xref: /freebsd/sys/contrib/openzfs/module/zfs/dsl_scan.c (revision e9e8876a4d6afc1ad5315faaa191b25121a813d7)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2011, 2021 by Delphix. All rights reserved.
24  * Copyright 2016 Gary Mills
25  * Copyright (c) 2017, 2019, Datto Inc. All rights reserved.
26  * Copyright (c) 2015, Nexenta Systems, Inc. All rights reserved.
27  * Copyright 2019 Joyent, Inc.
28  */
29 
30 #include <sys/dsl_scan.h>
31 #include <sys/dsl_pool.h>
32 #include <sys/dsl_dataset.h>
33 #include <sys/dsl_prop.h>
34 #include <sys/dsl_dir.h>
35 #include <sys/dsl_synctask.h>
36 #include <sys/dnode.h>
37 #include <sys/dmu_tx.h>
38 #include <sys/dmu_objset.h>
39 #include <sys/arc.h>
40 #include <sys/zap.h>
41 #include <sys/zio.h>
42 #include <sys/zfs_context.h>
43 #include <sys/fs/zfs.h>
44 #include <sys/zfs_znode.h>
45 #include <sys/spa_impl.h>
46 #include <sys/vdev_impl.h>
47 #include <sys/zil_impl.h>
48 #include <sys/zio_checksum.h>
49 #include <sys/ddt.h>
50 #include <sys/sa.h>
51 #include <sys/sa_impl.h>
52 #include <sys/zfeature.h>
53 #include <sys/abd.h>
54 #include <sys/range_tree.h>
55 #ifdef _KERNEL
56 #include <sys/zfs_vfsops.h>
57 #endif
58 
59 /*
60  * Grand theory statement on scan queue sorting
61  *
62  * Scanning is implemented by recursively traversing all indirection levels
63  * in an object and reading all blocks referenced from said objects. This
64  * results in us approximately traversing the object from lowest logical
65  * offset to the highest. For best performance, we would want the logical
66  * blocks to be physically contiguous. However, this is frequently not the
67  * case with pools given the allocation patterns of copy-on-write filesystems.
68  * So instead, we put the I/Os into a reordering queue and issue them in a
69  * way that will most benefit physical disks (LBA-order).
70  *
71  * Queue management:
72  *
73  * Ideally, we would want to scan all metadata and queue up all block I/O
74  * prior to starting to issue it, because that allows us to do an optimal
75  * sorting job. This can however consume large amounts of memory. Therefore
76  * we continuously monitor the size of the queues and constrain them to 5%
77  * (zfs_scan_mem_lim_fact) of physmem. If the queues grow larger than this
78  * limit, we clear out a few of the largest extents at the head of the queues
79  * to make room for more scanning. Hopefully, these extents will be fairly
80  * large and contiguous, allowing us to approach sequential I/O throughput
81  * even without a fully sorted tree.
82  *
83  * Metadata scanning takes place in dsl_scan_visit(), which is called from
84  * dsl_scan_sync() every spa_sync(). If we have either fully scanned all
85  * metadata on the pool, or we need to make room in memory because our
86  * queues are too large, dsl_scan_visit() is postponed and
87  * scan_io_queues_run() is called from dsl_scan_sync() instead. This implies
88  * that metadata scanning and queued I/O issuing are mutually exclusive. This
89  * allows us to provide maximum sequential I/O throughput for the majority of
90  * I/O's issued since sequential I/O performance is significantly negatively
91  * impacted if it is interleaved with random I/O.
92  *
93  * Implementation Notes
94  *
95  * One side effect of the queued scanning algorithm is that the scanning code
96  * needs to be notified whenever a block is freed. This is needed to allow
97  * the scanning code to remove these I/Os from the issuing queue. Additionally,
98  * we do not attempt to queue gang blocks to be issued sequentially since this
99  * is very hard to do and would have an extremely limited performance benefit.
100  * Instead, we simply issue gang I/Os as soon as we find them using the legacy
101  * algorithm.
102  *
103  * Backwards compatibility
104  *
105  * This new algorithm is backwards compatible with the legacy on-disk data
106  * structures (and therefore does not require a new feature flag).
107  * Periodically during scanning (see zfs_scan_checkpoint_intval), the scan
108  * will stop scanning metadata (in logical order) and wait for all outstanding
109  * sorted I/O to complete. Once this is done, we write out a checkpoint
110  * bookmark, indicating that we have scanned everything logically before it.
111  * If the pool is imported on a machine without the new sorting algorithm,
112  * the scan simply resumes from the last checkpoint using the legacy algorithm.
113  */
114 
115 typedef int (scan_cb_t)(dsl_pool_t *, const blkptr_t *,
116     const zbookmark_phys_t *);
117 
118 static scan_cb_t dsl_scan_scrub_cb;
119 
120 static int scan_ds_queue_compare(const void *a, const void *b);
121 static int scan_prefetch_queue_compare(const void *a, const void *b);
122 static void scan_ds_queue_clear(dsl_scan_t *scn);
123 static void scan_ds_prefetch_queue_clear(dsl_scan_t *scn);
124 static boolean_t scan_ds_queue_contains(dsl_scan_t *scn, uint64_t dsobj,
125     uint64_t *txg);
126 static void scan_ds_queue_insert(dsl_scan_t *scn, uint64_t dsobj, uint64_t txg);
127 static void scan_ds_queue_remove(dsl_scan_t *scn, uint64_t dsobj);
128 static void scan_ds_queue_sync(dsl_scan_t *scn, dmu_tx_t *tx);
129 static uint64_t dsl_scan_count_data_disks(vdev_t *vd);
130 
131 extern int zfs_vdev_async_write_active_min_dirty_percent;
132 
133 /*
134  * By default zfs will check to ensure it is not over the hard memory
135  * limit before each txg. If finer-grained control of this is needed
136  * this value can be set to 1 to enable checking before scanning each
137  * block.
138  */
139 int zfs_scan_strict_mem_lim = B_FALSE;
140 
141 /*
142  * Maximum number of parallelly executed bytes per leaf vdev. We attempt
143  * to strike a balance here between keeping the vdev queues full of I/Os
144  * at all times and not overflowing the queues to cause long latency,
145  * which would cause long txg sync times. No matter what, we will not
146  * overload the drives with I/O, since that is protected by
147  * zfs_vdev_scrub_max_active.
148  */
149 unsigned long zfs_scan_vdev_limit = 4 << 20;
150 
151 int zfs_scan_issue_strategy = 0;
152 int zfs_scan_legacy = B_FALSE; /* don't queue & sort zios, go direct */
153 unsigned long zfs_scan_max_ext_gap = 2 << 20; /* in bytes */
154 
155 /*
156  * fill_weight is non-tunable at runtime, so we copy it at module init from
157  * zfs_scan_fill_weight. Runtime adjustments to zfs_scan_fill_weight would
158  * break queue sorting.
159  */
160 int zfs_scan_fill_weight = 3;
161 static uint64_t fill_weight;
162 
163 /* See dsl_scan_should_clear() for details on the memory limit tunables */
164 uint64_t zfs_scan_mem_lim_min = 16 << 20;	/* bytes */
165 uint64_t zfs_scan_mem_lim_soft_max = 128 << 20;	/* bytes */
166 int zfs_scan_mem_lim_fact = 20;		/* fraction of physmem */
167 int zfs_scan_mem_lim_soft_fact = 20;	/* fraction of mem lim above */
168 
169 int zfs_scrub_min_time_ms = 1000; /* min millisecs to scrub per txg */
170 int zfs_obsolete_min_time_ms = 500; /* min millisecs to obsolete per txg */
171 int zfs_free_min_time_ms = 1000; /* min millisecs to free per txg */
172 int zfs_resilver_min_time_ms = 3000; /* min millisecs to resilver per txg */
173 int zfs_scan_checkpoint_intval = 7200; /* in seconds */
174 int zfs_scan_suspend_progress = 0; /* set to prevent scans from progressing */
175 int zfs_no_scrub_io = B_FALSE; /* set to disable scrub i/o */
176 int zfs_no_scrub_prefetch = B_FALSE; /* set to disable scrub prefetch */
177 enum ddt_class zfs_scrub_ddt_class_max = DDT_CLASS_DUPLICATE;
178 /* max number of blocks to free in a single TXG */
179 unsigned long zfs_async_block_max_blocks = ULONG_MAX;
180 /* max number of dedup blocks to free in a single TXG */
181 unsigned long zfs_max_async_dedup_frees = 100000;
182 
183 int zfs_resilver_disable_defer = 0; /* set to disable resilver deferring */
184 
185 /*
186  * We wait a few txgs after importing a pool to begin scanning so that
187  * the import / mounting code isn't held up by scrub / resilver IO.
188  * Unfortunately, it is a bit difficult to determine exactly how long
189  * this will take since userspace will trigger fs mounts asynchronously
190  * and the kernel will create zvol minors asynchronously. As a result,
191  * the value provided here is a bit arbitrary, but represents a
192  * reasonable estimate of how many txgs it will take to finish fully
193  * importing a pool
194  */
195 #define	SCAN_IMPORT_WAIT_TXGS 		5
196 
197 #define	DSL_SCAN_IS_SCRUB_RESILVER(scn) \
198 	((scn)->scn_phys.scn_func == POOL_SCAN_SCRUB || \
199 	(scn)->scn_phys.scn_func == POOL_SCAN_RESILVER)
200 
201 /*
202  * Enable/disable the processing of the free_bpobj object.
203  */
204 int zfs_free_bpobj_enabled = 1;
205 
206 /* the order has to match pool_scan_type */
207 static scan_cb_t *scan_funcs[POOL_SCAN_FUNCS] = {
208 	NULL,
209 	dsl_scan_scrub_cb,	/* POOL_SCAN_SCRUB */
210 	dsl_scan_scrub_cb,	/* POOL_SCAN_RESILVER */
211 };
212 
213 /* In core node for the scn->scn_queue. Represents a dataset to be scanned */
214 typedef struct {
215 	uint64_t	sds_dsobj;
216 	uint64_t	sds_txg;
217 	avl_node_t	sds_node;
218 } scan_ds_t;
219 
220 /*
221  * This controls what conditions are placed on dsl_scan_sync_state():
222  * SYNC_OPTIONAL) write out scn_phys iff scn_bytes_pending == 0
223  * SYNC_MANDATORY) write out scn_phys always. scn_bytes_pending must be 0.
224  * SYNC_CACHED) if scn_bytes_pending == 0, write out scn_phys. Otherwise
225  *	write out the scn_phys_cached version.
226  * See dsl_scan_sync_state for details.
227  */
228 typedef enum {
229 	SYNC_OPTIONAL,
230 	SYNC_MANDATORY,
231 	SYNC_CACHED
232 } state_sync_type_t;
233 
234 /*
235  * This struct represents the minimum information needed to reconstruct a
236  * zio for sequential scanning. This is useful because many of these will
237  * accumulate in the sequential IO queues before being issued, so saving
238  * memory matters here.
239  */
240 typedef struct scan_io {
241 	/* fields from blkptr_t */
242 	uint64_t		sio_blk_prop;
243 	uint64_t		sio_phys_birth;
244 	uint64_t		sio_birth;
245 	zio_cksum_t		sio_cksum;
246 	uint32_t		sio_nr_dvas;
247 
248 	/* fields from zio_t */
249 	uint32_t		sio_flags;
250 	zbookmark_phys_t	sio_zb;
251 
252 	/* members for queue sorting */
253 	union {
254 		avl_node_t	sio_addr_node; /* link into issuing queue */
255 		list_node_t	sio_list_node; /* link for issuing to disk */
256 	} sio_nodes;
257 
258 	/*
259 	 * There may be up to SPA_DVAS_PER_BP DVAs here from the bp,
260 	 * depending on how many were in the original bp. Only the
261 	 * first DVA is really used for sorting and issuing purposes.
262 	 * The other DVAs (if provided) simply exist so that the zio
263 	 * layer can find additional copies to repair from in the
264 	 * event of an error. This array must go at the end of the
265 	 * struct to allow this for the variable number of elements.
266 	 */
267 	dva_t			sio_dva[0];
268 } scan_io_t;
269 
270 #define	SIO_SET_OFFSET(sio, x)		DVA_SET_OFFSET(&(sio)->sio_dva[0], x)
271 #define	SIO_SET_ASIZE(sio, x)		DVA_SET_ASIZE(&(sio)->sio_dva[0], x)
272 #define	SIO_GET_OFFSET(sio)		DVA_GET_OFFSET(&(sio)->sio_dva[0])
273 #define	SIO_GET_ASIZE(sio)		DVA_GET_ASIZE(&(sio)->sio_dva[0])
274 #define	SIO_GET_END_OFFSET(sio)		\
275 	(SIO_GET_OFFSET(sio) + SIO_GET_ASIZE(sio))
276 #define	SIO_GET_MUSED(sio)		\
277 	(sizeof (scan_io_t) + ((sio)->sio_nr_dvas * sizeof (dva_t)))
278 
279 struct dsl_scan_io_queue {
280 	dsl_scan_t	*q_scn; /* associated dsl_scan_t */
281 	vdev_t		*q_vd; /* top-level vdev that this queue represents */
282 
283 	/* trees used for sorting I/Os and extents of I/Os */
284 	range_tree_t	*q_exts_by_addr;
285 	zfs_btree_t		q_exts_by_size;
286 	avl_tree_t	q_sios_by_addr;
287 	uint64_t	q_sio_memused;
288 
289 	/* members for zio rate limiting */
290 	uint64_t	q_maxinflight_bytes;
291 	uint64_t	q_inflight_bytes;
292 	kcondvar_t	q_zio_cv; /* used under vd->vdev_scan_io_queue_lock */
293 
294 	/* per txg statistics */
295 	uint64_t	q_total_seg_size_this_txg;
296 	uint64_t	q_segs_this_txg;
297 	uint64_t	q_total_zio_size_this_txg;
298 	uint64_t	q_zios_this_txg;
299 };
300 
301 /* private data for dsl_scan_prefetch_cb() */
302 typedef struct scan_prefetch_ctx {
303 	zfs_refcount_t spc_refcnt;	/* refcount for memory management */
304 	dsl_scan_t *spc_scn;		/* dsl_scan_t for the pool */
305 	boolean_t spc_root;		/* is this prefetch for an objset? */
306 	uint8_t spc_indblkshift;	/* dn_indblkshift of current dnode */
307 	uint16_t spc_datablkszsec;	/* dn_idatablkszsec of current dnode */
308 } scan_prefetch_ctx_t;
309 
310 /* private data for dsl_scan_prefetch() */
311 typedef struct scan_prefetch_issue_ctx {
312 	avl_node_t spic_avl_node;	/* link into scn->scn_prefetch_queue */
313 	scan_prefetch_ctx_t *spic_spc;	/* spc for the callback */
314 	blkptr_t spic_bp;		/* bp to prefetch */
315 	zbookmark_phys_t spic_zb;	/* bookmark to prefetch */
316 } scan_prefetch_issue_ctx_t;
317 
318 static void scan_exec_io(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
319     const zbookmark_phys_t *zb, dsl_scan_io_queue_t *queue);
320 static void scan_io_queue_insert_impl(dsl_scan_io_queue_t *queue,
321     scan_io_t *sio);
322 
323 static dsl_scan_io_queue_t *scan_io_queue_create(vdev_t *vd);
324 static void scan_io_queues_destroy(dsl_scan_t *scn);
325 
326 static kmem_cache_t *sio_cache[SPA_DVAS_PER_BP];
327 
328 /* sio->sio_nr_dvas must be set so we know which cache to free from */
329 static void
330 sio_free(scan_io_t *sio)
331 {
332 	ASSERT3U(sio->sio_nr_dvas, >, 0);
333 	ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);
334 
335 	kmem_cache_free(sio_cache[sio->sio_nr_dvas - 1], sio);
336 }
337 
338 /* It is up to the caller to set sio->sio_nr_dvas for freeing */
339 static scan_io_t *
340 sio_alloc(unsigned short nr_dvas)
341 {
342 	ASSERT3U(nr_dvas, >, 0);
343 	ASSERT3U(nr_dvas, <=, SPA_DVAS_PER_BP);
344 
345 	return (kmem_cache_alloc(sio_cache[nr_dvas - 1], KM_SLEEP));
346 }
347 
348 void
349 scan_init(void)
350 {
351 	/*
352 	 * This is used in ext_size_compare() to weight segments
353 	 * based on how sparse they are. This cannot be changed
354 	 * mid-scan and the tree comparison functions don't currently
355 	 * have a mechanism for passing additional context to the
356 	 * compare functions. Thus we store this value globally and
357 	 * we only allow it to be set at module initialization time
358 	 */
359 	fill_weight = zfs_scan_fill_weight;
360 
361 	for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
362 		char name[36];
363 
364 		(void) snprintf(name, sizeof (name), "sio_cache_%d", i);
365 		sio_cache[i] = kmem_cache_create(name,
366 		    (sizeof (scan_io_t) + ((i + 1) * sizeof (dva_t))),
367 		    0, NULL, NULL, NULL, NULL, NULL, 0);
368 	}
369 }
370 
371 void
372 scan_fini(void)
373 {
374 	for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
375 		kmem_cache_destroy(sio_cache[i]);
376 	}
377 }
378 
379 static inline boolean_t
380 dsl_scan_is_running(const dsl_scan_t *scn)
381 {
382 	return (scn->scn_phys.scn_state == DSS_SCANNING);
383 }
384 
385 boolean_t
386 dsl_scan_resilvering(dsl_pool_t *dp)
387 {
388 	return (dsl_scan_is_running(dp->dp_scan) &&
389 	    dp->dp_scan->scn_phys.scn_func == POOL_SCAN_RESILVER);
390 }
391 
392 static inline void
393 sio2bp(const scan_io_t *sio, blkptr_t *bp)
394 {
395 	bzero(bp, sizeof (*bp));
396 	bp->blk_prop = sio->sio_blk_prop;
397 	bp->blk_phys_birth = sio->sio_phys_birth;
398 	bp->blk_birth = sio->sio_birth;
399 	bp->blk_fill = 1;	/* we always only work with data pointers */
400 	bp->blk_cksum = sio->sio_cksum;
401 
402 	ASSERT3U(sio->sio_nr_dvas, >, 0);
403 	ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);
404 
405 	bcopy(sio->sio_dva, bp->blk_dva, sio->sio_nr_dvas * sizeof (dva_t));
406 }
407 
408 static inline void
409 bp2sio(const blkptr_t *bp, scan_io_t *sio, int dva_i)
410 {
411 	sio->sio_blk_prop = bp->blk_prop;
412 	sio->sio_phys_birth = bp->blk_phys_birth;
413 	sio->sio_birth = bp->blk_birth;
414 	sio->sio_cksum = bp->blk_cksum;
415 	sio->sio_nr_dvas = BP_GET_NDVAS(bp);
416 
417 	/*
418 	 * Copy the DVAs to the sio. We need all copies of the block so
419 	 * that the self healing code can use the alternate copies if the
420 	 * first is corrupted. We want the DVA at index dva_i to be first
421 	 * in the sio since this is the primary one that we want to issue.
422 	 */
423 	for (int i = 0, j = dva_i; i < sio->sio_nr_dvas; i++, j++) {
424 		sio->sio_dva[i] = bp->blk_dva[j % sio->sio_nr_dvas];
425 	}
426 }
427 
428 int
429 dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
430 {
431 	int err;
432 	dsl_scan_t *scn;
433 	spa_t *spa = dp->dp_spa;
434 	uint64_t f;
435 
436 	scn = dp->dp_scan = kmem_zalloc(sizeof (dsl_scan_t), KM_SLEEP);
437 	scn->scn_dp = dp;
438 
439 	/*
440 	 * It's possible that we're resuming a scan after a reboot so
441 	 * make sure that the scan_async_destroying flag is initialized
442 	 * appropriately.
443 	 */
444 	ASSERT(!scn->scn_async_destroying);
445 	scn->scn_async_destroying = spa_feature_is_active(dp->dp_spa,
446 	    SPA_FEATURE_ASYNC_DESTROY);
447 
448 	/*
449 	 * Calculate the max number of in-flight bytes for pool-wide
450 	 * scanning operations (minimum 1MB). Limits for the issuing
451 	 * phase are done per top-level vdev and are handled separately.
452 	 */
453 	scn->scn_maxinflight_bytes = MAX(zfs_scan_vdev_limit *
454 	    dsl_scan_count_data_disks(spa->spa_root_vdev), 1ULL << 20);
455 
456 	avl_create(&scn->scn_queue, scan_ds_queue_compare, sizeof (scan_ds_t),
457 	    offsetof(scan_ds_t, sds_node));
458 	avl_create(&scn->scn_prefetch_queue, scan_prefetch_queue_compare,
459 	    sizeof (scan_prefetch_issue_ctx_t),
460 	    offsetof(scan_prefetch_issue_ctx_t, spic_avl_node));
461 
462 	err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
463 	    "scrub_func", sizeof (uint64_t), 1, &f);
464 	if (err == 0) {
465 		/*
466 		 * There was an old-style scrub in progress.  Restart a
467 		 * new-style scrub from the beginning.
468 		 */
469 		scn->scn_restart_txg = txg;
470 		zfs_dbgmsg("old-style scrub was in progress for %s; "
471 		    "restarting new-style scrub in txg %llu",
472 		    spa->spa_name,
473 		    (longlong_t)scn->scn_restart_txg);
474 
475 		/*
476 		 * Load the queue obj from the old location so that it
477 		 * can be freed by dsl_scan_done().
478 		 */
479 		(void) zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
480 		    "scrub_queue", sizeof (uint64_t), 1,
481 		    &scn->scn_phys.scn_queue_obj);
482 	} else {
483 		err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
484 		    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
485 		    &scn->scn_phys);
486 		/*
487 		 * Detect if the pool contains the signature of #2094.  If it
488 		 * does properly update the scn->scn_phys structure and notify
489 		 * the administrator by setting an errata for the pool.
490 		 */
491 		if (err == EOVERFLOW) {
492 			uint64_t zaptmp[SCAN_PHYS_NUMINTS + 1];
493 			VERIFY3S(SCAN_PHYS_NUMINTS, ==, 24);
494 			VERIFY3S(offsetof(dsl_scan_phys_t, scn_flags), ==,
495 			    (23 * sizeof (uint64_t)));
496 
497 			err = zap_lookup(dp->dp_meta_objset,
498 			    DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_SCAN,
499 			    sizeof (uint64_t), SCAN_PHYS_NUMINTS + 1, &zaptmp);
500 			if (err == 0) {
501 				uint64_t overflow = zaptmp[SCAN_PHYS_NUMINTS];
502 
503 				if (overflow & ~DSL_SCAN_FLAGS_MASK ||
504 				    scn->scn_async_destroying) {
505 					spa->spa_errata =
506 					    ZPOOL_ERRATA_ZOL_2094_ASYNC_DESTROY;
507 					return (EOVERFLOW);
508 				}
509 
510 				bcopy(zaptmp, &scn->scn_phys,
511 				    SCAN_PHYS_NUMINTS * sizeof (uint64_t));
512 				scn->scn_phys.scn_flags = overflow;
513 
514 				/* Required scrub already in progress. */
515 				if (scn->scn_phys.scn_state == DSS_FINISHED ||
516 				    scn->scn_phys.scn_state == DSS_CANCELED)
517 					spa->spa_errata =
518 					    ZPOOL_ERRATA_ZOL_2094_SCRUB;
519 			}
520 		}
521 
522 		if (err == ENOENT)
523 			return (0);
524 		else if (err)
525 			return (err);
526 
527 		/*
528 		 * We might be restarting after a reboot, so jump the issued
529 		 * counter to how far we've scanned. We know we're consistent
530 		 * up to here.
531 		 */
532 		scn->scn_issued_before_pass = scn->scn_phys.scn_examined;
533 
534 		if (dsl_scan_is_running(scn) &&
535 		    spa_prev_software_version(dp->dp_spa) < SPA_VERSION_SCAN) {
536 			/*
537 			 * A new-type scrub was in progress on an old
538 			 * pool, and the pool was accessed by old
539 			 * software.  Restart from the beginning, since
540 			 * the old software may have changed the pool in
541 			 * the meantime.
542 			 */
543 			scn->scn_restart_txg = txg;
544 			zfs_dbgmsg("new-style scrub for %s was modified "
545 			    "by old software; restarting in txg %llu",
546 			    spa->spa_name,
547 			    (longlong_t)scn->scn_restart_txg);
548 		} else if (dsl_scan_resilvering(dp)) {
549 			/*
550 			 * If a resilver is in progress and there are already
551 			 * errors, restart it instead of finishing this scan and
552 			 * then restarting it. If there haven't been any errors
553 			 * then remember that the incore DTL is valid.
