will never be scrubbed.
2994  * To catch this, ddt_sync_entry() notifies the scrub code whenever a block's
2995  * reference class transitions to a higher level (i.e DDT_CLASS_UNIQUE to
2996  * DDT_CLASS_DUPLICATE); if it transitions from refcnt == 1 to refcnt > 1
2997  * while a scrub is in progress, it scrubs the block right then.
2998  */
2999 static void
3000 dsl_scan_ddt(dsl_scan_t *scn, dmu_tx_t *tx)
3001 {
3002 	ddt_bookmark_t *ddb = &scn->scn_phys.scn_ddt_bookmark;
3003 	ddt_entry_t dde = {{{{0}}}};
3004 	int error;
3005 	uint64_t n = 0;
3006 
3007 	while ((error = ddt_walk(scn->scn_dp->dp_spa, ddb, &dde)) == 0) {
3008 		ddt_t *ddt;
3009 
3010 		if (ddb->ddb_class > scn->scn_phys.scn_ddt_class_max)
3011 			break;
3012 		dprintf("visiting ddb=%llu/%llu/%llu/%llx\n",
3013 		    (longlong_t)ddb->ddb_class,
3014 		    (longlong_t)ddb->ddb_type,
3015 		    (longlong_t)ddb->ddb_checksum,
3016 		    (longlong_t)ddb->ddb_cursor);
3017 
3018 		/* There should be no pending changes to the dedup table */
3019 		ddt = scn->scn_dp->dp_spa->spa_ddt[ddb->ddb_checksum];
3020 		ASSERT(avl_first(&ddt->ddt_tree) == NULL);
3021 
3022 		dsl_scan_ddt_entry(scn, ddb->ddb_checksum, &dde, tx);
3023 		n++;
3024 
3025 		if (dsl_scan_check_suspend(scn, NULL))
3026 			break;
3027 	}
3028 
3029 	zfs_dbgmsg("scanned %llu ddt entries on %s with class_max = %u; "
3030 	    "suspending=%u", (longlong_t)n, scn->scn_dp->dp_spa->spa_name,
3031 	    (int)scn->scn_phys.scn_ddt_class_max, (int)scn->scn_suspending);
3032 
3033 	ASSERT(error == 0 || error == ENOENT);
3034 	ASSERT(error != ENOENT ||
3035 	    ddb->ddb_class > scn->scn_phys.scn_ddt_class_max);
3036 }
3037 
3038 static uint64_t
3039 dsl_scan_ds_maxtxg(dsl_dataset_t *ds)
3040 {
3041 	uint64_t smt = ds->ds_dir->dd_pool->dp_scan->scn_phys.scn_max_txg;
3042 	if (ds->ds_is_snapshot)
3043 		return (MIN(smt, dsl_dataset_phys(ds)->ds_creation_txg));
3044 	return (smt);
3045 }
3046 
3047 static void
3048 dsl_scan_visit(dsl_scan_t *scn, dmu_tx_t *tx)
3049 {
3050 	scan_ds_t *sds;
3051 	dsl_pool_t *dp = scn->scn_dp;
3052 
3053 	if (scn->scn_phys.scn_ddt_bookmark.ddb_class <=
3054 	    scn->scn_phys.scn_ddt_class_max) {
3055 		scn->scn_phys.scn_cur_min_txg = scn->scn_phys.scn_min_txg;
3056 		scn->scn_phys.scn_cur_max_txg = scn->scn_phys.scn_max_txg;
3057 		dsl_scan_ddt(scn, tx);
3058 		if (scn->scn_suspending)
3059 			return;
3060 	}
3061 
3062 	if (scn->scn_phys.scn_bookmark.zb_objset == DMU_META_OBJSET) {
3063 		/* First do the MOS & ORIGIN */
3064 
3065 		scn->scn_phys.scn_cur_min_txg = scn->scn_phys.scn_min_txg;
3066 		scn->scn_phys.scn_cur_max_txg = scn->scn_phys.scn_max_txg;
3067 		dsl_scan_visit_rootbp(scn, NULL,
3068 		    &dp->dp_meta_rootbp, tx);
3069 		spa_set_rootblkptr(dp->dp_spa, &dp->dp_meta_rootbp);
3070 		if (scn->scn_suspending)
3071 			return;
3072 
3073 		if (spa_version(dp->dp_spa) < SPA_VERSION_DSL_SCRUB) {
3074 			VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
3075 			    enqueue_cb, NULL, DS_FIND_CHILDREN));
3076 		} else {
3077 			dsl_scan_visitds(scn,
3078 			    dp->dp_origin_snap->ds_object, tx);
3079 		}
3080 		ASSERT(!scn->scn_suspending);
3081 	} else if (scn->scn_phys.scn_bookmark.zb_objset !=
3082 	    ZB_DESTROYED_OBJSET) {
3083 		uint64_t dsobj = scn->scn_phys.scn_bookmark.zb_objset;
3084 		/*
3085 		 * If we were suspended, continue from here. Note if the
3086 		 * ds we were suspended on was deleted, the zb_objset may
3087 		 * be -1, so we will skip this and find a new objset
3088 		 * below.
3089 		 */
3090 		dsl_scan_visitds(scn, dsobj, tx);
3091 		if (scn->scn_suspending)
3092 			return;
3093 	}
3094 
3095 	/*
3096 	 * In case we suspended right at the end of the ds, zero the
3097 	 * bookmark so we don't think that we're still trying to resume.
3098 	 */
3099 	memset(&scn->scn_phys.scn_bookmark, 0, sizeof (zbookmark_phys_t));
3100 
3101 	/*
3102 	 * Keep pulling things out of the dataset avl queue. Updates to the
3103 	 * persistent zap-object-as-queue happen only at checkpoints.
3104 	 */
3105 	while ((sds = avl_first(&scn->scn_queue)) != NULL) {
3106 		dsl_dataset_t *ds;
3107 		uint64_t dsobj = sds->sds_dsobj;
3108 		uint64_t txg = sds->sds_txg;
3109 
3110 		/* dequeue and free the ds from the queue */
3111 		scan_ds_queue_remove(scn, dsobj);
3112 		sds = NULL;
3113 
3114 		/* set up min / max txg */
3115 		VERIFY3U(0, ==, dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds));
3116 		if (txg != 0) {
3117 			scn->scn_phys.scn_cur_min_txg =
3118 			    MAX(scn->scn_phys.scn_min_txg, txg);
3119 		} else {
3120 			scn->scn_phys.scn_cur_min_txg =
3121 			    MAX(scn->scn_phys.scn_min_txg,
3122 			    dsl_dataset_phys(ds)->ds_prev_snap_txg);
3123 		}
3124 		scn->scn_phys.scn_cur_max_txg = dsl_scan_ds_maxtxg(ds);
3125 		dsl_dataset_rele(ds, FTAG);
3126 
3127 		dsl_scan_visitds(scn, dsobj, tx);
3128 		if (scn->scn_suspending)
3129 			return;
3130 	}
3131 
3132 	/* No more objsets to fetch, we're done */
3133 	scn->scn_phys.scn_bookmark.zb_objset = ZB_DESTROYED_OBJSET;
3134 	ASSERT0(scn->scn_suspending);
3135 }
3136 
3137 static uint64_t
3138 dsl_scan_count_data_disks(spa_t *spa)
3139 {
3140 	vdev_t *rvd = spa->spa_root_vdev;
3141 	uint64_t i, leaves = 0;
3142 
3143 	for (i = 0; i < rvd->vdev_children; i++) {
3144 		vdev_t *vd = rvd->vdev_child[i];
3145 		if (vd->vdev_islog || vd->vdev_isspare || vd->vdev_isl2cache)
3146 			continue;
3147 		leaves += vdev_get_ndisks(vd) - vdev_get_nparity(vd);
3148 	}
3149 	return (leaves);
3150 }
3151 
3152 static void
3153 scan_io_queues_update_zio_stats(dsl_scan_io_queue_t *q, const blkptr_t *bp)
3154 {
3155 	int i;
3156 	uint64_t cur_size = 0;
3157 
3158 	for (i = 0; i < BP_GET_NDVAS(bp); i++) {
3159 		cur_size += DVA_GET_ASIZE(&bp->blk_dva[i]);
3160 	}
3161 
3162 	q->q_total_zio_size_this_txg += cur_size;
3163 	q->q_zios_this_txg++;
3164 }
3165 
3166 static void
3167 scan_io_queues_update_seg_stats(dsl_scan_io_queue_t *q, uint64_t start,
3168     uint64_t end)
3169 {
3170 	q->q_total_seg_size_this_txg += end - start;
3171 	q->q_segs_this_txg++;
3172 }
3173 
3174 static boolean_t
3175 scan_io_queue_check_suspend(dsl_scan_t *scn)
3176 {
3177 	/* See comment in dsl_scan_check_suspend() */
3178 	uint64_t curr_time_ns = gethrtime();
3179 	uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
3180 	uint64_t sync_time_ns = curr_time_ns -
3181 	    scn->scn_dp->dp_spa->spa_sync_starttime;
3182 	uint64_t dirty_min_bytes = zfs_dirty_data_max *
3183 	    zfs_vdev_async_write_active_min_dirty_percent / 100;
3184 	uint_t mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
3185 	    zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;
3186 
3187 	return ((NSEC2MSEC(scan_time_ns) > mintime &&
3188 	    (scn->scn_dp->dp_dirty_total >= dirty_min_bytes ||
3189 	    txg_sync_waiting(scn->scn_dp) ||
3190 	    NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
3191 	    spa_shutting_down(scn->scn_dp->dp_spa));
3192 }
3193 
3194 /*
3195  * Given a list of scan_io_t's in io_list, this issues the I/Os out to
3196  * disk. This consumes the io_list and frees the scan_io_t's. This is
3197  * called when emptying queues, either when we're up against the memory
3198  * limit or when we have finished scanning. Returns B_TRUE if we stopped
3199  * processing the list before we finished. Any sios that were not issued
3200  * will remain in the io_list.
3201  */
3202 static boolean_t
3203 scan_io_queue_issue(dsl_scan_io_queue_t *queue, list_t *io_list)
3204 {
3205 	dsl_scan_t *scn = queue->q_scn;
3206 	scan_io_t *sio;
3207 	boolean_t suspended = B_FALSE;
3208 
3209 	while ((sio = list_head(io_list)) != NULL) {
3210 		blkptr_t bp;
3211 
3212 		if (scan_io_queue_check_suspend(scn)) {
3213 			suspended = B_TRUE;
3214 			break;
3215 		}
3216 
3217 		sio2bp(sio, &bp);
3218 		scan_exec_io(scn->scn_dp, &bp, sio->sio_flags,
3219 		    &sio->sio_zb, queue);
3220 		(void) list_remove_head(io_list);
3221 		scan_io_queues_update_zio_stats(queue, &bp);
3222 		sio_free(sio);
3223 	}
3224 	return (suspended);
3225 }
3226 
3227 /*
3228  * This function removes sios from an IO queue which reside within a given
3229  * range_seg_t and inserts them (in offset order) into a list. Note that
3230  * we only ever return a maximum of 32 sios at once. If there are more sios
3231  * to process within this segment that did not make it onto the list we
3232  * return B_TRUE and otherwise B_FALSE.
3233  */
3234 static boolean_t
3235 scan_io_queue_gather(dsl_scan_io_queue_t *queue, range_seg_t *rs, list_t *list)
3236 {
3237 	scan_io_t *srch_sio, *sio, *next_sio;
3238 	avl_index_t idx;
3239 	uint_t num_sios = 0;
3240 	int64_t bytes_issued = 0;
3241 
3242 	ASSERT(rs != NULL);
3243 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
3244 
3245 	srch_sio = sio_alloc(1);
3246 	srch_sio->sio_nr_dvas = 1;
3247 	SIO_SET_OFFSET(srch_sio, rs_get_start(rs, queue->q_exts_by_addr));
3248 
3249 	/*
3250 	 * The exact start of the extent might not contain any matching zios,
3251 	 * so if that's the case, examine the next one in the tree.
3252 	 */
3253 	sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
3254 	sio_free(srch_sio);
3255 
3256 	if (sio == NULL)
3257 		sio = avl_nearest(&queue->q_sios_by_addr, idx, AVL_AFTER);
3258 
3259 	while (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
3260 	    queue->q_exts_by_addr) && num_sios <= 32) {
3261 		ASSERT3U(SIO_GET_OFFSET(sio), >=, rs_get_start(rs,
3262 		    queue->q_exts_by_addr));
3263 		ASSERT3U(SIO_GET_END_OFFSET(sio), <=, rs_get_end(rs,
3264 		    queue->q_exts_by_addr));
3265 
3266 		next_sio = AVL_NEXT(&queue->q_sios_by_addr, sio);
3267 		avl_remove(&queue->q_sios_by_addr, sio);
3268 		if (avl_is_empty(&queue->q_sios_by_addr))
3269 			atomic_add_64(&queue->q_scn->scn_queues_pending, -1);
3270 		queue->q_sio_memused -= SIO_GET_MUSED(sio);
3271 
3272 		bytes_issued += SIO_GET_ASIZE(sio);
3273 		num_sios++;
3274 		list_insert_tail(list, sio);
3275 		sio = next_sio;
3276 	}
3277 
3278 	/*
3279 	 * We limit the number of sios we process at once to 32 to avoid
3280 	 * biting off more than we can chew. If we didn't take everything
3281 	 * in the segment we update it to reflect the work we were able to
3282 	 * complete. Otherwise, we remove it from the range tree entirely.
