xref: /freebsd/sys/contrib/openzfs/module/zfs/zio.c (revision 47ef2a131091508e049ab10cad7f91a3c1342cd9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or https://opensource.org/licenses/CDDL-1.0.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2011, 2022 by Delphix. All rights reserved.
24  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
25  * Copyright (c) 2017, Intel Corporation.
26  * Copyright (c) 2019, 2023, 2024, Klara Inc.
27  * Copyright (c) 2019, Allan Jude
28  * Copyright (c) 2021, Datto, Inc.
29  * Copyright (c) 2021, 2024 by George Melikov. All rights reserved.
30  */
31 
32 #include <sys/sysmacros.h>
33 #include <sys/zfs_context.h>
34 #include <sys/fm/fs/zfs.h>
35 #include <sys/spa.h>
36 #include <sys/txg.h>
37 #include <sys/spa_impl.h>
38 #include <sys/vdev_impl.h>
39 #include <sys/vdev_trim.h>
40 #include <sys/zio_impl.h>
41 #include <sys/zio_compress.h>
42 #include <sys/zio_checksum.h>
43 #include <sys/dmu_objset.h>
44 #include <sys/arc.h>
45 #include <sys/brt.h>
46 #include <sys/ddt.h>
47 #include <sys/blkptr.h>
48 #include <sys/zfeature.h>
49 #include <sys/dsl_scan.h>
50 #include <sys/metaslab_impl.h>
51 #include <sys/time.h>
52 #include <sys/trace_zfs.h>
53 #include <sys/abd.h>
54 #include <sys/dsl_crypt.h>
55 #include <cityhash.h>
56 
57 /*
58  * ==========================================================================
59  * I/O type descriptions
60  * ==========================================================================
61  */
62 const char *const zio_type_name[ZIO_TYPES] = {
63 	/*
64 	 * Note: Linux kernel thread name length is limited
65 	 * so these names will differ from upstream open zfs.
66 	 */
67 	"z_null", "z_rd", "z_wr", "z_fr", "z_cl", "z_flush", "z_trim"
68 };
69 
70 int zio_dva_throttle_enabled = B_TRUE;
71 static int zio_deadman_log_all = B_FALSE;
72 
73 /*
74  * ==========================================================================
75  * I/O kmem caches
76  * ==========================================================================
77  */
78 static kmem_cache_t *zio_cache;
79 static kmem_cache_t *zio_link_cache;
80 kmem_cache_t *zio_buf_cache[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
81 kmem_cache_t *zio_data_buf_cache[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
82 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
83 static uint64_t zio_buf_cache_allocs[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
84 static uint64_t zio_buf_cache_frees[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
85 #endif
86 
87 /* Mark IOs as "slow" if they take longer than 30 seconds */
88 static uint_t zio_slow_io_ms = (30 * MILLISEC);
89 
90 #define	BP_SPANB(indblkshift, level) \
91 	(((uint64_t)1) << ((level) * ((indblkshift) - SPA_BLKPTRSHIFT)))
92 #define	COMPARE_META_LEVEL	0x80000000ul
93 /*
94  * The following actions directly effect the spa's sync-to-convergence logic.
95  * The values below define the sync pass when we start performing the action.
96  * Care should be taken when changing these values as they directly impact
97  * spa_sync() performance. Tuning these values may introduce subtle performance
98  * pathologies and should only be done in the context of performance analysis.
99  * These tunables will eventually be removed and replaced with #defines once
100  * enough analysis has been done to determine optimal values.
101  *
102  * The 'zfs_sync_pass_deferred_free' pass must be greater than 1 to ensure that
103  * regular blocks are not deferred.
104  *
105  * Starting in sync pass 8 (zfs_sync_pass_dont_compress), we disable
106  * compression (including of metadata).  In practice, we don't have this
107  * many sync passes, so this has no effect.
108  *
109  * The original intent was that disabling compression would help the sync
110  * passes to converge. However, in practice disabling compression increases
111  * the average number of sync passes, because when we turn compression off, a
112  * lot of block's size will change and thus we have to re-allocate (not
113  * overwrite) them. It also increases the number of 128KB allocations (e.g.
114  * for indirect blocks and spacemaps) because these will not be compressed.
115  * The 128K allocations are especially detrimental to performance on highly
116  * fragmented systems, which may have very few free segments of this size,
117  * and may need to load new metaslabs to satisfy 128K allocations.
118  */
119 
120 /* defer frees starting in this pass */
121 uint_t zfs_sync_pass_deferred_free = 2;
122 
123 /* don't compress starting in this pass */
124 static uint_t zfs_sync_pass_dont_compress = 8;
125 
126 /* rewrite new bps starting in this pass */
127 static uint_t zfs_sync_pass_rewrite = 2;
128 
129 /*
130  * An allocating zio is one that either currently has the DVA allocate
131  * stage set or will have it later in its lifetime.
132  */
133 #define	IO_IS_ALLOCATING(zio) ((zio)->io_orig_pipeline & ZIO_STAGE_DVA_ALLOCATE)
134 
135 /*
136  * Enable smaller cores by excluding metadata
137  * allocations as well.
138  */
139 int zio_exclude_metadata = 0;
140 static int zio_requeue_io_start_cut_in_line = 1;
141 
142 #ifdef ZFS_DEBUG
143 static const int zio_buf_debug_limit = 16384;
144 #else
145 static const int zio_buf_debug_limit = 0;
146 #endif
147 
148 static inline void __zio_execute(zio_t *zio);
149 
150 static void zio_taskq_dispatch(zio_t *, zio_taskq_type_t, boolean_t);
151 
152 void
153 zio_init(void)
154 {
155 	size_t c;
156 
157 	zio_cache = kmem_cache_create("zio_cache",
158 	    sizeof (zio_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
159 	zio_link_cache = kmem_cache_create("zio_link_cache",
160 	    sizeof (zio_link_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
161 
162 	for (c = 0; c < SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT; c++) {
163 		size_t size = (c + 1) << SPA_MINBLOCKSHIFT;
164 		size_t align, cflags, data_cflags;
165 		char name[32];
166 
167 		/*
168 		 * Create cache for each half-power of 2 size, starting from
169 		 * SPA_MINBLOCKSIZE.  It should give us memory space efficiency
170 		 * of ~7/8, sufficient for transient allocations mostly using
171 		 * these caches.