554 			 */
555 			if (scn->scn_phys.scn_errors > 0) {
556 				scn->scn_restart_txg = txg;
557 				zfs_dbgmsg("resilver can't excise DTL_MISSING "
558 				    "when finished; restarting on %s in txg "
559 				    "%llu",
560 				    spa->spa_name,
561 				    (u_longlong_t)scn->scn_restart_txg);
562 			} else {
563 				/* it's safe to excise DTL when finished */
564 				spa->spa_scrub_started = B_TRUE;
565 			}
566 		}
567 	}
568 
569 	bcopy(&scn->scn_phys, &scn->scn_phys_cached, sizeof (scn->scn_phys));
570 
571 	/* reload the queue into the in-core state */
572 	if (scn->scn_phys.scn_queue_obj != 0) {
573 		zap_cursor_t zc;
574 		zap_attribute_t za;
575 
576 		for (zap_cursor_init(&zc, dp->dp_meta_objset,
577 		    scn->scn_phys.scn_queue_obj);
578 		    zap_cursor_retrieve(&zc, &za) == 0;
579 		    (void) zap_cursor_advance(&zc)) {
580 			scan_ds_queue_insert(scn,
581 			    zfs_strtonum(za.za_name, NULL),
582 			    za.za_first_integer);
583 		}
584 		zap_cursor_fini(&zc);
585 	}
586 
587 	spa_scan_stat_init(spa);
588 	return (0);
589 }
590 
591 void
592 dsl_scan_fini(dsl_pool_t *dp)
593 {
594 	if (dp->dp_scan != NULL) {
595 		dsl_scan_t *scn = dp->dp_scan;
596 
597 		if (scn->scn_taskq != NULL)
598 			taskq_destroy(scn->scn_taskq);
599 
600 		scan_ds_queue_clear(scn);
601 		avl_destroy(&scn->scn_queue);
602 		scan_ds_prefetch_queue_clear(scn);
603 		avl_destroy(&scn->scn_prefetch_queue);
604 
605 		kmem_free(dp->dp_scan, sizeof (dsl_scan_t));
606 		dp->dp_scan = NULL;
607 	}
608 }
609 
610 static boolean_t
611 dsl_scan_restarting(dsl_scan_t *scn, dmu_tx_t *tx)
612 {
613 	return (scn->scn_restart_txg != 0 &&
614 	    scn->scn_restart_txg <= tx->tx_txg);
615 }
616 
617 boolean_t
618 dsl_scan_resilver_scheduled(dsl_pool_t *dp)
619 {
620 	return ((dp->dp_scan && dp->dp_scan->scn_restart_txg != 0) ||
621 	    (spa_async_tasks(dp->dp_spa) & SPA_ASYNC_RESILVER));
622 }
623 
624 boolean_t
625 dsl_scan_scrubbing(const dsl_pool_t *dp)
626 {
627 	dsl_scan_phys_t *scn_phys = &dp->dp_scan->scn_phys;
628 
629 	return (scn_phys->scn_state == DSS_SCANNING &&
630 	    scn_phys->scn_func == POOL_SCAN_SCRUB);
631 }
632 
633 boolean_t
634 dsl_scan_is_paused_scrub(const dsl_scan_t *scn)
635 {
636 	return (dsl_scan_scrubbing(scn->scn_dp) &&
637 	    scn->scn_phys.scn_flags & DSF_SCRUB_PAUSED);
638 }
639 
640 /*
641  * Writes out a persistent dsl_scan_phys_t record to the pool directory.
642  * Because we can be running in the block sorting algorithm, we do not always
643  * want to write out the record, only when it is "safe" to do so. This safety
644  * condition is achieved by making sure that the sorting queues are empty
645  * (scn_bytes_pending == 0). When this condition is not true, the sync'd state
646  * is inconsistent with how much actual scanning progress has been made. The
647  * kind of sync to be performed is specified by the sync_type argument. If the
648  * sync is optional, we only sync if the queues are empty. If the sync is
649  * mandatory, we do a hard ASSERT to make sure that the queues are empty. The
650  * third possible state is a "cached" sync. This is done in response to:
651  * 1) The dataset that was in the last sync'd dsl_scan_phys_t having been
652  *	destroyed, so we wouldn't be able to restart scanning from it.
653  * 2) The snapshot that was in the last sync'd dsl_scan_phys_t having been
654  *	superseded by a newer snapshot.
655  * 3) The dataset that was in the last sync'd dsl_scan_phys_t having been
656  *	swapped with its clone.
657  * In all cases, a cached sync simply rewrites the last record we've written,
658  * just slightly modified. For the modifications that are performed to the
659  * last written dsl_scan_phys_t, see dsl_scan_ds_destroyed,
660  * dsl_scan_ds_snapshotted and dsl_scan_ds_clone_swapped.
661  */
662 static void
663 dsl_scan_sync_state(dsl_scan_t *scn, dmu_tx_t *tx, state_sync_type_t sync_type)
664 {
665 	int i;
666 	spa_t *spa = scn->scn_dp->dp_spa;
667 
668 	ASSERT(sync_type != SYNC_MANDATORY || scn->scn_bytes_pending == 0);
669 	if (scn->scn_bytes_pending == 0) {
670 		for (i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
671 			vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
672 			dsl_scan_io_queue_t *q = vd->vdev_scan_io_queue;
673 
674 			if (q == NULL)
675 				continue;
676 
677 			mutex_enter(&vd->vdev_scan_io_queue_lock);
678 			ASSERT3P(avl_first(&q->q_sios_by_addr), ==, NULL);
679 			ASSERT3P(zfs_btree_first(&q->q_exts_by_size, NULL), ==,
680 			    NULL);
681 			ASSERT3P(range_tree_first(q->q_exts_by_addr), ==, NULL);
682 			mutex_exit(&vd->vdev_scan_io_queue_lock);
683 		}
684 
685 		if (scn->scn_phys.scn_queue_obj != 0)
686 			scan_ds_queue_sync(scn, tx);
687 		VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
688 		    DMU_POOL_DIRECTORY_OBJECT,
689 		    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
690 		    &scn->scn_phys, tx));
691 		bcopy(&scn->scn_phys, &scn->scn_phys_cached,
692 		    sizeof (scn->scn_phys));
693 
694 		if (scn->scn_checkpointing)
695 			zfs_dbgmsg("finish scan checkpoint for %s",
696 			    spa->spa_name);
697 
698 		scn->scn_checkpointing = B_FALSE;
699 		scn->scn_last_checkpoint = ddi_get_lbolt();
700 	} else if (sync_type == SYNC_CACHED) {
701 		VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
702 		    DMU_POOL_DIRECTORY_OBJECT,
703 		    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
704 		    &scn->scn_phys_cached, tx));
705 	}
706 }
707 
708 /* ARGSUSED */
709 int
710 dsl_scan_setup_check(void *arg, dmu_tx_t *tx)
711 {
712 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
713 	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
714 
715 	if (dsl_scan_is_running(scn) || vdev_rebuild_active(rvd))
716 		return (SET_ERROR(EBUSY));
717 
718 	return (0);
719 }
720 
721 void
722 dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
723 {
724 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
725 	pool_scan_func_t *funcp = arg;
726 	dmu_object_type_t ot = 0;
727 	dsl_pool_t *dp = scn->scn_dp;
728 	spa_t *spa = dp->dp_spa;
729 
730 	ASSERT(!dsl_scan_is_running(scn));
731 	ASSERT(*funcp > POOL_SCAN_NONE && *funcp < POOL_SCAN_FUNCS);
732 	bzero(&scn->scn_phys, sizeof (scn->scn_phys));
733 	scn->scn_phys.scn_func = *funcp;
734 	scn->scn_phys.scn_state = DSS_SCANNING;
735 	scn->scn_phys.scn_min_txg = 0;
736 	scn->scn_phys.scn_max_txg = tx->tx_txg;
737 	scn->scn_phys.scn_ddt_class_max = DDT_CLASSES - 1; /* the entire DDT */
738 	scn->scn_phys.scn_start_time = gethrestime_sec();
739 	scn->scn_phys.scn_errors = 0;
740 	scn->scn_phys.scn_to_examine = spa->spa_root_vdev->vdev_stat.vs_alloc;
741 	scn->scn_issued_before_pass = 0;
742 	scn->scn_restart_txg = 0;
743 	scn->scn_done_txg = 0;
744 	scn->scn_last_checkpoint = 0;
745 	scn->scn_checkpointing = B_FALSE;
746 	spa_scan_stat_init(spa);
747 
748 	if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
749 		scn->scn_phys.scn_ddt_class_max = zfs_scrub_ddt_class_max;
750 
751 		/* rewrite all disk labels */
752 		vdev_config_dirty(spa->spa_root_vdev);
753 
754 		if (vdev_resilver_needed(spa->spa_root_vdev,
755 		    &scn->scn_phys.scn_min_txg, &scn->scn_phys.scn_max_txg)) {
756 			nvlist_t *aux = fnvlist_alloc();
757 			fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
758 			    "healing");
759 			spa_event_notify(spa, NULL, aux,
760 			    ESC_ZFS_RESILVER_START);
761 			nvlist_free(aux);
762 		} else {
763 			spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_START);
764 		}
765 
766 		spa->spa_scrub_started = B_TRUE;
767 		/*
768 		 * If this is an incremental scrub, limit the DDT scrub phase
769 		 * to just the auto-ditto class (for correctness); the rest
770 		 * of the scrub should go faster using top-down pruning.
771 		 */
772 		if (scn->scn_phys.scn_min_txg > TXG_INITIAL)
773 			scn->scn_phys.scn_ddt_class_max = DDT_CLASS_DITTO;
774 
775 		/*
776 		 * When starting a resilver clear any existing rebuild state.
777 		 * This is required to prevent stale rebuild status from
778 		 * being reported when a rebuild is run, then a resilver and
779 		 * finally a scrub.  In which case only the scrub status
780 		 * should be reported by 'zpool status'.
781 		 */
782 		if (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) {
783 			vdev_t *rvd = spa->spa_root_vdev;
784 			for (uint64_t i = 0; i < rvd->vdev_children; i++) {
785 				vdev_t *vd = rvd->vdev_child[i];
786 				vdev_rebuild_clear_sync(
787 				    (void *)(uintptr_t)vd->vdev_id, tx);
788 			}
789 		}
790 	}
791 
792 	/* back to the generic stuff */
793 
794 	if (dp->dp_blkstats == NULL) {
795 		dp->dp_blkstats =
796 		    vmem_alloc(sizeof (zfs_all_blkstats_t), KM_SLEEP);
797 		mutex_init(&dp->dp_blkstats->zab_lock, NULL,
798 		    MUTEX_DEFAULT, NULL);
799 	}
800 	bzero(&dp->dp_blkstats->zab_type, sizeof (dp->dp_blkstats->zab_type));
801 
802 	if (spa_version(spa) < SPA_VERSION_DSL_SCRUB)
803 		ot = DMU_OT_ZAP_OTHER;
804 
805 	scn->scn_phys.scn_queue_obj = zap_create(dp->dp_meta_objset,
806 	    ot ? ot : DMU_OT_SCAN_QUEUE, DMU_OT_NONE, 0, tx);
807 
808 	bcopy(&scn->scn_phys, &scn->scn_phys_cached, sizeof (scn->scn_phys));
809 
810 	dsl_scan_sync_state(scn, tx, SYNC_MANDATORY);
811 
812 	spa_history_log_internal(spa, "scan setup", tx,
813 	    "func=%u mintxg=%llu maxtxg=%llu",
814 	    *funcp, (u_longlong_t)scn->scn_phys.scn_min_txg,
815 	    (u_longlong_t)scn->scn_phys.scn_max_txg);
816 }
817 
818 /*
819  * Called by the ZFS_IOC_POOL_SCAN ioctl to start a scrub or resilver.
820  * Can also be called to resume a paused scrub.
821  */
822 int
823 dsl_scan(dsl_pool_t *dp, pool_scan_func_t func)
824 {
825 	spa_t *spa = dp->dp_spa;
826 	dsl_scan_t *scn = dp->dp_scan;
827 
828 	/*
829 	 * Purge all vdev caches and probe all devices.  We do this here
830 	 * rather than in sync context because this requires a writer lock
831 	 * on the spa_config lock, which we can't do from sync context.  The
832 	 * spa_scrub_reopen flag indicates that vdev_open() should not
833 	 * attempt to start another scrub.
834 	 */
835 	spa_vdev_state_enter(spa, SCL_NONE);
836 	spa->spa_scrub_reopen = B_TRUE;
837 	vdev_reopen(spa->spa_root_vdev);
838 	spa->spa_scrub_reopen = B_FALSE;
839 	(void) spa_vdev_state_exit(spa, NULL, 0);
840 
841 	if (func == POOL_SCAN_RESILVER) {
842 		dsl_scan_restart_resilver(spa->spa_dsl_pool, 0);
843 		return (0);
844 	}
845 
846 	if (func == POOL_SCAN_SCRUB && dsl_scan_is_paused_scrub(scn)) {
847 		/* got scrub start cmd, resume paused scrub */
848 		int err = dsl_scrub_set_pause_resume(scn->scn_dp,
849 		    POOL_SCRUB_NORMAL);
850 		if (err == 0) {
851 			spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_RESUME);
852 			return (SET_ERROR(ECANCELED));
853 		}
854 
855 		return (SET_ERROR(err));
856 	}
857 
858 	return (dsl_sync_task(spa_name(spa), dsl_scan_setup_check,
859 	    dsl_scan_setup_sync, &func, 0, ZFS_SPACE_CHECK_EXTRA_RESERVED));
860 }
861 
862 /* ARGSUSED */
863 static void
864 dsl_scan_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
865 {
866 	static const char *old_names[] = {
867 		"scrub_bookmark",
868 		"scrub_ddt_bookmark",
869 		"scrub_ddt_class_max",
870 		"scrub_queue",
871 		"scrub_min_txg",
872 		"scrub_max_txg",
873 		"scrub_func",
874 		"scrub_errors",
875 		NULL
876 	};
877 
878 	dsl_pool_t *dp = scn->scn_dp;
879 	spa_t *spa = dp->dp_spa;
880 	int i;
881 
882 	/* Remove any remnants of an old-style scrub. */
883 	for (i = 0; old_names[i]; i++) {
884 		(void) zap_remove(dp->dp_meta_objset,
885 		    DMU_POOL_DIRECTORY_OBJECT, old_names[i], tx);
886 	}
887 
888 	if (scn->scn_phys.scn_queue_obj != 0) {
889 		VERIFY0(dmu_object_free(dp->dp_meta_objset,
890 		    scn->scn_phys.scn_queue_obj, tx));
891 		scn->scn_phys.scn_queue_obj = 0;
892 	}
893 	scan_ds_queue_clear(scn);
894 	scan_ds_prefetch_queue_clear(scn);
895 
896 	scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;
897 
898 	/*
899 	 * If we were "restarted" from a stopped state, don't bother
900 	 * with anything else.
901 	 */
902 	if (!dsl_scan_is_running(scn)) {
903 		ASSERT(!scn->scn_is_sorted);
904 		return;
905 	}
906 
907 	if (scn->scn_is_sorted) {
908 		scan_io_queues_destroy(scn);
909 		scn->scn_is_sorted = B_FALSE;
910 
911 		if (scn->scn_taskq != NULL) {
912 			taskq_destroy(scn->scn_taskq);
913 			scn->scn_taskq = NULL;
914 		}
915 	}
916 
917 	scn->scn_phys.scn_state = complete ? DSS_FINISHED : DSS_CANCELED;
918 
919 	spa_notify_waiters(spa);
920 
921 	if (dsl_scan_restarting(scn, tx))
922 		spa_history_log_internal(spa, "scan aborted, restarting", tx,
923 		    "errors=%llu", (u_longlong_t)spa_get_errlog_size(spa));
924 	else if (!complete)
925 		spa_history_log_internal(spa, "scan cancelled", tx,
926 		    "errors=%llu", (u_longlong_t)spa_get_errlog_size(spa));
927 	else
928 		spa_history_log_internal(spa, "scan done", tx,
929 		    "errors=%llu", (u_longlong_t)spa_get_errlog_size(spa));
930 
931 	if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
932 		spa->spa_scrub_active = B_FALSE;
933 
934 		/*
935 		 * If the scrub/resilver completed, update all DTLs to
936 		 * reflect this.  Whether it succeeded or not, vacate
937 		 * all temporary scrub DTLs.
938 		 *
939 		 * As the scrub does not currently support traversing
940 		 * data that have been freed but are part of a checkpoint,
941 		 * we don't mark the scrub as done in the DTLs as faults
942 		 * may still exist in those vdevs.
943 		 */
944 		if (complete &&
945 		    !spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
946 			vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
947 			    scn->scn_phys.scn_max_txg, B_TRUE, B_FALSE);
948 
949 			if (scn->scn_phys.scn_min_txg) {
950 				nvlist_t *aux = fnvlist_alloc();
951 				fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
952 				    "healing");
953 				spa_event_notify(spa, NULL, aux,
954 				    ESC_ZFS_RESILVER_FINISH);
955 				nvlist_free(aux);
956 			} else {
957 				spa_event_notify(spa, NULL, NULL,
958 				    ESC_ZFS_SCRUB_FINISH);
959 			}
960 		} else {
961 			vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
962 			    0, B_TRUE, B_FALSE);
963 		}
964 		spa_errlog_rotate(spa);
965 
966 		/*
967 		 * Don't clear flag until after vdev_dtl_reassess to ensure that
968 		 * DTL_MISSING will get updated when possible.
969 		 */
970 		spa->spa_scrub_started = B_FALSE;
971 
972 		/*
973 		 * We may have finished replacing a device.
974 		 * Let the async thread assess this and handle the detach.
975 		 */
976 		spa_async_request(spa, SPA_ASYNC_RESILVER_DONE);
977 
978 		/*
979 		 * Clear any resilver_deferred flags in the config.
980 		 * If there are drives that need resilvering, kick
981 		 * off an asynchronous request to start resilver.
982 		 * vdev_clear_resilver_deferred() may update the config
983 		 * before the resilver can restart. In the event of
984 		 * a crash during this period, the spa loading code
985 		 * will find the drives that need to be resilvered
986 		 * and start the resilver then.
987 		 */
988 		if (spa_feature_is_enabled(spa, SPA_FEATURE_RESILVER_DEFER) &&
989 		    vdev_clear_resilver_deferred(spa->spa_root_vdev, tx)) {
990 			spa_history_log_internal(spa,
991 			    "starting deferred resilver", tx, "errors=%llu",
992 			    (u_longlong_t)spa_get_errlog_size(spa));
993 			spa_async_request(spa, SPA_ASYNC_RESILVER);
994 		}
995 
996 		/* Clear recent error events (i.e. duplicate events tracking) */
997 		if (complete)
998 			zfs_ereport_clear(spa, NULL);
999 	}
1000 
1001 	scn->scn_phys.scn_end_time = gethrestime_sec();
1002 
1003 	if (spa->spa_errata == ZPOOL_ERRATA_ZOL_2094_SCRUB)
1004 		spa->spa_errata = 0;
1005 
1006 	ASSERT(!dsl_scan_is_running(scn));
1007 }
1008 
1009 /* ARGSUSED */
1010 static int
1011 dsl_scan_cancel_check(void *arg, dmu_tx_t *tx)
1012 {
1013 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
1014 
1015 	if (!dsl_scan_is_running(scn))
1016 		return (SET_ERROR(ENOENT));
1017 	return (0);
1018 }
1019 
1020 /* ARGSUSED */
1021 static void
1022 dsl_scan_cancel_sync(void *arg, dmu_tx_t *tx)
1023 {
1024 	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
1025 
1026 	dsl_scan_done(scn, B_FALSE, tx);
1027 	dsl_scan_sync_state(scn, tx, SYNC_MANDATORY);
1028 	spa_event_notify(scn->scn_dp->dp_spa, NULL, NULL, ESC_ZFS_SCRUB_ABORT);
1029 }
1030 
1031 int
1032 dsl_scan_cancel(dsl_pool_t *dp)
1033 {
1034 	return (dsl_sync_task(spa_name(dp->dp_spa), dsl_scan_cancel_check,
1035 	    dsl_scan_cancel_sync, NULL, 3, ZFS_SPACE_CHECK_RESERVED));
1036 }
1037 
1038 static int
1039 dsl_scrub_pause_resume_check(void *arg, dmu_tx_t *tx)
1040 {
1041 	pool_scrub_cmd_t *cmd = arg;
1042 	dsl_pool_t *dp = dmu_tx_pool(tx);
1043 	dsl_scan_t *scn = dp->dp_scan;
1044 
1045 	if (*cmd == POOL_SCRUB_PAUSE) {
1046 		/* can't pause a scrub when there is no in-progress scrub */
1047 		if (!dsl_scan_scrubbing(dp))
1048 			return (SET_ERROR(ENOENT));
1049 
1050 		/* can't pause a paused scrub */
1051 		if (dsl_scan_is_paused_scrub(scn))
1052 			return (SET_ERROR(EBUSY));
1053 	} else if (*cmd != POOL_SCRUB_NORMAL) {
1054 		return (SET_ERROR(ENOTSUP));
1055 	}
1056 
1057 	return (0);
1058 }
1059 
1060 static void
1061 dsl_scrub_pause_resume_sync(void *arg, dmu_tx_t *tx)
1062 {
1063 	pool_scrub_cmd_t *cmd = arg;
1064 	dsl_pool_t *dp = dmu_tx_pool(tx);
1065 	spa_t *spa = dp->dp_spa;
1066 	dsl_scan_t *scn = dp->dp_scan;
1067 
1068 	if (*cmd == POOL_SCRUB_PAUSE) {
1069 		/* can't pause a scrub when there is no in-progress scrub */
1070 		spa->spa_scan_pass_scrub_pause = gethrestime_sec();
1071 		scn->scn_phys.scn_flags |= DSF_SCRUB_PAUSED;
1072 		scn->scn_phys_cached.scn_flags |= DSF_SCRUB_PAUSED;
1073 		dsl_scan_sync_state(scn, tx, SYNC_CACHED);
1074 		spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_PAUSED);
1075 		spa_notify_waiters(spa);
1076 	} else {
1077 		ASSERT3U(*cmd, ==, POOL_SCRUB_NORMAL);
1078 		if (dsl_scan_is_paused_scrub(scn)) {
1079 			/*
1080 			 * We need to keep track of how much time we spend
1081 			 * paused per pass so that we can adjust the scrub rate
1082 			 * shown in the output of 'zpool status'
1083 			 */
1084 			spa->spa_scan_pass_scrub_spent_paused +=
1085 			    gethrestime_sec() - spa->spa_scan_pass_scrub_pause;
1086 			spa->spa_scan_pass_scrub_pause = 0;
1087 			scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;
1088 			scn->scn_phys_cached.scn_flags &= ~DSF_SCRUB_PAUSED;
1089 			dsl_scan_sync_state(scn, tx, SYNC_CACHED);
1090 		}
1091 	}
1092 }
1093 
1094 /*
1095  * Set scrub pause/resume state if it makes sense to do so
1096  */
1097 int
1098 dsl_scrub_set_pause_resume(const dsl_pool_t *dp, pool_scrub_cmd_t cmd)
1099 {
1100 	return (dsl_sync_task(spa_name(dp->dp_spa),
1101 	    dsl_scrub_pause_resume_check, dsl_scrub_pause_resume_sync, &cmd, 3,
1102 	    ZFS_SPACE_CHECK_RESERVED));
1103 }
1104 
1105 
1106 /* start a new scan, or restart an existing one. */
1107 void
1108 dsl_scan_restart_resilver(dsl_pool_t *dp, uint64_t txg)
1109 {
1110 	if (txg == 0) {
1111 		dmu_tx_t *tx;
1112 		tx = dmu_tx_create_dd(dp->dp_mos_dir);
1113 		VERIFY(0 == dmu_tx_assign(tx, TXG_WAIT));
1114 
1115 		txg = dmu_tx_get_txg(tx);
1116 		dp->dp_scan->scn_restart_txg = txg;
1117 		dmu_tx_commit(tx);
1118 	} else {
1119 		dp->dp_scan->scn_restart_txg = txg;
1120 	}
1121 	zfs_dbgmsg("restarting resilver for %s at txg=%llu",
1122 	    dp->dp_spa->spa_name, (longlong_t)txg);
1123 }
1124 
1125 void
1126 dsl_free(dsl_pool_t *dp, uint64_t txg, const blkptr_t *bp)
1127 {
1128 	zio_free(dp->dp_spa, txg, bp);
1129 }
1130 
1131 void
1132 dsl_free_sync(zio_t *pio, dsl_pool_t *dp, uint64_t txg, const blkptr_t *bpp)
1133 {
1134 	ASSERT(dsl_pool_sync_context(dp));
1135 	zio_nowait(zio_free_sync(pio, dp->dp_spa, txg, bpp, pio->io_flags));
1136 }
1137 
1138 static int
1139 scan_ds_queue_compare(const void *a, const void *b)
1140 {
1141 	const scan_ds_t *sds_a = a, *sds_b = b;
1142 
1143 	if (sds_a->sds_dsobj < sds_b->sds_dsobj)
1144 		return (-1);
1145 	if (sds_a->sds_dsobj == sds_b->sds_dsobj)
1146 		return (0);
1147 	return (1);
1148 }
1149 
1150 static void
1151 scan_ds_queue_clear(dsl_scan_t *scn)
1152 {
1153 	void *cookie = NULL;
1154 	scan_ds_t *sds;
1155 	while ((sds = avl_destroy_nodes(&scn->scn_queue, &cookie)) != NULL) {
1156 		kmem_free(sds, sizeof (*sds));
1157 	}
1158 }
1159 
1160 static boolean_t
1161 scan_ds_queue_contains(dsl_scan_t *scn, uint64_t dsobj, uint64_t *txg)
1162 {
1163 	scan_ds_t srch, *sds;
1164 
1165 	srch.sds_dsobj = dsobj;
1166 	sds = avl_find(&scn->scn_queue, &srch, NULL);
1167 	if (sds != NULL && txg != NULL)
1168 		*txg = sds->sds_txg;
1169 	return (sds != NULL);
1170 }
1171 
1172 static void
1173 scan_ds_queue_insert(dsl_scan_t *scn, uint64_t dsobj, uint64_t txg)
1174 {
1175 	scan_ds_t *sds;
1176 	avl_index_t where;
1177 
1178 	sds = kmem_zalloc(sizeof (*sds), KM_SLEEP);
1179 	sds->sds_dsobj = dsobj;
1180 	sds->sds_txg = txg;
1181 
1182 	VERIFY3P(avl_find(&scn->scn_queue, sds, &where), ==, NULL);
1183 	avl_insert(&scn->scn_queue, sds, where);
1184 }
1185 
1186 static void
1187 scan_ds_queue_remove(dsl_scan_t *scn, uint64_t dsobj)
1188 {
1189 	scan_ds_t srch, *sds;
1190 
1191 	srch.sds_dsobj = dsobj;
1192 
1193 	sds = avl_find(&scn->scn_queue, &srch, NULL);
1194 	VERIFY(sds != NULL);
1195 	avl_remove(&scn->scn_queue, sds);
1196 	kmem_free(sds, sizeof (*sds));
1197 }
1198 
1199 static void
1200 scan_ds_queue_sync(dsl_scan_t *scn, dmu_tx_t *tx)
1201 {
1202 	dsl_pool_t *dp = scn->scn_dp;
1203 	spa_t *spa = dp->dp_spa;
1204 	dmu_object_type_t ot = (spa_version(spa) >= SPA_VERSION_DSL_SCRUB) ?