3283 	 */
3284 	if (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
3285 	    queue->q_exts_by_addr)) {
3286 		range_tree_adjust_fill(queue->q_exts_by_addr, rs,
3287 		    -bytes_issued);
3288 		range_tree_resize_segment(queue->q_exts_by_addr, rs,
3289 		    SIO_GET_OFFSET(sio), rs_get_end(rs,
3290 		    queue->q_exts_by_addr) - SIO_GET_OFFSET(sio));
3291 		queue->q_last_ext_addr = SIO_GET_OFFSET(sio);
3292 		return (B_TRUE);
3293 	} else {
3294 		uint64_t rstart = rs_get_start(rs, queue->q_exts_by_addr);
3295 		uint64_t rend = rs_get_end(rs, queue->q_exts_by_addr);
3296 		range_tree_remove(queue->q_exts_by_addr, rstart, rend - rstart);
3297 		queue->q_last_ext_addr = -1;
3298 		return (B_FALSE);
3299 	}
3300 }
3301 
3302 /*
3303  * This is called from the queue emptying thread and selects the next
3304  * extent from which we are to issue I/Os. The behavior of this function
3305  * depends on the state of the scan, the current memory consumption and
3306  * whether or not we are performing a scan shutdown.
3307  * 1) We select extents in an elevator algorithm (LBA-order) if the scan
3308  * 	needs to perform a checkpoint
3309  * 2) We select the largest available extent if we are up against the
3310  * 	memory limit.
3311  * 3) Otherwise we don't select any extents.
3312  */
3313 static range_seg_t *
3314 scan_io_queue_fetch_ext(dsl_scan_io_queue_t *queue)
3315 {
3316 	dsl_scan_t *scn = queue->q_scn;
3317 	range_tree_t *rt = queue->q_exts_by_addr;
3318 
3319 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
3320 	ASSERT(scn->scn_is_sorted);
3321 
3322 	if (!scn->scn_checkpointing && !scn->scn_clearing)
3323 		return (NULL);
3324 
3325 	/*
3326 	 * During normal clearing, we want to issue our largest segments
3327 	 * first, keeping IO as sequential as possible, and leaving the
3328 	 * smaller extents for later with the hope that they might eventually
3329 	 * grow to larger sequential segments. However, when the scan is
3330 	 * checkpointing, no new extents will be added to the sorting queue,
3331 	 * so the way we are sorted now is as good as it will ever get.
3332 	 * In this case, we instead switch to issuing extents in LBA order.
3333 	 */
3334 	if ((zfs_scan_issue_strategy < 1 && scn->scn_checkpointing) ||
3335 	    zfs_scan_issue_strategy == 1)
3336 		return (range_tree_first(rt));
3337 
3338 	/*
3339 	 * Try to continue previous extent if it is not completed yet.  After
3340 	 * shrink in scan_io_queue_gather() it may no longer be the best, but
3341 	 * otherwise we leave shorter remnant every txg.
3342 	 */
3343 	uint64_t start;
3344 	uint64_t size = 1ULL << rt->rt_shift;
3345 	range_seg_t *addr_rs;
3346 	if (queue->q_last_ext_addr != -1) {
3347 		start = queue->q_last_ext_addr;
3348 		addr_rs = range_tree_find(rt, start, size);
3349 		if (addr_rs != NULL)
3350 			return (addr_rs);
3351 	}
3352 
3353 	/*
3354 	 * Nothing to continue, so find new best extent.
3355 	 */
3356 	uint64_t *v = zfs_btree_first(&queue->q_exts_by_size, NULL);
3357 	if (v == NULL)
3358 		return (NULL);
3359 	queue->q_last_ext_addr = start = *v << rt->rt_shift;
3360 
3361 	/*
3362 	 * We need to get the original entry in the by_addr tree so we can
3363 	 * modify it.
3364 	 */
3365 	addr_rs = range_tree_find(rt, start, size);
3366 	ASSERT3P(addr_rs, !=, NULL);
3367 	ASSERT3U(rs_get_start(addr_rs, rt), ==, start);
3368 	ASSERT3U(rs_get_end(addr_rs, rt), >, start);
3369 	return (addr_rs);
3370 }
3371 
3372 static void
3373 scan_io_queues_run_one(void *arg)
3374 {
3375 	dsl_scan_io_queue_t *queue = arg;
3376 	kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;
3377 	boolean_t suspended = B_FALSE;
3378 	range_seg_t *rs;
3379 	scan_io_t *sio;
3380 	zio_t *zio;
3381 	list_t sio_list;
3382 
3383 	ASSERT(queue->q_scn->scn_is_sorted);
3384 
3385 	list_create(&sio_list, sizeof (scan_io_t),
3386 	    offsetof(scan_io_t, sio_nodes.sio_list_node));
3387 	zio = zio_null(queue->q_scn->scn_zio_root, queue->q_scn->scn_dp->dp_spa,
3388 	    NULL, NULL, NULL, ZIO_FLAG_CANFAIL);
3389 	mutex_enter(q_lock);
3390 	queue->q_zio = zio;
3391 
3392 	/* Calculate maximum in-flight bytes for this vdev. */
3393 	queue->q_maxinflight_bytes = MAX(1, zfs_scan_vdev_limit *
3394 	    (vdev_get_ndisks(queue->q_vd) - vdev_get_nparity(queue->q_vd)));
3395 
3396 	/* reset per-queue scan statistics for this txg */
3397 	queue->q_total_seg_size_this_txg = 0;
3398 	queue->q_segs_this_txg = 0;
3399 	queue->q_total_zio_size_this_txg = 0;
3400 	queue->q_zios_this_txg = 0;
3401 
3402 	/* loop until we run out of time or sios */
3403 	while ((rs = scan_io_queue_fetch_ext(queue)) != NULL) {
3404 		uint64_t seg_start = 0, seg_end = 0;
3405 		boolean_t more_left;
3406 
3407 		ASSERT(list_is_empty(&sio_list));
3408 
3409 		/* loop while we still have sios left to process in this rs */
3410 		do {
3411 			scan_io_t *first_sio, *last_sio;
3412 
3413 			/*
3414 			 * We have selected which extent needs to be
3415 			 * processed next. Gather up the corresponding sios.
3416 			 */
3417 			more_left = scan_io_queue_gather(queue, rs, &sio_list);
3418 			ASSERT(!list_is_empty(&sio_list));
3419 			first_sio = list_head(&sio_list);
3420 			last_sio = list_tail(&sio_list);
3421 
3422 			seg_end = SIO_GET_END_OFFSET(last_sio);
3423 			if (seg_start == 0)
3424 				seg_start = SIO_GET_OFFSET(first_sio);
3425 
3426 			/*
3427 			 * Issuing sios can take a long time so drop the
3428 			 * queue lock. The sio queue won't be updated by
3429 			 * other threads since we're in syncing context so
3430 			 * we can be sure that our trees will remain exactly
3431 			 * as we left them.
3432 			 */
3433 			mutex_exit(q_lock);
3434 			suspended = scan_io_queue_issue(queue, &sio_list);
3435 			mutex_enter(q_lock);
3436 
3437 			if (suspended)
3438 				break;
3439 		} while (more_left);
3440 
3441 		/* update statistics for debugging purposes */
3442 		scan_io_queues_update_seg_stats(queue, seg_start, seg_end);
3443 
3444 		if (suspended)
3445 			break;
3446 	}
3447 
3448 	/*
3449 	 * If we were suspended in the middle of processing,
3450 	 * requeue any unfinished sios and exit.
3451 	 */
3452 	while ((sio = list_remove_head(&sio_list)) != NULL)
3453 		scan_io_queue_insert_impl(queue, sio);
3454 
3455 	queue->q_zio = NULL;
3456 	mutex_exit(q_lock);
3457 	zio_nowait(zio);
3458 	list_destroy(&sio_list);
3459 }
3460 
3461 /*
3462  * Performs an emptying run on all scan queues in the pool. This just
3463  * punches out one thread per top-level vdev, each of which processes
3464  * only that vdev's scan queue. We can parallelize the I/O here because
3465  * we know that each queue's I/Os only affect its own top-level vdev.
3466  *
3467  * This function waits for the queue runs to complete, and must be
3468  * called from dsl_scan_sync (or in general, syncing context).
3469  */
3470 static void
3471 scan_io_queues_run(dsl_scan_t *scn)
3472 {
3473 	spa_t *spa = scn->scn_dp->dp_spa;
3474 
3475 	ASSERT(scn->scn_is_sorted);
3476 	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_READER));
3477 
3478 	if (scn->scn_queues_pending == 0)
3479 		return;
3480 
3481 	if (scn->scn_taskq == NULL) {
3482 		int nthreads = spa->spa_root_vdev->vdev_children;
3483 
3484 		/*
3485 		 * We need to make this taskq *always* execute as many
3486 		 * threads in parallel as we have top-level vdevs and no
3487 		 * less, otherwise strange serialization of the calls to
3488 		 * scan_io_queues_run_one can occur during spa_sync runs
3489 		 * and that significantly impacts performance.
3490 		 */
3491 		scn->scn_taskq = taskq_create("dsl_scan_iss", nthreads,
3492 		    minclsyspri, nthreads, nthreads, TASKQ_PREPOPULATE);
3493 	}
3494 
3495 	for (uint64_t i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
3496 		vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
3497 
3498 		mutex_enter(&vd->vdev_scan_io_queue_lock);
3499 		if (vd->vdev_scan_io_queue != NULL) {
3500 			VERIFY(taskq_dispatch(scn->scn_taskq,
3501 			    scan_io_queues_run_one, vd->vdev_scan_io_queue,
3502 			    TQ_SLEEP) != TASKQID_INVALID);
3503 		}
3504 		mutex_exit(&vd->vdev_scan_io_queue_lock);
3505 	}
3506 
3507 	/*
3508 	 * Wait for the queues to finish issuing their IOs for this run
3509 	 * before we return. There may still be IOs in flight at this
3510 	 * point.