172 		 */
173 		size_t p2 = size;
174 		while (!ISP2(p2))
175 			p2 &= p2 - 1;
176 		if (!IS_P2ALIGNED(size, p2 / 2))
177 			continue;
178 
179 #ifndef _KERNEL
180 		/*
181 		 * If we are using watchpoints, put each buffer on its own page,
182 		 * to eliminate the performance overhead of trapping to the
183 		 * kernel when modifying a non-watched buffer that shares the
184 		 * page with a watched buffer.
185 		 */
186 		if (arc_watch && !IS_P2ALIGNED(size, PAGESIZE))
187 			continue;
188 #endif
189 
190 		if (IS_P2ALIGNED(size, PAGESIZE))
191 			align = PAGESIZE;
192 		else
193 			align = 1 << (highbit64(size ^ (size - 1)) - 1);
194 
195 		cflags = (zio_exclude_metadata || size > zio_buf_debug_limit) ?
196 		    KMC_NODEBUG : 0;
197 		data_cflags = KMC_NODEBUG;
198 		if (abd_size_alloc_linear(size)) {
199 			cflags |= KMC_RECLAIMABLE;
200 			data_cflags |= KMC_RECLAIMABLE;
201 		}
202 		if (cflags == data_cflags) {
203 			/*
204 			 * Resulting kmem caches would be identical.
205 			 * Save memory by creating only one.
206 			 */
207 			(void) snprintf(name, sizeof (name),
208 			    "zio_buf_comb_%lu", (ulong_t)size);
209 			zio_buf_cache[c] = kmem_cache_create(name, size, align,
210 			    NULL, NULL, NULL, NULL, NULL, cflags);
211 			zio_data_buf_cache[c] = zio_buf_cache[c];
212 			continue;
213 		}
214 		(void) snprintf(name, sizeof (name), "zio_buf_%lu",
215 		    (ulong_t)size);
216 		zio_buf_cache[c] = kmem_cache_create(name, size, align,
217 		    NULL, NULL, NULL, NULL, NULL, cflags);
218 
219 		(void) snprintf(name, sizeof (name), "zio_data_buf_%lu",
220 		    (ulong_t)size);
221 		zio_data_buf_cache[c] = kmem_cache_create(name, size, align,
222 		    NULL, NULL, NULL, NULL, NULL, data_cflags);
223 	}
224 
225 	while (--c != 0) {
226 		ASSERT(zio_buf_cache[c] != NULL);
227 		if (zio_buf_cache[c - 1] == NULL)
228 			zio_buf_cache[c - 1] = zio_buf_cache[c];
229 
230 		ASSERT(zio_data_buf_cache[c] != NULL);
231 		if (zio_data_buf_cache[c - 1] == NULL)
232 			zio_data_buf_cache[c - 1] = zio_data_buf_cache[c];
233 	}
234 
235 	zio_inject_init();
236 
237 	lz4_init();
238 }
239 
240 void
241 zio_fini(void)
242 {
243 	size_t n = SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT;
244 
245 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
246 	for (size_t i = 0; i < n; i++) {
247 		if (zio_buf_cache_allocs[i] != zio_buf_cache_frees[i])
248 			(void) printf("zio_fini: [%d] %llu != %llu\n",
249 			    (int)((i + 1) << SPA_MINBLOCKSHIFT),
250 			    (long long unsigned)zio_buf_cache_allocs[i],
251 			    (long long unsigned)zio_buf_cache_frees[i]);
252 	}
253 #endif
254 
255 	/*
256 	 * The same kmem cache can show up multiple times in both zio_buf_cache
257 	 * and zio_data_buf_cache. Do a wasteful but trivially correct scan to
258 	 * sort it out.
259 	 */
260 	for (size_t i = 0; i < n; i++) {
261 		kmem_cache_t *cache = zio_buf_cache[i];
262 		if (cache == NULL)
263 			continue;
264 		for (size_t j = i; j < n; j++) {
265 			if (cache == zio_buf_cache[j])
266 				zio_buf_cache[j] = NULL;
267 			if (cache == zio_data_buf_cache[j])
268 				zio_data_buf_cache[j] = NULL;
269 		}
270 		kmem_cache_destroy(cache);
271 	}
272 
273 	for (size_t i = 0; i < n; i++) {
274 		kmem_cache_t *cache = zio_data_buf_cache[i];
275 		if (cache == NULL)
276 			continue;
277 		for (size_t j = i; j < n; j++) {
278 			if (cache == zio_data_buf_cache[j])
279 				zio_data_buf_cache[j] = NULL;
280 		}
281 		kmem_cache_destroy(cache);
282 	}
283 
284 	for (size_t i = 0; i < n; i++) {
285 		VERIFY3P(zio_buf_cache[i], ==, NULL);
286 		VERIFY3P(zio_data_buf_cache[i], ==, NULL);
287 	}
288 
289 	kmem_cache_destroy(zio_link_cache);
290 	kmem_cache_destroy(zio_cache);
291 
292 	zio_inject_fini();
293 
294 	lz4_fini();
295 }
296 
297 /*
298  * ==========================================================================
299  * Allocate and free I/O buffers
300  * ==========================================================================
301  */
302 
303 #if defined(ZFS_DEBUG) && defined(_KERNEL)
304 #define	ZFS_ZIO_BUF_CANARY	1
305 #endif
306 
307 #ifdef ZFS_ZIO_BUF_CANARY
308 static const ulong_t zio_buf_canary = (ulong_t)0xdeadc0dedead210b;
309 
310 /*
311  * Use empty space after the buffer to detect overflows.
312  *
313  * Since zio_init() creates kmem caches only for certain set of buffer sizes,
314  * allocations of different sizes may have some unused space after the data.
315  * Filling part of that space with a known pattern on allocation and checking
316  * it on free should allow us to detect some buffer overflows.