1205 	    DMU_OT_SCAN_QUEUE : DMU_OT_ZAP_OTHER;
1206 
1207 	ASSERT0(scn->scn_bytes_pending);
1208 	ASSERT(scn->scn_phys.scn_queue_obj != 0);
1209 
1210 	VERIFY0(dmu_object_free(dp->dp_meta_objset,
1211 	    scn->scn_phys.scn_queue_obj, tx));
1212 	scn->scn_phys.scn_queue_obj = zap_create(dp->dp_meta_objset, ot,
1213 	    DMU_OT_NONE, 0, tx);
1214 	for (scan_ds_t *sds = avl_first(&scn->scn_queue);
1215 	    sds != NULL; sds = AVL_NEXT(&scn->scn_queue, sds)) {
1216 		VERIFY0(zap_add_int_key(dp->dp_meta_objset,
1217 		    scn->scn_phys.scn_queue_obj, sds->sds_dsobj,
1218 		    sds->sds_txg, tx));
1219 	}
1220 }
1221 
1222 /*
1223  * Computes the memory limit state that we're currently in. A sorted scan
1224  * needs quite a bit of memory to hold the sorting queue, so we need to
1225  * reasonably constrain the size so it doesn't impact overall system
1226  * performance. We compute two limits:
1227  * 1) Hard memory limit: if the amount of memory used by the sorting
1228  *	queues on a pool gets above this value, we stop the metadata
1229  *	scanning portion and start issuing the queued up and sorted
1230  *	I/Os to reduce memory usage.
1231  *	This limit is calculated as a fraction of physmem (by default 5%).
1232  *	We constrain the lower bound of the hard limit to an absolute
1233  *	minimum of zfs_scan_mem_lim_min (default: 16 MiB). We also constrain
1234  *	the upper bound to 5% of the total pool size - no chance we'll
1235  *	ever need that much memory, but just to keep the value in check.
1236  * 2) Soft memory limit: once we hit the hard memory limit, we start
1237  *	issuing I/O to reduce queue memory usage, but we don't want to
1238  *	completely empty out the queues, since we might be able to find I/Os
1239  *	that will fill in the gaps of our non-sequential IOs at some point
1240  *	in the future. So we stop the issuing of I/Os once the amount of
1241  *	memory used drops below the soft limit (at which point we stop issuing
1242  *	I/O and start scanning metadata again).
1243  *
1244  *	This limit is calculated by subtracting a fraction of the hard
1245  *	limit from the hard limit. By default this fraction is 5%, so
1246  *	the soft limit is 95% of the hard limit. We cap the size of the
1247  *	difference between the hard and soft limits at an absolute
1248  *	maximum of zfs_scan_mem_lim_soft_max (default: 128 MiB) - this is
1249  *	sufficient to not cause too frequent switching between the
1250  *	metadata scan and I/O issue (even at 2k recordsize, 128 MiB's
1251  *	worth of queues is about 1.2 GiB of on-pool data, so scanning
1252  *	that should take at least a decent fraction of a second).
1253  */
1254 static boolean_t
1255 dsl_scan_should_clear(dsl_scan_t *scn)
1256 {
1257 	spa_t *spa = scn->scn_dp->dp_spa;
1258 	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
1259 	uint64_t alloc, mlim_hard, mlim_soft, mused;
1260 
1261 	alloc = metaslab_class_get_alloc(spa_normal_class(spa));
1262 	alloc += metaslab_class_get_alloc(spa_special_class(spa));
1263 	alloc += metaslab_class_get_alloc(spa_dedup_class(spa));
1264 
1265 	mlim_hard = MAX((physmem / zfs_scan_mem_lim_fact) * PAGESIZE,
1266 	    zfs_scan_mem_lim_min);
1267 	mlim_hard = MIN(mlim_hard, alloc / 20);
1268 	mlim_soft = mlim_hard - MIN(mlim_hard / zfs_scan_mem_lim_soft_fact,
1269 	    zfs_scan_mem_lim_soft_max);
1270 	mused = 0;
1271 	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
1272 		vdev_t *tvd = rvd->vdev_child[i];
1273 		dsl_scan_io_queue_t *queue;
1274 
1275 		mutex_enter(&tvd->vdev_scan_io_queue_lock);
1276 		queue = tvd->vdev_scan_io_queue;
1277 		if (queue != NULL) {
1278 			/* # extents in exts_by_size = # in exts_by_addr */
1279 			mused += zfs_btree_numnodes(&queue->q_exts_by_size) *
1280 			    sizeof (range_seg_gap_t) + queue->q_sio_memused;
1281 		}
1282 		mutex_exit(&tvd->vdev_scan_io_queue_lock);
1283 	}
1284 
1285 	dprintf("current scan memory usage: %llu bytes\n", (longlong_t)mused);
1286 
1287 	if (mused == 0)
1288 		ASSERT0(scn->scn_bytes_pending);
1289 
1290 	/*
1291 	 * If we are above our hard limit, we need to clear out memory.
1292 	 * If we are below our soft limit, we need to accumulate sequential IOs.
1293 	 * Otherwise, we should keep doing whatever we are currently doing.
1294 	 */
1295 	if (mused >= mlim_hard)
1296 		return (B_TRUE);
1297 	else if (mused < mlim_soft)
1298 		return (B_FALSE);
1299 	else
1300 		return (scn->scn_clearing);
1301 }
1302 
1303 static boolean_t
1304 dsl_scan_check_suspend(dsl_scan_t *scn, const zbookmark_phys_t *zb)
1305 {
1306 	/* we never skip user/group accounting objects */
1307 	if (zb && (int64_t)zb->zb_object < 0)
1308 		return (B_FALSE);
1309 
1310 	if (scn->scn_suspending)
1311 		return (B_TRUE); /* we're already suspending */
1312 
1313 	if (!ZB_IS_ZERO(&scn->scn_phys.scn_bookmark))
1314 		return (B_FALSE); /* we're resuming */
1315 
1316 	/* We only know how to resume from level-0 and objset blocks. */
1317 	if (zb && (zb->zb_level != 0 && zb->zb_level != ZB_ROOT_LEVEL))
1318 		return (B_FALSE);
1319 
1320 	/*
1321 	 * We suspend if:
1322 	 *  - we have scanned for at least the minimum time (default 1 sec
1323 	 *    for scrub, 3 sec for resilver), and either we have sufficient
1324 	 *    dirty data that we are starting to write more quickly
1325 	 *    (default 30%), someone is explicitly waiting for this txg
1326 	 *    to complete, or we have used up all of the time in the txg
1327 	 *    timeout (default 5 sec).
1328 	 *  or
1329 	 *  - the spa is shutting down because this pool is being exported
1330 	 *    or the machine is rebooting.
1331 	 *  or
1332 	 *  - the scan queue has reached its memory use limit
1333 	 */
1334 	uint64_t curr_time_ns = gethrtime();
1335 	uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
1336 	uint64_t sync_time_ns = curr_time_ns -
1337 	    scn->scn_dp->dp_spa->spa_sync_starttime;
1338 	int dirty_pct = scn->scn_dp->dp_dirty_total * 100 / zfs_dirty_data_max;
1339 	int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
1340 	    zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;
1341 
1342 	if ((NSEC2MSEC(scan_time_ns) > mintime &&
1343 	    (dirty_pct >= zfs_vdev_async_write_active_min_dirty_percent ||
1344 	    txg_sync_waiting(scn->scn_dp) ||
1345 	    NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
1346 	    spa_shutting_down(scn->scn_dp->dp_spa) ||
1347 	    (zfs_scan_strict_mem_lim && dsl_scan_should_clear(scn))) {
1348 		if (zb && zb->zb_level == ZB_ROOT_LEVEL) {
1349 			dprintf("suspending at first available bookmark "
1350 			    "%llx/%llx/%llx/%llx\n",
1351 			    (longlong_t)zb->zb_objset,
1352 			    (longlong_t)zb->zb_object,
1353 			    (longlong_t)zb->zb_level,
1354 			    (longlong_t)zb->zb_blkid);
1355 			SET_BOOKMARK(&scn->scn_phys.scn_bookmark,
1356 			    zb->zb_objset, 0, 0, 0);
1357 		} else if (zb != NULL) {
1358 			dprintf("suspending at bookmark %llx/%llx/%llx/%llx\n",
1359 			    (longlong_t)zb->zb_objset,
1360 			    (longlong_t)zb->zb_object,
1361 			    (longlong_t)zb->zb_level,
1362 			    (longlong_t)zb->zb_blkid);
1363 			scn->scn_phys.scn_bookmark = *zb;
1364 		} else {
1365 #ifdef ZFS_DEBUG
1366 			dsl_scan_phys_t *scnp = &scn->scn_phys;
1367 			dprintf("suspending at at DDT bookmark "
1368 			    "%llx/%llx/%llx/%llx\n",
1369 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_class,
1370 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_type,
1371 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_checksum,
1372 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_cursor);
1373 #endif
1374 		}
1375 		scn->scn_suspending = B_TRUE;
1376 		return (B_TRUE);
1377 	}
1378 	return (B_FALSE);
1379 }
1380 
1381 typedef struct zil_scan_arg {
1382 	dsl_pool_t	*zsa_dp;
1383 	zil_header_t	*zsa_zh;
1384 } zil_scan_arg_t;
1385 
1386 /* ARGSUSED */
1387 static int
1388 dsl_scan_zil_block(zilog_t *zilog, const blkptr_t *bp, void *arg,
1389     uint64_t claim_txg)
1390 {
1391 	zil_scan_arg_t *zsa = arg;
1392 	dsl_pool_t *dp = zsa->zsa_dp;
1393 	dsl_scan_t *scn = dp->dp_scan;
1394 	zil_header_t *zh = zsa->zsa_zh;
1395 	zbookmark_phys_t zb;
1396 
1397 	ASSERT(!BP_IS_REDACTED(bp));
1398 	if (BP_IS_HOLE(bp) || bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
1399 		return (0);
1400 
1401 	/*
1402 	 * One block ("stubby") can be allocated a long time ago; we
1403 	 * want to visit that one because it has been allocated
1404 	 * (on-disk) even if it hasn't been claimed (even though for
1405 	 * scrub there's nothing to do to it).
1406 	 */
1407 	if (claim_txg == 0 && bp->blk_birth >= spa_min_claim_txg(dp->dp_spa))
1408 		return (0);
1409 
1410 	SET_BOOKMARK(&zb, zh->zh_log.blk_cksum.zc_word[ZIL_ZC_OBJSET],
1411 	    ZB_ZIL_OBJECT, ZB_ZIL_LEVEL, bp->blk_cksum.zc_word[ZIL_ZC_SEQ]);
1412 
1413 	VERIFY(0 == scan_funcs[scn->scn_phys.scn_func](dp, bp, &zb));
1414 	return (0);
1415 }
1416 
1417 /* ARGSUSED */
1418 static int
1419 dsl_scan_zil_record(zilog_t *zilog, const lr_t *lrc, void *arg,
1420     uint64_t claim_txg)
1421 {
1422 	if (lrc->lrc_txtype == TX_WRITE) {
1423 		zil_scan_arg_t *zsa = arg;
1424 		dsl_pool_t *dp = zsa->zsa_dp;
1425 		dsl_scan_t *scn = dp->dp_scan;
1426 		zil_header_t *zh = zsa->zsa_zh;
1427 		const lr_write_t *lr = (const lr_write_t *)lrc;
1428 		const blkptr_t *bp = &lr->lr_blkptr;
1429 		zbookmark_phys_t zb;
1430 
1431 		ASSERT(!BP_IS_REDACTED(bp));
1432 		if (BP_IS_HOLE(bp) ||
1433 		    bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
1434 			return (0);
1435 
1436 		/*
1437 		 * birth can be < claim_txg if this record's txg is
1438 		 * already txg sync'ed (but this log block contains
1439 		 * other records that are not synced)
1440 		 */
1441 		if (claim_txg == 0 || bp->blk_birth < claim_txg)
1442 			return (0);
1443 
1444 		SET_BOOKMARK(&zb, zh->zh_log.blk_cksum.zc_word[ZIL_ZC_OBJSET],
1445 		    lr->lr_foid, ZB_ZIL_LEVEL,
1446 		    lr->lr_offset / BP_GET_LSIZE(bp));
1447 
1448 		VERIFY(0 == scan_funcs[scn->scn_phys.scn_func](dp, bp, &zb));
1449 	}
1450 	return (0);
1451 }
1452 
1453 static void
1454 dsl_scan_zil(dsl_pool_t *dp, zil_header_t *zh)
1455 {
1456 	uint64_t claim_txg = zh->zh_claim_txg;
1457 	zil_scan_arg_t zsa = { dp, zh };
1458 	zilog_t *zilog;
1459 
1460 	ASSERT(spa_writeable(dp->dp_spa));
1461 
1462 	/*
1463 	 * We only want to visit blocks that have been claimed but not yet
1464 	 * replayed (or, in read-only mode, blocks that *would* be claimed).
1465 	 */
1466 	if (claim_txg == 0)
1467 		return;
1468 
1469 	zilog = zil_alloc(dp->dp_meta_objset, zh);
1470 
1471 	(void) zil_parse(zilog, dsl_scan_zil_block, dsl_scan_zil_record, &zsa,
1472 	    claim_txg, B_FALSE);
1473 
1474 	zil_free(zilog);
1475 }
1476 
1477 /*
1478  * We compare scan_prefetch_issue_ctx_t's based on their bookmarks. The idea
1479  * here is to sort the AVL tree by the order each block will be needed.
1480  */
1481 static int
1482 scan_prefetch_queue_compare(const void *a, const void *b)
1483 {
1484 	const scan_prefetch_issue_ctx_t *spic_a = a, *spic_b = b;
1485 	const scan_prefetch_ctx_t *spc_a = spic_a->spic_spc;
1486 	const scan_prefetch_ctx_t *spc_b = spic_b->spic_spc;
1487 
1488 	return (zbookmark_compare(spc_a->spc_datablkszsec,
1489 	    spc_a->spc_indblkshift, spc_b->spc_datablkszsec,
1490 	    spc_b->spc_indblkshift, &spic_a->spic_zb, &spic_b->spic_zb));
1491 }
1492 
1493 static void
1494 scan_prefetch_ctx_rele(scan_prefetch_ctx_t *spc, void *tag)
1495 {
1496 	if (zfs_refcount_remove(&spc->spc_refcnt, tag) == 0) {
1497 		zfs_refcount_destroy(&spc->spc_refcnt);
1498 		kmem_free(spc, sizeof (scan_prefetch_ctx_t));
1499 	}
1500 }
1501 
1502 static scan_prefetch_ctx_t *
1503 scan_prefetch_ctx_create(dsl_scan_t *scn, dnode_phys_t *dnp, void *tag)
1504 {
1505 	scan_prefetch_ctx_t *spc;
1506 
1507 	spc = kmem_alloc(sizeof (scan_prefetch_ctx_t), KM_SLEEP);
1508 	zfs_refcount_create(&spc->spc_refcnt);
1509 	zfs_refcount_add(&spc->spc_refcnt, tag);
1510 	spc->spc_scn = scn;
1511 	if (dnp != NULL) {
1512 		spc->spc_datablkszsec = dnp->dn_datablkszsec;
1513 		spc->spc_indblkshift = dnp->dn_indblkshift;
1514 		spc->spc_root = B_FALSE;
1515 	} else {
1516 		spc->spc_datablkszsec = 0;
1517 		spc->spc_indblkshift = 0;
1518 		spc->spc_root = B_TRUE;
1519 	}
1520 
1521 	return (spc);
1522 }
1523 
1524 static void
1525 scan_prefetch_ctx_add_ref(scan_prefetch_ctx_t *spc, void *tag)
1526 {
1527 	zfs_refcount_add(&spc->spc_refcnt, tag);
1528 }
1529 
1530 static void
1531 scan_ds_prefetch_queue_clear(dsl_scan_t *scn)
1532 {
1533 	spa_t *spa = scn->scn_dp->dp_spa;
1534 	void *cookie = NULL;
1535 	scan_prefetch_issue_ctx_t *spic = NULL;
1536 
1537 	mutex_enter(&spa->spa_scrub_lock);
1538 	while ((spic = avl_destroy_nodes(&scn->scn_prefetch_queue,
1539 	    &cookie)) != NULL) {
1540 		scan_prefetch_ctx_rele(spic->spic_spc, scn);
1541 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
1542 	}
1543 	mutex_exit(&spa->spa_scrub_lock);
1544 }
1545 
1546 static boolean_t
1547 dsl_scan_check_prefetch_resume(scan_prefetch_ctx_t *spc,
1548     const zbookmark_phys_t *zb)
1549 {
1550 	zbookmark_phys_t *last_zb = &spc->spc_scn->scn_prefetch_bookmark;
1551 	dnode_phys_t tmp_dnp;
1552 	dnode_phys_t *dnp = (spc->spc_root) ? NULL : &tmp_dnp;
1553 
1554 	if (zb->zb_objset != last_zb->zb_objset)
1555 		return (B_TRUE);
1556 	if ((int64_t)zb->zb_object < 0)
1557 		return (B_FALSE);
1558 
1559 	tmp_dnp.dn_datablkszsec = spc->spc_datablkszsec;
1560 	tmp_dnp.dn_indblkshift = spc->spc_indblkshift;
1561 
1562 	if (zbookmark_subtree_completed(dnp, zb, last_zb))
1563 		return (B_TRUE);
1564 
1565 	return (B_FALSE);
1566 }
1567 
1568 static void
1569 dsl_scan_prefetch(scan_prefetch_ctx_t *spc, blkptr_t *bp, zbookmark_phys_t *zb)
1570 {
1571 	avl_index_t idx;
1572 	dsl_scan_t *scn = spc->spc_scn;
1573 	spa_t *spa = scn->scn_dp->dp_spa;
1574 	scan_prefetch_issue_ctx_t *spic;
1575 
1576 	if (zfs_no_scrub_prefetch || BP_IS_REDACTED(bp))
1577 		return;
1578 
1579 	if (BP_IS_HOLE(bp) || bp->blk_birth <= scn->scn_phys.scn_cur_min_txg ||
1580 	    (BP_GET_LEVEL(bp) == 0 && BP_GET_TYPE(bp) != DMU_OT_DNODE &&
1581 	    BP_GET_TYPE(bp) != DMU_OT_OBJSET))
1582 		return;
1583 
1584 	if (dsl_scan_check_prefetch_resume(spc, zb))
1585 		return;
1586 
1587 	scan_prefetch_ctx_add_ref(spc, scn);
1588 	spic = kmem_alloc(sizeof (scan_prefetch_issue_ctx_t), KM_SLEEP);
1589 	spic->spic_spc = spc;
1590 	spic->spic_bp = *bp;
1591 	spic->spic_zb = *zb;
1592 
1593 	/*
1594 	 * Add the IO to the queue of blocks to prefetch. This allows us to
1595 	 * prioritize blocks that we will need first for the main traversal
1596 	 * thread.
1597 	 */
1598 	mutex_enter(&spa->spa_scrub_lock);
1599 	if (avl_find(&scn->scn_prefetch_queue, spic, &idx) != NULL) {
1600 		/* this block is already queued for prefetch */
1601 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
1602 		scan_prefetch_ctx_rele(spc, scn);
1603 		mutex_exit(&spa->spa_scrub_lock);
1604 		return;
1605 	}
1606 
1607 	avl_insert(&scn->scn_prefetch_queue, spic, idx);
1608 	cv_broadcast(&spa->spa_scrub_io_cv);
1609 	mutex_exit(&spa->spa_scrub_lock);
1610 }
1611 
1612 static void
1613 dsl_scan_prefetch_dnode(dsl_scan_t *scn, dnode_phys_t *dnp,
1614     uint64_t objset, uint64_t object)
1615 {
1616 	int i;
1617 	zbookmark_phys_t zb;
1618 	scan_prefetch_ctx_t *spc;
1619 
1620 	if (dnp->dn_nblkptr == 0 && !(dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR))
1621 		return;
1622 
1623 	SET_BOOKMARK(&zb, objset, object, 0, 0);
1624 
1625 	spc = scan_prefetch_ctx_create(scn, dnp, FTAG);
1626 
1627 	for (i = 0; i < dnp->dn_nblkptr; i++) {
1628 		zb.zb_level = BP_GET_LEVEL(&dnp->dn_blkptr[i]);
1629 		zb.zb_blkid = i;
1630 		dsl_scan_prefetch(spc, &dnp->dn_blkptr[i], &zb);
1631 	}
1632 
1633 	if (dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR) {
1634 		zb.zb_level = 0;
1635 		zb.zb_blkid = DMU_SPILL_BLKID;
1636 		dsl_scan_prefetch(spc, DN_SPILL_BLKPTR(dnp), &zb);
1637 	}
1638 
1639 	scan_prefetch_ctx_rele(spc, FTAG);
1640 }
1641 
1642 static void
1643 dsl_scan_prefetch_cb(zio_t *zio, const zbookmark_phys_t *zb, const blkptr_t *bp,
1644     arc_buf_t *buf, void *private)
1645 {
1646 	scan_prefetch_ctx_t *spc = private;
1647 	dsl_scan_t *scn = spc->spc_scn;
1648 	spa_t *spa = scn->scn_dp->dp_spa;
1649 
1650 	/* broadcast that the IO has completed for rate limiting purposes */
1651 	mutex_enter(&spa->spa_scrub_lock);
1652 	ASSERT3U(spa->spa_scrub_inflight, >=, BP_GET_PSIZE(bp));
1653 	spa->spa_scrub_inflight -= BP_GET_PSIZE(bp);
1654 	cv_broadcast(&spa->spa_scrub_io_cv);
1655 	mutex_exit(&spa->spa_scrub_lock);
1656 
1657 	/* if there was an error or we are done prefetching, just cleanup */
1658 	if (buf == NULL || scn->scn_prefetch_stop)
1659 		goto out;
1660 
1661 	if (BP_GET_LEVEL(bp) > 0) {
1662 		int i;
1663 		blkptr_t *cbp;
1664 		int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
1665 		zbookmark_phys_t czb;
1666 
1667 		for (i = 0, cbp = buf->b_data; i < epb; i++, cbp++) {
1668 			SET_BOOKMARK(&czb, zb->zb_objset, zb->zb_object,
1669 			    zb->zb_level - 1, zb->zb_blkid * epb + i);
1670 			dsl_scan_prefetch(spc, cbp, &czb);
1671 		}
1672 	} else if (BP_GET_TYPE(bp) == DMU_OT_DNODE) {
1673 		dnode_phys_t *cdnp;
1674 		int i;
1675 		int epb = BP_GET_LSIZE(bp) >> DNODE_SHIFT;
1676 
1677 		for (i = 0, cdnp = buf->b_data; i < epb;
1678 		    i += cdnp->dn_extra_slots + 1,
1679 		    cdnp += cdnp->dn_extra_slots + 1) {
1680 			dsl_scan_prefetch_dnode(scn, cdnp,
1681 			    zb->zb_objset, zb->zb_blkid * epb + i);
1682 		}
1683 	} else if (BP_GET_TYPE(bp) == DMU_OT_OBJSET) {
1684 		objset_phys_t *osp = buf->b_data;
1685 
1686 		dsl_scan_prefetch_dnode(scn, &osp->os_meta_dnode,
1687 		    zb->zb_objset, DMU_META_DNODE_OBJECT);
1688 
1689 		if (OBJSET_BUF_HAS_USERUSED(buf)) {
1690 			dsl_scan_prefetch_dnode(scn,
1691 			    &osp->os_groupused_dnode, zb->zb_objset,
1692 			    DMU_GROUPUSED_OBJECT);
1693 			dsl_scan_prefetch_dnode(scn,
1694 			    &osp->os_userused_dnode, zb->zb_objset,
1695 			    DMU_USERUSED_OBJECT);
1696 		}
1697 	}
1698 
1699 out:
1700 	if (buf != NULL)
1701 		arc_buf_destroy(buf, private);
1702 	scan_prefetch_ctx_rele(spc, scn);
1703 }
1704 
1705 /* ARGSUSED */
1706 static void
1707 dsl_scan_prefetch_thread(void *arg)
1708 {
1709 	dsl_scan_t *scn = arg;
1710 	spa_t *spa = scn->scn_dp->dp_spa;
1711 	scan_prefetch_issue_ctx_t *spic;
1712 
1713 	/* loop until we are told to stop */
1714 	while (!scn->scn_prefetch_stop) {
1715 		arc_flags_t flags = ARC_FLAG_NOWAIT |
1716 		    ARC_FLAG_PRESCIENT_PREFETCH | ARC_FLAG_PREFETCH;
1717 		int zio_flags = ZIO_FLAG_CANFAIL | ZIO_FLAG_SCAN_THREAD;
1718 
1719 		mutex_enter(&spa->spa_scrub_lock);
1720 
1721 		/*
1722 		 * Wait until we have an IO to issue and are not above our
1723 		 * maximum in flight limit.