3511 	 */
3512 	taskq_wait(scn->scn_taskq);
3513 }
3514 
3515 static boolean_t
3516 dsl_scan_async_block_should_pause(dsl_scan_t *scn)
3517 {
3518 	uint64_t elapsed_nanosecs;
3519 
3520 	if (zfs_recover)
3521 		return (B_FALSE);
3522 
3523 	if (zfs_async_block_max_blocks != 0 &&
3524 	    scn->scn_visited_this_txg >= zfs_async_block_max_blocks) {
3525 		return (B_TRUE);
3526 	}
3527 
3528 	if (zfs_max_async_dedup_frees != 0 &&
3529 	    scn->scn_dedup_frees_this_txg >= zfs_max_async_dedup_frees) {
3530 		return (B_TRUE);
3531 	}
3532 
3533 	elapsed_nanosecs = gethrtime() - scn->scn_sync_start_time;
3534 	return (elapsed_nanosecs / NANOSEC > zfs_txg_timeout ||
3535 	    (NSEC2MSEC(elapsed_nanosecs) > scn->scn_async_block_min_time_ms &&
3536 	    txg_sync_waiting(scn->scn_dp)) ||
3537 	    spa_shutting_down(scn->scn_dp->dp_spa));
3538 }
3539 
3540 static int
3541 dsl_scan_free_block_cb(void *arg, const blkptr_t *bp, dmu_tx_t *tx)
3542 {
3543 	dsl_scan_t *scn = arg;
3544 
3545 	if (!scn->scn_is_bptree ||
3546 	    (BP_GET_LEVEL(bp) == 0 && BP_GET_TYPE(bp) != DMU_OT_OBJSET)) {
3547 		if (dsl_scan_async_block_should_pause(scn))
3548 			return (SET_ERROR(ERESTART));
3549 	}
3550 
3551 	zio_nowait(zio_free_sync(scn->scn_zio_root, scn->scn_dp->dp_spa,
3552 	    dmu_tx_get_txg(tx), bp, 0));
3553 	dsl_dir_diduse_space(tx->tx_pool->dp_free_dir, DD_USED_HEAD,
3554 	    -bp_get_dsize_sync(scn->scn_dp->dp_spa, bp),
3555 	    -BP_GET_PSIZE(bp), -BP_GET_UCSIZE(bp), tx);
3556 	scn->scn_visited_this_txg++;
3557 	if (BP_GET_DEDUP(bp))
3558 		scn->scn_dedup_frees_this_txg++;
3559 	return (0);
3560 }
3561 
3562 static void
3563 dsl_scan_update_stats(dsl_scan_t *scn)
3564 {
3565 	spa_t *spa = scn->scn_dp->dp_spa;
3566 	uint64_t i;
3567 	uint64_t seg_size_total = 0, zio_size_total = 0;
3568 	uint64_t seg_count_total = 0, zio_count_total = 0;
3569 
3570 	for (i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
3571 		vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
3572 		dsl_scan_io_queue_t *queue = vd->vdev_scan_io_queue;
3573 
3574 		if (queue == NULL)
3575 			continue;
3576 
3577 		seg_size_total += queue->q_total_seg_size_this_txg;
3578 		zio_size_total += queue->q_total_zio_size_this_txg;
3579 		seg_count_total += queue->q_segs_this_txg;
3580 		zio_count_total += queue->q_zios_this_txg;
3581 	}
3582 
3583 	if (seg_count_total == 0 || zio_count_total == 0) {
3584 		scn->scn_avg_seg_size_this_txg = 0;
3585 		scn->scn_avg_zio_size_this_txg = 0;
3586 		scn->scn_segs_this_txg = 0;
3587 		scn->scn_zios_this_txg = 0;
3588 		return;
3589 	}
3590 
3591 	scn->scn_avg_seg_size_this_txg = seg_size_total / seg_count_total;
3592 	scn->scn_avg_zio_size_this_txg = zio_size_total / zio_count_total;
3593 	scn->scn_segs_this_txg = seg_count_total;
3594 	scn->scn_zios_this_txg = zio_count_total;
3595 }
3596 
3597 static int
3598 bpobj_dsl_scan_free_block_cb(void *arg, const blkptr_t *bp, boolean_t bp_freed,
3599     dmu_tx_t *tx)
3600 {
3601 	ASSERT(!bp_freed);
3602 	return (dsl_scan_free_block_cb(arg, bp, tx));
3603 }
3604 
3605 static int
3606 dsl_scan_obsolete_block_cb(void *arg, const blkptr_t *bp, boolean_t bp_freed,
3607     dmu_tx_t *tx)
3608 {
3609 	ASSERT(!bp_freed);
3610 	dsl_scan_t *scn = arg;
3611 	const dva_t *dva = &bp->blk_dva[0];
3612 
3613 	if (dsl_scan_async_block_should_pause(scn))
3614 		return (SET_ERROR(ERESTART));
3615 
3616 	spa_vdev_indirect_mark_obsolete(scn->scn_dp->dp_spa,
3617 	    DVA_GET_VDEV(dva), DVA_GET_OFFSET(dva),
3618 	    DVA_GET_ASIZE(dva), tx);
3619 	scn->scn_visited_this_txg++;
3620 	return (0);
3621 }
3622 
3623 boolean_t
3624 dsl_scan_active(dsl_scan_t *scn)
3625 {
3626 	spa_t *spa = scn->scn_dp->dp_spa;
3627 	uint64_t used = 0, comp, uncomp;
3628 	boolean_t clones_left;
3629 
3630 	if (spa->spa_load_state != SPA_LOAD_NONE)
3631 		return (B_FALSE);
3632 	if (spa_shutting_down(spa))
3633 		return (B_FALSE);
3634 	if ((dsl_scan_is_running(scn) && !dsl_scan_is_paused_scrub(scn)) ||
3635 	    (scn->scn_async_destroying && !scn->scn_async_stalled))
3636 		return (B_TRUE);
3637 
3638 	if (spa_version(scn->scn_dp->dp_spa) >= SPA_VERSION_DEADLISTS) {
3639 		(void) bpobj_space(&scn->scn_dp->dp_free_bpobj,
3640 		    &used, &comp, &uncomp);
3641 	}
3642 	clones_left = spa_livelist_delete_check(spa);
3643 	return ((used != 0) || (clones_left));
3644 }
3645 
3646 boolean_t
3647 dsl_errorscrub_active(dsl_scan_t *scn)
3648 {
3649 	spa_t *spa = scn->scn_dp->dp_spa;
3650 	if (spa->spa_load_state != SPA_LOAD_NONE)
3651 		return (B_FALSE);
3652 	if (spa_shutting_down(spa))
3653 		return (B_FALSE);
3654 	if (dsl_errorscrubbing(scn->scn_dp))
3655 		return (B_TRUE);
3656 	return (B_FALSE);
3657 }
3658 
3659 static boolean_t
3660 dsl_scan_check_deferred(vdev_t *vd)
3661 {
3662 	boolean_t need_resilver = B_FALSE;
3663 
3664 	for (int c = 0; c < vd->vdev_children; c++) {
3665 		need_resilver |=
3666 		    dsl_scan_check_deferred(vd->vdev_child[c]);
3667 	}
3668 
3669 	if (!vdev_is_concrete(vd) || vd->vdev_aux ||
3670 	    !vd->vdev_ops->vdev_op_leaf)
3671 		return (need_resilver);
3672 
3673 	if (!vd->vdev_resilver_deferred)
3674 		need_resilver = B_TRUE;
3675 
3676 	return (need_resilver);
3677 }
3678 
3679 static boolean_t
3680 dsl_scan_need_resilver(spa_t *spa, const dva_t *dva, size_t psize,
3681     uint64_t phys_birth)
3682 {
3683 	vdev_t *vd;
3684 
3685 	vd = vdev_lookup_top(spa, DVA_GET_VDEV(dva));
3686 
3687 	if (vd->vdev_ops == &vdev_indirect_ops) {
3688 		/*
3689 		 * The indirect vdev can point to multiple
3690 		 * vdevs.  For simplicity, always create
3691 		 * the resilver zio_t. zio_vdev_io_start()
3692 		 * will bypass the child resilver i/o's if
3693 		 * they are on vdevs that don't have DTL's.
3694 		 */
3695 		return (B_TRUE);
3696 	}
3697 
3698 	if (DVA_GET_GANG(dva)) {
3699 		/*
3700 		 * Gang members may be spread across multiple
3701 		 * vdevs, so the best estimate we have is the
3702 		 * scrub range, which has already been checked.
3703 		 * XXX -- it would be better to change our
3704 		 * allocation policy to ensure that all
3705 		 * gang members reside on the same vdev.
3706 		 */
3707 		return (B_TRUE);
3708 	}
3709 
3710 	/*
3711 	 * Check if the top-level vdev must resilver this offset.
3712 	 * When the offset does not intersect with a dirty leaf DTL
3713 	 * then it may be possible to skip the resilver IO.  The psize
3714 	 * is provided instead of asize to simplify the check for RAIDZ.
3715 	 */
3716 	if (!vdev_dtl_need_resilver(vd, dva, psize, phys_birth))
3717 		return (B_FALSE);
3718 
3719 	/*
3720 	 * Check that this top-level vdev has a device under it which
3721 	 * is resilvering and is not deferred.
3722 	 */
3723 	if (!dsl_scan_check_deferred(vd))
3724 		return (B_FALSE);
3725 
3726 	return (B_TRUE);
3727 }
3728 
3729 static int
3730 dsl_process_async_destroys(dsl_pool_t *dp, dmu_tx_t *tx)
3731 {
3732 	dsl_scan_t *scn = dp->dp_scan;
3733 	spa_t *spa = dp->dp_spa;
3734 	int err = 0;
3735 
3736 	if (spa_suspend_async_destroy(spa))
3737 		return (0);
3738 
3739 	if (zfs_free_bpobj_enabled &&
3740 	    spa_version(spa) >= SPA_VERSION_DEADLISTS) {
3741 		scn->scn_is_bptree = B_FALSE;
3742 		scn->scn_async_block_min_time_ms = zfs_free_min_time_ms;
3743 		scn->scn_zio_root = zio_root(spa, NULL,
3744 		    NULL, ZIO_FLAG_MUSTSUCCEED);
3745 		err = bpobj_iterate(&dp->dp_free_bpobj,
3746 		    bpobj_dsl_scan_free_block_cb, scn, tx);
3747 		VERIFY0(zio_wait(scn->scn_zio_root));
3748 		scn->scn_zio_root = NULL;
3749 
3750 		if (err != 0 && err != ERESTART)
3751 			zfs_panic_recover("error %u from bpobj_iterate()", err);
3752 	}
3753 
3754 	if (err == 0 && spa_feature_is_active(spa, SPA_FEATURE_ASYNC_DESTROY)) {
3755 		ASSERT(scn->scn_async_destroying);
3756 		scn->scn_is_bptree = B_TRUE;
3757 		scn->scn_zio_root = zio_root(spa, NULL,
3758 		    NULL, ZIO_FLAG_MUSTSUCCEED);
3759 		err = bptree_iterate(dp->dp_meta_objset,
3760 		    dp->dp_bptree_obj, B_TRUE, dsl_scan_free_block_cb, scn, tx);
3761 		VERIFY0(zio_wait(scn->scn_zio_root));
3762 		scn->scn_zio_root = NULL;
3763 
3764 		if (err == EIO || err == ECKSUM) {
3765 			err = 0;
3766 		} else if (err != 0 && err != ERESTART) {
3767 			zfs_panic_recover("error %u from "
3768 			    "traverse_dataset_destroyed()", err);
3769 		}
3770 
3771 		if (bptree_is_empty(dp->dp_meta_objset, dp->dp_bptree_obj)) {
3772 			/* finished; deactivate async destroy feature */
3773 			spa_feature_decr(spa, SPA_FEATURE_ASYNC_DESTROY, tx);
3774 			ASSERT(!spa_feature_is_active(spa,
3775 			    SPA_FEATURE_ASYNC_DESTROY));
3776 			VERIFY0(zap_remove(dp->dp_meta_objset,
3777 			    DMU_POOL_DIRECTORY_OBJECT,
3778 			    DMU_POOL_BPTREE_OBJ, tx));
3779 			VERIFY0(bptree_free(dp->dp_meta_objset,
3780 			    dp->dp_bptree_obj, tx));
3781 			dp->dp_bptree_obj = 0;
3782 			scn->scn_async_destroying = B_FALSE;
3783 			scn->scn_async_stalled = B_FALSE;
3784 		} else {
3785 			/*
3786 			 * If we didn't make progress, mark the async
3787 			 * destroy as stalled, so that we will not initiate
3788 			 * a spa_sync() on its behalf.  Note that we only
3789 			 * check this if we are not finished, because if the
3790 			 * bptree had no blocks for us to visit, we can
3791 			 * finish without "making progress".
3792 			 */
3793 			scn->scn_async_stalled =
3794 			    (scn->scn_visited_this_txg == 0);
3795 		}
3796 	}
3797 	if (scn->scn_visited_this_txg) {
3798 		zfs_dbgmsg("freed %llu blocks in %llums from "
3799 		    "free_bpobj/bptree on %s in txg %llu; err=%u",
3800 		    (longlong_t)scn->scn_visited_this_txg,
3801 		    (longlong_t)
3802 		    NSEC2MSEC(gethrtime() - scn->scn_sync_start_time),
3803 		    spa->spa_name, (longlong_t)tx->tx_txg, err);
3804 		scn->scn_visited_this_txg = 0;
3805 		scn->scn_dedup_frees_this_txg = 0;
3806 
3807 		/*
3808 		 * Write out changes to the DDT and the BRT that may be required
3809 		 * as a result of the blocks freed.  This ensures that the DDT
3810 		 * and the BRT are clean when a scrub/resilver runs.
3811 		 */
3812 		ddt_sync(spa, tx->tx_txg);
3813 		brt_sync(spa, tx->tx_txg);
3814 	}
3815 	if (err != 0)
3816 		return (err);
3817 	if (dp->dp_free_dir != NULL && !scn->scn_async_destroying &&
3818 	    zfs_free_leak_on_eio &&
3819 	    (dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes != 0 ||
3820 	    dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes != 0 ||
3821 	    dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes != 0)) {
3822 		/*
3823 		 * We have finished background destroying, but there is still
3824 		 * some space left in the dp_free_dir. Transfer this leaked
3825 		 * space to the dp_leak_dir.