317  */
318 static void
319 zio_buf_put_canary(ulong_t *p, size_t size, kmem_cache_t **cache, size_t c)
320 {
321 	size_t off = P2ROUNDUP(size, sizeof (ulong_t));
322 	ulong_t *canary = p + off / sizeof (ulong_t);
323 	size_t asize = (c + 1) << SPA_MINBLOCKSHIFT;
324 	if (c + 1 < SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT &&
325 	    cache[c] == cache[c + 1])
326 		asize = (c + 2) << SPA_MINBLOCKSHIFT;
327 	for (; off < asize; canary++, off += sizeof (ulong_t))
328 		*canary = zio_buf_canary;
329 }
330 
331 static void
332 zio_buf_check_canary(ulong_t *p, size_t size, kmem_cache_t **cache, size_t c)
333 {
334 	size_t off = P2ROUNDUP(size, sizeof (ulong_t));
335 	ulong_t *canary = p + off / sizeof (ulong_t);
336 	size_t asize = (c + 1) << SPA_MINBLOCKSHIFT;
337 	if (c + 1 < SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT &&
338 	    cache[c] == cache[c + 1])
339 		asize = (c + 2) << SPA_MINBLOCKSHIFT;
340 	for (; off < asize; canary++, off += sizeof (ulong_t)) {
341 		if (unlikely(*canary != zio_buf_canary)) {
342 			PANIC("ZIO buffer overflow %p (%zu) + %zu %#lx != %#lx",
343 			    p, size, (canary - p) * sizeof (ulong_t),
344 			    *canary, zio_buf_canary);
345 		}
346 	}
347 }
348 #endif
349 
350 /*
351  * Use zio_buf_alloc to allocate ZFS metadata.  This data will appear in a
352  * crashdump if the kernel panics, so use it judiciously.  Obviously, it's
353  * useful to inspect ZFS metadata, but if possible, we should avoid keeping
354  * excess / transient data in-core during a crashdump.
355  */
356 void *
357 zio_buf_alloc(size_t size)
358 {
359 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
360 
361 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
362 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
363 	atomic_add_64(&zio_buf_cache_allocs[c], 1);
364 #endif
365 
366 	void *p = kmem_cache_alloc(zio_buf_cache[c], KM_PUSHPAGE);
367 #ifdef ZFS_ZIO_BUF_CANARY
368 	zio_buf_put_canary(p, size, zio_buf_cache, c);
369 #endif
370 	return (p);
371 }
372 
373 /*
374  * Use zio_data_buf_alloc to allocate data.  The data will not appear in a
375  * crashdump if the kernel panics.  This exists so that we will limit the amount
376  * of ZFS data that shows up in a kernel crashdump.  (Thus reducing the amount
377  * of kernel heap dumped to disk when the kernel panics)
378  */
379 void *
380 zio_data_buf_alloc(size_t size)
381 {
382 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
383 
384 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
385 
386 	void *p = kmem_cache_alloc(zio_data_buf_cache[c], KM_PUSHPAGE);
387 #ifdef ZFS_ZIO_BUF_CANARY
388 	zio_buf_put_canary(p, size, zio_data_buf_cache, c);
389 #endif
390 	return (p);
391 }
392 
393 void
394 zio_buf_free(void *buf, size_t size)
395 {
396 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
397 
398 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
399 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
400 	atomic_add_64(&zio_buf_cache_frees[c], 1);
401 #endif
402 
403 #ifdef ZFS_ZIO_BUF_CANARY
404 	zio_buf_check_canary(buf, size, zio_buf_cache, c);
405 #endif
406 	kmem_cache_free(zio_buf_cache[c], buf);
407 }
408 
409 void
410 zio_data_buf_free(void *buf, size_t size)
411 {
412 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
413 
414 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
415 
416 #ifdef ZFS_ZIO_BUF_CANARY
417 	zio_buf_check_canary(buf, size, zio_data_buf_cache, c);
418 #endif
419 	kmem_cache_free(zio_data_buf_cache[c], buf);
420 }
421 
422 static void
423 zio_abd_free(void *abd, size_t size)
424 {
425 	(void) size;
426 	abd_free((abd_t *)abd);
427 }
428 
429 /*
430  * ==========================================================================
431  * Push and pop I/O transform buffers
432  * ==========================================================================
433  */
434 void
435 zio_push_transform(zio_t *zio, abd_t *data, uint64_t size, uint64_t bufsize,
436     zio_transform_func_t *transform)
437 {
438 	zio_transform_t *zt = kmem_alloc(sizeof (zio_transform_t), KM_SLEEP);
439 
440 	zt->zt_orig_abd = zio->io_abd;
441 	zt->zt_orig_size = zio->io_size;
442 	zt->zt_bufsize = bufsize;
443 	zt->zt_transform = transform;
444 
445 	zt->zt_next = zio->io_transform_stack;
446 	zio->io_transform_stack = zt;
447 
448 	zio->io_abd = data;
449 	zio->io_size = size;
450 }
451 
452 void
453 zio_pop_transforms(zio_t *zio)
454 {
455 	zio_transform_t *zt;
456 
457 	while ((zt = zio->io_transform_stack) != NULL) {
458 		if (zt->zt_transform != NULL)
459 			zt->zt_transform(zio,
460 			    zt->zt_orig_abd, zt->zt_orig_size);
461 
462 		if (zt->zt_bufsize != 0)
463 			abd_free(zio->io_abd);
464 
465 		zio->io_abd = zt->zt_orig_abd;
466 		zio->io_size = zt->zt_orig_size;
467 		zio->io_transform_stack = zt->zt_next;
468 
469 		kmem_free(zt, sizeof (zio_transform_t));
470 	}
471 }
472 
473 /*
474  * ==========================================================================
475  * I/O transform callbacks for subblocks, decompression, and decryption
476  * ==========================================================================
477  */
478 static void
479 zio_subblock(zio_t *zio, abd_t *data, uint64_t size)
480 {
481 	ASSERT(zio->io_size > size);
482 
483 	if (zio->io_type == ZIO_TYPE_READ)
484 		abd_copy(data, zio->io_abd, size);
485 }
486 
487 static void
488 zio_decompress(zio_t *zio, abd_t *data, uint64_t size)
489 {
490 	if (zio->io_error == 0) {
491 		int ret = zio_decompress_data(BP_GET_COMPRESS(zio->io_bp),
492 		    zio->io_abd, data, zio->io_size, size,
493 		    &zio->io_prop.zp_complevel);
494 
495 		if (zio_injection_enabled && ret == 0)
496 			ret = zio_handle_fault_injection(zio, EINVAL);
497 
498 		if (ret != 0)
499 			zio->io_error = SET_ERROR(EIO);
500 	}
501 }
502 
503 static void
504 zio_decrypt(zio_t *zio, abd_t *data, uint64_t size)
505 {
506 	int ret;
507 	void *tmp;
508 	blkptr_t *bp = zio->io_bp;
509 	spa_t *spa = zio->io_spa;
510 	uint64_t dsobj = zio->io_bookmark.zb_objset;
511 	uint64_t lsize = BP_GET_LSIZE(bp);
512 	dmu_object_type_t ot = BP_GET_TYPE(bp);
513 	uint8_t salt[ZIO_DATA_SALT_LEN];
514 	uint8_t iv[ZIO_DATA_IV_LEN];
515 	uint8_t mac[ZIO_DATA_MAC_LEN];
516 	boolean_t no_crypt = B_FALSE;
517 
518 	ASSERT(BP_USES_CRYPT(bp));
519 	ASSERT3U(size, !=, 0);
520 
521 	if (zio->io_error != 0)
522 		return;
523 
524 	/*
525 	 * Verify the cksum of MACs stored in an indirect bp. It will always
526 	 * be possible to verify this since it does not require an encryption
527 	 * key.