1724 		 */
1725 		while (!scn->scn_prefetch_stop &&
1726 		    (avl_numnodes(&scn->scn_prefetch_queue) == 0 ||
1727 		    spa->spa_scrub_inflight >= scn->scn_maxinflight_bytes)) {
1728 			cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
1729 		}
1730 
1731 		/* recheck if we should stop since we waited for the cv */
1732 		if (scn->scn_prefetch_stop) {
1733 			mutex_exit(&spa->spa_scrub_lock);
1734 			break;
1735 		}
1736 
1737 		/* remove the prefetch IO from the tree */
1738 		spic = avl_first(&scn->scn_prefetch_queue);
1739 		spa->spa_scrub_inflight += BP_GET_PSIZE(&spic->spic_bp);
1740 		avl_remove(&scn->scn_prefetch_queue, spic);
1741 
1742 		mutex_exit(&spa->spa_scrub_lock);
1743 
1744 		if (BP_IS_PROTECTED(&spic->spic_bp)) {
1745 			ASSERT(BP_GET_TYPE(&spic->spic_bp) == DMU_OT_DNODE ||
1746 			    BP_GET_TYPE(&spic->spic_bp) == DMU_OT_OBJSET);
1747 			ASSERT3U(BP_GET_LEVEL(&spic->spic_bp), ==, 0);
1748 			zio_flags |= ZIO_FLAG_RAW;
1749 		}
1750 
1751 		/* issue the prefetch asynchronously */
1752 		(void) arc_read(scn->scn_zio_root, scn->scn_dp->dp_spa,
1753 		    &spic->spic_bp, dsl_scan_prefetch_cb, spic->spic_spc,
1754 		    ZIO_PRIORITY_SCRUB, zio_flags, &flags, &spic->spic_zb);
1755 
1756 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
1757 	}
1758 
1759 	ASSERT(scn->scn_prefetch_stop);
1760 
1761 	/* free any prefetches we didn't get to complete */
1762 	mutex_enter(&spa->spa_scrub_lock);
1763 	while ((spic = avl_first(&scn->scn_prefetch_queue)) != NULL) {
1764 		avl_remove(&scn->scn_prefetch_queue, spic);
1765 		scan_prefetch_ctx_rele(spic->spic_spc, scn);
1766 		kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
1767 	}
1768 	ASSERT0(avl_numnodes(&scn->scn_prefetch_queue));
1769 	mutex_exit(&spa->spa_scrub_lock);
1770 }
1771 
1772 static boolean_t
1773 dsl_scan_check_resume(dsl_scan_t *scn, const dnode_phys_t *dnp,
1774     const zbookmark_phys_t *zb)
1775 {
1776 	/*
1777 	 * We never skip over user/group accounting objects (obj<0)
1778 	 */
1779 	if (!ZB_IS_ZERO(&scn->scn_phys.scn_bookmark) &&
1780 	    (int64_t)zb->zb_object >= 0) {
1781 		/*
1782 		 * If we already visited this bp & everything below (in
1783 		 * a prior txg sync), don't bother doing it again.
1784 		 */
1785 		if (zbookmark_subtree_completed(dnp, zb,
1786 		    &scn->scn_phys.scn_bookmark))
1787 			return (B_TRUE);
1788 
1789 		/*
1790 		 * If we found the block we're trying to resume from, or
1791 		 * we went past it to a different object, zero it out to
1792 		 * indicate that it's OK to start checking for suspending
1793 		 * again.
1794 		 */
1795 		if (bcmp(zb, &scn->scn_phys.scn_bookmark, sizeof (*zb)) == 0 ||
1796 		    zb->zb_object > scn->scn_phys.scn_bookmark.zb_object) {
1797 			dprintf("resuming at %llx/%llx/%llx/%llx\n",
1798 			    (longlong_t)zb->zb_objset,
1799 			    (longlong_t)zb->zb_object,
1800 			    (longlong_t)zb->zb_level,
1801 			    (longlong_t)zb->zb_blkid);
1802 			bzero(&scn->scn_phys.scn_bookmark, sizeof (*zb));
1803 		}
1804 	}
1805 	return (B_FALSE);
1806 }
1807 
1808 static void dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
1809     dnode_phys_t *dnp, dsl_dataset_t *ds, dsl_scan_t *scn,
1810     dmu_objset_type_t ostype, dmu_tx_t *tx);
1811 inline __attribute__((always_inline)) static void dsl_scan_visitdnode(
1812     dsl_scan_t *, dsl_dataset_t *ds, dmu_objset_type_t ostype,
1813     dnode_phys_t *dnp, uint64_t object, dmu_tx_t *tx);
1814 
1815 /*
1816  * Return nonzero on i/o error.
1817  * Return new buf to write out in *bufp.
1818  */
1819 inline __attribute__((always_inline)) static int
1820 dsl_scan_recurse(dsl_scan_t *scn, dsl_dataset_t *ds, dmu_objset_type_t ostype,
1821     dnode_phys_t *dnp, const blkptr_t *bp,
1822     const zbookmark_phys_t *zb, dmu_tx_t *tx)
1823 {
1824 	dsl_pool_t *dp = scn->scn_dp;
1825 	int zio_flags = ZIO_FLAG_CANFAIL | ZIO_FLAG_SCAN_THREAD;
1826 	int err;
1827 
1828 	ASSERT(!BP_IS_REDACTED(bp));
1829 
1830 	if (BP_GET_LEVEL(bp) > 0) {
1831 		arc_flags_t flags = ARC_FLAG_WAIT;
1832 		int i;
1833 		blkptr_t *cbp;
1834 		int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
1835 		arc_buf_t *buf;
1836 
1837 		err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
1838 		    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
1839 		if (err) {
1840 			scn->scn_phys.scn_errors++;
1841 			return (err);
1842 		}
1843 		for (i = 0, cbp = buf->b_data; i < epb; i++, cbp++) {
1844 			zbookmark_phys_t czb;
1845 
1846 			SET_BOOKMARK(&czb, zb->zb_objset, zb->zb_object,
1847 			    zb->zb_level - 1,
1848 			    zb->zb_blkid * epb + i);
1849 			dsl_scan_visitbp(cbp, &czb, dnp,
1850 			    ds, scn, ostype, tx);
1851 		}
1852 		arc_buf_destroy(buf, &buf);
1853 	} else if (BP_GET_TYPE(bp) == DMU_OT_DNODE) {
1854 		arc_flags_t flags = ARC_FLAG_WAIT;
1855 		dnode_phys_t *cdnp;
1856 		int i;
1857 		int epb = BP_GET_LSIZE(bp) >> DNODE_SHIFT;
1858 		arc_buf_t *buf;
1859 
1860 		if (BP_IS_PROTECTED(bp)) {
1861 			ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
1862 			zio_flags |= ZIO_FLAG_RAW;
1863 		}
1864 
1865 		err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
1866 		    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
1867 		if (err) {
1868 			scn->scn_phys.scn_errors++;
1869 			return (err);
1870 		}
1871 		for (i = 0, cdnp = buf->b_data; i < epb;
1872 		    i += cdnp->dn_extra_slots + 1,
1873 		    cdnp += cdnp->dn_extra_slots + 1) {
1874 			dsl_scan_visitdnode(scn, ds, ostype,
1875 			    cdnp, zb->zb_blkid * epb + i, tx);
1876 		}
1877 
1878 		arc_buf_destroy(buf, &buf);
1879 	} else if (BP_GET_TYPE(bp) == DMU_OT_OBJSET) {
1880 		arc_flags_t flags = ARC_FLAG_WAIT;
1881 		objset_phys_t *osp;
1882 		arc_buf_t *buf;
1883 
1884 		err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
1885 		    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
1886 		if (err) {
1887 			scn->scn_phys.scn_errors++;
1888 			return (err);
1889 		}
1890 
1891 		osp = buf->b_data;
1892 
1893 		dsl_scan_visitdnode(scn, ds, osp->os_type,
1894 		    &osp->os_meta_dnode, DMU_META_DNODE_OBJECT, tx);
1895 
1896 		if (OBJSET_BUF_HAS_USERUSED(buf)) {
1897 			/*
1898 			 * We also always visit user/group/project accounting
1899 			 * objects, and never skip them, even if we are
1900 			 * suspending. This is necessary so that the
1901 			 * space deltas from this txg get integrated.
1902 			 */
1903 			if (OBJSET_BUF_HAS_PROJECTUSED(buf))
1904 				dsl_scan_visitdnode(scn, ds, osp->os_type,
1905 				    &osp->os_projectused_dnode,
1906 				    DMU_PROJECTUSED_OBJECT, tx);
1907 			dsl_scan_visitdnode(scn, ds, osp->os_type,
1908 			    &osp->os_groupused_dnode,
1909 			    DMU_GROUPUSED_OBJECT, tx);
1910 			dsl_scan_visitdnode(scn, ds, osp->os_type,
1911 			    &osp->os_userused_dnode,
1912 			    DMU_USERUSED_OBJECT, tx);
1913 		}
1914 		arc_buf_destroy(buf, &buf);
1915 	}
1916 
1917 	return (0);
1918 }
1919 
1920 inline __attribute__((always_inline)) static void
1921 dsl_scan_visitdnode(dsl_scan_t *scn, dsl_dataset_t *ds,
1922     dmu_objset_type_t ostype, dnode_phys_t *dnp,
1923     uint64_t object, dmu_tx_t *tx)
1924 {
1925 	int j;
1926 
1927 	for (j = 0; j < dnp->dn_nblkptr; j++) {
1928 		zbookmark_phys_t czb;
1929 
1930 		SET_BOOKMARK(&czb, ds ? ds->ds_object : 0, object,
1931 		    dnp->dn_nlevels - 1, j);
1932 		dsl_scan_visitbp(&dnp->dn_blkptr[j],
1933 		    &czb, dnp, ds, scn, ostype, tx);
1934 	}
1935 
1936 	if (dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR) {
1937 		zbookmark_phys_t czb;
1938 		SET_BOOKMARK(&czb, ds ? ds->ds_object : 0, object,
1939 		    0, DMU_SPILL_BLKID);
1940 		dsl_scan_visitbp(DN_SPILL_BLKPTR(dnp),
1941 		    &czb, dnp, ds, scn, ostype, tx);
1942 	}
1943 }
1944 
1945 /*
1946  * The arguments are in this order because mdb can only print the
1947  * first 5; we want them to be useful.
1948  */
1949 static void
1950 dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
1951     dnode_phys_t *dnp, dsl_dataset_t *ds, dsl_scan_t *scn,
1952     dmu_objset_type_t ostype, dmu_tx_t *tx)
1953 {
1954 	dsl_pool_t *dp = scn->scn_dp;
1955 	blkptr_t *bp_toread = NULL;
1956 
1957 	if (dsl_scan_check_suspend(scn, zb))
1958 		return;
1959 
1960 	if (dsl_scan_check_resume(scn, dnp, zb))
1961 		return;
1962 
1963 	scn->scn_visited_this_txg++;
1964 
1965 	/*
1966 	 * This debugging is commented out to conserve stack space.  This
1967 	 * function is called recursively and the debugging adds several
1968 	 * bytes to the stack for each call.  It can be commented back in
1969 	 * if required to debug an issue in dsl_scan_visitbp().
1970 	 *
1971 	 * dprintf_bp(bp,
1972 	 *     "visiting ds=%p/%llu zb=%llx/%llx/%llx/%llx bp=%p",
1973 	 *     ds, ds ? ds->ds_object : 0,
1974 	 *     zb->zb_objset, zb->zb_object, zb->zb_level, zb->zb_blkid,
1975 	 *     bp);
1976 	 */
1977 
1978 	if (BP_IS_HOLE(bp)) {
1979 		scn->scn_holes_this_txg++;
1980 		return;
1981 	}
1982 
1983 	if (BP_IS_REDACTED(bp)) {
1984 		ASSERT(dsl_dataset_feature_is_active(ds,
1985 		    SPA_FEATURE_REDACTED_DATASETS));
1986 		return;
1987 	}
1988 
1989 	if (bp->blk_birth <= scn->scn_phys.scn_cur_min_txg) {
1990 		scn->scn_lt_min_this_txg++;
1991 		return;
1992 	}
1993 
1994 	bp_toread = kmem_alloc(sizeof (blkptr_t), KM_SLEEP);
1995 	*bp_toread = *bp;
1996 
1997 	if (dsl_scan_recurse(scn, ds, ostype, dnp, bp_toread, zb, tx) != 0)
1998 		goto out;
1999 
2000 	/*
2001 	 * If dsl_scan_ddt() has already visited this block, it will have
2002 	 * already done any translations or scrubbing, so don't call the
2003 	 * callback again.
2004 	 */
2005 	if (ddt_class_contains(dp->dp_spa,
2006 	    scn->scn_phys.scn_ddt_class_max, bp)) {
2007 		scn->scn_ddt_contained_this_txg++;
2008 		goto out;
2009 	}
2010 
2011 	/*
2012 	 * If this block is from the future (after cur_max_txg), then we
2013 	 * are doing this on behalf of a deleted snapshot, and we will
2014 	 * revisit the future block on the next pass of this dataset.
2015 	 * Don't scan it now unless we need to because something
2016 	 * under it was modified.
2017 	 */
2018 	if (BP_PHYSICAL_BIRTH(bp) > scn->scn_phys.scn_cur_max_txg) {
2019 		scn->scn_gt_max_this_txg++;
2020 		goto out;
2021 	}
2022 
2023 	scan_funcs[scn->scn_phys.scn_func](dp, bp, zb);
2024 
2025 out:
2026 	kmem_free(bp_toread, sizeof (blkptr_t));
2027 }
2028 
2029 static void
2030 dsl_scan_visit_rootbp(dsl_scan_t *scn, dsl_dataset_t *ds, blkptr_t *bp,
2031     dmu_tx_t *tx)
2032 {
2033 	zbookmark_phys_t zb;
2034 	scan_prefetch_ctx_t *spc;
2035 
2036 	SET_BOOKMARK(&zb, ds ? ds->ds_object : DMU_META_OBJSET,
2037 	    ZB_ROOT_OBJECT, ZB_ROOT_LEVEL, ZB_ROOT_BLKID);
2038 
2039 	if (ZB_IS_ZERO(&scn->scn_phys.scn_bookmark)) {
2040 		SET_BOOKMARK(&scn->scn_prefetch_bookmark,
2041 		    zb.zb_objset, 0, 0, 0);
2042 	} else {
2043 		scn->scn_prefetch_bookmark = scn->scn_phys.scn_bookmark;
2044 	}
2045 
2046 	scn->scn_objsets_visited_this_txg++;
2047 
2048 	spc = scan_prefetch_ctx_create(scn, NULL, FTAG);
2049 	dsl_scan_prefetch(spc, bp, &zb);
2050 	scan_prefetch_ctx_rele(spc, FTAG);
2051 
2052 	dsl_scan_visitbp(bp, &zb, NULL, ds, scn, DMU_OST_NONE, tx);
2053 
2054 	dprintf_ds(ds, "finished scan%s", "");
2055 }
2056 
2057 static void
2058 ds_destroyed_scn_phys(dsl_dataset_t *ds, dsl_scan_phys_t *scn_phys)
2059 {
2060 	if (scn_phys->scn_bookmark.zb_objset == ds->ds_object) {
2061 		if (ds->ds_is_snapshot) {
2062 			/*
2063 			 * Note:
2064 			 *  - scn_cur_{min,max}_txg stays the same.
2065 			 *  - Setting the flag is not really necessary if
2066 			 *    scn_cur_max_txg == scn_max_txg, because there
2067 			 *    is nothing after this snapshot that we care
2068 			 *    about.  However, we set it anyway and then
2069 			 *    ignore it when we retraverse it in
2070 			 *    dsl_scan_visitds().
2071 			 */
2072 			scn_phys->scn_bookmark.zb_objset =
2073 			    dsl_dataset_phys(ds)->ds_next_snap_obj;
2074 			zfs_dbgmsg("destroying ds %llu on %s; currently "
2075 			    "traversing; reset zb_objset to %llu",
2076 			    (u_longlong_t)ds->ds_object,
2077 			    ds->ds_dir->dd_pool->dp_spa->spa_name,
2078 			    (u_longlong_t)dsl_dataset_phys(ds)->
2079 			    ds_next_snap_obj);
2080 			scn_phys->scn_flags |= DSF_VISIT_DS_AGAIN;
2081 		} else {
2082 			SET_BOOKMARK(&scn_phys->scn_bookmark,
2083 			    ZB_DESTROYED_OBJSET, 0, 0, 0);
2084 			zfs_dbgmsg("destroying ds %llu on %s; currently "
2085 			    "traversing; reset bookmark to -1,0,0,0",
2086 			    (u_longlong_t)ds->ds_object,
2087 			    ds->ds_dir->dd_pool->dp_spa->spa_name);
2088 		}
2089 	}
2090 }
2091 
2092 /*
2093  * Invoked when a dataset is destroyed. We need to make sure that:
2094  *
2095  * 1) If it is the dataset that was currently being scanned, we write
2096  *	a new dsl_scan_phys_t and marking the objset reference in it
2097  *	as destroyed.
2098  * 2) Remove it from the work queue, if it was present.
2099  *
2100  * If the dataset was actually a snapshot, instead of marking the dataset
2101  * as destroyed, we instead substitute the next snapshot in line.
2102  */
2103 void
2104 dsl_scan_ds_destroyed(dsl_dataset_t *ds, dmu_tx_t *tx)
2105 {
2106 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
2107 	dsl_scan_t *scn = dp->dp_scan;
2108 	uint64_t mintxg;
2109 
2110 	if (!dsl_scan_is_running(scn))
2111 		return;
2112 
2113 	ds_destroyed_scn_phys(ds, &scn->scn_phys);
2114 	ds_destroyed_scn_phys(ds, &scn->scn_phys_cached);
2115 
2116 	if (scan_ds_queue_contains(scn, ds->ds_object, &mintxg)) {
2117 		scan_ds_queue_remove(scn, ds->ds_object);
2118 		if (ds->ds_is_snapshot)
2119 			scan_ds_queue_insert(scn,
2120 			    dsl_dataset_phys(ds)->ds_next_snap_obj, mintxg);
2121 	}
2122 
2123 	if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
2124 	    ds->ds_object, &mintxg) == 0) {
2125 		ASSERT3U(dsl_dataset_phys(ds)->ds_num_children, <=, 1);
2126 		VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
2127 		    scn->scn_phys.scn_queue_obj, ds->ds_object, tx));
2128 		if (ds->ds_is_snapshot) {
2129 			/*
2130 			 * We keep the same mintxg; it could be >
2131 			 * ds_creation_txg if the previous snapshot was
2132 			 * deleted too.
2133 			 */
2134 			VERIFY(zap_add_int_key(dp->dp_meta_objset,
2135 			    scn->scn_phys.scn_queue_obj,
2136 			    dsl_dataset_phys(ds)->ds_next_snap_obj,
2137 			    mintxg, tx) == 0);
2138 			zfs_dbgmsg("destroying ds %llu on %s; in queue; "
2139 			    "replacing with %llu",
2140 			    (u_longlong_t)ds->ds_object,
2141 			    dp->dp_spa->spa_name,
2142 			    (u_longlong_t)dsl_dataset_phys(ds)->
2143 			    ds_next_snap_obj);
2144 		} else {
2145 			zfs_dbgmsg("destroying ds %llu on %s; in queue; "
2146 			    "removing",
2147 			    (u_longlong_t)ds->ds_object,
2148 			    dp->dp_spa->spa_name);
2149 		}
2150 	}
2151 
2152 	/*
2153 	 * dsl_scan_sync() should be called after this, and should sync
2154 	 * out our changed state, but just to be safe, do it here.
2155 	 */
2156 	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
2157 }
2158 
2159 static void
2160 ds_snapshotted_bookmark(dsl_dataset_t *ds, zbookmark_phys_t *scn_bookmark)
2161 {
2162 	if (scn_bookmark->zb_objset == ds->ds_object) {
2163 		scn_bookmark->zb_objset =
2164 		    dsl_dataset_phys(ds)->ds_prev_snap_obj;
2165 		zfs_dbgmsg("snapshotting ds %llu on %s; currently traversing; "
2166 		    "reset zb_objset to %llu",
2167 		    (u_longlong_t)ds->ds_object,
2168 		    ds->ds_dir->dd_pool->dp_spa->spa_name,
2169 		    (u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
2170 	}
2171 }
2172 
2173 /*
2174  * Called when a dataset is snapshotted. If we were currently traversing
2175  * this snapshot, we reset our bookmark to point at the newly created
2176  * snapshot. We also modify our work queue to remove the old snapshot and
2177  * replace with the new one.
2178  */
2179 void
2180 dsl_scan_ds_snapshotted(dsl_dataset_t *ds, dmu_tx_t *tx)
2181 {
2182 	dsl_pool_t *dp = ds->ds_dir->dd_pool;
2183 	dsl_scan_t *scn = dp->dp_scan;
2184 	uint64_t mintxg;
2185 
2186 	if (!dsl_scan_is_running(scn))
2187 		return;
2188 
2189 	ASSERT(dsl_dataset_phys(ds)->ds_prev_snap_obj != 0);
2190 
2191 	ds_snapshotted_bookmark(ds, &scn->scn_phys.scn_bookmark);
2192 	ds_snapshotted_bookmark(ds, &scn->scn_phys_cached.scn_bookmark);
2193 
2194 	if (scan_ds_queue_contains(scn, ds->ds_object, &mintxg)) {
2195 		scan_ds_queue_remove(scn, ds->ds_object);
2196 		scan_ds_queue_insert(scn,
2197 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, mintxg);
2198 	}
2199 
2200 	if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
2201 	    ds->ds_object, &mintxg) == 0) {
2202 		VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
2203 		    scn->scn_phys.scn_queue_obj, ds->ds_object, tx));
2204 		VERIFY(zap_add_int_key(dp->dp_meta_objset,
2205 		    scn->scn_phys.scn_queue_obj,
2206 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, mintxg, tx) == 0);
2207 		zfs_dbgmsg("snapshotting ds %llu on %s; in queue; "
2208 		    "replacing with %llu",
2209 		    (u_longlong_t)ds->ds_object,
2210 		    dp->dp_spa->spa_name,
2211 		    (u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
2212 	}
2213 
2214 	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
2215 }
2216 
2217 static void
2218 ds_clone_swapped_bookmark(dsl_dataset_t *ds1, dsl_dataset_t *ds2,
2219     zbookmark_phys_t *scn_bookmark)
2220 {
2221 	if (scn_bookmark->zb_objset == ds1->ds_object) {
2222 		scn_bookmark->zb_objset = ds2->ds_object;
2223 		zfs_dbgmsg("clone_swap ds %llu on %s; currently traversing; "
2224 		    "reset zb_objset to %llu",
2225 		    (u_longlong_t)ds1->ds_object,
2226 		    ds1->ds_dir->dd_pool->dp_spa->spa_name,
2227 		    (u_longlong_t)ds2->ds_object);
2228 	} else if (scn_bookmark->zb_objset == ds2->ds_object) {
2229 		scn_bookmark->zb_objset = ds1->ds_object;
2230 		zfs_dbgmsg("clone_swap ds %llu on %s; currently traversing; "
2231 		    "reset zb_objset to %llu",
2232 		    (u_longlong_t)ds2->ds_object,
2233 		    ds2->ds_dir->dd_pool->dp_spa->spa_name,
2234 		    (u_longlong_t)ds1->ds_object);
2235 	}
2236 }
2237 
2238 /*
2239  * Called when an origin dataset and its clone are swapped.  If we were
2240  * currently traversing the dataset, we need to switch to traversing the
2241  * newly promoted clone.