3826 		 */
3827 		if (dp->dp_leak_dir == NULL) {
3828 			rrw_enter(&dp->dp_config_rwlock, RW_WRITER, FTAG);
3829 			(void) dsl_dir_create_sync(dp, dp->dp_root_dir,
3830 			    LEAK_DIR_NAME, tx);
3831 			VERIFY0(dsl_pool_open_special_dir(dp,
3832 			    LEAK_DIR_NAME, &dp->dp_leak_dir));
3833 			rrw_exit(&dp->dp_config_rwlock, FTAG);
3834 		}
3835 		dsl_dir_diduse_space(dp->dp_leak_dir, DD_USED_HEAD,
3836 		    dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes,
3837 		    dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes,
3838 		    dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes, tx);
3839 		dsl_dir_diduse_space(dp->dp_free_dir, DD_USED_HEAD,
3840 		    -dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes,
3841 		    -dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes,
3842 		    -dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes, tx);
3843 	}
3844 
3845 	if (dp->dp_free_dir != NULL && !scn->scn_async_destroying &&
3846 	    !spa_livelist_delete_check(spa)) {
3847 		/* finished; verify that space accounting went to zero */
3848 		ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes);
3849 		ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes);
3850 		ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes);
3851 	}
3852 
3853 	spa_notify_waiters(spa);
3854 
3855 	EQUIV(bpobj_is_open(&dp->dp_obsolete_bpobj),
3856 	    0 == zap_contains(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
3857 	    DMU_POOL_OBSOLETE_BPOBJ));
3858 	if (err == 0 && bpobj_is_open(&dp->dp_obsolete_bpobj)) {
3859 		ASSERT(spa_feature_is_active(dp->dp_spa,
3860 		    SPA_FEATURE_OBSOLETE_COUNTS));
3861 
3862 		scn->scn_is_bptree = B_FALSE;
3863 		scn->scn_async_block_min_time_ms = zfs_obsolete_min_time_ms;
3864 		err = bpobj_iterate(&dp->dp_obsolete_bpobj,
3865 		    dsl_scan_obsolete_block_cb, scn, tx);
3866 		if (err != 0 && err != ERESTART)
3867 			zfs_panic_recover("error %u from bpobj_iterate()", err);
3868 
3869 		if (bpobj_is_empty(&dp->dp_obsolete_bpobj))
3870 			dsl_pool_destroy_obsolete_bpobj(dp, tx);
3871 	}
3872 	return (0);
3873 }
3874 
3875 static void
3876 name_to_bookmark(char *buf, zbookmark_phys_t *zb)
3877 {
3878 	zb->zb_objset = zfs_strtonum(buf, &buf);
3879 	ASSERT(*buf == ':');
3880 	zb->zb_object = zfs_strtonum(buf + 1, &buf);
3881 	ASSERT(*buf == ':');
3882 	zb->zb_level = (int)zfs_strtonum(buf + 1, &buf);
3883 	ASSERT(*buf == ':');
3884 	zb->zb_blkid = zfs_strtonum(buf + 1, &buf);
3885 	ASSERT(*buf == '\0');
3886 }
3887 
3888 static void
3889 name_to_object(char *buf, uint64_t *obj)
3890 {
3891 	*obj = zfs_strtonum(buf, &buf);
3892 	ASSERT(*buf == '\0');
3893 }
3894 
3895 static void
3896 read_by_block_level(dsl_scan_t *scn, zbookmark_phys_t zb)
3897 {
3898 	dsl_pool_t *dp = scn->scn_dp;
3899 	dsl_dataset_t *ds;
3900 	objset_t *os;
3901 	if (dsl_dataset_hold_obj(dp, zb.zb_objset, FTAG, &ds) != 0)
3902 		return;
3903 
3904 	if (dmu_objset_from_ds(ds, &os) != 0) {
3905 		dsl_dataset_rele(ds, FTAG);
3906 		return;
3907 	}
3908 
3909 	/*
3910 	 * If the key is not loaded dbuf_dnode_findbp() will error out with
3911 	 * EACCES. However in that case dnode_hold() will eventually call
3912 	 * dbuf_read()->zio_wait() which may call spa_log_error(). This will
3913 	 * lead to a deadlock due to us holding the mutex spa_errlist_lock.
3914 	 * Avoid this by checking here if the keys are loaded, if not return.
3915 	 * If the keys are not loaded the head_errlog feature is meaningless
3916 	 * as we cannot figure out the birth txg of the block pointer.
3917 	 */
3918 	if (dsl_dataset_get_keystatus(ds->ds_dir) ==
3919 	    ZFS_KEYSTATUS_UNAVAILABLE) {
3920 		dsl_dataset_rele(ds, FTAG);
3921 		return;
3922 	}
3923 
3924 	dnode_t *dn;
3925 	blkptr_t bp;
3926 
3927 	if (dnode_hold(os, zb.zb_object, FTAG, &dn) != 0) {
3928 		dsl_dataset_rele(ds, FTAG);
3929 		return;
3930 	}
3931 
3932 	rw_enter(&dn->dn_struct_rwlock, RW_READER);
3933 	int error = dbuf_dnode_findbp(dn, zb.zb_level, zb.zb_blkid, &bp, NULL,
3934 	    NULL);
3935 
3936 	if (error) {
3937 		rw_exit(&dn->dn_struct_rwlock);
3938 		dnode_rele(dn, FTAG);
3939 		dsl_dataset_rele(ds, FTAG);
3940 		return;
3941 	}
3942 
3943 	if (!error && BP_IS_HOLE(&bp)) {
3944 		rw_exit(&dn->dn_struct_rwlock);
3945 		dnode_rele(dn, FTAG);
3946 		dsl_dataset_rele(ds, FTAG);
3947 		return;
3948 	}
3949 
3950 	int zio_flags = ZIO_FLAG_SCAN_THREAD | ZIO_FLAG_RAW |
3951 	    ZIO_FLAG_CANFAIL | ZIO_FLAG_SCRUB;
3952 
3953 	/* If it's an intent log block, failure is expected. */
3954 	if (zb.zb_level == ZB_ZIL_LEVEL)
3955 		zio_flags |= ZIO_FLAG_SPECULATIVE;
3956 
3957 	ASSERT(!BP_IS_EMBEDDED(&bp));
3958 	scan_exec_io(dp, &bp, zio_flags, &zb, NULL);
3959 	rw_exit(&dn->dn_struct_rwlock);
3960 	dnode_rele(dn, FTAG);
3961 	dsl_dataset_rele(ds, FTAG);
3962 }
3963 
3964 /*
3965  * We keep track of the scrubbed error blocks in "count". This will be used
3966  * when deciding whether we exceeded zfs_scrub_error_blocks_per_txg. This
3967  * function is modelled after check_filesystem().
3968  */
3969 static int
3970 scrub_filesystem(spa_t *spa, uint64_t fs, zbookmark_err_phys_t *zep,
3971     int *count)
3972 {
3973 	dsl_dataset_t *ds;
3974 	dsl_pool_t *dp = spa->spa_dsl_pool;
3975 	dsl_scan_t *scn = dp->dp_scan;
3976 
3977 	int error = dsl_dataset_hold_obj(dp, fs, FTAG, &ds);
3978 	if (error != 0)
3979 		return (error);
3980 
3981 	uint64_t latest_txg;
3982 	uint64_t txg_to_consider = spa->spa_syncing_txg;
3983 	boolean_t check_snapshot = B_TRUE;
3984 
3985 	error = find_birth_txg(ds, zep, &latest_txg);
3986 
3987 	/*
3988 	 * If find_birth_txg() errors out, then err on the side of caution and
3989 	 * proceed. In worst case scenario scrub all objects. If zep->zb_birth
3990 	 * is 0 (e.g. in case of encryption with unloaded keys) also proceed to
3991 	 * scrub all objects.
3992 	 */
3993 	if (error == 0 && zep->zb_birth == latest_txg) {
3994 		/* Block neither free nor re written. */
3995 		zbookmark_phys_t zb;
3996 		zep_to_zb(fs, zep, &zb);
3997 		scn->scn_zio_root = zio_root(spa, NULL, NULL,
3998 		    ZIO_FLAG_CANFAIL);
3999 		/* We have already acquired the config lock for spa */
4000 		read_by_block_level(scn, zb);
4001 
4002 		(void) zio_wait(scn->scn_zio_root);
4003 		scn->scn_zio_root = NULL;
4004 
4005 		scn->errorscrub_phys.dep_examined++;
4006 		scn->errorscrub_phys.dep_to_examine--;
4007 		(*count)++;
4008 		if ((*count) == zfs_scrub_error_blocks_per_txg ||
4009 		    dsl_error_scrub_check_suspend(scn, &zb)) {
4010 			dsl_dataset_rele(ds, FTAG);
4011 			return (SET_ERROR(EFAULT));
4012 		}
4013 
4014 		check_snapshot = B_FALSE;
4015 	} else if (error == 0) {
4016 		txg_to_consider = latest_txg;
4017 	}
4018 
4019 	/*
4020 	 * Retrieve the number of snapshots if the dataset is not a snapshot.
4021 	 */
4022 	uint64_t snap_count = 0;
4023 	if (dsl_dataset_phys(ds)->ds_snapnames_zapobj != 0) {
4024 
4025 		error = zap_count(spa->spa_meta_objset,
4026 		    dsl_dataset_phys(ds)->ds_snapnames_zapobj, &snap_count);
4027 
4028 		if (error != 0) {
4029 			dsl_dataset_rele(ds, FTAG);
4030 			return (error);
4031 		}
4032 	}
4033 
4034 	if (snap_count == 0) {
4035 		/* Filesystem without snapshots. */
4036 		dsl_dataset_rele(ds, FTAG);
4037 		return (0);
4038 	}
4039 
4040 	uint64_t snap_obj = dsl_dataset_phys(ds)->ds_prev_snap_obj;
4041 	uint64_t snap_obj_txg = dsl_dataset_phys(ds)->ds_prev_snap_txg;
4042 
4043 	dsl_dataset_rele(ds, FTAG);
4044 
4045 	/* Check only snapshots created from this file system. */
4046 	while (snap_obj != 0 && zep->zb_birth < snap_obj_txg &&
4047 	    snap_obj_txg <= txg_to_consider) {
4048 
4049 		error = dsl_dataset_hold_obj(dp, snap_obj, FTAG, &ds);
4050 		if (error != 0)
4051 			return (error);
4052 
4053 		if (dsl_dir_phys(ds->ds_dir)->dd_head_dataset_obj != fs) {
4054 			snap_obj = dsl_dataset_phys(ds)->ds_prev_snap_obj;
4055 			snap_obj_txg = dsl_dataset_phys(ds)->ds_prev_snap_txg;
4056 			dsl_dataset_rele(ds, FTAG);
4057 			continue;
4058 		}
4059 
4060 		boolean_t affected = B_TRUE;
4061 		if (check_snapshot) {
4062 			uint64_t blk_txg;
4063 			error = find_birth_txg(ds, zep, &blk_txg);
4064 
4065 			/*
4066 			 * Scrub the snapshot also when zb_birth == 0 or when
4067 			 * find_birth_txg() returns an error.
4068 			 */
4069 			affected = (error == 0 && zep->zb_birth == blk_txg) ||
4070 			    (error != 0) || (zep->zb_birth == 0);
4071 		}
4072 
4073 		/* Scrub snapshots. */
4074 		if (affected) {
4075 			zbookmark_phys_t zb;
4076 			zep_to_zb(snap_obj, zep, &zb);
4077 			scn->scn_zio_root = zio_root(spa, NULL, NULL,
4078 			    ZIO_FLAG_CANFAIL);
4079 			/* We have already acquired the config lock for spa */
4080 			read_by_block_level(scn, zb);
4081 
4082 			(void) zio_wait(scn->scn_zio_root);
4083 			scn->scn_zio_root = NULL;
4084 
4085 			scn->errorscrub_phys.dep_examined++;
4086 			scn->errorscrub_phys.dep_to_examine--;
4087 			(*count)++;
4088 			if ((*count) == zfs_scrub_error_blocks_per_txg ||
4089 			    dsl_error_scrub_check_suspend(scn, &zb)) {
4090 				dsl_dataset_rele(ds, FTAG);
4091 				return (EFAULT);
4092 			}
4093 		}
4094 		snap_obj_txg = dsl_dataset_phys(ds)->ds_prev_snap_txg;
4095 		snap_obj = dsl_dataset_phys(ds)->ds_prev_snap_obj;
4096 		dsl_dataset_rele(ds, FTAG);
4097 	}
4098 	return (0);
4099 }
4100 
4101 void
4102 dsl_errorscrub_sync(dsl_pool_t *dp, dmu_tx_t *tx)
4103 {
4104 	spa_t *spa = dp->dp_spa;
4105 	dsl_scan_t *scn = dp->dp_scan;
4106 
4107 	/*
4108 	 * Only process scans in sync pass 1.
4109 	 */
4110 
4111 	if (spa_sync_pass(spa) > 1)
4112 		return;
4113 
4114 	/*
4115 	 * If the spa is shutting down, then stop scanning. This will
4116 	 * ensure that the scan does not dirty any new data during the
4117 	 * shutdown phase.
4118 	 */
4119 	if (spa_shutting_down(spa))
4120 		return;
4121 
4122 	if (!dsl_errorscrub_active(scn) || dsl_errorscrub_is_paused(scn)) {
4123 		return;
4124 	}
4125 
4126 	if (dsl_scan_resilvering(scn->scn_dp)) {
4127 		/* cancel the error scrub if resilver started */
4128 		dsl_scan_cancel(scn->scn_dp);
4129 		return;
4130 	}
4131 
4132 	spa->spa_scrub_active = B_TRUE;
4133 	scn->scn_sync_start_time = gethrtime();
4134 
4135 	/*
4136 	 * zfs_scan_suspend_progress can be set to disable scrub progress.
4137 	 * See more detailed comment in dsl_scan_sync().