528 	 */
529 	if (BP_HAS_INDIRECT_MAC_CKSUM(bp)) {
530 		zio_crypt_decode_mac_bp(bp, mac);
531 
532 		if (BP_GET_COMPRESS(bp) != ZIO_COMPRESS_OFF) {
533 			/*
534 			 * We haven't decompressed the data yet, but
535 			 * zio_crypt_do_indirect_mac_checksum() requires
536 			 * decompressed data to be able to parse out the MACs
537 			 * from the indirect block. We decompress it now and
538 			 * throw away the result after we are finished.
539 			 */
540 			abd_t *abd = abd_alloc_linear(lsize, B_TRUE);
541 			ret = zio_decompress_data(BP_GET_COMPRESS(bp),
542 			    zio->io_abd, abd, zio->io_size, lsize,
543 			    &zio->io_prop.zp_complevel);
544 			if (ret != 0) {
545 				abd_free(abd);
546 				ret = SET_ERROR(EIO);
547 				goto error;
548 			}
549 			ret = zio_crypt_do_indirect_mac_checksum_abd(B_FALSE,
550 			    abd, lsize, BP_SHOULD_BYTESWAP(bp), mac);
551 			abd_free(abd);
552 		} else {
553 			ret = zio_crypt_do_indirect_mac_checksum_abd(B_FALSE,
554 			    zio->io_abd, size, BP_SHOULD_BYTESWAP(bp), mac);
555 		}
556 		abd_copy(data, zio->io_abd, size);
557 
558 		if (zio_injection_enabled && ot != DMU_OT_DNODE && ret == 0) {
559 			ret = zio_handle_decrypt_injection(spa,
560 			    &zio->io_bookmark, ot, ECKSUM);
561 		}
562 		if (ret != 0)
563 			goto error;
564 
565 		return;
566 	}
567 
568 	/*
569 	 * If this is an authenticated block, just check the MAC. It would be
570 	 * nice to separate this out into its own flag, but when this was done,
571 	 * we had run out of bits in what is now zio_flag_t. Future cleanup
572 	 * could make this a flag bit.
573 	 */
574 	if (BP_IS_AUTHENTICATED(bp)) {
575 		if (ot == DMU_OT_OBJSET) {
576 			ret = spa_do_crypt_objset_mac_abd(B_FALSE, spa,
577 			    dsobj, zio->io_abd, size, BP_SHOULD_BYTESWAP(bp));
578 		} else {
579 			zio_crypt_decode_mac_bp(bp, mac);
580 			ret = spa_do_crypt_mac_abd(B_FALSE, spa, dsobj,
581 			    zio->io_abd, size, mac);
582 			if (zio_injection_enabled && ret == 0) {
583 				ret = zio_handle_decrypt_injection(spa,
584 				    &zio->io_bookmark, ot, ECKSUM);
585 			}
586 		}
587 		abd_copy(data, zio->io_abd, size);
588 
589 		if (ret != 0)
590 			goto error;
591 
592 		return;
593 	}
594 
595 	zio_crypt_decode_params_bp(bp, salt, iv);
596 
597 	if (ot == DMU_OT_INTENT_LOG) {
598 		tmp = abd_borrow_buf_copy(zio->io_abd, sizeof (zil_chain_t));
599 		zio_crypt_decode_mac_zil(tmp, mac);
600 		abd_return_buf(zio->io_abd, tmp, sizeof (zil_chain_t));
601 	} else {
602 		zio_crypt_decode_mac_bp(bp, mac);
603 	}
604 
605 	ret = spa_do_crypt_abd(B_FALSE, spa, &zio->io_bookmark, BP_GET_TYPE(bp),
606 	    BP_GET_DEDUP(bp), BP_SHOULD_BYTESWAP(bp), salt, iv, mac, size, data,
607 	    zio->io_abd, &no_crypt);
608 	if (no_crypt)
609 		abd_copy(data, zio->io_abd, size);
610 
611 	if (ret != 0)
612 		goto error;
613 
614 	return;
615 
616 error:
617 	/* assert that the key was found unless this was speculative */
618 	ASSERT(ret != EACCES || (zio->io_flags & ZIO_FLAG_SPECULATIVE));
619 
620 	/*
621 	 * If there was a decryption / authentication error return EIO as
622 	 * the io_error. If this was not a speculative zio, create an ereport.