2242  */
2243 void
2244 dsl_scan_ds_clone_swapped(dsl_dataset_t *ds1, dsl_dataset_t *ds2, dmu_tx_t *tx)
2245 {
2246 	dsl_pool_t *dp = ds1->ds_dir->dd_pool;
2247 	dsl_scan_t *scn = dp->dp_scan;
2248 	uint64_t mintxg1, mintxg2;
2249 	boolean_t ds1_queued, ds2_queued;
2250 
2251 	if (!dsl_scan_is_running(scn))
2252 		return;
2253 
2254 	ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys.scn_bookmark);
2255 	ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys_cached.scn_bookmark);
2256 
2257 	/*
2258 	 * Handle the in-memory scan queue.
2259 	 */
2260 	ds1_queued = scan_ds_queue_contains(scn, ds1->ds_object, &mintxg1);
2261 	ds2_queued = scan_ds_queue_contains(scn, ds2->ds_object, &mintxg2);
2262 
2263 	/* Sanity checking. */
2264 	if (ds1_queued) {
2265 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2266 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2267 	}
2268 	if (ds2_queued) {
2269 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2270 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2271 	}
2272 
2273 	if (ds1_queued && ds2_queued) {
2274 		/*
2275 		 * If both are queued, we don't need to do anything.
2276 		 * The swapping code below would not handle this case correctly,
2277 		 * since we can't insert ds2 if it is already there. That's
2278 		 * because scan_ds_queue_insert() prohibits a duplicate insert
2279 		 * and panics.
2280 		 */
2281 	} else if (ds1_queued) {
2282 		scan_ds_queue_remove(scn, ds1->ds_object);
2283 		scan_ds_queue_insert(scn, ds2->ds_object, mintxg1);
2284 	} else if (ds2_queued) {
2285 		scan_ds_queue_remove(scn, ds2->ds_object);
2286 		scan_ds_queue_insert(scn, ds1->ds_object, mintxg2);
2287 	}
2288 
2289 	/*
2290 	 * Handle the on-disk scan queue.
2291 	 * The on-disk state is an out-of-date version of the in-memory state,
2292 	 * so the in-memory and on-disk values for ds1_queued and ds2_queued may
2293 	 * be different. Therefore we need to apply the swap logic to the
2294 	 * on-disk state independently of the in-memory state.
2295 	 */
2296 	ds1_queued = zap_lookup_int_key(dp->dp_meta_objset,
2297 	    scn->scn_phys.scn_queue_obj, ds1->ds_object, &mintxg1) == 0;
2298 	ds2_queued = zap_lookup_int_key(dp->dp_meta_objset,
2299 	    scn->scn_phys.scn_queue_obj, ds2->ds_object, &mintxg2) == 0;
2300 
2301 	/* Sanity checking. */
2302 	if (ds1_queued) {
2303 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2304 		ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2305 	}
2306 	if (ds2_queued) {
2307 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
2308 		ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
2309 	}
2310 
2311 	if (ds1_queued && ds2_queued) {
2312 		/*
2313 		 * If both are queued, we don't need to do anything.
2314 		 * Alternatively, we could check for EEXIST from
2315 		 * zap_add_int_key() and back out to the original state, but
2316 		 * that would be more work than checking for this case upfront.
2317 		 */
2318 	} else if (ds1_queued) {
2319 		VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
2320 		    scn->scn_phys.scn_queue_obj, ds1->ds_object, tx));
2321 		VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
2322 		    scn->scn_phys.scn_queue_obj, ds2->ds_object, mintxg1, tx));
2323 		zfs_dbgmsg("clone_swap ds %llu on %s; in queue; "
2324 		    "replacing with %llu",
2325 		    (u_longlong_t)ds1->ds_object,
2326 		    dp->dp_spa->spa_name,
2327 		    (u_longlong_t)ds2->ds_object);
2328 	} else if (ds2_queued) {
2329 		VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
2330 		    scn->scn_phys.scn_queue_obj, ds2->ds_object, tx));
2331 		VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
2332 		    scn->scn_phys.scn_queue_obj, ds1->ds_object, mintxg2, tx));
2333 		zfs_dbgmsg("clone_swap ds %llu on %s; in queue; "
2334 		    "replacing with %llu",
2335 		    (u_longlong_t)ds2->ds_object,
2336 		    dp->dp_spa->spa_name,
2337 		    (u_longlong_t)ds1->ds_object);
2338 	}
2339 
2340 	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
2341 }
2342 
2343 /* ARGSUSED */
2344 static int
2345 enqueue_clones_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
2346 {
2347 	uint64_t originobj = *(uint64_t *)arg;
2348 	dsl_dataset_t *ds;
2349 	int err;
2350 	dsl_scan_t *scn = dp->dp_scan;
2351 
2352 	if (dsl_dir_phys(hds->ds_dir)->dd_origin_obj != originobj)
2353 		return (0);
2354 
2355 	err = dsl_dataset_hold_obj(dp, hds->ds_object, FTAG, &ds);
2356 	if (err)
2357 		return (err);
2358 
2359 	while (dsl_dataset_phys(ds)->ds_prev_snap_obj != originobj) {
2360 		dsl_dataset_t *prev;
2361 		err = dsl_dataset_hold_obj(dp,
2362 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, FTAG, &prev);
2363 
2364 		dsl_dataset_rele(ds, FTAG);
2365 		if (err)
2366 			return (err);
2367 		ds = prev;
2368 	}
2369 	scan_ds_queue_insert(scn, ds->ds_object,
2370 	    dsl_dataset_phys(ds)->ds_prev_snap_txg);
2371 	dsl_dataset_rele(ds, FTAG);
2372 	return (0);
2373 }
2374 
2375 static void
2376 dsl_scan_visitds(dsl_scan_t *scn, uint64_t dsobj, dmu_tx_t *tx)
2377 {
2378 	dsl_pool_t *dp = scn->scn_dp;
2379 	dsl_dataset_t *ds;
2380 
2381 	VERIFY3U(0, ==, dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds));
2382 
2383 	if (scn->scn_phys.scn_cur_min_txg >=
2384 	    scn->scn_phys.scn_max_txg) {
2385 		/*
2386 		 * This can happen if this snapshot was created after the
2387 		 * scan started, and we already completed a previous snapshot
2388 		 * that was created after the scan started.  This snapshot
2389 		 * only references blocks with:
2390 		 *
2391 		 *	birth < our ds_creation_txg
2392 		 *	cur_min_txg is no less than ds_creation_txg.
2393 		 *	We have already visited these blocks.
2394 		 * or
2395 		 *	birth > scn_max_txg
2396 		 *	The scan requested not to visit these blocks.
2397 		 *
2398 		 * Subsequent snapshots (and clones) can reference our
2399 		 * blocks, or blocks with even higher birth times.
2400 		 * Therefore we do not need to visit them either,
2401 		 * so we do not add them to the work queue.
2402 		 *
2403 		 * Note that checking for cur_min_txg >= cur_max_txg
2404 		 * is not sufficient, because in that case we may need to
2405 		 * visit subsequent snapshots.  This happens when min_txg > 0,
2406 		 * which raises cur_min_txg.  In this case we will visit
2407 		 * this dataset but skip all of its blocks, because the
2408 		 * rootbp's birth time is < cur_min_txg.  Then we will
2409 		 * add the next snapshots/clones to the work queue.
2410 		 */
2411 		char *dsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
2412 		dsl_dataset_name(ds, dsname);
2413 		zfs_dbgmsg("scanning dataset %llu (%s) is unnecessary because "
2414 		    "cur_min_txg (%llu) >= max_txg (%llu)",
2415 		    (longlong_t)dsobj, dsname,
2416 		    (longlong_t)scn->scn_phys.scn_cur_min_txg,
2417 		    (longlong_t)scn->scn_phys.scn_max_txg);
2418 		kmem_free(dsname, MAXNAMELEN);
2419 
2420 		goto out;
2421 	}
2422 
2423 	/*
2424 	 * Only the ZIL in the head (non-snapshot) is valid. Even though
2425 	 * snapshots can have ZIL block pointers (which may be the same
2426 	 * BP as in the head), they must be ignored. In addition, $ORIGIN
2427 	 * doesn't have a objset (i.e. its ds_bp is a hole) so we don't
2428 	 * need to look for a ZIL in it either. So we traverse the ZIL here,
2429 	 * rather than in scan_recurse(), because the regular snapshot
2430 	 * block-sharing rules don't apply to it.
2431 	 */
2432 	if (!dsl_dataset_is_snapshot(ds) &&
2433 	    (dp->dp_origin_snap == NULL ||
2434 	    ds->ds_dir != dp->dp_origin_snap->ds_dir)) {
2435 		objset_t *os;
2436 		if (dmu_objset_from_ds(ds, &os) != 0) {
2437 			goto out;
2438 		}
2439 		dsl_scan_zil(dp, &os->os_zil_header);
2440 	}
2441 
2442 	/*
2443 	 * Iterate over the bps in this ds.
2444 	 */
2445 	dmu_buf_will_dirty(ds->ds_dbuf, tx);
2446 	rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG);
2447 	dsl_scan_visit_rootbp(scn, ds, &dsl_dataset_phys(ds)->ds_bp, tx);
2448 	rrw_exit(&ds->ds_bp_rwlock, FTAG);
2449 
2450 	char *dsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
2451 	dsl_dataset_name(ds, dsname);
2452 	zfs_dbgmsg("scanned dataset %llu (%s) with min=%llu max=%llu; "
2453 	    "suspending=%u",
2454 	    (longlong_t)dsobj, dsname,
2455 	    (longlong_t)scn->scn_phys.scn_cur_min_txg,
2456 	    (longlong_t)scn->scn_phys.scn_cur_max_txg,
2457 	    (int)scn->scn_suspending);
2458 	kmem_free(dsname, ZFS_MAX_DATASET_NAME_LEN);
2459 
2460 	if (scn->scn_suspending)
2461 		goto out;
2462 
2463 	/*
2464 	 * We've finished this pass over this dataset.
2465 	 */
2466 
2467 	/*
2468 	 * If we did not completely visit this dataset, do another pass.
2469 	 */
2470 	if (scn->scn_phys.scn_flags & DSF_VISIT_DS_AGAIN) {
2471 		zfs_dbgmsg("incomplete pass on %s; visiting again",
2472 		    dp->dp_spa->spa_name);
2473 		scn->scn_phys.scn_flags &= ~DSF_VISIT_DS_AGAIN;
2474 		scan_ds_queue_insert(scn, ds->ds_object,
2475 		    scn->scn_phys.scn_cur_max_txg);
2476 		goto out;
2477 	}
2478 
2479 	/*
2480 	 * Add descendant datasets to work queue.
2481 	 */
2482 	if (dsl_dataset_phys(ds)->ds_next_snap_obj != 0) {
2483 		scan_ds_queue_insert(scn,
2484 		    dsl_dataset_phys(ds)->ds_next_snap_obj,
2485 		    dsl_dataset_phys(ds)->ds_creation_txg);
2486 	}
2487 	if (dsl_dataset_phys(ds)->ds_num_children > 1) {
2488 		boolean_t usenext = B_FALSE;
2489 		if (dsl_dataset_phys(ds)->ds_next_clones_obj != 0) {
2490 			uint64_t count;
2491 			/*
2492 			 * A bug in a previous version of the code could
2493 			 * cause upgrade_clones_cb() to not set
2494 			 * ds_next_snap_obj when it should, leading to a
2495 			 * missing entry.  Therefore we can only use the
2496 			 * next_clones_obj when its count is correct.
2497 			 */
2498 			int err = zap_count(dp->dp_meta_objset,
2499 			    dsl_dataset_phys(ds)->ds_next_clones_obj, &count);
2500 			if (err == 0 &&
2501 			    count == dsl_dataset_phys(ds)->ds_num_children - 1)
2502 				usenext = B_TRUE;
2503 		}
2504 
2505 		if (usenext) {
2506 			zap_cursor_t zc;
2507 			zap_attribute_t za;
2508 			for (zap_cursor_init(&zc, dp->dp_meta_objset,
2509 			    dsl_dataset_phys(ds)->ds_next_clones_obj);
2510 			    zap_cursor_retrieve(&zc, &za) == 0;
2511 			    (void) zap_cursor_advance(&zc)) {
2512 				scan_ds_queue_insert(scn,
2513 				    zfs_strtonum(za.za_name, NULL),
2514 				    dsl_dataset_phys(ds)->ds_creation_txg);
2515 			}
2516 			zap_cursor_fini(&zc);
2517 		} else {
2518 			VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
2519 			    enqueue_clones_cb, &ds->ds_object,
2520 			    DS_FIND_CHILDREN));
2521 		}
2522 	}
2523 
2524 out:
2525 	dsl_dataset_rele(ds, FTAG);
2526 }
2527 
2528 /* ARGSUSED */
2529 static int
2530 enqueue_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
2531 {
2532 	dsl_dataset_t *ds;
2533 	int err;
2534 	dsl_scan_t *scn = dp->dp_scan;
2535 
2536 	err = dsl_dataset_hold_obj(dp, hds->ds_object, FTAG, &ds);
2537 	if (err)
2538 		return (err);
2539 
2540 	while (dsl_dataset_phys(ds)->ds_prev_snap_obj != 0) {
2541 		dsl_dataset_t *prev;
2542 		err = dsl_dataset_hold_obj(dp,
2543 		    dsl_dataset_phys(ds)->ds_prev_snap_obj, FTAG, &prev);
2544 		if (err) {
2545 			dsl_dataset_rele(ds, FTAG);
2546 			return (err);
2547 		}
2548 
2549 		/*
2550 		 * If this is a clone, we don't need to worry about it for now.
2551 		 */
2552 		if (dsl_dataset_phys(prev)->ds_next_snap_obj != ds->ds_object) {
2553 			dsl_dataset_rele(ds, FTAG);
2554 			dsl_dataset_rele(prev, FTAG);
2555 			return (0);
2556 		}
2557 		dsl_dataset_rele(ds, FTAG);
2558 		ds = prev;
2559 	}
2560 
2561 	scan_ds_queue_insert(scn, ds->ds_object,
2562 	    dsl_dataset_phys(ds)->ds_prev_snap_txg);
2563 	dsl_dataset_rele(ds, FTAG);
2564 	return (0);
2565 }
2566 
2567 /* ARGSUSED */
2568 void
2569 dsl_scan_ddt_entry(dsl_scan_t *scn, enum zio_checksum checksum,
2570     ddt_entry_t *dde, dmu_tx_t *tx)
2571 {
2572 	const ddt_key_t *ddk = &dde->dde_key;
2573 	ddt_phys_t *ddp = dde->dde_phys;
2574 	blkptr_t bp;
2575 	zbookmark_phys_t zb = { 0 };
2576 	int p;
2577 
2578 	if (!dsl_scan_is_running(scn))
2579 		return;
2580 
2581 	/*
2582 	 * This function is special because it is the only thing
2583 	 * that can add scan_io_t's to the vdev scan queues from
2584 	 * outside dsl_scan_sync(). For the most part this is ok
2585 	 * as long as it is called from within syncing context.
2586 	 * However, dsl_scan_sync() expects that no new sio's will
2587 	 * be added between when all the work for a scan is done
2588 	 * and the next txg when the scan is actually marked as
2589 	 * completed. This check ensures we do not issue new sio's
2590 	 * during this period.
2591 	 */
2592 	if (scn->scn_done_txg != 0)
2593 		return;
2594 
2595 	for (p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
2596 		if (ddp->ddp_phys_birth == 0 ||
2597 		    ddp->ddp_phys_birth > scn->scn_phys.scn_max_txg)
2598 			continue;
2599 		ddt_bp_create(checksum, ddk, ddp, &bp);
2600 
2601 		scn->scn_visited_this_txg++;
2602 		scan_funcs[scn->scn_phys.scn_func](scn->scn_dp, &bp, &zb);
2603 	}
2604 }
2605 
2606 /*
2607  * Scrub/dedup interaction.
2608  *
2609  * If there are N references to a deduped block, we don't want to scrub it
2610  * N times -- ideally, we should scrub it exactly once.
2611  *
2612  * We leverage the fact that the dde's replication class (enum ddt_class)
2613  * is ordered from highest replication class (DDT_CLASS_DITTO) to lowest
2614  * (DDT_CLASS_UNIQUE) so that we may walk the DDT in that order.
2615  *
2616  * To prevent excess scrubbing, the scrub begins by walking the DDT
2617  * to find all blocks with refcnt > 1, and scrubs each of these once.
2618  * Since there are two replication classes which contain blocks with
2619  * refcnt > 1, we scrub the highest replication class (DDT_CLASS_DITTO) first.
2620  * Finally the top-down scrub begins, only visiting blocks with refcnt == 1.
2621  *
2622  * There would be nothing more to say if a block's refcnt couldn't change
2623  * during a scrub, but of course it can so we must account for changes
2624  * in a block's replication class.
2625  *
2626  * Here's an example of what can occur:
2627  *
2628  * If a block has refcnt > 1 during the DDT scrub phase, but has refcnt == 1
2629  * when visited during the top-down scrub phase, it will be scrubbed twice.
2630  * This negates our scrub optimization, but is otherwise harmless.
2631  *
2632  * If a block has refcnt == 1 during the DDT scrub phase, but has refcnt > 1
2633  * on each visit during the top-down scrub phase, it will never be scrubbed.
2634  * To catch this, ddt_sync_entry() notifies the scrub code whenever a block's
2635  * reference class transitions to a higher level (i.e DDT_CLASS_UNIQUE to
2636  * DDT_CLASS_DUPLICATE); if it transitions from refcnt == 1 to refcnt > 1
2637  * while a scrub is in progress, it scrubs the block right then.
2638  */
2639 static void
2640 dsl_scan_ddt(dsl_scan_t *scn, dmu_tx_t *tx)
2641 {
2642 	ddt_bookmark_t *ddb = &scn->scn_phys.scn_ddt_bookmark;
2643 	ddt_entry_t dde;
2644 	int error;
2645 	uint64_t n = 0;
2646 
2647 	bzero(&dde, sizeof (ddt_entry_t));
2648 
2649 	while ((error = ddt_walk(scn->scn_dp->dp_spa, ddb, &dde)) == 0) {
2650 		ddt_t *ddt;
2651 
2652 		if (ddb->ddb_class > scn->scn_phys.scn_ddt_class_max)
2653 			break;
2654 		dprintf("visiting ddb=%llu/%llu/%llu/%llx\n",
2655 		    (longlong_t)ddb->ddb_class,
2656 		    (longlong_t)ddb->ddb_type,
2657 		    (longlong_t)ddb->ddb_checksum,
2658 		    (longlong_t)ddb->ddb_cursor);
2659 
2660 		/* There should be no pending changes to the dedup table */
2661 		ddt = scn->scn_dp->dp_spa->spa_ddt[ddb->ddb_checksum];
2662 		ASSERT(avl_first(&ddt->ddt_tree) == NULL);
2663 
2664 		dsl_scan_ddt_entry(scn, ddb->ddb_checksum, &dde, tx);
2665 		n++;
2666 
2667 		if (dsl_scan_check_suspend(scn, NULL))
2668 			break;
2669 	}
2670 
2671 	zfs_dbgmsg("scanned %llu ddt entries on %s with class_max = %u; "
2672 	    "suspending=%u", (longlong_t)n, scn->scn_dp->dp_spa->spa_name,
2673 	    (int)scn->scn_phys.scn_ddt_class_max, (int)scn->scn_suspending);
2674 
2675 	ASSERT(error == 0 || error == ENOENT);
2676 	ASSERT(error != ENOENT ||
2677 	    ddb->ddb_class > scn->scn_phys.scn_ddt_class_max);
2678 }
2679 
2680 static uint64_t
2681 dsl_scan_ds_maxtxg(dsl_dataset_t *ds)
2682 {
2683 	uint64_t smt = ds->ds_dir->dd_pool->dp_scan->scn_phys.scn_max_txg;
2684 	if (ds->ds_is_snapshot)
2685 		return (MIN(smt, dsl_dataset_phys(ds)->ds_creation_txg));
2686 	return (smt);
2687 }
2688 
2689 static void
2690 dsl_scan_visit(dsl_scan_t *scn, dmu_tx_t *tx)
2691 {
2692 	scan_ds_t *sds;
2693 	dsl_pool_t *dp = scn->scn_dp;
2694 
2695 	if (scn->scn_phys.scn_ddt_bookmark.ddb_class <=
2696 	    scn->scn_phys.scn_ddt_class_max) {
2697 		scn->scn_phys.scn_cur_min_txg = scn->scn_phys.scn_min_txg;
2698 		scn->scn_phys.scn_cur_max_txg = scn->scn_phys.scn_max_txg;
2699 		dsl_scan_ddt(scn, tx);
2700 		if (scn->scn_suspending)
2701 			return;
2702 	}
2703 
2704 	if (scn->scn_phys.scn_bookmark.zb_objset == DMU_META_OBJSET) {
2705 		/* First do the MOS & ORIGIN */
2706 
2707 		scn->scn_phys.scn_cur_min_txg = scn->scn_phys.scn_min_txg;
2708 		scn->scn_phys.scn_cur_max_txg = scn->scn_phys.scn_max_txg;
2709 		dsl_scan_visit_rootbp(scn, NULL,
2710 		    &dp->dp_meta_rootbp, tx);
2711 		spa_set_rootblkptr(dp->dp_spa, &dp->dp_meta_rootbp);
2712 		if (scn->scn_suspending)
2713 			return;
2714 
2715 		if (spa_version(dp->dp_spa) < SPA_VERSION_DSL_SCRUB) {
2716 			VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
2717 			    enqueue_cb, NULL, DS_FIND_CHILDREN));
2718 		} else {
2719 			dsl_scan_visitds(scn,
2720 			    dp->dp_origin_snap->ds_object, tx);
2721 		}
2722 		ASSERT(!scn->scn_suspending);
2723 	} else if (scn->scn_phys.scn_bookmark.zb_objset !=
2724 	    ZB_DESTROYED_OBJSET) {
2725 		uint64_t dsobj = scn->scn_phys.scn_bookmark.zb_objset;
2726 		/*
2727 		 * If we were suspended, continue from here. Note if the
2728 		 * ds we were suspended on was deleted, the zb_objset may
2729 		 * be -1, so we will skip this and find a new objset
2730 		 * below.
2731 		 */
2732 		dsl_scan_visitds(scn, dsobj, tx);
2733 		if (scn->scn_suspending)
2734 			return;
2735 	}
2736 
2737 	/*
2738 	 * In case we suspended right at the end of the ds, zero the
2739 	 * bookmark so we don't think that we're still trying to resume.
2740 	 */
2741 	bzero(&scn->scn_phys.scn_bookmark, sizeof (zbookmark_phys_t));
2742 
2743 	/*
2744 	 * Keep pulling things out of the dataset avl queue. Updates to the
2745 	 * persistent zap-object-as-queue happen only at checkpoints.
2746 	 */
2747 	while ((sds = avl_first(&scn->scn_queue)) != NULL) {
2748 		dsl_dataset_t *ds;
2749 		uint64_t dsobj = sds->sds_dsobj;
2750 		uint64_t txg = sds->sds_txg;
2751 
2752 		/* dequeue and free the ds from the queue */
2753 		scan_ds_queue_remove(scn, dsobj);
2754 		sds = NULL;
2755 
2756 		/* set up min / max txg */
2757 		VERIFY3U(0, ==, dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds));
2758 		if (txg != 0) {
2759 			scn->scn_phys.scn_cur_min_txg =
2760 			    MAX(scn->scn_phys.scn_min_txg, txg);
2761 		} else {
2762 			scn->scn_phys.scn_cur_min_txg =
2763 			    MAX(scn->scn_phys.scn_min_txg,
2764 			    dsl_dataset_phys(ds)->ds_prev_snap_txg);
2765 		}
2766 		scn->scn_phys.scn_cur_max_txg = dsl_scan_ds_maxtxg(ds);
2767 		dsl_dataset_rele(ds, FTAG);
2768 
2769 		dsl_scan_visitds(scn, dsobj, tx);
2770 		if (scn->scn_suspending)
2771 			return;
2772 	}
2773 
2774 	/* No more objsets to fetch, we're done */
2775 	scn->scn_phys.scn_bookmark.zb_objset = ZB_DESTROYED_OBJSET;
2776 	ASSERT0(scn->scn_suspending);
2777 }
2778 
2779 static uint64_t
2780 dsl_scan_count_data_disks(vdev_t *rvd)
2781 {
2782 	uint64_t i, leaves = 0;
2783 
2784 	for (i = 0; i < rvd->vdev_children; i++) {
2785 		vdev_t *vd = rvd->vdev_child[i];
2786 		if (vd->vdev_islog || vd->vdev_isspare || vd->vdev_isl2cache)
2787 			continue;
2788 		leaves += vdev_get_ndisks(vd) - vdev_get_nparity(vd);
2789 	}
2790 	return (leaves);
2791 }
2792 
2793 static void
2794 scan_io_queues_update_zio_stats(dsl_scan_io_queue_t *q, const blkptr_t *bp)
2795 {
2796 	int i;
2797 	uint64_t cur_size = 0;
2798 
2799 	for (i = 0; i < BP_GET_NDVAS(bp); i++) {
2800 		cur_size += DVA_GET_ASIZE(&bp->blk_dva[i]);
2801 	}
2802 
2803 	q->q_total_zio_size_this_txg += cur_size;
2804 	q->q_zios_this_txg++;
2805 }
2806 
2807 static void
2808 scan_io_queues_update_seg_stats(dsl_scan_io_queue_t *q, uint64_t start,
2809     uint64_t end)
2810 {
2811 	q->q_total_seg_size_this_txg += end - start;
2812 	q->q_segs_this_txg++;
2813 }
2814 
2815 static boolean_t
2816 scan_io_queue_check_suspend(dsl_scan_t *scn)
2817 {
2818 	/* See comment in dsl_scan_check_suspend() */
2819 	uint64_t curr_time_ns = gethrtime();
2820 	uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
2821 	uint64_t sync_time_ns = curr_time_ns -
2822 	    scn->scn_dp->dp_spa->spa_sync_starttime;
2823 	int dirty_pct = scn->scn_dp->dp_dirty_total * 100 / zfs_dirty_data_max;
2824 	int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
2825 	    zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;
2826 
2827 	return ((NSEC2MSEC(scan_time_ns) > mintime &&
2828 	    (dirty_pct >= zfs_vdev_async_write_active_min_dirty_percent ||
2829 	    txg_sync_waiting(scn->scn_dp) ||
2830 	    NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
2831 	    spa_shutting_down(scn->scn_dp->dp_spa));
2832 }
2833 
2834 /*
2835  * Given a list of scan_io_t's in io_list, this issues the I/Os out to
2836  * disk. This consumes the io_list and frees the scan_io_t's. This is
2837  * called when emptying queues, either when we're up against the memory
2838  * limit or when we have finished scanning. Returns B_TRUE if we stopped
2839  * processing the list before we finished. Any sios that were not issued
2840  * will remain in the io_list.