4138 	 */
4139 	if (zfs_scan_suspend_progress) {
4140 		uint64_t scan_time_ns = gethrtime() - scn->scn_sync_start_time;
4141 		int mintime = zfs_scrub_min_time_ms;
4142 
4143 		while (zfs_scan_suspend_progress &&
4144 		    !txg_sync_waiting(scn->scn_dp) &&
4145 		    !spa_shutting_down(scn->scn_dp->dp_spa) &&
4146 		    NSEC2MSEC(scan_time_ns) < mintime) {
4147 			delay(hz);
4148 			scan_time_ns = gethrtime() - scn->scn_sync_start_time;
4149 		}
4150 		return;
4151 	}
4152 
4153 	int i = 0;
4154 	zap_attribute_t *za;
4155 	zbookmark_phys_t *zb;
4156 	boolean_t limit_exceeded = B_FALSE;
4157 
4158 	za = kmem_zalloc(sizeof (zap_attribute_t), KM_SLEEP);
4159 	zb = kmem_zalloc(sizeof (zbookmark_phys_t), KM_SLEEP);
4160 
4161 	if (!spa_feature_is_enabled(spa, SPA_FEATURE_HEAD_ERRLOG)) {
4162 		for (; zap_cursor_retrieve(&scn->errorscrub_cursor, za) == 0;
4163 		    zap_cursor_advance(&scn->errorscrub_cursor)) {
4164 			name_to_bookmark(za->za_name, zb);
4165 
4166 			scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
4167 			    NULL, ZIO_FLAG_CANFAIL);
4168 			dsl_pool_config_enter(dp, FTAG);
4169 			read_by_block_level(scn, *zb);
4170 			dsl_pool_config_exit(dp, FTAG);
4171 
4172 			(void) zio_wait(scn->scn_zio_root);
4173 			scn->scn_zio_root = NULL;
4174 
4175 			scn->errorscrub_phys.dep_examined += 1;
4176 			scn->errorscrub_phys.dep_to_examine -= 1;
4177 			i++;
4178 			if (i == zfs_scrub_error_blocks_per_txg ||
4179 			    dsl_error_scrub_check_suspend(scn, zb)) {
4180 				limit_exceeded = B_TRUE;
4181 				break;
4182 			}
4183 		}
4184 
4185 		if (!limit_exceeded)
4186 			dsl_errorscrub_done(scn, B_TRUE, tx);
4187 
4188 		dsl_errorscrub_sync_state(scn, tx);
4189 		kmem_free(za, sizeof (*za));
4190 		kmem_free(zb, sizeof (*zb));
4191 		return;
4192 	}
4193 
4194 	int error = 0;
4195 	for (; zap_cursor_retrieve(&scn->errorscrub_cursor, za) == 0;
4196 	    zap_cursor_advance(&scn->errorscrub_cursor)) {
4197 
4198 		zap_cursor_t *head_ds_cursor;
4199 		zap_attribute_t *head_ds_attr;
4200 		zbookmark_err_phys_t head_ds_block;
4201 
4202 		head_ds_cursor = kmem_zalloc(sizeof (zap_cursor_t), KM_SLEEP);
4203 		head_ds_attr = kmem_zalloc(sizeof (zap_attribute_t), KM_SLEEP);
4204 
4205 		uint64_t head_ds_err_obj = za->za_first_integer;
4206 		uint64_t head_ds;
4207 		name_to_object(za->za_name, &head_ds);
4208 		boolean_t config_held = B_FALSE;
4209 		uint64_t top_affected_fs;
4210 
4211 		for (zap_cursor_init(head_ds_cursor, spa->spa_meta_objset,
4212 		    head_ds_err_obj); zap_cursor_retrieve(head_ds_cursor,
4213 		    head_ds_attr) == 0; zap_cursor_advance(head_ds_cursor)) {
4214 
4215 			name_to_errphys(head_ds_attr->za_name, &head_ds_block);
4216 
4217 			/*
4218 			 * In case we are called from spa_sync the pool
4219 			 * config is already held.
4220 			 */
4221 			if (!dsl_pool_config_held(dp)) {
4222 				dsl_pool_config_enter(dp, FTAG);
4223 				config_held = B_TRUE;
4224 			}
4225 
4226 			error = find_top_affected_fs(spa,
4227 			    head_ds, &head_ds_block, &top_affected_fs);
4228 			if (error)
4229 				break;
4230 
4231 			error = scrub_filesystem(spa, top_affected_fs,
4232 			    &head_ds_block, &i);
4233 
4234 			if (error == SET_ERROR(EFAULT)) {
4235 				limit_exceeded = B_TRUE;
4236 				break;
4237 			}
4238 		}
4239 
4240 		zap_cursor_fini(head_ds_cursor);
4241 		kmem_free(head_ds_cursor, sizeof (*head_ds_cursor));
4242 		kmem_free(head_ds_attr, sizeof (*head_ds_attr));
4243 
4244 		if (config_held)
4245 			dsl_pool_config_exit(dp, FTAG);
4246 	}
4247 
4248 	kmem_free(za, sizeof (*za));
4249 	kmem_free(zb, sizeof (*zb));
4250 	if (!limit_exceeded)
4251 		dsl_errorscrub_done(scn, B_TRUE, tx);
4252 
4253 	dsl_errorscrub_sync_state(scn, tx);
4254 }
4255 
4256 /*
4257  * This is the primary entry point for scans that is called from syncing
4258  * context. Scans must happen entirely during syncing context so that we
4259  * can guarantee that blocks we are currently scanning will not change out
4260  * from under us. While a scan is active, this function controls how quickly
4261  * transaction groups proceed, instead of the normal handling provided by
4262  * txg_sync_thread().
4263  */
4264 void
4265 dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
4266 {
4267 	int err = 0;
4268 	dsl_scan_t *scn = dp->dp_scan;
4269 	spa_t *spa = dp->dp_spa;
4270 	state_sync_type_t sync_type = SYNC_OPTIONAL;
4271 
4272 	if (spa->spa_resilver_deferred &&
4273 	    !spa_feature_is_active(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
4274 		spa_feature_incr(spa, SPA_FEATURE_RESILVER_DEFER, tx);
4275 
4276 	/*
4277 	 * Check for scn_restart_txg before checking spa_load_state, so
4278 	 * that we can restart an old-style scan while the pool is being
4279 	 * imported (see dsl_scan_init). We also restart scans if there
4280 	 * is a deferred resilver and the user has manually disabled
4281 	 * deferred resilvers via the tunable.
4282 	 */
4283 	if (dsl_scan_restarting(scn, tx) ||
4284 	    (spa->spa_resilver_deferred && zfs_resilver_disable_defer)) {
4285 		pool_scan_func_t func = POOL_SCAN_SCRUB;
4286 		dsl_scan_done(scn, B_FALSE, tx);
4287 		if (vdev_resilver_needed(spa->spa_root_vdev, NULL, NULL))
4288 			func = POOL_SCAN_RESILVER;
4289 		zfs_dbgmsg("restarting scan func=%u on %s txg=%llu",
4290 		    func, dp->dp_spa->spa_name, (longlong_t)tx->tx_txg);
4291 		dsl_scan_setup_sync(&func, tx);
4292 	}
4293 
4294 	/*
4295 	 * Only process scans in sync pass 1.
4296 	 */
4297 	if (spa_sync_pass(spa) > 1)
4298 		return;
4299 
4300 	/*
4301 	 * If the spa is shutting down, then stop scanning. This will
4302 	 * ensure that the scan does not dirty any new data during the
4303 	 * shutdown phase.
4304 	 */
4305 	if (spa_shutting_down(spa))
4306 		return;
4307 
4308 	/*
4309 	 * If the scan is inactive due to a stalled async destroy, try again.
4310 	 */
4311 	if (!scn->scn_async_stalled && !dsl_scan_active(scn))
4312 		return;
4313 
4314 	/* reset scan statistics */
4315 	scn->scn_visited_this_txg = 0;
4316 	scn->scn_dedup_frees_this_txg = 0;
4317 	scn->scn_holes_this_txg = 0;
4318 	scn->scn_lt_min_this_txg = 0;
4319 	scn->scn_gt_max_this_txg = 0;
4320 	scn->scn_ddt_contained_this_txg = 0;
4321 	scn->scn_objsets_visited_this_txg = 0;
4322 	scn->scn_avg_seg_size_this_txg = 0;
4323 	scn->scn_segs_this_txg = 0;
4324 	scn->scn_avg_zio_size_this_txg = 0;
4325 	scn->scn_zios_this_txg = 0;
4326 	scn->scn_suspending = B_FALSE;
4327 	scn->scn_sync_start_time = gethrtime();
4328 	spa->spa_scrub_active = B_TRUE;
4329 
4330 	/*
4331 	 * First process the async destroys.  If we suspend, don't do
4332 	 * any scrubbing or resilvering.  This ensures that there are no
4333 	 * async destroys while we are scanning, so the scan code doesn't
4334 	 * have to worry about traversing it.  It is also faster to free the
4335 	 * blocks than to scrub them.
4336 	 */
4337 	err = dsl_process_async_destroys(dp, tx);
4338 	if (err != 0)
4339 		return;
4340 
4341 	if (!dsl_scan_is_running(scn) || dsl_scan_is_paused_scrub(scn))
4342 		return;
4343 
4344 	/*
4345 	 * Wait a few txgs after importing to begin scanning so that
4346 	 * we can get the pool imported quickly.
4347 	 */
4348 	if (spa->spa_syncing_txg < spa->spa_first_txg + SCAN_IMPORT_WAIT_TXGS)
4349 		return;
4350 
4351 	/*
4352 	 * zfs_scan_suspend_progress can be set to disable scan progress.
4353 	 * We don't want to spin the txg_sync thread, so we add a delay
4354 	 * here to simulate the time spent doing a scan. This is mostly
4355 	 * useful for testing and debugging.
4356 	 */
4357 	if (zfs_scan_suspend_progress) {
4358 		uint64_t scan_time_ns = gethrtime() - scn->scn_sync_start_time;
4359 		uint_t mintime = (scn->scn_phys.scn_func ==
4360 		    POOL_SCAN_RESILVER) ? zfs_resilver_min_time_ms :
4361 		    zfs_scrub_min_time_ms;
4362 
4363 		while (zfs_scan_suspend_progress &&
4364 		    !txg_sync_waiting(scn->scn_dp) &&
4365 		    !spa_shutting_down(scn->scn_dp->dp_spa) &&
4366 		    NSEC2MSEC(scan_time_ns) < mintime) {
4367 			delay(hz);
4368 			scan_time_ns = gethrtime() - scn->scn_sync_start_time;
4369 		}
4370 		return;
4371 	}
4372 
4373 	/*
4374 	 * Disabled by default, set zfs_scan_report_txgs to report
4375 	 * average performance over the last zfs_scan_report_txgs TXGs.
4376 	 */
4377 	if (zfs_scan_report_txgs != 0 &&
4378 	    tx->tx_txg % zfs_scan_report_txgs == 0) {
4379 		scn->scn_issued_before_pass += spa->spa_scan_pass_issued;
4380 		spa_scan_stat_init(spa);
4381 	}
4382 
4383 	/*
4384 	 * It is possible to switch from unsorted to sorted at any time,
4385 	 * but afterwards the scan will remain sorted unless reloaded from
4386 	 * a checkpoint after a reboot.
4387 	 */
4388 	if (!zfs_scan_legacy) {
4389 		scn->scn_is_sorted = B_TRUE;
4390 		if (scn->scn_last_checkpoint == 0)
4391 			scn->scn_last_checkpoint = ddi_get_lbolt();
4392 	}
4393 
4394 	/*
4395 	 * For sorted scans, determine what kind of work we will be doing
4396 	 * this txg based on our memory limitations and whether or not we
4397 	 * need to perform a checkpoint.
4398 	 */
4399 	if (scn->scn_is_sorted) {
4400 		/*
4401 		 * If we are over our checkpoint interval, set scn_clearing
4402 		 * so that we can begin checkpointing immediately. The
4403 		 * checkpoint allows us to save a consistent bookmark
4404 		 * representing how much data we have scrubbed so far.
4405 		 * Otherwise, use the memory limit to determine if we should
4406 		 * scan for metadata or start issue scrub IOs. We accumulate
4407 		 * metadata until we hit our hard memory limit at which point
4408 		 * we issue scrub IOs until we are at our soft memory limit.
4409 		 */
4410 		if (scn->scn_checkpointing ||
4411 		    ddi_get_lbolt() - scn->scn_last_checkpoint >
4412 		    SEC_TO_TICK(zfs_scan_checkpoint_intval)) {
4413 			if (!scn->scn_checkpointing)
4414 				zfs_dbgmsg("begin scan checkpoint for %s",
4415 				    spa->spa_name);
4416 
4417 			scn->scn_checkpointing = B_TRUE;
4418 			scn->scn_clearing = B_TRUE;
4419 		} else {
4420 			boolean_t should_clear = dsl_scan_should_clear(scn);
4421 			if (should_clear && !scn->scn_clearing) {
4422 				zfs_dbgmsg("begin scan clearing for %s",
4423 				    spa->spa_name);
4424 				scn->scn_clearing = B_TRUE;
4425 			} else if (!should_clear && scn->scn_clearing) {
4426 				zfs_dbgmsg("finish scan clearing for %s",
4427 				    spa->spa_name);
4428 				scn->scn_clearing = B_FALSE;
4429 			}
4430 		}
4431 	} else {
4432 		ASSERT0(scn->scn_checkpointing);
4433 		ASSERT0(scn->scn_clearing);
4434 	}
4435 
4436 	if (!scn->scn_clearing && scn->scn_done_txg == 0) {
4437 		/* Need to scan metadata for more blocks to scrub */
4438 		dsl_scan_phys_t *scnp = &scn->scn_phys;
4439 		taskqid_t prefetch_tqid;
4440 
4441 		/*
4442 		 * Calculate the max number of in-flight bytes for pool-wide
4443 		 * scanning operations (minimum 1MB, maximum 1/4 of arc_c_max).
4444 		 * Limits for the issuing phase are done per top-level vdev and
4445 		 * are handled separately.