623 	 */
624 	if (ret == ECKSUM) {
625 		zio->io_error = SET_ERROR(EIO);
626 		if ((zio->io_flags & ZIO_FLAG_SPECULATIVE) == 0) {
627 			spa_log_error(spa, &zio->io_bookmark,
628 			    BP_GET_LOGICAL_BIRTH(zio->io_bp));
629 			(void) zfs_ereport_post(FM_EREPORT_ZFS_AUTHENTICATION,
630 			    spa, NULL, &zio->io_bookmark, zio, 0);
631 		}
632 	} else {
633 		zio->io_error = ret;
634 	}
635 }
636 
637 /*
638  * ==========================================================================
639  * I/O parent/child relationships and pipeline interlocks
640  * ==========================================================================
641  */
642 zio_t *
643 zio_walk_parents(zio_t *cio, zio_link_t **zl)
644 {
645 	list_t *pl = &cio->io_parent_list;
646 
647 	*zl = (*zl == NULL) ? list_head(pl) : list_next(pl, *zl);
648 	if (*zl == NULL)
649 		return (NULL);
650 
651 	ASSERT((*zl)->zl_child == cio);
652 	return ((*zl)->zl_parent);
653 }
654 
655 zio_t *
656 zio_walk_children(zio_t *pio, zio_link_t **zl)
657 {
658 	list_t *cl = &pio->io_child_list;
659 
660 	ASSERT(MUTEX_HELD(&pio->io_lock));
661 
662 	*zl = (*zl == NULL) ? list_head(cl) : list_next(cl, *zl);
663 	if (*zl == NULL)
664 		return (NULL);
665 
666 	ASSERT((*zl)->zl_parent == pio);
667 	return ((*zl)->zl_child);
668 }
669 
670 zio_t *
671 zio_unique_parent(zio_t *cio)
672 {
673 	zio_link_t *zl = NULL;
674 	zio_t *pio = zio_walk_parents(cio, &zl);
675 
676 	VERIFY3P(zio_walk_parents(cio, &zl), ==, NULL);
677 	return (pio);
678 }
679 
680 void
681 zio_add_child(zio_t *pio, zio_t *cio)
682 {
683 	/*
684 	 * Logical I/Os can have logical, gang, or vdev children.
685 	 * Gang I/Os can have gang or vdev children.
686 	 * Vdev I/Os can only have vdev children.
687 	 * The following ASSERT captures all of these constraints.
688 	 */
689 	ASSERT3S(cio->io_child_type, <=, pio->io_child_type);
690 
691 	/* Parent should not have READY stage if child doesn't have it. */
692 	IMPLY((cio->io_pipeline & ZIO_STAGE_READY) == 0 &&
693 	    (cio->io_child_type != ZIO_CHILD_VDEV),
694 	    (pio->io_pipeline & ZIO_STAGE_READY) == 0);
695 
696 	zio_link_t *zl = kmem_cache_alloc(zio_link_cache, KM_SLEEP);
697 	zl->zl_parent = pio;
698 	zl->zl_child = cio;
699 
700 	mutex_enter(&pio->io_lock);
701 	mutex_enter(&cio->io_lock);
702 
703 	ASSERT(pio->io_state[ZIO_WAIT_DONE] == 0);
704 
705 	uint64_t *countp = pio->io_children[cio->io_child_type];
706 	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
707 		countp[w] += !cio->io_state[w];
708 
709 	list_insert_head(&pio->io_child_list, zl);
710 	list_insert_head(&cio->io_parent_list, zl);
711 
712 	mutex_exit(&cio->io_lock);
713 	mutex_exit(&pio->io_lock);
714 }
715 
716 void
717 zio_add_child_first(zio_t *pio, zio_t *cio)
718 {
719 	/*
720 	 * Logical I/Os can have logical, gang, or vdev children.
721 	 * Gang I/Os can have gang or vdev children.
722 	 * Vdev I/Os can only have vdev children.
723 	 * The following ASSERT captures all of these constraints.
724 	 */
725 	ASSERT3S(cio->io_child_type, <=, pio->io_child_type);
726 
727 	/* Parent should not have READY stage if child doesn't have it. */
728 	IMPLY((cio->io_pipeline & ZIO_STAGE_READY) == 0 &&
729 	    (cio->io_child_type != ZIO_CHILD_VDEV),
730 	    (pio->io_pipeline & ZIO_STAGE_READY) == 0);
731 
732 	zio_link_t *zl = kmem_cache_alloc(zio_link_cache, KM_SLEEP);
733 	zl->zl_parent = pio;
734 	zl->zl_child = cio;
735 
736 	ASSERT(list_is_empty(&cio->io_parent_list));
737 	list_insert_head(&cio->io_parent_list, zl);
738 
739 	mutex_enter(&pio->io_lock);
740 
741 	ASSERT(pio->io_state[ZIO_WAIT_DONE] == 0);
742 
743 	uint64_t *countp = pio->io_children[cio->io_child_type];
744 	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
745 		countp[w] += !cio->io_state[w];
746 
747 	list_insert_head(&pio->io_child_list, zl);
748 
749 	mutex_exit(&pio->io_lock);
750 }
751 
752 static void
753 zio_remove_child(zio_t *pio, zio_t *cio, zio_link_t *zl)
754 {
755 	ASSERT(zl->zl_parent == pio);
756 	ASSERT(zl->zl_child == cio);
757 
758 	mutex_enter(&pio->io_lock);
759 	mutex_enter(&cio->io_lock);
760 
761 	list_remove(&pio->io_child_list, zl);
762 	list_remove(&cio->io_parent_list, zl);
763 
764 	mutex_exit(&cio->io_lock);
765 	mutex_exit(&pio->io_lock);
766 	kmem_cache_free(zio_link_cache, zl);
767 }
768 
769 static boolean_t
770 zio_wait_for_children(zio_t *zio, uint8_t childbits, enum zio_wait_type wait)
771 {
772 	boolean_t waiting = B_FALSE;
773 
774 	mutex_enter(&zio->io_lock);
775 	ASSERT(zio->io_stall == NULL);
776 	for (int c = 0; c < ZIO_CHILD_TYPES; c++) {
777 		if (!(ZIO_CHILD_BIT_IS_SET(childbits, c)))
778 			continue;
779 
780 		uint64_t *countp = &zio->io_children[c][wait];
781 		if (*countp != 0) {
782 			zio->io_stage >>= 1;
783 			ASSERT3U(zio->io_stage, !=, ZIO_STAGE_OPEN);
784 			zio->io_stall = countp;
785 			waiting = B_TRUE;
786 			break;
787 		}
788 	}
789 	mutex_exit(&zio->io_lock);
790 	return (waiting);
791 }
792 
793 __attribute__((always_inline))
794 static inline void
795 zio_notify_parent(zio_t *pio, zio_t *zio, enum zio_wait_type wait,
796     zio_t **next_to_executep)
797 {
798 	uint64_t *countp = &pio->io_children[zio->io_child_type][wait];
799 	int *errorp = &pio->io_child_error[zio->io_child_type];
800 
801 	mutex_enter(&pio->io_lock);
802 	if (zio->io_error && !(zio->io_flags & ZIO_FLAG_DONT_PROPAGATE))
803 		*errorp = zio_worst_error(*errorp, zio->io_error);
804 	pio->io_reexecute |= zio->io_reexecute;
805 	ASSERT3U(*countp, >, 0);
806 
807 	/*
808 	 * Propogate the Direct I/O checksum verify failure to the parent.