2841  */
2842 static boolean_t
2843 scan_io_queue_issue(dsl_scan_io_queue_t *queue, list_t *io_list)
2844 {
2845 	dsl_scan_t *scn = queue->q_scn;
2846 	scan_io_t *sio;
2847 	int64_t bytes_issued = 0;
2848 	boolean_t suspended = B_FALSE;
2849 
2850 	while ((sio = list_head(io_list)) != NULL) {
2851 		blkptr_t bp;
2852 
2853 		if (scan_io_queue_check_suspend(scn)) {
2854 			suspended = B_TRUE;
2855 			break;
2856 		}
2857 
2858 		sio2bp(sio, &bp);
2859 		bytes_issued += SIO_GET_ASIZE(sio);
2860 		scan_exec_io(scn->scn_dp, &bp, sio->sio_flags,
2861 		    &sio->sio_zb, queue);
2862 		(void) list_remove_head(io_list);
2863 		scan_io_queues_update_zio_stats(queue, &bp);
2864 		sio_free(sio);
2865 	}
2866 
2867 	atomic_add_64(&scn->scn_bytes_pending, -bytes_issued);
2868 
2869 	return (suspended);
2870 }
2871 
2872 /*
2873  * This function removes sios from an IO queue which reside within a given
2874  * range_seg_t and inserts them (in offset order) into a list. Note that
2875  * we only ever return a maximum of 32 sios at once. If there are more sios
2876  * to process within this segment that did not make it onto the list we
2877  * return B_TRUE and otherwise B_FALSE.
2878  */
2879 static boolean_t
2880 scan_io_queue_gather(dsl_scan_io_queue_t *queue, range_seg_t *rs, list_t *list)
2881 {
2882 	scan_io_t *srch_sio, *sio, *next_sio;
2883 	avl_index_t idx;
2884 	uint_t num_sios = 0;
2885 	int64_t bytes_issued = 0;
2886 
2887 	ASSERT(rs != NULL);
2888 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
2889 
2890 	srch_sio = sio_alloc(1);
2891 	srch_sio->sio_nr_dvas = 1;
2892 	SIO_SET_OFFSET(srch_sio, rs_get_start(rs, queue->q_exts_by_addr));
2893 
2894 	/*
2895 	 * The exact start of the extent might not contain any matching zios,
2896 	 * so if that's the case, examine the next one in the tree.
2897 	 */
2898 	sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
2899 	sio_free(srch_sio);
2900 
2901 	if (sio == NULL)
2902 		sio = avl_nearest(&queue->q_sios_by_addr, idx, AVL_AFTER);
2903 
2904 	while (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
2905 	    queue->q_exts_by_addr) && num_sios <= 32) {
2906 		ASSERT3U(SIO_GET_OFFSET(sio), >=, rs_get_start(rs,
2907 		    queue->q_exts_by_addr));
2908 		ASSERT3U(SIO_GET_END_OFFSET(sio), <=, rs_get_end(rs,
2909 		    queue->q_exts_by_addr));
2910 
2911 		next_sio = AVL_NEXT(&queue->q_sios_by_addr, sio);
2912 		avl_remove(&queue->q_sios_by_addr, sio);
2913 		queue->q_sio_memused -= SIO_GET_MUSED(sio);
2914 
2915 		bytes_issued += SIO_GET_ASIZE(sio);
2916 		num_sios++;
2917 		list_insert_tail(list, sio);
2918 		sio = next_sio;
2919 	}
2920 
2921 	/*
2922 	 * We limit the number of sios we process at once to 32 to avoid
2923 	 * biting off more than we can chew. If we didn't take everything
2924 	 * in the segment we update it to reflect the work we were able to
2925 	 * complete. Otherwise, we remove it from the range tree entirely.
2926 	 */
2927 	if (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
2928 	    queue->q_exts_by_addr)) {
2929 		range_tree_adjust_fill(queue->q_exts_by_addr, rs,
2930 		    -bytes_issued);
2931 		range_tree_resize_segment(queue->q_exts_by_addr, rs,
2932 		    SIO_GET_OFFSET(sio), rs_get_end(rs,
2933 		    queue->q_exts_by_addr) - SIO_GET_OFFSET(sio));
2934 
2935 		return (B_TRUE);
2936 	} else {
2937 		uint64_t rstart = rs_get_start(rs, queue->q_exts_by_addr);
2938 		uint64_t rend = rs_get_end(rs, queue->q_exts_by_addr);
2939 		range_tree_remove(queue->q_exts_by_addr, rstart, rend - rstart);
2940 		return (B_FALSE);
2941 	}
2942 }
2943 
2944 /*
2945  * This is called from the queue emptying thread and selects the next
2946  * extent from which we are to issue I/Os. The behavior of this function
2947  * depends on the state of the scan, the current memory consumption and
2948  * whether or not we are performing a scan shutdown.
2949  * 1) We select extents in an elevator algorithm (LBA-order) if the scan
2950  * 	needs to perform a checkpoint
2951  * 2) We select the largest available extent if we are up against the
2952  * 	memory limit.
2953  * 3) Otherwise we don't select any extents.
2954  */
2955 static range_seg_t *
2956 scan_io_queue_fetch_ext(dsl_scan_io_queue_t *queue)
2957 {
2958 	dsl_scan_t *scn = queue->q_scn;
2959 	range_tree_t *rt = queue->q_exts_by_addr;
2960 
2961 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
2962 	ASSERT(scn->scn_is_sorted);
2963 
2964 	/* handle tunable overrides */
2965 	if (scn->scn_checkpointing || scn->scn_clearing) {
2966 		if (zfs_scan_issue_strategy == 1) {
2967 			return (range_tree_first(rt));
2968 		} else if (zfs_scan_issue_strategy == 2) {
2969 			/*
2970 			 * We need to get the original entry in the by_addr
2971 			 * tree so we can modify it.
2972 			 */
2973 			range_seg_t *size_rs =
2974 			    zfs_btree_first(&queue->q_exts_by_size, NULL);
2975 			if (size_rs == NULL)
2976 				return (NULL);
2977 			uint64_t start = rs_get_start(size_rs, rt);
2978 			uint64_t size = rs_get_end(size_rs, rt) - start;
2979 			range_seg_t *addr_rs = range_tree_find(rt, start,
2980 			    size);
2981 			ASSERT3P(addr_rs, !=, NULL);
2982 			ASSERT3U(rs_get_start(size_rs, rt), ==,
2983 			    rs_get_start(addr_rs, rt));
2984 			ASSERT3U(rs_get_end(size_rs, rt), ==,
2985 			    rs_get_end(addr_rs, rt));
2986 			return (addr_rs);
2987 		}
2988 	}
2989 
2990 	/*
2991 	 * During normal clearing, we want to issue our largest segments
2992 	 * first, keeping IO as sequential as possible, and leaving the
2993 	 * smaller extents for later with the hope that they might eventually
2994 	 * grow to larger sequential segments. However, when the scan is
2995 	 * checkpointing, no new extents will be added to the sorting queue,
2996 	 * so the way we are sorted now is as good as it will ever get.
2997 	 * In this case, we instead switch to issuing extents in LBA order.
2998 	 */
2999 	if (scn->scn_checkpointing) {
3000 		return (range_tree_first(rt));
3001 	} else if (scn->scn_clearing) {
3002 		/*
3003 		 * We need to get the original entry in the by_addr
3004 		 * tree so we can modify it.
3005 		 */
3006 		range_seg_t *size_rs = zfs_btree_first(&queue->q_exts_by_size,
3007 		    NULL);
3008 		if (size_rs == NULL)
3009 			return (NULL);
3010 		uint64_t start = rs_get_start(size_rs, rt);
3011 		uint64_t size = rs_get_end(size_rs, rt) - start;
3012 		range_seg_t *addr_rs = range_tree_find(rt, start, size);
3013 		ASSERT3P(addr_rs, !=, NULL);
3014 		ASSERT3U(rs_get_start(size_rs, rt), ==, rs_get_start(addr_rs,
3015 		    rt));
3016 		ASSERT3U(rs_get_end(size_rs, rt), ==, rs_get_end(addr_rs, rt));
3017 		return (addr_rs);
3018 	} else {
3019 		return (NULL);
3020 	}
3021 }
3022 
3023 static void
3024 scan_io_queues_run_one(void *arg)
3025 {
3026 	dsl_scan_io_queue_t *queue = arg;
3027 	kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;
3028 	boolean_t suspended = B_FALSE;
3029 	range_seg_t *rs = NULL;
3030 	scan_io_t *sio = NULL;
3031 	list_t sio_list;
3032 
3033 	ASSERT(queue->q_scn->scn_is_sorted);
3034 
3035 	list_create(&sio_list, sizeof (scan_io_t),
3036 	    offsetof(scan_io_t, sio_nodes.sio_list_node));
3037 	mutex_enter(q_lock);
3038 
3039 	/* Calculate maximum in-flight bytes for this vdev. */
3040 	queue->q_maxinflight_bytes = MAX(1, zfs_scan_vdev_limit *
3041 	    (vdev_get_ndisks(queue->q_vd) - vdev_get_nparity(queue->q_vd)));
3042 
3043 	/* reset per-queue scan statistics for this txg */
3044 	queue->q_total_seg_size_this_txg = 0;
3045 	queue->q_segs_this_txg = 0;
3046 	queue->q_total_zio_size_this_txg = 0;
3047 	queue->q_zios_this_txg = 0;
3048 
3049 	/* loop until we run out of time or sios */
3050 	while ((rs = scan_io_queue_fetch_ext(queue)) != NULL) {
3051 		uint64_t seg_start = 0, seg_end = 0;
3052 		boolean_t more_left = B_TRUE;
3053 
3054 		ASSERT(list_is_empty(&sio_list));
3055 
3056 		/* loop while we still have sios left to process in this rs */
3057 		while (more_left) {
3058 			scan_io_t *first_sio, *last_sio;
3059 
3060 			/*
3061 			 * We have selected which extent needs to be
3062 			 * processed next. Gather up the corresponding sios.
3063 			 */
3064 			more_left = scan_io_queue_gather(queue, rs, &sio_list);
3065 			ASSERT(!list_is_empty(&sio_list));
3066 			first_sio = list_head(&sio_list);
3067 			last_sio = list_tail(&sio_list);
3068 
3069 			seg_end = SIO_GET_END_OFFSET(last_sio);
3070 			if (seg_start == 0)
3071 				seg_start = SIO_GET_OFFSET(first_sio);
3072 
3073 			/*
3074 			 * Issuing sios can take a long time so drop the
3075 			 * queue lock. The sio queue won't be updated by
3076 			 * other threads since we're in syncing context so
3077 			 * we can be sure that our trees will remain exactly
3078 			 * as we left them.
3079 			 */
3080 			mutex_exit(q_lock);
3081 			suspended = scan_io_queue_issue(queue, &sio_list);
3082 			mutex_enter(q_lock);
3083 
3084 			if (suspended)
3085 				break;
3086 		}
3087 
3088 		/* update statistics for debugging purposes */
3089 		scan_io_queues_update_seg_stats(queue, seg_start, seg_end);
3090 
3091 		if (suspended)
3092 			break;
3093 	}
3094 
3095 	/*
3096 	 * If we were suspended in the middle of processing,
3097 	 * requeue any unfinished sios and exit.
3098 	 */
3099 	while ((sio = list_head(&sio_list)) != NULL) {
3100 		list_remove(&sio_list, sio);
3101 		scan_io_queue_insert_impl(queue, sio);
3102 	}
3103 
3104 	mutex_exit(q_lock);
3105 	list_destroy(&sio_list);
3106 }
3107 
3108 /*
3109  * Performs an emptying run on all scan queues in the pool. This just
3110  * punches out one thread per top-level vdev, each of which processes
3111  * only that vdev's scan queue. We can parallelize the I/O here because
3112  * we know that each queue's I/Os only affect its own top-level vdev.
3113  *
3114  * This function waits for the queue runs to complete, and must be
3115  * called from dsl_scan_sync (or in general, syncing context).
3116  */
3117 static void
3118 scan_io_queues_run(dsl_scan_t *scn)
3119 {
3120 	spa_t *spa = scn->scn_dp->dp_spa;
3121 
3122 	ASSERT(scn->scn_is_sorted);
3123 	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_READER));
3124 
3125 	if (scn->scn_bytes_pending == 0)
3126 		return;
3127 
3128 	if (scn->scn_taskq == NULL) {
3129 		int nthreads = spa->spa_root_vdev->vdev_children;
3130 
3131 		/*
3132 		 * We need to make this taskq *always* execute as many
3133 		 * threads in parallel as we have top-level vdevs and no
3134 		 * less, otherwise strange serialization of the calls to
3135 		 * scan_io_queues_run_one can occur during spa_sync runs
3136 		 * and that significantly impacts performance.
3137 		 */
3138 		scn->scn_taskq = taskq_create("dsl_scan_iss", nthreads,
3139 		    minclsyspri, nthreads, nthreads, TASKQ_PREPOPULATE);
3140 	}
3141 
3142 	for (uint64_t i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
3143 		vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
3144 
3145 		mutex_enter(&vd->vdev_scan_io_queue_lock);
3146 		if (vd->vdev_scan_io_queue != NULL) {
3147 			VERIFY(taskq_dispatch(scn->scn_taskq,
3148 			    scan_io_queues_run_one, vd->vdev_scan_io_queue,
3149 			    TQ_SLEEP) != TASKQID_INVALID);
3150 		}
3151 		mutex_exit(&vd->vdev_scan_io_queue_lock);
3152 	}
3153 
3154 	/*
3155 	 * Wait for the queues to finish issuing their IOs for this run
3156 	 * before we return. There may still be IOs in flight at this
3157 	 * point.
3158 	 */
3159 	taskq_wait(scn->scn_taskq);
3160 }
3161 
3162 static boolean_t
3163 dsl_scan_async_block_should_pause(dsl_scan_t *scn)
3164 {
3165 	uint64_t elapsed_nanosecs;
3166 
3167 	if (zfs_recover)
3168 		return (B_FALSE);
3169 
3170 	if (zfs_async_block_max_blocks != 0 &&
3171 	    scn->scn_visited_this_txg >= zfs_async_block_max_blocks) {
3172 		return (B_TRUE);
3173 	}
3174 
3175 	if (zfs_max_async_dedup_frees != 0 &&
3176 	    scn->scn_dedup_frees_this_txg >= zfs_max_async_dedup_frees) {
3177 		return (B_TRUE);
3178 	}
3179 
3180 	elapsed_nanosecs = gethrtime() - scn->scn_sync_start_time;
3181 	return (elapsed_nanosecs / NANOSEC > zfs_txg_timeout ||
3182 	    (NSEC2MSEC(elapsed_nanosecs) > scn->scn_async_block_min_time_ms &&
3183 	    txg_sync_waiting(scn->scn_dp)) ||
3184 	    spa_shutting_down(scn->scn_dp->dp_spa));
3185 }
3186 
3187 static int
3188 dsl_scan_free_block_cb(void *arg, const blkptr_t *bp, dmu_tx_t *tx)
3189 {
3190 	dsl_scan_t *scn = arg;
3191 
3192 	if (!scn->scn_is_bptree ||
3193 	    (BP_GET_LEVEL(bp) == 0 && BP_GET_TYPE(bp) != DMU_OT_OBJSET)) {
3194 		if (dsl_scan_async_block_should_pause(scn))
3195 			return (SET_ERROR(ERESTART));
3196 	}
3197 
3198 	zio_nowait(zio_free_sync(scn->scn_zio_root, scn->scn_dp->dp_spa,
3199 	    dmu_tx_get_txg(tx), bp, 0));
3200 	dsl_dir_diduse_space(tx->tx_pool->dp_free_dir, DD_USED_HEAD,
3201 	    -bp_get_dsize_sync(scn->scn_dp->dp_spa, bp),
3202 	    -BP_GET_PSIZE(bp), -BP_GET_UCSIZE(bp), tx);
3203 	scn->scn_visited_this_txg++;
3204 	if (BP_GET_DEDUP(bp))
3205 		scn->scn_dedup_frees_this_txg++;
3206 	return (0);
3207 }
3208 
3209 static void
3210 dsl_scan_update_stats(dsl_scan_t *scn)
3211 {
3212 	spa_t *spa = scn->scn_dp->dp_spa;
3213 	uint64_t i;
3214 	uint64_t seg_size_total = 0, zio_size_total = 0;
3215 	uint64_t seg_count_total = 0, zio_count_total = 0;
3216 
3217 	for (i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
3218 		vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
3219 		dsl_scan_io_queue_t *queue = vd->vdev_scan_io_queue;
3220 
3221 		if (queue == NULL)
3222 			continue;
3223 
3224 		seg_size_total += queue->q_total_seg_size_this_txg;
3225 		zio_size_total += queue->q_total_zio_size_this_txg;
3226 		seg_count_total += queue->q_segs_this_txg;
3227 		zio_count_total += queue->q_zios_this_txg;
3228 	}
3229 
3230 	if (seg_count_total == 0 || zio_count_total == 0) {
3231 		scn->scn_avg_seg_size_this_txg = 0;
3232 		scn->scn_avg_zio_size_this_txg = 0;
3233 		scn->scn_segs_this_txg = 0;
3234 		scn->scn_zios_this_txg = 0;
3235 		return;
3236 	}
3237 
3238 	scn->scn_avg_seg_size_this_txg = seg_size_total / seg_count_total;
3239 	scn->scn_avg_zio_size_this_txg = zio_size_total / zio_count_total;
3240 	scn->scn_segs_this_txg = seg_count_total;
3241 	scn->scn_zios_this_txg = zio_count_total;
3242 }
3243 
3244 static int
3245 bpobj_dsl_scan_free_block_cb(void *arg, const blkptr_t *bp, boolean_t bp_freed,
3246     dmu_tx_t *tx)
3247 {
3248 	ASSERT(!bp_freed);
3249 	return (dsl_scan_free_block_cb(arg, bp, tx));
3250 }
3251 
3252 static int
3253 dsl_scan_obsolete_block_cb(void *arg, const blkptr_t *bp, boolean_t bp_freed,
3254     dmu_tx_t *tx)
3255 {
3256 	ASSERT(!bp_freed);
3257 	dsl_scan_t *scn = arg;
3258 	const dva_t *dva = &bp->blk_dva[0];
3259 
3260 	if (dsl_scan_async_block_should_pause(scn))
3261 		return (SET_ERROR(ERESTART));
3262 
3263 	spa_vdev_indirect_mark_obsolete(scn->scn_dp->dp_spa,
3264 	    DVA_GET_VDEV(dva), DVA_GET_OFFSET(dva),
3265 	    DVA_GET_ASIZE(dva), tx);
3266 	scn->scn_visited_this_txg++;
3267 	return (0);
3268 }
3269 
3270 boolean_t
3271 dsl_scan_active(dsl_scan_t *scn)
3272 {
3273 	spa_t *spa = scn->scn_dp->dp_spa;
3274 	uint64_t used = 0, comp, uncomp;
3275 	boolean_t clones_left;
3276 
3277 	if (spa->spa_load_state != SPA_LOAD_NONE)
3278 		return (B_FALSE);
3279 	if (spa_shutting_down(spa))
3280 		return (B_FALSE);
3281 	if ((dsl_scan_is_running(scn) && !dsl_scan_is_paused_scrub(scn)) ||
3282 	    (scn->scn_async_destroying && !scn->scn_async_stalled))
3283 		return (B_TRUE);
3284 
3285 	if (spa_version(scn->scn_dp->dp_spa) >= SPA_VERSION_DEADLISTS) {
3286 		(void) bpobj_space(&scn->scn_dp->dp_free_bpobj,
3287 		    &used, &comp, &uncomp);
3288 	}
3289 	clones_left = spa_livelist_delete_check(spa);
3290 	return ((used != 0) || (clones_left));
3291 }
3292 
3293 static boolean_t
3294 dsl_scan_check_deferred(vdev_t *vd)
3295 {
3296 	boolean_t need_resilver = B_FALSE;
3297 
3298 	for (int c = 0; c < vd->vdev_children; c++) {
3299 		need_resilver |=
3300 		    dsl_scan_check_deferred(vd->vdev_child[c]);
3301 	}
3302 
3303 	if (!vdev_is_concrete(vd) || vd->vdev_aux ||
3304 	    !vd->vdev_ops->vdev_op_leaf)
3305 		return (need_resilver);
3306 
3307 	if (!vd->vdev_resilver_deferred)
3308 		need_resilver = B_TRUE;
3309 
3310 	return (need_resilver);
3311 }
3312 
3313 static boolean_t
3314 dsl_scan_need_resilver(spa_t *spa, const dva_t *dva, size_t psize,
3315     uint64_t phys_birth)
3316 {
3317 	vdev_t *vd;
3318 
3319 	vd = vdev_lookup_top(spa, DVA_GET_VDEV(dva));
3320 
3321 	if (vd->vdev_ops == &vdev_indirect_ops) {
3322 		/*
3323 		 * The indirect vdev can point to multiple
3324 		 * vdevs.  For simplicity, always create
3325 		 * the resilver zio_t. zio_vdev_io_start()
3326 		 * will bypass the child resilver i/o's if
3327 		 * they are on vdevs that don't have DTL's.
3328 		 */
3329 		return (B_TRUE);
3330 	}
3331 
3332 	if (DVA_GET_GANG(dva)) {
3333 		/*
3334 		 * Gang members may be spread across multiple
3335 		 * vdevs, so the best estimate we have is the
3336 		 * scrub range, which has already been checked.
3337 		 * XXX -- it would be better to change our
3338 		 * allocation policy to ensure that all
3339 		 * gang members reside on the same vdev.
3340 		 */
3341 		return (B_TRUE);
3342 	}
3343 
3344 	/*
3345 	 * Check if the top-level vdev must resilver this offset.
3346 	 * When the offset does not intersect with a dirty leaf DTL
3347 	 * then it may be possible to skip the resilver IO.  The psize
3348 	 * is provided instead of asize to simplify the check for RAIDZ.
3349 	 */
3350 	if (!vdev_dtl_need_resilver(vd, dva, psize, phys_birth))
3351 		return (B_FALSE);
3352 
3353 	/*
3354 	 * Check that this top-level vdev has a device under it which
3355 	 * is resilvering and is not deferred.