4446 		 */
4447 		scn->scn_maxinflight_bytes = MIN(arc_c_max / 4, MAX(1ULL << 20,
4448 		    zfs_scan_vdev_limit * dsl_scan_count_data_disks(spa)));
4449 
4450 		if (scnp->scn_ddt_bookmark.ddb_class <=
4451 		    scnp->scn_ddt_class_max) {
4452 			ASSERT(ZB_IS_ZERO(&scnp->scn_bookmark));
4453 			zfs_dbgmsg("doing scan sync for %s txg %llu; "
4454 			    "ddt bm=%llu/%llu/%llu/%llx",
4455 			    spa->spa_name,
4456 			    (longlong_t)tx->tx_txg,
4457 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_class,
4458 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_type,
4459 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_checksum,
4460 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_cursor);
4461 		} else {
4462 			zfs_dbgmsg("doing scan sync for %s txg %llu; "
4463 			    "bm=%llu/%llu/%llu/%llu",
4464 			    spa->spa_name,
4465 			    (longlong_t)tx->tx_txg,
4466 			    (longlong_t)scnp->scn_bookmark.zb_objset,
4467 			    (longlong_t)scnp->scn_bookmark.zb_object,
4468 			    (longlong_t)scnp->scn_bookmark.zb_level,
4469 			    (longlong_t)scnp->scn_bookmark.zb_blkid);
4470 		}
4471 
4472 		scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
4473 		    NULL, ZIO_FLAG_CANFAIL);
4474 
4475 		scn->scn_prefetch_stop = B_FALSE;
4476 		prefetch_tqid = taskq_dispatch(dp->dp_sync_taskq,
4477 		    dsl_scan_prefetch_thread, scn, TQ_SLEEP);
4478 		ASSERT(prefetch_tqid != TASKQID_INVALID);
4479 
4480 		dsl_pool_config_enter(dp, FTAG);
4481 		dsl_scan_visit(scn, tx);
4482 		dsl_pool_config_exit(dp, FTAG);
4483 
4484 		mutex_enter(&dp->dp_spa->spa_scrub_lock);
4485 		scn->scn_prefetch_stop = B_TRUE;
4486 		cv_broadcast(&spa->spa_scrub_io_cv);
4487 		mutex_exit(&dp->dp_spa->spa_scrub_lock);
4488 
4489 		taskq_wait_id(dp->dp_sync_taskq, prefetch_tqid);
4490 		(void) zio_wait(scn->scn_zio_root);
4491 		scn->scn_zio_root = NULL;
4492 
4493 		zfs_dbgmsg("scan visited %llu blocks of %s in %llums "
4494 		    "(%llu os's, %llu holes, %llu < mintxg, "
4495 		    "%llu in ddt, %llu > maxtxg)",
4496 		    (longlong_t)scn->scn_visited_this_txg,
4497 		    spa->spa_name,
4498 		    (longlong_t)NSEC2MSEC(gethrtime() -
4499 		    scn->scn_sync_start_time),
4500 		    (longlong_t)scn->scn_objsets_visited_this_txg,
4501 		    (longlong_t)scn->scn_holes_this_txg,
4502 		    (longlong_t)scn->scn_lt_min_this_txg,
4503 		    (longlong_t)scn->scn_ddt_contained_this_txg,
4504 		    (longlong_t)scn->scn_gt_max_this_txg);
4505 
4506 		if (!scn->scn_suspending) {
4507 			ASSERT0(avl_numnodes(&scn->scn_queue));
4508 			scn->scn_done_txg = tx->tx_txg + 1;
4509 			if (scn->scn_is_sorted) {
4510 				scn->scn_checkpointing = B_TRUE;
4511 				scn->scn_clearing = B_TRUE;
4512 				scn->scn_issued_before_pass +=
4513 				    spa->spa_scan_pass_issued;
4514 				spa_scan_stat_init(spa);
4515 			}
4516 			zfs_dbgmsg("scan complete for %s txg %llu",
4517 			    spa->spa_name,
4518 			    (longlong_t)tx->tx_txg);
4519 		}
4520 	} else if (scn->scn_is_sorted && scn->scn_queues_pending != 0) {
4521 		ASSERT(scn->scn_clearing);
4522 
4523 		/* need to issue scrubbing IOs from per-vdev queues */
4524 		scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
4525 		    NULL, ZIO_FLAG_CANFAIL);
4526 		scan_io_queues_run(scn);
4527 		(void) zio_wait(scn->scn_zio_root);
4528 		scn->scn_zio_root = NULL;
4529 
4530 		/* calculate and dprintf the current memory usage */
4531 		(void) dsl_scan_should_clear(scn);
4532 		dsl_scan_update_stats(scn);
4533 
4534 		zfs_dbgmsg("scan issued %llu blocks for %s (%llu segs) "
4535 		    "in %llums (avg_block_size = %llu, avg_seg_size = %llu)",
4536 		    (longlong_t)scn->scn_zios_this_txg,
4537 		    spa->spa_name,
4538 		    (longlong_t)scn->scn_segs_this_txg,
4539 		    (longlong_t)NSEC2MSEC(gethrtime() -
4540 		    scn->scn_sync_start_time),
4541 		    (longlong_t)scn->scn_avg_zio_size_this_txg,
4542 		    (longlong_t)scn->scn_avg_seg_size_this_txg);
4543 	} else if (scn->scn_done_txg != 0 && scn->scn_done_txg <= tx->tx_txg) {
4544 		/* Finished with everything. Mark the scrub as complete */
4545 		zfs_dbgmsg("scan issuing complete txg %llu for %s",
4546 		    (longlong_t)tx->tx_txg,
4547 		    spa->spa_name);
4548 		ASSERT3U(scn->scn_done_txg, !=, 0);
4549 		ASSERT0(spa->spa_scrub_inflight);
4550 		ASSERT0(scn->scn_queues_pending);
4551 		dsl_scan_done(scn, B_TRUE, tx);
4552 		sync_type = SYNC_MANDATORY;
4553 	}
4554 
4555 	dsl_scan_sync_state(scn, tx, sync_type);
4556 }
4557 
4558 static void
4559 count_block_issued(spa_t *spa, const blkptr_t *bp, boolean_t all)
4560 {
4561 	/*
4562 	 * Don't count embedded bp's, since we already did the work of
4563 	 * scanning these when we scanned the containing block.
4564 	 */
4565 	if (BP_IS_EMBEDDED(bp))
4566 		return;
4567 
4568 	/*
4569 	 * Update the spa's stats on how many bytes we have issued.
4570 	 * Sequential scrubs create a zio for each DVA of the bp. Each
4571 	 * of these will include all DVAs for repair purposes, but the
4572 	 * zio code will only try the first one unless there is an issue.
4573 	 * Therefore, we should only count the first DVA for these IOs.
4574 	 */
4575 	atomic_add_64(&spa->spa_scan_pass_issued,
4576 	    all ? BP_GET_ASIZE(bp) : DVA_GET_ASIZE(&bp->blk_dva[0]));
4577 }
4578 
4579 static void
4580 count_block_skipped(dsl_scan_t *scn, const blkptr_t *bp, boolean_t all)
4581 {
4582 	if (BP_IS_EMBEDDED(bp))
4583 		return;
4584 	atomic_add_64(&scn->scn_phys.scn_skipped,
4585 	    all ? BP_GET_ASIZE(bp) : DVA_GET_ASIZE(&bp->blk_dva[0]));
4586 }
4587 
4588 static void
4589 count_block(zfs_all_blkstats_t *zab, const blkptr_t *bp)
4590 {
4591 	/*
4592 	 * If we resume after a reboot, zab will be NULL; don't record
4593 	 * incomplete stats in that case.
4594 	 */
4595 	if (zab == NULL)
4596 		return;
4597 
4598 	for (int i = 0; i < 4; i++) {
4599 		int l = (i < 2) ? BP_GET_LEVEL(bp) : DN_MAX_LEVELS;
4600 		int t = (i & 1) ? BP_GET_TYPE(bp) : DMU_OT_TOTAL;
4601 
4602 		if (t & DMU_OT_NEWTYPE)
4603 			t = DMU_OT_OTHER;
4604 		zfs_blkstat_t *zb = &zab->zab_type[l][t];
4605 		int equal;
4606 
4607 		zb->zb_count++;
4608 		zb->zb_asize += BP_GET_ASIZE(bp);
4609 		zb->zb_lsize += BP_GET_LSIZE(bp);
4610 		zb->zb_psize += BP_GET_PSIZE(bp);
4611 		zb->zb_gangs += BP_COUNT_GANG(bp);
4612 
4613 		switch (BP_GET_NDVAS(bp)) {
4614 		case 2:
4615 			if (DVA_GET_VDEV(&bp->blk_dva[0]) ==
4616 			    DVA_GET_VDEV(&bp->blk_dva[1]))
4617 				zb->zb_ditto_2_of_2_samevdev++;
4618 			break;
4619 		case 3:
4620 			equal = (DVA_GET_VDEV(&bp->blk_dva[0]) ==
4621 			    DVA_GET_VDEV(&bp->blk_dva[1])) +
4622 			    (DVA_GET_VDEV(&bp->blk_dva[0]) ==
4623 			    DVA_GET_VDEV(&bp->blk_dva[2])) +
4624 			    (DVA_GET_VDEV(&bp->blk_dva[1]) ==
4625 			    DVA_GET_VDEV(&bp->blk_dva[2]));
4626 			if (equal == 1)
4627 				zb->zb_ditto_2_of_3_samevdev++;
4628 			else if (equal == 3)
4629 				zb->zb_ditto_3_of_3_samevdev++;
4630 			break;
4631 		}
4632 	}
4633 }
4634 
4635 static void
4636 scan_io_queue_insert_impl(dsl_scan_io_queue_t *queue, scan_io_t *sio)
4637 {
4638 	avl_index_t idx;
4639 	dsl_scan_t *scn = queue->q_scn;
4640 
4641 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
4642 
4643 	if (unlikely(avl_is_empty(&queue->q_sios_by_addr)))
4644 		atomic_add_64(&scn->scn_queues_pending, 1);
4645 	if (avl_find(&queue->q_sios_by_addr, sio, &idx) != NULL) {
4646 		/* block is already scheduled for reading */
4647 		sio_free(sio);
4648 		return;
4649 	}
4650 	avl_insert(&queue->q_sios_by_addr, sio, idx);
4651 	queue->q_sio_memused += SIO_GET_MUSED(sio);
4652 	range_tree_add(queue->q_exts_by_addr, SIO_GET_OFFSET(sio),
4653 	    SIO_GET_ASIZE(sio));
4654 }
4655 
4656 /*
4657  * Given all the info we got from our metadata scanning process, we
4658  * construct a scan_io_t and insert it into the scan sorting queue. The
4659  * I/O must already be suitable for us to process. This is controlled
4660  * by dsl_scan_enqueue().
4661  */
4662 static void
4663 scan_io_queue_insert(dsl_scan_io_queue_t *queue, const blkptr_t *bp, int dva_i,
4664     int zio_flags, const zbookmark_phys_t *zb)
4665 {
4666 	scan_io_t *sio = sio_alloc(BP_GET_NDVAS(bp));
4667 
4668 	ASSERT0(BP_IS_GANG(bp));
4669 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
4670 
4671 	bp2sio(bp, sio, dva_i);
4672 	sio->sio_flags = zio_flags;
4673 	sio->sio_zb = *zb;
4674 
4675 	queue->q_last_ext_addr = -1;
4676 	scan_io_queue_insert_impl(queue, sio);
4677 }
4678 
4679 /*
4680  * Given a set of I/O parameters as discovered by the metadata traversal
4681  * process, attempts to place the I/O into the sorted queues (if allowed),
4682  * or immediately executes the I/O.
4683  */
4684 static void
4685 dsl_scan_enqueue(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
4686     const zbookmark_phys_t *zb)
4687 {
4688 	spa_t *spa = dp->dp_spa;
4689 
4690 	ASSERT(!BP_IS_EMBEDDED(bp));
4691 
4692 	/*
4693 	 * Gang blocks are hard to issue sequentially, so we just issue them
4694 	 * here immediately instead of queuing them.