809 	 */
810 	if (zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR)
811 		pio->io_flags |= ZIO_FLAG_DIO_CHKSUM_ERR;
812 
813 	(*countp)--;
814 
815 	if (*countp == 0 && pio->io_stall == countp) {
816 		zio_taskq_type_t type =
817 		    pio->io_stage < ZIO_STAGE_VDEV_IO_START ? ZIO_TASKQ_ISSUE :
818 		    ZIO_TASKQ_INTERRUPT;
819 		pio->io_stall = NULL;
820 		mutex_exit(&pio->io_lock);
821 
822 		/*
823 		 * If we can tell the caller to execute this parent next, do
824 		 * so. We do this if the parent's zio type matches the child's
825 		 * type, or if it's a zio_null() with no done callback, and so
826 		 * has no actual work to do. Otherwise dispatch the parent zio
827 		 * in its own taskq.
828 		 *
829 		 * Having the caller execute the parent when possible reduces
830 		 * locking on the zio taskq's, reduces context switch
831 		 * overhead, and has no recursion penalty.  Note that one
832 		 * read from disk typically causes at least 3 zio's: a
833 		 * zio_null(), the logical zio_read(), and then a physical
834 		 * zio.  When the physical ZIO completes, we are able to call
835 		 * zio_done() on all 3 of these zio's from one invocation of
836 		 * zio_execute() by returning the parent back to
837 		 * zio_execute().  Since the parent isn't executed until this
838 		 * thread returns back to zio_execute(), the caller should do
839 		 * so promptly.
840 		 *
841 		 * In other cases, dispatching the parent prevents
842 		 * overflowing the stack when we have deeply nested
843 		 * parent-child relationships, as we do with the "mega zio"
844 		 * of writes for spa_sync(), and the chain of ZIL blocks.
845 		 */
846 		if (next_to_executep != NULL && *next_to_executep == NULL &&
847 		    (pio->io_type == zio->io_type ||
848 		    (pio->io_type == ZIO_TYPE_NULL && !pio->io_done))) {
849 			*next_to_executep = pio;
850 		} else {
851 			zio_taskq_dispatch(pio, type, B_FALSE);
852 		}
853 	} else {
854 		mutex_exit(&pio->io_lock);
855 	}
856 }
857 
858 static void
859 zio_inherit_child_errors(zio_t *zio, enum zio_child c)
860 {
861 	if (zio->io_child_error[c] != 0 && zio->io_error == 0)
862 		zio->io_error = zio->io_child_error[c];
863 }
864 
865 int
866 zio_bookmark_compare(const void *x1, const void *x2)
867 {
868 	const zio_t *z1 = x1;
869 	const zio_t *z2 = x2;
870 
871 	if (z1->io_bookmark.zb_objset < z2->io_bookmark.zb_objset)
872 		return (-1);
873 	if (z1->io_bookmark.zb_objset > z2->io_bookmark.zb_objset)
874 		return (1);
875 
876 	if (z1->io_bookmark.zb_object < z2->io_bookmark.zb_object)
877 		return (-1);
878 	if (z1->io_bookmark.zb_object > z2->io_bookmark.zb_object)
879 		return (1);
880 
881 	if (z1->io_bookmark.zb_level < z2->io_bookmark.zb_level)
882 		return (-1);
883 	if (z1->io_bookmark.zb_level > z2->io_bookmark.zb_level)
884 		return (1);
885 
886 	if (z1->io_bookmark.zb_blkid < z2->io_bookmark.zb_blkid)
887 		return (-1);
888 	if (z1->io_bookmark.zb_blkid > z2->io_bookmark.zb_blkid)
889 		return (1);
890 
891 	if (z1 < z2)
892 		return (-1);
893 	if (z1 > z2)
894 		return (1);
895 
896 	return (0);
897 }
898 
899 /*
900  * ==========================================================================
901  * Create the various types of I/O (read, write, free, etc)
902  * ==========================================================================
903  */
904 static zio_t *
905 zio_create(zio_t *pio, spa_t *spa, uint64_t txg, const blkptr_t *bp,
906     abd_t *data, uint64_t lsize, uint64_t psize, zio_done_func_t *done,
907     void *private, zio_type_t type, zio_priority_t priority,
908     zio_flag_t flags, vdev_t *vd, uint64_t offset,
909     const zbookmark_phys_t *zb, enum zio_stage stage,
910     enum zio_stage pipeline)
911 {
912 	zio_t *zio;
913 
914 	IMPLY(type != ZIO_TYPE_TRIM, psize <= SPA_MAXBLOCKSIZE);
915 	ASSERT(P2PHASE(psize, SPA_MINBLOCKSIZE) == 0);