3356 	 */
3357 	if (!dsl_scan_check_deferred(vd))
3358 		return (B_FALSE);
3359 
3360 	return (B_TRUE);
3361 }
3362 
3363 static int
3364 dsl_process_async_destroys(dsl_pool_t *dp, dmu_tx_t *tx)
3365 {
3366 	dsl_scan_t *scn = dp->dp_scan;
3367 	spa_t *spa = dp->dp_spa;
3368 	int err = 0;
3369 
3370 	if (spa_suspend_async_destroy(spa))
3371 		return (0);
3372 
3373 	if (zfs_free_bpobj_enabled &&
3374 	    spa_version(spa) >= SPA_VERSION_DEADLISTS) {
3375 		scn->scn_is_bptree = B_FALSE;
3376 		scn->scn_async_block_min_time_ms = zfs_free_min_time_ms;
3377 		scn->scn_zio_root = zio_root(spa, NULL,
3378 		    NULL, ZIO_FLAG_MUSTSUCCEED);
3379 		err = bpobj_iterate(&dp->dp_free_bpobj,
3380 		    bpobj_dsl_scan_free_block_cb, scn, tx);
3381 		VERIFY0(zio_wait(scn->scn_zio_root));
3382 		scn->scn_zio_root = NULL;
3383 
3384 		if (err != 0 && err != ERESTART)
3385 			zfs_panic_recover("error %u from bpobj_iterate()", err);
3386 	}
3387 
3388 	if (err == 0 && spa_feature_is_active(spa, SPA_FEATURE_ASYNC_DESTROY)) {
3389 		ASSERT(scn->scn_async_destroying);
3390 		scn->scn_is_bptree = B_TRUE;
3391 		scn->scn_zio_root = zio_root(spa, NULL,
3392 		    NULL, ZIO_FLAG_MUSTSUCCEED);
3393 		err = bptree_iterate(dp->dp_meta_objset,
3394 		    dp->dp_bptree_obj, B_TRUE, dsl_scan_free_block_cb, scn, tx);
3395 		VERIFY0(zio_wait(scn->scn_zio_root));
3396 		scn->scn_zio_root = NULL;
3397 
3398 		if (err == EIO || err == ECKSUM) {
3399 			err = 0;
3400 		} else if (err != 0 && err != ERESTART) {
3401 			zfs_panic_recover("error %u from "
3402 			    "traverse_dataset_destroyed()", err);
3403 		}
3404 
3405 		if (bptree_is_empty(dp->dp_meta_objset, dp->dp_bptree_obj)) {
3406 			/* finished; deactivate async destroy feature */
3407 			spa_feature_decr(spa, SPA_FEATURE_ASYNC_DESTROY, tx);
3408 			ASSERT(!spa_feature_is_active(spa,
3409 			    SPA_FEATURE_ASYNC_DESTROY));
3410 			VERIFY0(zap_remove(dp->dp_meta_objset,
3411 			    DMU_POOL_DIRECTORY_OBJECT,
3412 			    DMU_POOL_BPTREE_OBJ, tx));
3413 			VERIFY0(bptree_free(dp->dp_meta_objset,
3414 			    dp->dp_bptree_obj, tx));
3415 			dp->dp_bptree_obj = 0;
3416 			scn->scn_async_destroying = B_FALSE;
3417 			scn->scn_async_stalled = B_FALSE;
3418 		} else {
3419 			/*
3420 			 * If we didn't make progress, mark the async
3421 			 * destroy as stalled, so that we will not initiate
3422 			 * a spa_sync() on its behalf.  Note that we only
3423 			 * check this if we are not finished, because if the
3424 			 * bptree had no blocks for us to visit, we can
3425 			 * finish without "making progress".
3426 			 */
3427 			scn->scn_async_stalled =
3428 			    (scn->scn_visited_this_txg == 0);
3429 		}
3430 	}
3431 	if (scn->scn_visited_this_txg) {
3432 		zfs_dbgmsg("freed %llu blocks in %llums from "
3433 		    "free_bpobj/bptree on %s in txg %llu; err=%u",
3434 		    (longlong_t)scn->scn_visited_this_txg,
3435 		    (longlong_t)
3436 		    NSEC2MSEC(gethrtime() - scn->scn_sync_start_time),
3437 		    spa->spa_name, (longlong_t)tx->tx_txg, err);
3438 		scn->scn_visited_this_txg = 0;
3439 		scn->scn_dedup_frees_this_txg = 0;
3440 
3441 		/*
3442 		 * Write out changes to the DDT that may be required as a
3443 		 * result of the blocks freed.  This ensures that the DDT
3444 		 * is clean when a scrub/resilver runs.
3445 		 */
3446 		ddt_sync(spa, tx->tx_txg);
3447 	}
3448 	if (err != 0)
3449 		return (err);
3450 	if (dp->dp_free_dir != NULL && !scn->scn_async_destroying &&
3451 	    zfs_free_leak_on_eio &&
3452 	    (dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes != 0 ||
3453 	    dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes != 0 ||
3454 	    dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes != 0)) {
3455 		/*
3456 		 * We have finished background destroying, but there is still
3457 		 * some space left in the dp_free_dir. Transfer this leaked
3458 		 * space to the dp_leak_dir.
3459 		 */
3460 		if (dp->dp_leak_dir == NULL) {
3461 			rrw_enter(&dp->dp_config_rwlock, RW_WRITER, FTAG);
3462 			(void) dsl_dir_create_sync(dp, dp->dp_root_dir,
3463 			    LEAK_DIR_NAME, tx);
3464 			VERIFY0(dsl_pool_open_special_dir(dp,
3465 			    LEAK_DIR_NAME, &dp->dp_leak_dir));
3466 			rrw_exit(&dp->dp_config_rwlock, FTAG);
3467 		}
3468 		dsl_dir_diduse_space(dp->dp_leak_dir, DD_USED_HEAD,
3469 		    dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes,
3470 		    dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes,
3471 		    dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes, tx);
3472 		dsl_dir_diduse_space(dp->dp_free_dir, DD_USED_HEAD,
3473 		    -dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes,
3474 		    -dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes,
3475 		    -dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes, tx);
3476 	}
3477 
3478 	if (dp->dp_free_dir != NULL && !scn->scn_async_destroying &&
3479 	    !spa_livelist_delete_check(spa)) {
3480 		/* finished; verify that space accounting went to zero */
3481 		ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes);
3482 		ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes);
3483 		ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes);
3484 	}
3485 
3486 	spa_notify_waiters(spa);
3487 
3488 	EQUIV(bpobj_is_open(&dp->dp_obsolete_bpobj),
3489 	    0 == zap_contains(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
3490 	    DMU_POOL_OBSOLETE_BPOBJ));
3491 	if (err == 0 && bpobj_is_open(&dp->dp_obsolete_bpobj)) {
3492 		ASSERT(spa_feature_is_active(dp->dp_spa,
3493 		    SPA_FEATURE_OBSOLETE_COUNTS));
3494 
3495 		scn->scn_is_bptree = B_FALSE;
3496 		scn->scn_async_block_min_time_ms = zfs_obsolete_min_time_ms;
3497 		err = bpobj_iterate(&dp->dp_obsolete_bpobj,
3498 		    dsl_scan_obsolete_block_cb, scn, tx);
3499 		if (err != 0 && err != ERESTART)
3500 			zfs_panic_recover("error %u from bpobj_iterate()", err);
3501 
3502 		if (bpobj_is_empty(&dp->dp_obsolete_bpobj))
3503 			dsl_pool_destroy_obsolete_bpobj(dp, tx);
3504 	}
3505 	return (0);
3506 }
3507 
3508 /*
3509  * This is the primary entry point for scans that is called from syncing
3510  * context. Scans must happen entirely during syncing context so that we
3511  * can guarantee that blocks we are currently scanning will not change out
3512  * from under us. While a scan is active, this function controls how quickly
3513  * transaction groups proceed, instead of the normal handling provided by
3514  * txg_sync_thread().
3515  */
3516 void
3517 dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
3518 {
3519 	int err = 0;
3520 	dsl_scan_t *scn = dp->dp_scan;
3521 	spa_t *spa = dp->dp_spa;
3522 	state_sync_type_t sync_type = SYNC_OPTIONAL;
3523 
3524 	if (spa->spa_resilver_deferred &&
3525 	    !spa_feature_is_active(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
3526 		spa_feature_incr(spa, SPA_FEATURE_RESILVER_DEFER, tx);
3527 
3528 	/*
3529 	 * Check for scn_restart_txg before checking spa_load_state, so
3530 	 * that we can restart an old-style scan while the pool is being
3531 	 * imported (see dsl_scan_init). We also restart scans if there
3532 	 * is a deferred resilver and the user has manually disabled
3533 	 * deferred resilvers via the tunable.
3534 	 */
3535 	if (dsl_scan_restarting(scn, tx) ||
3536 	    (spa->spa_resilver_deferred && zfs_resilver_disable_defer)) {
3537 		pool_scan_func_t func = POOL_SCAN_SCRUB;
3538 		dsl_scan_done(scn, B_FALSE, tx);
3539 		if (vdev_resilver_needed(spa->spa_root_vdev, NULL, NULL))
3540 			func = POOL_SCAN_RESILVER;
3541 		zfs_dbgmsg("restarting scan func=%u on %s txg=%llu",
3542 		    func, dp->dp_spa->spa_name, (longlong_t)tx->tx_txg);
3543 		dsl_scan_setup_sync(&func, tx);
3544 	}
3545 
3546 	/*
3547 	 * Only process scans in sync pass 1.
3548 	 */
3549 	if (spa_sync_pass(spa) > 1)
3550 		return;
3551 
3552 	/*
3553 	 * If the spa is shutting down, then stop scanning. This will
3554 	 * ensure that the scan does not dirty any new data during the
3555 	 * shutdown phase.
3556 	 */
3557 	if (spa_shutting_down(spa))
3558 		return;
3559 
3560 	/*
3561 	 * If the scan is inactive due to a stalled async destroy, try again.
3562 	 */
3563 	if (!scn->scn_async_stalled && !dsl_scan_active(scn))
3564 		return;
3565 
3566 	/* reset scan statistics */
3567 	scn->scn_visited_this_txg = 0;
3568 	scn->scn_dedup_frees_this_txg = 0;
3569 	scn->scn_holes_this_txg = 0;
3570 	scn->scn_lt_min_this_txg = 0;
3571 	scn->scn_gt_max_this_txg = 0;
3572 	scn->scn_ddt_contained_this_txg = 0;
3573 	scn->scn_objsets_visited_this_txg = 0;
3574 	scn->scn_avg_seg_size_this_txg = 0;
3575 	scn->scn_segs_this_txg = 0;
3576 	scn->scn_avg_zio_size_this_txg = 0;
3577 	scn->scn_zios_this_txg = 0;
3578 	scn->scn_suspending = B_FALSE;
3579 	scn->scn_sync_start_time = gethrtime();
3580 	spa->spa_scrub_active = B_TRUE;
3581 
3582 	/*
3583 	 * First process the async destroys.  If we suspend, don't do
3584 	 * any scrubbing or resilvering.  This ensures that there are no
3585 	 * async destroys while we are scanning, so the scan code doesn't
3586 	 * have to worry about traversing it.  It is also faster to free the
3587 	 * blocks than to scrub them.
3588 	 */
3589 	err = dsl_process_async_destroys(dp, tx);
3590 	if (err != 0)
3591 		return;
3592 
3593 	if (!dsl_scan_is_running(scn) || dsl_scan_is_paused_scrub(scn))
3594 		return;
3595 
3596 	/*
3597 	 * Wait a few txgs after importing to begin scanning so that
3598 	 * we can get the pool imported quickly.
3599 	 */
3600 	if (spa->spa_syncing_txg < spa->spa_first_txg + SCAN_IMPORT_WAIT_TXGS)
3601 		return;
3602 
3603 	/*
3604 	 * zfs_scan_suspend_progress can be set to disable scan progress.
3605 	 * We don't want to spin the txg_sync thread, so we add a delay
3606 	 * here to simulate the time spent doing a scan. This is mostly
3607 	 * useful for testing and debugging.
3608 	 */
3609 	if (zfs_scan_suspend_progress) {
3610 		uint64_t scan_time_ns = gethrtime() - scn->scn_sync_start_time;
3611 		int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
3612 		    zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;
3613 
3614 		while (zfs_scan_suspend_progress &&
3615 		    !txg_sync_waiting(scn->scn_dp) &&
3616 		    !spa_shutting_down(scn->scn_dp->dp_spa) &&
3617 		    NSEC2MSEC(scan_time_ns) < mintime) {
3618 			delay(hz);
3619 			scan_time_ns = gethrtime() - scn->scn_sync_start_time;
3620 		}
3621 		return;
3622 	}
3623 
3624 	/*
3625 	 * It is possible to switch from unsorted to sorted at any time,
3626 	 * but afterwards the scan will remain sorted unless reloaded from
3627 	 * a checkpoint after a reboot.
3628 	 */
3629 	if (!zfs_scan_legacy) {
3630 		scn->scn_is_sorted = B_TRUE;
3631 		if (scn->scn_last_checkpoint == 0)
3632 			scn->scn_last_checkpoint = ddi_get_lbolt();
3633 	}
3634 
3635 	/*
3636 	 * For sorted scans, determine what kind of work we will be doing
3637 	 * this txg based on our memory limitations and whether or not we
3638 	 * need to perform a checkpoint.
3639 	 */
3640 	if (scn->scn_is_sorted) {
3641 		/*
3642 		 * If we are over our checkpoint interval, set scn_clearing
3643 		 * so that we can begin checkpointing immediately. The
3644 		 * checkpoint allows us to save a consistent bookmark
3645 		 * representing how much data we have scrubbed so far.
3646 		 * Otherwise, use the memory limit to determine if we should
3647 		 * scan for metadata or start issue scrub IOs. We accumulate
3648 		 * metadata until we hit our hard memory limit at which point
3649 		 * we issue scrub IOs until we are at our soft memory limit.
3650 		 */
3651 		if (scn->scn_checkpointing ||
3652 		    ddi_get_lbolt() - scn->scn_last_checkpoint >
3653 		    SEC_TO_TICK(zfs_scan_checkpoint_intval)) {
3654 			if (!scn->scn_checkpointing)
3655 				zfs_dbgmsg("begin scan checkpoint for %s",
3656 				    spa->spa_name);
3657 
3658 			scn->scn_checkpointing = B_TRUE;
3659 			scn->scn_clearing = B_TRUE;
3660 		} else {
3661 			boolean_t should_clear = dsl_scan_should_clear(scn);
3662 			if (should_clear && !scn->scn_clearing) {
3663 				zfs_dbgmsg("begin scan clearing for %s",
3664 				    spa->spa_name);
3665 				scn->scn_clearing = B_TRUE;
3666 			} else if (!should_clear && scn->scn_clearing) {
3667 				zfs_dbgmsg("finish scan clearing for %s",
3668 				    spa->spa_name);
3669 				scn->scn_clearing = B_FALSE;
3670 			}
3671 		}
3672 	} else {
3673 		ASSERT0(scn->scn_checkpointing);
3674 		ASSERT0(scn->scn_clearing);
3675 	}
3676 
3677 	if (!scn->scn_clearing && scn->scn_done_txg == 0) {
3678 		/* Need to scan metadata for more blocks to scrub */
3679 		dsl_scan_phys_t *scnp = &scn->scn_phys;
3680 		taskqid_t prefetch_tqid;
3681 
3682 		/*
3683 		 * Recalculate the max number of in-flight bytes for pool-wide
3684 		 * scanning operations (minimum 1MB). Limits for the issuing
3685 		 * phase are done per top-level vdev and are handled separately.
3686 		 */
3687 		scn->scn_maxinflight_bytes = MAX(zfs_scan_vdev_limit *
3688 		    dsl_scan_count_data_disks(spa->spa_root_vdev), 1ULL << 20);
3689 
3690 		if (scnp->scn_ddt_bookmark.ddb_class <=
3691 		    scnp->scn_ddt_class_max) {
3692 			ASSERT(ZB_IS_ZERO(&scnp->scn_bookmark));
3693 			zfs_dbgmsg("doing scan sync for %s txg %llu; "
3694 			    "ddt bm=%llu/%llu/%llu/%llx",
3695 			    spa->spa_name,
3696 			    (longlong_t)tx->tx_txg,
3697 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_class,
3698 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_type,
3699 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_checksum,
3700 			    (longlong_t)scnp->scn_ddt_bookmark.ddb_cursor);
3701 		} else {
3702 			zfs_dbgmsg("doing scan sync for %s txg %llu; "
3703 			    "bm=%llu/%llu/%llu/%llu",
3704 			    spa->spa_name,
3705 			    (longlong_t)tx->tx_txg,
3706 			    (longlong_t)scnp->scn_bookmark.zb_objset,
3707 			    (longlong_t)scnp->scn_bookmark.zb_object,
3708 			    (longlong_t)scnp->scn_bookmark.zb_level,
3709 			    (longlong_t)scnp->scn_bookmark.zb_blkid);
3710 		}
3711 
3712 		scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
3713 		    NULL, ZIO_FLAG_CANFAIL);
3714 
3715 		scn->scn_prefetch_stop = B_FALSE;
3716 		prefetch_tqid = taskq_dispatch(dp->dp_sync_taskq,
3717 		    dsl_scan_prefetch_thread, scn, TQ_SLEEP);
3718 		ASSERT(prefetch_tqid != TASKQID_INVALID);
3719 
3720 		dsl_pool_config_enter(dp, FTAG);
3721 		dsl_scan_visit(scn, tx);
3722 		dsl_pool_config_exit(dp, FTAG);
3723 
3724 		mutex_enter(&dp->dp_spa->spa_scrub_lock);
3725 		scn->scn_prefetch_stop = B_TRUE;
3726 		cv_broadcast(&spa->spa_scrub_io_cv);
3727 		mutex_exit(&dp->dp_spa->spa_scrub_lock);
3728 
3729 		taskq_wait_id(dp->dp_sync_taskq, prefetch_tqid);
3730 		(void) zio_wait(scn->scn_zio_root);
3731 		scn->scn_zio_root = NULL;
3732 
3733 		zfs_dbgmsg("scan visited %llu blocks of %s in %llums "
3734 		    "(%llu os's, %llu holes, %llu < mintxg, "
3735 		    "%llu in ddt, %llu > maxtxg)",
3736 		    (longlong_t)scn->scn_visited_this_txg,
3737 		    spa->spa_name,
3738 		    (longlong_t)NSEC2MSEC(gethrtime() -
3739 		    scn->scn_sync_start_time),
3740 		    (longlong_t)scn->scn_objsets_visited_this_txg,
3741 		    (longlong_t)scn->scn_holes_this_txg,
3742 		    (longlong_t)scn->scn_lt_min_this_txg,
3743 		    (longlong_t)scn->scn_ddt_contained_this_txg,
3744 		    (longlong_t)scn->scn_gt_max_this_txg);
3745 
3746 		if (!scn->scn_suspending) {
3747 			ASSERT0(avl_numnodes(&scn->scn_queue));
3748 			scn->scn_done_txg = tx->tx_txg + 1;
3749 			if (scn->scn_is_sorted) {
3750 				scn->scn_checkpointing = B_TRUE;
3751 				scn->scn_clearing = B_TRUE;
3752 			}
3753 			zfs_dbgmsg("scan complete for %s txg %llu",
3754 			    spa->spa_name,
3755 			    (longlong_t)tx->tx_txg);
3756 		}
3757 	} else if (scn->scn_is_sorted && scn->scn_bytes_pending != 0) {
3758 		ASSERT(scn->scn_clearing);
3759 
3760 		/* need to issue scrubbing IOs from per-vdev queues */
3761 		scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
3762 		    NULL, ZIO_FLAG_CANFAIL);
3763 		scan_io_queues_run(scn);
3764 		(void) zio_wait(scn->scn_zio_root);
3765 		scn->scn_zio_root = NULL;
3766 
3767 		/* calculate and dprintf the current memory usage */
3768 		(void) dsl_scan_should_clear(scn);
3769 		dsl_scan_update_stats(scn);
3770 
3771 		zfs_dbgmsg("scan issued %llu blocks for %s (%llu segs) "
3772 		    "in %llums (avg_block_size = %llu, avg_seg_size = %llu)",
3773 		    (longlong_t)scn->scn_zios_this_txg,
3774 		    spa->spa_name,
3775 		    (longlong_t)scn->scn_segs_this_txg,
3776 		    (longlong_t)NSEC2MSEC(gethrtime() -
3777 		    scn->scn_sync_start_time),
3778 		    (longlong_t)scn->scn_avg_zio_size_this_txg,
3779 		    (longlong_t)scn->scn_avg_seg_size_this_txg);
3780 	} else if (scn->scn_done_txg != 0 && scn->scn_done_txg <= tx->tx_txg) {
3781 		/* Finished with everything. Mark the scrub as complete */
3782 		zfs_dbgmsg("scan issuing complete txg %llu for %s",
3783 		    (longlong_t)tx->tx_txg,
3784 		    spa->spa_name);
3785 		ASSERT3U(scn->scn_done_txg, !=, 0);
3786 		ASSERT0(spa->spa_scrub_inflight);
3787 		ASSERT0(scn->scn_bytes_pending);
3788 		dsl_scan_done(scn, B_TRUE, tx);
3789 		sync_type = SYNC_MANDATORY;
3790 	}
3791 
3792 	dsl_scan_sync_state(scn, tx, sync_type);
3793 }
3794 
3795 static void
3796 count_block(dsl_scan_t *scn, zfs_all_blkstats_t *zab, const blkptr_t *bp)
3797 {
3798 	int i;
3799 
3800 	/*
3801 	 * Don't count embedded bp's, since we already did the work of
3802 	 * scanning these when we scanned the containing block.
3803 	 */
3804 	if (BP_IS_EMBEDDED(bp))
3805 		return;
3806 
3807 	/*
3808 	 * Update the spa's stats on how many bytes we have issued.
3809 	 * Sequential scrubs create a zio for each DVA of the bp. Each
3810 	 * of these will include all DVAs for repair purposes, but the
3811 	 * zio code will only try the first one unless there is an issue.
3812 	 * Therefore, we should only count the first DVA for these IOs.
3813 	 */
3814 	if (scn->scn_is_sorted) {
3815 		atomic_add_64(&scn->scn_dp->dp_spa->spa_scan_pass_issued,
3816 		    DVA_GET_ASIZE(&bp->blk_dva[0]));
3817 	} else {
3818 		spa_t *spa = scn->scn_dp->dp_spa;
3819 
3820 		for (i = 0; i < BP_GET_NDVAS(bp); i++) {
3821 			atomic_add_64(&spa->spa_scan_pass_issued,
3822 			    DVA_GET_ASIZE(&bp->blk_dva[i]));
3823 		}
3824 	}
3825 
3826 	/*
3827 	 * If we resume after a reboot, zab will be NULL; don't record
3828 	 * incomplete stats in that case.
3829 	 */
3830 	if (zab == NULL)
3831 		return;
3832 
3833 	mutex_enter(&zab->zab_lock);
3834 
3835 	for (i = 0; i < 4; i++) {
3836 		int l = (i < 2) ? BP_GET_LEVEL(bp) : DN_MAX_LEVELS;
3837 		int t = (i & 1) ? BP_GET_TYPE(bp) : DMU_OT_TOTAL;
3838 
3839 		if (t & DMU_OT_NEWTYPE)
3840 			t = DMU_OT_OTHER;
3841 		zfs_blkstat_t *zb = &zab->zab_type[l][t];
3842 		int equal;
3843 
3844 		zb->zb_count++;
3845 		zb->zb_asize += BP_GET_ASIZE(bp);
3846 		zb->zb_lsize += BP_GET_LSIZE(bp);
3847 		zb->zb_psize += BP_GET_PSIZE(bp);
3848 		zb->zb_gangs += BP_COUNT_GANG(bp);
3849 
3850 		switch (BP_GET_NDVAS(bp)) {
3851 		case 2:
3852 			if (DVA_GET_VDEV(&bp->blk_dva[0]) ==
3853 			    DVA_GET_VDEV(&bp->blk_dva[1]))
3854 				zb->zb_ditto_2_of_2_samevdev++;
3855 			break;
3856 		case 3:
3857 			equal = (DVA_GET_VDEV(&bp->blk_dva[0]) ==
3858 			    DVA_GET_VDEV(&bp->blk_dva[1])) +
3859 			    (DVA_GET_VDEV(&bp->blk_dva[0]) ==
3860 			    DVA_GET_VDEV(&bp->blk_dva[2])) +
3861 			    (DVA_GET_VDEV(&bp->blk_dva[1]) ==
3862 			    DVA_GET_VDEV(&bp->blk_dva[2]));
3863 			if (equal == 1)
3864 				zb->zb_ditto_2_of_3_samevdev++;
3865 			else if (equal == 3)
3866 				zb->zb_ditto_3_of_3_samevdev++;
3867 			break;
3868 		}
3869 	}
3870 
3871 	mutex_exit(&zab->zab_lock);
3872 }
3873 
3874 static void
3875 scan_io_queue_insert_impl(dsl_scan_io_queue_t *queue, scan_io_t *sio)
3876 {
3877 	avl_index_t idx;
3878 	int64_t asize = SIO_GET_ASIZE(sio);
3879 	dsl_scan_t *scn = queue->q_scn;
3880 
3881 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
3882 
3883 	if (avl_find(&queue->q_sios_by_addr, sio, &idx) != NULL) {
3884 		/* block is already scheduled for reading */
3885 		atomic_add_64(&scn->scn_bytes_pending, -asize);
3886 		sio_free(sio);
3887 		return;
3888 	}
3889 	avl_insert(&queue->q_sios_by_addr, sio, idx);
3890 	queue->q_sio_memused += SIO_GET_MUSED(sio);
3891 	range_tree_add(queue->q_exts_by_addr, SIO_GET_OFFSET(sio), asize);
3892 }
3893 
3894 /*
3895  * Given all the info we got from our metadata scanning process, we
3896  * construct a scan_io_t and insert it into the scan sorting queue. The
3897  * I/O must already be suitable for us to process. This is controlled
3898  * by dsl_scan_enqueue().
3899  */
3900 static void
3901 scan_io_queue_insert(dsl_scan_io_queue_t *queue, const blkptr_t *bp, int dva_i,
3902     int zio_flags, const zbookmark_phys_t *zb)
3903 {
3904 	dsl_scan_t *scn = queue->q_scn;
3905 	scan_io_t *sio = sio_alloc(BP_GET_NDVAS(bp));
3906 
3907 	ASSERT0(BP_IS_GANG(bp));
3908 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
3909 
3910 	bp2sio(bp, sio, dva_i);
3911 	sio->sio_flags = zio_flags;
3912 	sio->sio_zb = *zb;
3913 
3914 	/*
3915 	 * Increment the bytes pending counter now so that we can't
3916 	 * get an integer underflow in case the worker processes the
3917 	 * zio before we get to incrementing this counter.