4695 	 */
4696 	if (!dp->dp_scan->scn_is_sorted || BP_IS_GANG(bp)) {
4697 		scan_exec_io(dp, bp, zio_flags, zb, NULL);
4698 		return;
4699 	}
4700 
4701 	for (int i = 0; i < BP_GET_NDVAS(bp); i++) {
4702 		dva_t dva;
4703 		vdev_t *vdev;
4704 
4705 		dva = bp->blk_dva[i];
4706 		vdev = vdev_lookup_top(spa, DVA_GET_VDEV(&dva));
4707 		ASSERT(vdev != NULL);
4708 
4709 		mutex_enter(&vdev->vdev_scan_io_queue_lock);
4710 		if (vdev->vdev_scan_io_queue == NULL)
4711 			vdev->vdev_scan_io_queue = scan_io_queue_create(vdev);
4712 		ASSERT(dp->dp_scan != NULL);
4713 		scan_io_queue_insert(vdev->vdev_scan_io_queue, bp,
4714 		    i, zio_flags, zb);
4715 		mutex_exit(&vdev->vdev_scan_io_queue_lock);
4716 	}
4717 }
4718 
4719 static int
4720 dsl_scan_scrub_cb(dsl_pool_t *dp,
4721     const blkptr_t *bp, const zbookmark_phys_t *zb)
4722 {
4723 	dsl_scan_t *scn = dp->dp_scan;
4724 	spa_t *spa = dp->dp_spa;
4725 	uint64_t phys_birth = BP_PHYSICAL_BIRTH(bp);
4726 	size_t psize = BP_GET_PSIZE(bp);
4727 	boolean_t needs_io = B_FALSE;
4728 	int zio_flags = ZIO_FLAG_SCAN_THREAD | ZIO_FLAG_RAW | ZIO_FLAG_CANFAIL;
4729 
4730 	count_block(dp->dp_blkstats, bp);
4731 	if (phys_birth <= scn->scn_phys.scn_min_txg ||
4732 	    phys_birth >= scn->scn_phys.scn_max_txg) {
4733 		count_block_skipped(scn, bp, B_TRUE);
4734 		return (0);
4735 	}
4736 
4737 	/* Embedded BP's have phys_birth==0, so we reject them above. */
4738 	ASSERT(!BP_IS_EMBEDDED(bp));
4739 
4740 	ASSERT(DSL_SCAN_IS_SCRUB_RESILVER(scn));
4741 	if (scn->scn_phys.scn_func == POOL_SCAN_SCRUB) {
4742 		zio_flags |= ZIO_FLAG_SCRUB;
4743 		needs_io = B_TRUE;
4744 	} else {
4745 		ASSERT3U(scn->scn_phys.scn_func, ==, POOL_SCAN_RESILVER);
4746 		zio_flags |= ZIO_FLAG_RESILVER;
4747 		needs_io = B_FALSE;
4748 	}
4749 
4750 	/* If it's an intent log block, failure is expected. */
4751 	if (zb->zb_level == ZB_ZIL_LEVEL)
4752 		zio_flags |= ZIO_FLAG_SPECULATIVE;
4753 
4754 	for (int d = 0; d < BP_GET_NDVAS(bp); d++) {
4755 		const dva_t *dva = &bp->blk_dva[d];
4756 
4757 		/*
4758 		 * Keep track of how much data we've examined so that
4759 		 * zpool(8) status can make useful progress reports.
4760 		 */
4761 		uint64_t asize = DVA_GET_ASIZE(dva);
4762 		scn->scn_phys.scn_examined += asize;
4763 		spa->spa_scan_pass_exam += asize;
4764 
4765 		/* if it's a resilver, this may not be in the target range */
4766 		if (!needs_io)
4767 			needs_io = dsl_scan_need_resilver(spa, dva, psize,
4768 			    phys_birth);
4769 	}
4770 
4771 	if (needs_io && !zfs_no_scrub_io) {
4772 		dsl_scan_enqueue(dp, bp, zio_flags, zb);
4773 	} else {
4774 		count_block_skipped(scn, bp, B_TRUE);
4775 	}
4776 
4777 	/* do not relocate this block */
4778 	return (0);
4779 }
4780 
4781 static void
4782 dsl_scan_scrub_done(zio_t *zio)
4783 {
4784 	spa_t *spa = zio->io_spa;
4785 	blkptr_t *bp = zio->io_bp;
4786 	dsl_scan_io_queue_t *queue = zio->io_private;
4787 
4788 	abd_free(zio->io_abd);
4789 
4790 	if (queue == NULL) {
4791 		mutex_enter(&spa->spa_scrub_lock);
4792 		ASSERT3U(spa->spa_scrub_inflight, >=, BP_GET_PSIZE(bp));
4793 		spa->spa_scrub_inflight -= BP_GET_PSIZE(bp);
4794 		cv_broadcast(&spa->spa_scrub_io_cv);
4795 		mutex_exit(&spa->spa_scrub_lock);
4796 	} else {
4797 		mutex_enter(&queue->q_vd->vdev_scan_io_queue_lock);
4798 		ASSERT3U(queue->q_inflight_bytes, >=, BP_GET_PSIZE(bp));
4799 		queue->q_inflight_bytes -= BP_GET_PSIZE(bp);
4800 		cv_broadcast(&queue->q_zio_cv);
4801 		mutex_exit(&queue->q_vd->vdev_scan_io_queue_lock);
4802 	}
4803 
4804 	if (zio->io_error && (zio->io_error != ECKSUM ||
4805 	    !(zio->io_flags & ZIO_FLAG_SPECULATIVE))) {
4806 		if (dsl_errorscrubbing(spa->spa_dsl_pool) &&
4807 		    !dsl_errorscrub_is_paused(spa->spa_dsl_pool->dp_scan)) {
4808 			atomic_inc_64(&spa->spa_dsl_pool->dp_scan
4809 			    ->errorscrub_phys.dep_errors);
4810 		} else {
4811 			atomic_inc_64(&spa->spa_dsl_pool->dp_scan->scn_phys
4812 			    .scn_errors);
4813 		}
4814 	}
4815 }
4816 
4817 /*
4818  * Given a scanning zio's information, executes the zio. The zio need
4819  * not necessarily be only sortable, this function simply executes the
4820  * zio, no matter what it is. The optional queue argument allows the
4821  * caller to specify that they want per top level vdev IO rate limiting
4822  * instead of the legacy global limiting.
4823  */
4824 static void
4825 scan_exec_io(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
4826     const zbookmark_phys_t *zb, dsl_scan_io_queue_t *queue)
4827 {
4828 	spa_t *spa = dp->dp_spa;
4829 	dsl_scan_t *scn = dp->dp_scan;
4830 	size_t size = BP_GET_PSIZE(bp);
4831 	abd_t *data = abd_alloc_for_io(size, B_FALSE);
4832 	zio_t *pio;
4833 
4834 	if (queue == NULL) {
4835 		ASSERT3U(scn->scn_maxinflight_bytes, >, 0);
4836 		mutex_enter(&spa->spa_scrub_lock);
4837 		while (spa->spa_scrub_inflight >= scn->scn_maxinflight_bytes)
4838 			cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
4839 		spa->spa_scrub_inflight += BP_GET_PSIZE(bp);
4840 		mutex_exit(&spa->spa_scrub_lock);
4841 		pio = scn->scn_zio_root;
4842 	} else {
4843 		kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;
4844 
4845 		ASSERT3U(queue->q_maxinflight_bytes, >, 0);
4846 		mutex_enter(q_lock);
4847 		while (queue->q_inflight_bytes >= queue->q_maxinflight_bytes)
4848 			cv_wait(&queue->q_zio_cv, q_lock);
4849 		queue->q_inflight_bytes += BP_GET_PSIZE(bp);
4850 		pio = queue->q_zio;
4851 		mutex_exit(q_lock);
4852 	}
4853 
4854 	ASSERT(pio != NULL);
4855 	count_block_issued(spa, bp, queue == NULL);
4856 	zio_nowait(zio_read(pio, spa, bp, data, size, dsl_scan_scrub_done,
4857 	    queue, ZIO_PRIORITY_SCRUB, zio_flags, zb));
4858 }
4859 
4860 /*
4861  * This is the primary extent sorting algorithm. We balance two parameters:
4862  * 1) how many bytes of I/O are in an extent
4863  * 2) how well the extent is filled with I/O (as a fraction of its total size)
4864  * Since we allow extents to have gaps between their constituent I/Os, it's
4865  * possible to have a fairly large extent that contains the same amount of
4866  * I/O bytes than a much smaller extent, which just packs the I/O more tightly.
4867  * The algorithm sorts based on a score calculated from the extent's size,
4868  * the relative fill volume (in %) and a "fill weight" parameter that controls
4869  * the split between whether we prefer larger extents or more well populated
4870  * extents:
4871  *
4872  * SCORE = FILL_IN_BYTES + (FILL_IN_PERCENT * FILL_IN_BYTES * FILL_WEIGHT)
4873  *
4874  * Example:
4875  * 1) assume extsz = 64 MiB
4876  * 2) assume fill = 32 MiB (extent is half full)
4877  * 3) assume fill_weight = 3
4878  * 4)	SCORE = 32M + (((32M * 100) / 64M) * 3 * 32M) / 100
4879  *	SCORE = 32M + (50 * 3 * 32M) / 100
4880  *	SCORE = 32M + (4800M / 100)
4881  *	SCORE = 32M + 48M
4882  *	         ^     ^
4883  *	         |     +--- final total relative fill-based score
4884  *	         +--------- final total fill-based score
4885  *	SCORE = 80M
4886  *
4887  * As can be seen, at fill_ratio=3, the algorithm is slightly biased towards
4888  * extents that are more completely filled (in a 3:2 ratio) vs just larger.
4889  * Note that as an optimization, we replace multiplication and division by
4890  * 100 with bitshifting by 7 (which effectively multiplies and divides by 128).
4891  *
4892  * Since we do not care if one extent is only few percent better than another,
4893  * compress the score into 6 bits via binary logarithm AKA highbit64() and
4894  * put into otherwise unused due to ashift high bits of offset.  This allows
4895  * to reduce q_exts_by_size B-tree elements to only 64 bits and compare them
4896  * with single operation.  Plus it makes scrubs more sequential and reduces
4897  * chances that minor extent change move it within the B-tree.
4898  */
4899 __attribute__((always_inline)) inline
4900 static int
4901 ext_size_compare(const void *x, const void *y)
4902 {
4903 	const uint64_t *a = x, *b = y;
4904 
4905 	return (TREE_CMP(*a, *b));
4906 }
4907 
4908 ZFS_BTREE_FIND_IN_BUF_FUNC(ext_size_find_in_buf, uint64_t,
4909     ext_size_compare)
4910 
4911 static void
4912 ext_size_create(range_tree_t *rt, void *arg)
4913 {
4914 	(void) rt;
4915 	zfs_btree_t *size_tree = arg;
4916 
4917 	zfs_btree_create(size_tree, ext_size_compare, ext_size_find_in_buf,
4918 	    sizeof (uint64_t));
4919 }
4920 
4921 static void
4922 ext_size_destroy(range_tree_t *rt, void *arg)
4923 {
4924 	(void) rt;
4925 	zfs_btree_t *size_tree = arg;
4926 	ASSERT0(zfs_btree_numnodes(size_tree));
4927 
4928 	zfs_btree_destroy(size_tree);
4929 }
4930 
4931 static uint64_t
4932 ext_size_value(range_tree_t *rt, range_seg_gap_t *rsg)
4933 {
4934 	(void) rt;
4935 	uint64_t size = rsg->rs_end - rsg->rs_start;
4936 	uint64_t score = rsg->rs_fill + ((((rsg->rs_fill << 7) / size) *
4937 	    fill_weight * rsg->rs_fill) >> 7);
4938 	ASSERT3U(rt->rt_shift, >=, 8);
4939 	return (((uint64_t)(64 - highbit64(score)) << 56) | rsg->rs_start);
4940 }
4941 
4942 static void
4943 ext_size_add(range_tree_t *rt, range_seg_t *rs, void *arg)
4944 {
4945 	zfs_btree_t *size_tree = arg;
4946 	ASSERT3U(rt->rt_type, ==, RANGE_SEG_GAP);
4947 	uint64_t v = ext_size_value(rt, (range_seg_gap_t *)rs);
4948 	zfs_btree_add(size_tree, &v);
4949 }
4950 
4951 static void
4952 ext_size_remove(range_tree_t *rt, range_seg_t *rs, void *arg)
4953 {
4954 	zfs_btree_t *size_tree = arg;
4955 	ASSERT3U(rt->rt_type, ==, RANGE_SEG_GAP);
4956 	uint64_t v = ext_size_value(rt, (range_seg_gap_t *)rs);
4957 	zfs_btree_remove(size_tree, &v);
4958 }
4959 
4960 static void
4961 ext_size_vacate(range_tree_t *rt, void *arg)
4962 {
4963 	zfs_btree_t *size_tree = arg;
4964 	zfs_btree_clear(size_tree);
4965 	zfs_btree_destroy(size_tree);
4966 
4967 	ext_size_create(rt, arg);
4968 }
4969 
4970 static const range_tree_ops_t ext_size_ops = {
4971 	.rtop_create = ext_size_create,
4972 	.rtop_destroy = ext_size_destroy,
4973 	.rtop_add = ext_size_add,
4974 	.rtop_remove = ext_size_remove,
4975 	.rtop_vacate = ext_size_vacate
4976 };
4977 
4978 /*
4979  * Comparator for the q_sios_by_addr tree. Sorting is simply performed
4980  * based on LBA-order (from lowest to highest).
4981  */
4982 static int
4983 sio_addr_compare(const void *x, const void *y)
4984 {
4985 	const scan_io_t *a = x, *b = y;
4986 
4987 	return (TREE_CMP(SIO_GET_OFFSET(a), SIO_GET_OFFSET(b)));
4988 }
4989 
4990 /* IO queues are created on demand when they are needed. */
4991 static dsl_scan_io_queue_t *
4992 scan_io_queue_create(vdev_t *vd)
4993 {
4994 	dsl_scan_t *scn = vd->vdev_spa->spa_dsl_pool->dp_scan;
4995 	dsl_scan_io_queue_t *q = kmem_zalloc(sizeof (*q), KM_SLEEP);
4996 
4997 	q->q_scn = scn;
4998 	q->q_vd = vd;
4999 	q->q_sio_memused = 0;
5000 	q->q_last_ext_addr = -1;
5001 	cv_init(&q->q_zio_cv, NULL, CV_DEFAULT, NULL);
5002 	q->q_exts_by_addr = range_tree_create_gap(&ext_size_ops, RANGE_SEG_GAP,
5003 	    &q->q_exts_by_size, 0, vd->vdev_ashift, zfs_scan_max_ext_gap);
5004 	avl_create(&q->q_sios_by_addr, sio_addr_compare,
5005 	    sizeof (scan_io_t), offsetof(scan_io_t, sio_nodes.sio_addr_node));
5006 
5007 	return (q);
5008 }
5009 
5010 /*
5011  * Destroys a scan queue and all segments and scan_io_t's contained in it.