916 	ASSERT(P2PHASE(offset, SPA_MINBLOCKSIZE) == 0);
917 
918 	ASSERT(!vd || spa_config_held(spa, SCL_STATE_ALL, RW_READER));
919 	ASSERT(!bp || !(flags & ZIO_FLAG_CONFIG_WRITER));
920 	ASSERT(vd || stage == ZIO_STAGE_OPEN);
921 
922 	IMPLY(lsize != psize, (flags & ZIO_FLAG_RAW_COMPRESS) != 0);
923 
924 	zio = kmem_cache_alloc(zio_cache, KM_SLEEP);
925 	memset(zio, 0, sizeof (zio_t));
926 
927 	mutex_init(&zio->io_lock, NULL, MUTEX_NOLOCKDEP, NULL);
928 	cv_init(&zio->io_cv, NULL, CV_DEFAULT, NULL);
929 
930 	list_create(&zio->io_parent_list, sizeof (zio_link_t),
931 	    offsetof(zio_link_t, zl_parent_node));
932 	list_create(&zio->io_child_list, sizeof (zio_link_t),
933 	    offsetof(zio_link_t, zl_child_node));
934 	metaslab_trace_init(&zio->io_alloc_list);
935 
936 	if (vd != NULL)
937 		zio->io_child_type = ZIO_CHILD_VDEV;
938 	else if (flags & ZIO_FLAG_GANG_CHILD)
939 		zio->io_child_type = ZIO_CHILD_GANG;
940 	else if (flags & ZIO_FLAG_DDT_CHILD)
941 		zio->io_child_type = ZIO_CHILD_DDT;
942 	else
943 		zio->io_child_type = ZIO_CHILD_LOGICAL;
944 
945 	if (bp != NULL) {
946 		if (type != ZIO_TYPE_WRITE ||
947 		    zio->io_child_type == ZIO_CHILD_DDT) {
948 			zio->io_bp_copy = *bp;
949 			zio->io_bp = &zio->io_bp_copy;	/* so caller can free */
950 		} else {
951 			zio->io_bp = (blkptr_t *)bp;
952 		}
953 		zio->io_bp_orig = *bp;
954 		if (zio->io_child_type == ZIO_CHILD_LOGICAL)
955 			zio->io_logical = zio;
956 		if (zio->io_child_type > ZIO_CHILD_GANG && BP_IS_GANG(bp))
957 			pipeline |= ZIO_GANG_STAGES;
958 	}
959 
960 	zio->io_spa = spa;
961 	zio->io_txg = txg;
962 	zio->io_done = done;
963 	zio->io_private = private;
964 	zio->io_type = type;
965 	zio->io_priority = priority;
966 	zio->io_vd = vd;
967 	zio->io_offset = offset;
968 	zio->io_orig_abd = zio->io_abd = data;
969 	zio->io_orig_size = zio->io_size = psize;
970 	zio->io_lsize = lsize;
971 	zio->io_orig_flags = zio->io_flags = flags;
972 	zio->io_orig_stage = zio->io_stage = stage;
973 	zio->io_orig_pipeline = zio->io_pipeline = pipeline;
974 	zio->io_pipeline_trace = ZIO_STAGE_OPEN;
975 	zio->io_allocator = ZIO_ALLOCATOR_NONE;
976 
977 	zio->io_state[ZIO_WAIT_READY] = (stage >= ZIO_STAGE_READY) ||
978 	    (pipeline & ZIO_STAGE_READY) == 0;
979 	zio->io_state[ZIO_WAIT_DONE] = (stage >= ZIO_STAGE_DONE);
980 
981 	if (zb != NULL)
982 		zio->io_bookmark = *zb;
983 
984 	if (pio != NULL) {
985 		zio->io_metaslab_class = pio->io_metaslab_class;
986 		if (zio->io_logical == NULL)
987 			zio->io_logical = pio->io_logical;
988 		if (zio->io_child_type == ZIO_CHILD_GANG)
989 			zio->io_gang_leader = pio->io_gang_leader;
990 		zio_add_child_first(pio, zio);
991 	}
992 
993 	taskq_init_ent(&zio->io_tqent);
994 
995 	return (zio);
996 }
997 
998 void
999 zio_destroy(zio_t *zio)
1000 {
1001 	metaslab_trace_fini(&zio->io_alloc_list);
1002 	list_destroy(&zio->io_parent_list);
1003 	list_destroy(&zio->io_child_list);
1004 	mutex_destroy(&zio->io_lock);
1005 	cv_destroy(&zio->io_cv);
1006 	kmem_cache_free(zio_cache, zio);
1007 }
1008 
1009 /*
1010  * ZIO intended to be between others.  Provides synchronization at READY
1011  * and DONE pipeline stages and calls the respective callbacks.
1012  */
1013 zio_t *
1014 zio_null(zio_t *pio, spa_t *spa, vdev_t *vd, zio_done_func_t *done,
1015     void *private, zio_flag_t flags)
1016 {
1017 	zio_t *zio;
1018 
1019 	zio = zio_create(pio, spa, 0, NULL, NULL, 0, 0, done, private,
1020 	    ZIO_TYPE_NULL, ZIO_PRIORITY_NOW, flags, vd, 0, NULL,
1021 	    ZIO_STAGE_OPEN, ZIO_INTERLOCK_PIPELINE);
1022 
1023 	return (zio);
1024 }
1025 
1026 /*
1027  * ZIO intended to be a root of a tree.  Unlike null ZIO does not have a
1028  * READY pipeline stage (is ready on creation), so it should not be used
1029  * as child of any ZIO that may need waiting for grandchildren READY stage
1030  * (any other ZIO type).