3918 	 */
3919 	atomic_add_64(&scn->scn_bytes_pending, SIO_GET_ASIZE(sio));
3920 
3921 	scan_io_queue_insert_impl(queue, sio);
3922 }
3923 
3924 /*
3925  * Given a set of I/O parameters as discovered by the metadata traversal
3926  * process, attempts to place the I/O into the sorted queues (if allowed),
3927  * or immediately executes the I/O.
3928  */
3929 static void
3930 dsl_scan_enqueue(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
3931     const zbookmark_phys_t *zb)
3932 {
3933 	spa_t *spa = dp->dp_spa;
3934 
3935 	ASSERT(!BP_IS_EMBEDDED(bp));
3936 
3937 	/*
3938 	 * Gang blocks are hard to issue sequentially, so we just issue them
3939 	 * here immediately instead of queuing them.
3940 	 */
3941 	if (!dp->dp_scan->scn_is_sorted || BP_IS_GANG(bp)) {
3942 		scan_exec_io(dp, bp, zio_flags, zb, NULL);
3943 		return;
3944 	}
3945 
3946 	for (int i = 0; i < BP_GET_NDVAS(bp); i++) {
3947 		dva_t dva;
3948 		vdev_t *vdev;
3949 
3950 		dva = bp->blk_dva[i];
3951 		vdev = vdev_lookup_top(spa, DVA_GET_VDEV(&dva));
3952 		ASSERT(vdev != NULL);
3953 
3954 		mutex_enter(&vdev->vdev_scan_io_queue_lock);
3955 		if (vdev->vdev_scan_io_queue == NULL)
3956 			vdev->vdev_scan_io_queue = scan_io_queue_create(vdev);
3957 		ASSERT(dp->dp_scan != NULL);
3958 		scan_io_queue_insert(vdev->vdev_scan_io_queue, bp,
3959 		    i, zio_flags, zb);
3960 		mutex_exit(&vdev->vdev_scan_io_queue_lock);
3961 	}
3962 }
3963 
3964 static int
3965 dsl_scan_scrub_cb(dsl_pool_t *dp,
3966     const blkptr_t *bp, const zbookmark_phys_t *zb)
3967 {
3968 	dsl_scan_t *scn = dp->dp_scan;
3969 	spa_t *spa = dp->dp_spa;
3970 	uint64_t phys_birth = BP_PHYSICAL_BIRTH(bp);
3971 	size_t psize = BP_GET_PSIZE(bp);
3972 	boolean_t needs_io = B_FALSE;
3973 	int zio_flags = ZIO_FLAG_SCAN_THREAD | ZIO_FLAG_RAW | ZIO_FLAG_CANFAIL;
3974 
3975 
3976 	if (phys_birth <= scn->scn_phys.scn_min_txg ||
3977 	    phys_birth >= scn->scn_phys.scn_max_txg) {
3978 		count_block(scn, dp->dp_blkstats, bp);
3979 		return (0);
3980 	}
3981 
3982 	/* Embedded BP's have phys_birth==0, so we reject them above. */
3983 	ASSERT(!BP_IS_EMBEDDED(bp));
3984 
3985 	ASSERT(DSL_SCAN_IS_SCRUB_RESILVER(scn));
3986 	if (scn->scn_phys.scn_func == POOL_SCAN_SCRUB) {
3987 		zio_flags |= ZIO_FLAG_SCRUB;
3988 		needs_io = B_TRUE;
3989 	} else {
3990 		ASSERT3U(scn->scn_phys.scn_func, ==, POOL_SCAN_RESILVER);
3991 		zio_flags |= ZIO_FLAG_RESILVER;
3992 		needs_io = B_FALSE;
3993 	}
3994 
3995 	/* If it's an intent log block, failure is expected. */
3996 	if (zb->zb_level == ZB_ZIL_LEVEL)
3997 		zio_flags |= ZIO_FLAG_SPECULATIVE;
3998 
3999 	for (int d = 0; d < BP_GET_NDVAS(bp); d++) {
4000 		const dva_t *dva = &bp->blk_dva[d];
4001 
4002 		/*
4003 		 * Keep track of how much data we've examined so that
4004 		 * zpool(8) status can make useful progress reports.
4005 		 */
4006 		scn->scn_phys.scn_examined += DVA_GET_ASIZE(dva);
4007 		spa->spa_scan_pass_exam += DVA_GET_ASIZE(dva);
4008 
4009 		/* if it's a resilver, this may not be in the target range */
4010 		if (!needs_io)
4011 			needs_io = dsl_scan_need_resilver(spa, dva, psize,
4012 			    phys_birth);
4013 	}
4014 
4015 	if (needs_io && !zfs_no_scrub_io) {
4016 		dsl_scan_enqueue(dp, bp, zio_flags, zb);
4017 	} else {
4018 		count_block(scn, dp->dp_blkstats, bp);
4019 	}
4020 
4021 	/* do not relocate this block */
4022 	return (0);
4023 }
4024 
4025 static void
4026 dsl_scan_scrub_done(zio_t *zio)
4027 {
4028 	spa_t *spa = zio->io_spa;
4029 	blkptr_t *bp = zio->io_bp;
4030 	dsl_scan_io_queue_t *queue = zio->io_private;
4031 
4032 	abd_free(zio->io_abd);
4033 
4034 	if (queue == NULL) {
4035 		mutex_enter(&spa->spa_scrub_lock);
4036 		ASSERT3U(spa->spa_scrub_inflight, >=, BP_GET_PSIZE(bp));
4037 		spa->spa_scrub_inflight -= BP_GET_PSIZE(bp);
4038 		cv_broadcast(&spa->spa_scrub_io_cv);
4039 		mutex_exit(&spa->spa_scrub_lock);
4040 	} else {
4041 		mutex_enter(&queue->q_vd->vdev_scan_io_queue_lock);
4042 		ASSERT3U(queue->q_inflight_bytes, >=, BP_GET_PSIZE(bp));
4043 		queue->q_inflight_bytes -= BP_GET_PSIZE(bp);
4044 		cv_broadcast(&queue->q_zio_cv);
4045 		mutex_exit(&queue->q_vd->vdev_scan_io_queue_lock);
4046 	}
4047 
4048 	if (zio->io_error && (zio->io_error != ECKSUM ||
4049 	    !(zio->io_flags & ZIO_FLAG_SPECULATIVE))) {
4050 		atomic_inc_64(&spa->spa_dsl_pool->dp_scan->scn_phys.scn_errors);
4051 	}
4052 }
4053 
4054 /*
4055  * Given a scanning zio's information, executes the zio. The zio need
4056  * not necessarily be only sortable, this function simply executes the
4057  * zio, no matter what it is. The optional queue argument allows the
4058  * caller to specify that they want per top level vdev IO rate limiting
4059  * instead of the legacy global limiting.
4060  */
4061 static void
4062 scan_exec_io(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
4063     const zbookmark_phys_t *zb, dsl_scan_io_queue_t *queue)
4064 {
4065 	spa_t *spa = dp->dp_spa;
4066 	dsl_scan_t *scn = dp->dp_scan;
4067 	size_t size = BP_GET_PSIZE(bp);
4068 	abd_t *data = abd_alloc_for_io(size, B_FALSE);
4069 
4070 	if (queue == NULL) {
4071 		ASSERT3U(scn->scn_maxinflight_bytes, >, 0);
4072 		mutex_enter(&spa->spa_scrub_lock);
4073 		while (spa->spa_scrub_inflight >= scn->scn_maxinflight_bytes)
4074 			cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
4075 		spa->spa_scrub_inflight += BP_GET_PSIZE(bp);
4076 		mutex_exit(&spa->spa_scrub_lock);
4077 	} else {
4078 		kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;
4079 
4080 		ASSERT3U(queue->q_maxinflight_bytes, >, 0);
4081 		mutex_enter(q_lock);
4082 		while (queue->q_inflight_bytes >= queue->q_maxinflight_bytes)
4083 			cv_wait(&queue->q_zio_cv, q_lock);
4084 		queue->q_inflight_bytes += BP_GET_PSIZE(bp);
4085 		mutex_exit(q_lock);
4086 	}
4087 
4088 	count_block(scn, dp->dp_blkstats, bp);
4089 	zio_nowait(zio_read(scn->scn_zio_root, spa, bp, data, size,
4090 	    dsl_scan_scrub_done, queue, ZIO_PRIORITY_SCRUB, zio_flags, zb));
4091 }
4092 
4093 /*
4094  * This is the primary extent sorting algorithm. We balance two parameters:
4095  * 1) how many bytes of I/O are in an extent
4096  * 2) how well the extent is filled with I/O (as a fraction of its total size)
4097  * Since we allow extents to have gaps between their constituent I/Os, it's
4098  * possible to have a fairly large extent that contains the same amount of
4099  * I/O bytes than a much smaller extent, which just packs the I/O more tightly.
4100  * The algorithm sorts based on a score calculated from the extent's size,
4101  * the relative fill volume (in %) and a "fill weight" parameter that controls
4102  * the split between whether we prefer larger extents or more well populated
4103  * extents:
4104  *
4105  * SCORE = FILL_IN_BYTES + (FILL_IN_PERCENT * FILL_IN_BYTES * FILL_WEIGHT)
4106  *
4107  * Example:
4108  * 1) assume extsz = 64 MiB
4109  * 2) assume fill = 32 MiB (extent is half full)
4110  * 3) assume fill_weight = 3
4111  * 4)	SCORE = 32M + (((32M * 100) / 64M) * 3 * 32M) / 100
4112  *	SCORE = 32M + (50 * 3 * 32M) / 100
4113  *	SCORE = 32M + (4800M / 100)
4114  *	SCORE = 32M + 48M
4115  *	         ^     ^
4116  *	         |     +--- final total relative fill-based score
4117  *	         +--------- final total fill-based score
4118  *	SCORE = 80M
4119  *
4120  * As can be seen, at fill_ratio=3, the algorithm is slightly biased towards
4121  * extents that are more completely filled (in a 3:2 ratio) vs just larger.
4122  * Note that as an optimization, we replace multiplication and division by
4123  * 100 with bitshifting by 7 (which effectively multiplies and divides by 128).
4124  */
4125 static int
4126 ext_size_compare(const void *x, const void *y)
4127 {
4128 	const range_seg_gap_t *rsa = x, *rsb = y;
4129 
4130 	uint64_t sa = rsa->rs_end - rsa->rs_start;
4131 	uint64_t sb = rsb->rs_end - rsb->rs_start;
4132 	uint64_t score_a, score_b;
4133 
4134 	score_a = rsa->rs_fill + ((((rsa->rs_fill << 7) / sa) *
4135 	    fill_weight * rsa->rs_fill) >> 7);
4136 	score_b = rsb->rs_fill + ((((rsb->rs_fill << 7) / sb) *
4137 	    fill_weight * rsb->rs_fill) >> 7);
4138 
4139 	if (score_a > score_b)
4140 		return (-1);
4141 	if (score_a == score_b) {
4142 		if (rsa->rs_start < rsb->rs_start)
4143 			return (-1);
4144 		if (rsa->rs_start == rsb->rs_start)
4145 			return (0);
4146 		return (1);
4147 	}
4148 	return (1);
4149 }
4150 
4151 /*
4152  * Comparator for the q_sios_by_addr tree. Sorting is simply performed
4153  * based on LBA-order (from lowest to highest).
4154  */
4155 static int
4156 sio_addr_compare(const void *x, const void *y)
4157 {
4158 	const scan_io_t *a = x, *b = y;
4159 
4160 	return (TREE_CMP(SIO_GET_OFFSET(a), SIO_GET_OFFSET(b)));
4161 }
4162 
4163 /* IO queues are created on demand when they are needed. */
4164 static dsl_scan_io_queue_t *
4165 scan_io_queue_create(vdev_t *vd)
4166 {
4167 	dsl_scan_t *scn = vd->vdev_spa->spa_dsl_pool->dp_scan;
4168 	dsl_scan_io_queue_t *q = kmem_zalloc(sizeof (*q), KM_SLEEP);
4169 
4170 	q->q_scn = scn;
4171 	q->q_vd = vd;
4172 	q->q_sio_memused = 0;
4173 	cv_init(&q->q_zio_cv, NULL, CV_DEFAULT, NULL);
4174 	q->q_exts_by_addr = range_tree_create_impl(&rt_btree_ops, RANGE_SEG_GAP,
4175 	    &q->q_exts_by_size, 0, 0, ext_size_compare, zfs_scan_max_ext_gap);
4176 	avl_create(&q->q_sios_by_addr, sio_addr_compare,
4177 	    sizeof (scan_io_t), offsetof(scan_io_t, sio_nodes.sio_addr_node));
4178 
4179 	return (q);
4180 }
4181 
4182 /*
4183  * Destroys a scan queue and all segments and scan_io_t's contained in it.
4184  * No further execution of I/O occurs, anything pending in the queue is
4185  * simply freed without being executed.
4186  */
4187 void
4188 dsl_scan_io_queue_destroy(dsl_scan_io_queue_t *queue)
4189 {
4190 	dsl_scan_t *scn = queue->q_scn;
4191 	scan_io_t *sio;
4192 	void *cookie = NULL;
4193 	int64_t bytes_dequeued = 0;
4194 
4195 	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
4196 
4197 	while ((sio = avl_destroy_nodes(&queue->q_sios_by_addr, &cookie)) !=
4198 	    NULL) {
4199 		ASSERT(range_tree_contains(queue->q_exts_by_addr,
4200 		    SIO_GET_OFFSET(sio), SIO_GET_ASIZE(sio)));
4201 		bytes_dequeued += SIO_GET_ASIZE(sio);
4202 		queue->q_sio_memused -= SIO_GET_MUSED(sio);
4203 		sio_free(sio);
4204 	}
4205 
4206 	ASSERT0(queue->q_sio_memused);
4207 	atomic_add_64(&scn->scn_bytes_pending, -bytes_dequeued);
4208 	range_tree_vacate(queue->q_exts_by_addr, NULL, queue);
4209 	range_tree_destroy(queue->q_exts_by_addr);
4210 	avl_destroy(&queue->q_sios_by_addr);
4211 	cv_destroy(&queue->q_zio_cv);
4212 
4213 	kmem_free(queue, sizeof (*queue));
4214 }
4215 
4216 /*
4217  * Properly transfers a dsl_scan_queue_t from `svd' to `tvd'. This is
4218  * called on behalf of vdev_top_transfer when creating or destroying
4219  * a mirror vdev due to zpool attach/detach.
4220  */
4221 void
4222 dsl_scan_io_queue_vdev_xfer(vdev_t *svd, vdev_t *tvd)
4223 {
4224 	mutex_enter(&svd->vdev_scan_io_queue_lock);
4225 	mutex_enter(&tvd->vdev_scan_io_queue_lock);
4226 
4227 	VERIFY3P(tvd->vdev_scan_io_queue, ==, NULL);
4228 	tvd->vdev_scan_io_queue = svd->vdev_scan_io_queue;
4229 	svd->vdev_scan_io_queue = NULL;
4230 	if (tvd->vdev_scan_io_queue != NULL)
4231 		tvd->vdev_scan_io_queue->q_vd = tvd;
4232 
4233 	mutex_exit(&tvd->vdev_scan_io_queue_lock);
4234 	mutex_exit(&svd->vdev_scan_io_queue_lock);
4235 }
4236 
4237 static void
4238 scan_io_queues_destroy(dsl_scan_t *scn)
4239 {
4240 	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
4241 
4242 	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
4243 		vdev_t *tvd = rvd->vdev_child[i];
4244 
4245 		mutex_enter(&tvd->vdev_scan_io_queue_lock);
4246 		if (tvd->vdev_scan_io_queue != NULL)
4247 			dsl_scan_io_queue_destroy(tvd->vdev_scan_io_queue);
4248 		tvd->vdev_scan_io_queue = NULL;
4249 		mutex_exit(&tvd->vdev_scan_io_queue_lock);
4250 	}
4251 }
4252 
4253 static void
4254 dsl_scan_freed_dva(spa_t *spa, const blkptr_t *bp, int dva_i)
4255 {
4256 	dsl_pool_t *dp = spa->spa_dsl_pool;
4257 	dsl_scan_t *scn = dp->dp_scan;
4258 	vdev_t *vdev;
4259 	kmutex_t *q_lock;
4260 	dsl_scan_io_queue_t *queue;
4261 	scan_io_t *srch_sio, *sio;
4262 	avl_index_t idx;
4263 	uint64_t start, size;
4264 
4265 	vdev = vdev_lookup_top(spa, DVA_GET_VDEV(&bp->blk_dva[dva_i]));
4266 	ASSERT(vdev != NULL);
4267 	q_lock = &vdev->vdev_scan_io_queue_lock;
4268 	queue = vdev->vdev_scan_io_queue;
4269 
4270 	mutex_enter(q_lock);
4271 	if (queue == NULL) {
4272 		mutex_exit(q_lock);
4273 		return;
4274 	}
4275 
4276 	srch_sio = sio_alloc(BP_GET_NDVAS(bp));
4277 	bp2sio(bp, srch_sio, dva_i);
4278 	start = SIO_GET_OFFSET(srch_sio);
4279 	size = SIO_GET_ASIZE(srch_sio);
4280 
4281 	/*
4282 	 * We can find the zio in two states:
4283 	 * 1) Cold, just sitting in the queue of zio's to be issued at
4284 	 *	some point in the future. In this case, all we do is
4285 	 *	remove the zio from the q_sios_by_addr tree, decrement
4286 	 *	its data volume from the containing range_seg_t and
4287 	 *	resort the q_exts_by_size tree to reflect that the
4288 	 *	range_seg_t has lost some of its 'fill'. We don't shorten
4289 	 *	the range_seg_t - this is usually rare enough not to be
4290 	 *	worth the extra hassle of trying keep track of precise
4291 	 *	extent boundaries.
4292 	 * 2) Hot, where the zio is currently in-flight in
4293 	 *	dsl_scan_issue_ios. In this case, we can't simply
4294 	 *	reach in and stop the in-flight zio's, so we instead
4295 	 *	block the caller. Eventually, dsl_scan_issue_ios will
4296 	 *	be done with issuing the zio's it gathered and will
4297 	 *	signal us.
4298 	 */
4299 	sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
4300 	sio_free(srch_sio);
4301 
4302 	if (sio != NULL) {
4303 		int64_t asize = SIO_GET_ASIZE(sio);
4304 		blkptr_t tmpbp;
4305 
4306 		/* Got it while it was cold in the queue */
4307 		ASSERT3U(start, ==, SIO_GET_OFFSET(sio));
4308 		ASSERT3U(size, ==, asize);
4309 		avl_remove(&queue->q_sios_by_addr, sio);
4310 		queue->q_sio_memused -= SIO_GET_MUSED(sio);
4311 
4312 		ASSERT(range_tree_contains(queue->q_exts_by_addr, start, size));
4313 		range_tree_remove_fill(queue->q_exts_by_addr, start, size);
4314 
4315 		/*
4316 		 * We only update scn_bytes_pending in the cold path,
4317 		 * otherwise it will already have been accounted for as
4318 		 * part of the zio's execution.
4319 		 */
4320 		atomic_add_64(&scn->scn_bytes_pending, -asize);
4321 
4322 		/* count the block as though we issued it */
4323 		sio2bp(sio, &tmpbp);
4324 		count_block(scn, dp->dp_blkstats, &tmpbp);
4325 
4326 		sio_free(sio);
4327 	}
4328 	mutex_exit(q_lock);
4329 }
4330 
4331 /*
4332  * Callback invoked when a zio_free() zio is executing. This needs to be
4333  * intercepted to prevent the zio from deallocating a particular portion
4334  * of disk space and it then getting reallocated and written to, while we
4335  * still have it queued up for processing.
4336  */
4337 void
4338 dsl_scan_freed(spa_t *spa, const blkptr_t *bp)
4339 {
4340 	dsl_pool_t *dp = spa->spa_dsl_pool;
4341 	dsl_scan_t *scn = dp->dp_scan;
4342 
4343 	ASSERT(!BP_IS_EMBEDDED(bp));
4344 	ASSERT(scn != NULL);
4345 	if (!dsl_scan_is_running(scn))
4346 		return;
4347 
4348 	for (int i = 0; i < BP_GET_NDVAS(bp); i++)
4349 		dsl_scan_freed_dva(spa, bp, i);
4350 }
4351 
4352 /*
4353  * Check if a vdev needs resilvering (non-empty DTL), if so, and resilver has
4354  * not started, start it. Otherwise, only restart if max txg in DTL range is
4355  * greater than the max txg in the current scan. If the DTL max is less than
4356  * the scan max, then the vdev has not missed any new data since the resilver
4357  * started, so a restart is not needed.
4358  */
4359 void
4360 dsl_scan_assess_vdev(dsl_pool_t *dp, vdev_t *vd)
4361 {
4362 	uint64_t min, max;
4363 
4364 	if (!vdev_resilver_needed(vd, &min, &max))
4365 		return;
4366 
4367 	if (!dsl_scan_resilvering(dp)) {
4368 		spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
4369 		return;
4370 	}
4371 
4372 	if (max <= dp->dp_scan->scn_phys.scn_max_txg)
4373 		return;
4374 
4375 	/* restart is needed, check if it can be deferred */
4376 	if (spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
4377 		vdev_defer_resilver(vd);
4378 	else
4379 		spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
4380 }
4381 
4382 /* BEGIN CSTYLED */
4383 ZFS_MODULE_PARAM(zfs, zfs_, scan_vdev_limit, ULONG, ZMOD_RW,
4384 	"Max bytes in flight per leaf vdev for scrubs and resilvers");
4385 
4386 ZFS_MODULE_PARAM(zfs, zfs_, scrub_min_time_ms, INT, ZMOD_RW,
4387 	"Min millisecs to scrub per txg");
4388 
4389 ZFS_MODULE_PARAM(zfs, zfs_, obsolete_min_time_ms, INT, ZMOD_RW,
4390 	"Min millisecs to obsolete per txg");
4391 
4392 ZFS_MODULE_PARAM(zfs, zfs_, free_min_time_ms, INT, ZMOD_RW,
4393 	"Min millisecs to free per txg");
4394 
4395 ZFS_MODULE_PARAM(zfs, zfs_, resilver_min_time_ms, INT, ZMOD_RW,
4396 	"Min millisecs to resilver per txg");
4397 
4398 ZFS_MODULE_PARAM(zfs, zfs_, scan_suspend_progress, INT, ZMOD_RW,
4399 	"Set to prevent scans from progressing");
4400 
4401 ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_io, INT, ZMOD_RW,
4402 	"Set to disable scrub I/O");
4403 
4404 ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_prefetch, INT, ZMOD_RW,
4405 	"Set to disable scrub prefetching");
4406 
4407 ZFS_MODULE_PARAM(zfs, zfs_, async_block_max_blocks, ULONG, ZMOD_RW,
4408 	"Max number of blocks freed in one txg");
4409 
4410 ZFS_MODULE_PARAM(zfs, zfs_, max_async_dedup_frees, ULONG, ZMOD_RW,
4411 	"Max number of dedup blocks freed in one txg");
4412 
4413 ZFS_MODULE_PARAM(zfs, zfs_, free_bpobj_enabled, INT, ZMOD_RW,
4414 	"Enable processing of the free_bpobj");
4415 
4416 ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_fact, INT, ZMOD_RW,
4417 	"Fraction of RAM for scan hard limit");
4418 
4419 ZFS_MODULE_PARAM(zfs, zfs_, scan_issue_strategy, INT, ZMOD_RW,
4420 	"IO issuing strategy during scrubbing. "
4421 	"0 = default, 1 = LBA, 2 = size");
4422 
4423 ZFS_MODULE_PARAM(zfs, zfs_, scan_legacy, INT, ZMOD_RW,
4424 	"Scrub using legacy non-sequential method");
4425 
4426 ZFS_MODULE_PARAM(zfs, zfs_, scan_checkpoint_intval, INT, ZMOD_RW,
4427 	"Scan progress on-disk checkpointing interval");
4428 
4429 ZFS_MODULE_PARAM(zfs, zfs_, scan_max_ext_gap, ULONG, ZMOD_RW,
4430 	"Max gap in bytes between sequential scrub / resilver I/Os");
4431 
4432 ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_soft_fact, INT, ZMOD_RW,
4433 	"Fraction of hard limit used as soft limit");
4434 
4435 ZFS_MODULE_PARAM(zfs, zfs_, scan_strict_mem_lim, INT, ZMOD_RW,
4436 	"Tunable to attempt to reduce lock contention");
4437 
4438 ZFS_MODULE_PARAM(zfs, zfs_, scan_fill_weight, INT, ZMOD_RW,
4439 	"Tunable to adjust bias towards more filled segments during scans");
4440 
4441 ZFS_MODULE_PARAM(zfs, zfs_, resilver_disable_defer, INT, ZMOD_RW,
4442 	"Process all resilvers immediately");
4443 /* END CSTYLED */
4444