5012  * No further execution of I/O occurs, anything pending in the queue is
5013  * simply freed without being executed.
5014  */
5015 void
5016 dsl_scan_io_queue_destroy(dsl_scan_io_queue_t *queue)
5017 {
5018 	dsl_scan_t *scn = queue->q_scn;
5019 	scan_io_t *sio;
5020 	void *cookie = NULL;
5021 
5022 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
5023 
5024 	if (!avl_is_empty(&queue->q_sios_by_addr))
5025 		atomic_add_64(&scn->scn_queues_pending, -1);
5026 	while ((sio = avl_destroy_nodes(&queue->q_sios_by_addr, &cookie)) !=
5027 	    NULL) {
5028 		ASSERT(range_tree_contains(queue->q_exts_by_addr,
5029 		    SIO_GET_OFFSET(sio), SIO_GET_ASIZE(sio)));
5030 		queue->q_sio_memused -= SIO_GET_MUSED(sio);
5031 		sio_free(sio);
5032 	}
5033 
5034 	ASSERT0(queue->q_sio_memused);
5035 	range_tree_vacate(queue->q_exts_by_addr, NULL, queue);
5036 	range_tree_destroy(queue->q_exts_by_addr);
5037 	avl_destroy(&queue->q_sios_by_addr);
5038 	cv_destroy(&queue->q_zio_cv);
5039 
5040 	kmem_free(queue, sizeof (*queue));
5041 }
5042 
5043 /*
5044  * Properly transfers a dsl_scan_queue_t from `svd' to `tvd'. This is
5045  * called on behalf of vdev_top_transfer when creating or destroying
5046  * a mirror vdev due to zpool attach/detach.
5047  */
5048 void
5049 dsl_scan_io_queue_vdev_xfer(vdev_t *svd, vdev_t *tvd)
5050 {
5051 	mutex_enter(&svd->vdev_scan_io_queue_lock);
5052 	mutex_enter(&tvd->vdev_scan_io_queue_lock);
5053 
5054 	VERIFY3P(tvd->vdev_scan_io_queue, ==, NULL);
5055 	tvd->vdev_scan_io_queue = svd->vdev_scan_io_queue;
5056 	svd->vdev_scan_io_queue = NULL;
5057 	if (tvd->vdev_scan_io_queue != NULL)
5058 		tvd->vdev_scan_io_queue->q_vd = tvd;
5059 
5060 	mutex_exit(&tvd->vdev_scan_io_queue_lock);
5061 	mutex_exit(&svd->vdev_scan_io_queue_lock);
5062 }
5063 
5064 static void
5065 scan_io_queues_destroy(dsl_scan_t *scn)
5066 {
5067 	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
5068 
5069 	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
5070 		vdev_t *tvd = rvd->vdev_child[i];
5071 
5072 		mutex_enter(&tvd->vdev_scan_io_queue_lock);
5073 		if (tvd->vdev_scan_io_queue != NULL)
5074 			dsl_scan_io_queue_destroy(tvd->vdev_scan_io_queue);
5075 		tvd->vdev_scan_io_queue = NULL;
5076 		mutex_exit(&tvd->vdev_scan_io_queue_lock);
5077 	}
5078 }
5079 
5080 static void
5081 dsl_scan_freed_dva(spa_t *spa, const blkptr_t *bp, int dva_i)
5082 {
5083 	dsl_pool_t *dp = spa->spa_dsl_pool;
5084 	dsl_scan_t *scn = dp->dp_scan;
5085 	vdev_t *vdev;
5086 	kmutex_t *q_lock;
5087 	dsl_scan_io_queue_t *queue;
5088 	scan_io_t *srch_sio, *sio;
5089 	avl_index_t idx;
5090 	uint64_t start, size;
5091 
5092 	vdev = vdev_lookup_top(spa, DVA_GET_VDEV(&bp->blk_dva[dva_i]));
5093 	ASSERT(vdev != NULL);
5094 	q_lock = &vdev->vdev_scan_io_queue_lock;
5095 	queue = vdev->vdev_scan_io_queue;
5096 
5097 	mutex_enter(q_lock);
5098 	if (queue == NULL) {
5099 		mutex_exit(q_lock);
5100 		return;
5101 	}
5102 
5103 	srch_sio = sio_alloc(BP_GET_NDVAS(bp));
5104 	bp2sio(bp, srch_sio, dva_i);
5105 	start = SIO_GET_OFFSET(srch_sio);
5106 	size = SIO_GET_ASIZE(srch_sio);
5107 
5108 	/*
5109 	 * We can find the zio in two states:
5110 	 * 1) Cold, just sitting in the queue of zio's to be issued at
5111 	 *	some point in the future. In this case, all we do is
5112 	 *	remove the zio from the q_sios_by_addr tree, decrement
5113 	 *	its data volume from the containing range_seg_t and
5114 	 *	resort the q_exts_by_size tree to reflect that the
5115 	 *	range_seg_t has lost some of its 'fill'. We don't shorten
5116 	 *	the range_seg_t - this is usually rare enough not to be
5117 	 *	worth the extra hassle of trying keep track of precise
5118 	 *	extent boundaries.
5119 	 * 2) Hot, where the zio is currently in-flight in
5120 	 *	dsl_scan_issue_ios. In this case, we can't simply
5121 	 *	reach in and stop the in-flight zio's, so we instead
5122 	 *	block the caller. Eventually, dsl_scan_issue_ios will
5123 	 *	be done with issuing the zio's it gathered and will
5124 	 *	signal us.
5125 	 */
5126 	sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
5127 	sio_free(srch_sio);
5128 
5129 	if (sio != NULL) {
5130 		blkptr_t tmpbp;
5131 
5132 		/* Got it while it was cold in the queue */
5133 		ASSERT3U(start, ==, SIO_GET_OFFSET(sio));
5134 		ASSERT3U(size, ==, SIO_GET_ASIZE(sio));
5135 		avl_remove(&queue->q_sios_by_addr, sio);
5136 		if (avl_is_empty(&queue->q_sios_by_addr))
5137 			atomic_add_64(&scn->scn_queues_pending, -1);
5138 		queue->q_sio_memused -= SIO_GET_MUSED(sio);
5139 
5140 		ASSERT(range_tree_contains(queue->q_exts_by_addr, start, size));
5141 		range_tree_remove_fill(queue->q_exts_by_addr, start, size);
5142 
5143 		/* count the block as though we skipped it */
5144 		sio2bp(sio, &tmpbp);
5145 		count_block_skipped(scn, &tmpbp, B_FALSE);
5146 
5147 		sio_free(sio);
5148 	}
5149 	mutex_exit(q_lock);
5150 }
5151 
5152 /*
5153  * Callback invoked when a zio_free() zio is executing. This needs to be
5154  * intercepted to prevent the zio from deallocating a particular portion
5155  * of disk space and it then getting reallocated and written to, while we
5156  * still have it queued up for processing.
5157  */
5158 void
5159 dsl_scan_freed(spa_t *spa, const blkptr_t *bp)
5160 {
5161 	dsl_pool_t *dp = spa->spa_dsl_pool;
5162 	dsl_scan_t *scn = dp->dp_scan;
5163 
5164 	ASSERT(!BP_IS_EMBEDDED(bp));
5165 	ASSERT(scn != NULL);
5166 	if (!dsl_scan_is_running(scn))
5167 		return;
5168 
5169 	for (int i = 0; i < BP_GET_NDVAS(bp); i++)
5170 		dsl_scan_freed_dva(spa, bp, i);
5171 }
5172 
5173 /*
5174  * Check if a vdev needs resilvering (non-empty DTL), if so, and resilver has
5175  * not started, start it. Otherwise, only restart if max txg in DTL range is
5176  * greater than the max txg in the current scan. If the DTL max is less than
5177  * the scan max, then the vdev has not missed any new data since the resilver
5178  * started, so a restart is not needed.
5179  */
5180 void
5181 dsl_scan_assess_vdev(dsl_pool_t *dp, vdev_t *vd)
5182 {
5183 	uint64_t min, max;
5184 
5185 	if (!vdev_resilver_needed(vd, &min, &max))
5186 		return;
5187 
5188 	if (!dsl_scan_resilvering(dp)) {
5189 		spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
5190 		return;
5191 	}
5192 
5193 	if (max <= dp->dp_scan->scn_phys.scn_max_txg)
5194 		return;
5195 
5196 	/* restart is needed, check if it can be deferred */
5197 	if (spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
5198 		vdev_defer_resilver(vd);
5199 	else
5200 		spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
5201 }
5202 
5203 ZFS_MODULE_PARAM(zfs, zfs_, scan_vdev_limit, U64, ZMOD_RW,
5204 	"Max bytes in flight per leaf vdev for scrubs and resilvers");
5205 
5206 ZFS_MODULE_PARAM(zfs, zfs_, scrub_min_time_ms, UINT, ZMOD_RW,
5207 	"Min millisecs to scrub per txg");
5208 
5209 ZFS_MODULE_PARAM(zfs, zfs_, obsolete_min_time_ms, UINT, ZMOD_RW,
5210 	"Min millisecs to obsolete per txg");
5211 
5212 ZFS_MODULE_PARAM(zfs, zfs_, free_min_time_ms, UINT, ZMOD_RW,
5213 	"Min millisecs to free per txg");
5214 
5215 ZFS_MODULE_PARAM(zfs, zfs_, resilver_min_time_ms, UINT, ZMOD_RW,
5216 	"Min millisecs to resilver per txg");
5217 
5218 ZFS_MODULE_PARAM(zfs, zfs_, scan_suspend_progress, INT, ZMOD_RW,
5219 	"Set to prevent scans from progressing");
5220 
5221 ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_io, INT, ZMOD_RW,
5222 	"Set to disable scrub I/O");
5223 
5224 ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_prefetch, INT, ZMOD_RW,
5225 	"Set to disable scrub prefetching");
5226 
5227 ZFS_MODULE_PARAM(zfs, zfs_, async_block_max_blocks, U64, ZMOD_RW,
5228 	"Max number of blocks freed in one txg");
5229 
5230 ZFS_MODULE_PARAM(zfs, zfs_, max_async_dedup_frees, U64, ZMOD_RW,
5231 	"Max number of dedup blocks freed in one txg");
5232 
5233 ZFS_MODULE_PARAM(zfs, zfs_, free_bpobj_enabled, INT, ZMOD_RW,
5234 	"Enable processing of the free_bpobj");
5235 
5236 ZFS_MODULE_PARAM(zfs, zfs_, scan_blkstats, INT, ZMOD_RW,
5237 	"Enable block statistics calculation during scrub");
5238 
5239 ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_fact, UINT, ZMOD_RW,
5240 	"Fraction of RAM for scan hard limit");
5241 
5242 ZFS_MODULE_PARAM(zfs, zfs_, scan_issue_strategy, UINT, ZMOD_RW,
5243 	"IO issuing strategy during scrubbing. 0 = default, 1 = LBA, 2 = size");
5244 
5245 ZFS_MODULE_PARAM(zfs, zfs_, scan_legacy, INT, ZMOD_RW,
5246 	"Scrub using legacy non-sequential method");
5247 
5248 ZFS_MODULE_PARAM(zfs, zfs_, scan_checkpoint_intval, UINT, ZMOD_RW,
5249 	"Scan progress on-disk checkpointing interval");
5250 
5251 ZFS_MODULE_PARAM(zfs, zfs_, scan_max_ext_gap, U64, ZMOD_RW,
5252 	"Max gap in bytes between sequential scrub / resilver I/Os");
5253 
5254 ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_soft_fact, UINT, ZMOD_RW,
5255 	"Fraction of hard limit used as soft limit");
5256 
5257 ZFS_MODULE_PARAM(zfs, zfs_, scan_strict_mem_lim, INT, ZMOD_RW,
5258 	"Tunable to attempt to reduce lock contention");
5259 
5260 ZFS_MODULE_PARAM(zfs, zfs_, scan_fill_weight, UINT, ZMOD_RW,
5261 	"Tunable to adjust bias towards more filled segments during scans");
5262 
5263 ZFS_MODULE_PARAM(zfs, zfs_, scan_report_txgs, UINT, ZMOD_RW,
5264 	"Tunable to report resilver performance over the last N txgs");
5265 
5266 ZFS_MODULE_PARAM(zfs, zfs_, resilver_disable_defer, INT, ZMOD_RW,
5267 	"Process all resilvers immediately");
5268 
5269 ZFS_MODULE_PARAM(zfs, zfs_, scrub_error_blocks_per_txg, UINT, ZMOD_RW,
5270 	"Error blocks to be scrubbed in one txg");
5271 /* END CSTYLED */
5272