1031  */
1032 zio_t *
1033 zio_root(spa_t *spa, zio_done_func_t *done, void *private, zio_flag_t flags)
1034 {
1035 	zio_t *zio;
1036 
1037 	zio = zio_create(NULL, spa, 0, NULL, NULL, 0, 0, done, private,
1038 	    ZIO_TYPE_NULL, ZIO_PRIORITY_NOW, flags, NULL, 0, NULL,
1039 	    ZIO_STAGE_OPEN, ZIO_ROOT_PIPELINE);
1040 
1041 	return (zio);
1042 }
1043 
1044 static int
1045 zfs_blkptr_verify_log(spa_t *spa, const blkptr_t *bp,
1046     enum blk_verify_flag blk_verify, const char *fmt, ...)
1047 {
1048 	va_list adx;
1049 	char buf[256];
1050 
1051 	va_start(adx, fmt);
1052 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
1053 	va_end(adx);
1054 
1055 	zfs_dbgmsg("bad blkptr at %px: "
1056 	    "DVA[0]=%#llx/%#llx "
1057 	    "DVA[1]=%#llx/%#llx "
1058 	    "DVA[2]=%#llx/%#llx "
1059 	    "prop=%#llx "
1060 	    "pad=%#llx,%#llx "
1061 	    "phys_birth=%#llx "
1062 	    "birth=%#llx "
1063 	    "fill=%#llx "
1064 	    "cksum=%#llx/%#llx/%#llx/%#llx",
1065 	    bp,
1066 	    (long long)bp->blk_dva[0].dva_word[0],
1067 	    (long long)bp->blk_dva[0].dva_word[1],
1068 	    (long long)bp->blk_dva[1].dva_word[0],
1069 	    (long long)bp->blk_dva[1].dva_word[1],
1070 	    (long long)bp->blk_dva[2].dva_word[0],
1071 	    (long long)bp->blk_dva[2].dva_word[1],
1072 	    (long long)bp->blk_prop,
1073 	    (long long)bp->blk_pad[0],
1074 	    (long long)bp->blk_pad[1],
1075 	    (long long)BP_GET_PHYSICAL_BIRTH(bp),
1076 	    (long long)BP_GET_LOGICAL_BIRTH(bp),
1077 	    (long long)bp->blk_fill,
1078 	    (long long)bp->blk_cksum.zc_word[0],
1079 	    (long long)bp->blk_cksum.zc_word[1],
1080 	    (long long)bp->blk_cksum.zc_word[2],
1081 	    (long long)bp->blk_cksum.zc_word[3]);
1082 	switch (blk_verify) {
1083 	case BLK_VERIFY_HALT:
1084 		zfs_panic_recover("%s: %s", spa_name(spa), buf);
1085 		break;
1086 	case BLK_VERIFY_LOG:
1087 		zfs_dbgmsg("%s: %s", spa_name(spa), buf);
1088 		break;
1089 	case BLK_VERIFY_ONLY:
1090 		break;
1091 	}
1092 
1093 	return (1);
1094 }
1095 
1096 /*
1097  * Verify the block pointer fields contain reasonable values.  This means
1098  * it only contains known object types, checksum/compression identifiers,
1099  * block sizes within the maximum allowed limits, valid DVAs, etc.
1100  *
1101  * If everything checks out B_TRUE is returned.  The zfs_blkptr_verify
1102  * argument controls the behavior when an invalid field is detected.
1103  *
1104  * Values for blk_verify_flag:
1105  *   BLK_VERIFY_ONLY: evaluate the block
1106  *   BLK_VERIFY_LOG: evaluate the block and log problems
1107  *   BLK_VERIFY_HALT: call zfs_panic_recover on error
1108  *
1109  * Values for blk_config_flag:
1110  *   BLK_CONFIG_HELD: caller holds SCL_VDEV for writer
1111  *   BLK_CONFIG_NEEDED: caller holds no config lock, SCL_VDEV will be
1112  *   obtained for reader
1113  *   BLK_CONFIG_SKIP: skip checks which require SCL_VDEV, for better
1114  *   performance
1115  */
1116 boolean_t
1117 zfs_blkptr_verify(spa_t *spa, const blkptr_t *bp,
1118     enum blk_config_flag blk_config, enum blk_verify_flag blk_verify)
1119 {
1120 	int errors = 0;
1121 
1122 	if (unlikely(!DMU_OT_IS_VALID(BP_GET_TYPE(bp)))) {
1123 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1124 		    "blkptr at %px has invalid TYPE %llu",
1125 		    bp, (longlong_t)BP_GET_TYPE(bp));
1126 	}
1127 	if (unlikely(BP_GET_COMPRESS(bp) >= ZIO_COMPRESS_FUNCTIONS)) {
1128 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1129 		    "blkptr at %px has invalid COMPRESS %llu",
1130 		    bp, (longlong_t)BP_GET_COMPRESS(bp));
1131 	}
1132 	if (unlikely(BP_GET_LSIZE(bp) > SPA_MAXBLOCKSIZE)) {
1133 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1134 		    "blkptr at %px has invalid LSIZE %llu",
1135 		    bp, (longlong_t)BP_GET_LSIZE(bp));
1136 	}
1137 	if (BP_IS_EMBEDDED(bp)) {
1138 		if (unlikely(BPE_GET_ETYPE(bp) >= NUM_BP_EMBEDDED_TYPES)) {
1139 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1140 			    "blkptr at %px has invalid ETYPE %llu",
1141 			    bp, (longlong_t)BPE_GET_ETYPE(bp));
1142 		}
1143 		if (unlikely(BPE_GET_PSIZE(bp) > BPE_PAYLOAD_SIZE)) {
1144 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1145 			    "blkptr at %px has invalid PSIZE %llu",
1146 			    bp, (longlong_t)BPE_GET_PSIZE(bp));
1147 		}
1148 		return (errors == 0);
1149 	}
1150 	if (unlikely(BP_GET_CHECKSUM(bp) >= ZIO_CHECKSUM_FUNCTIONS)) {
1151 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1152 		    "blkptr at %px has invalid CHECKSUM %llu",
1153 		    bp, (longlong_t)BP_GET_CHECKSUM(bp));
1154 	}
1155 	if (unlikely(BP_GET_PSIZE(bp) > SPA_MAXBLOCKSIZE)) {
1156 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1157 		    "blkptr at %px has invalid PSIZE %llu",
1158 		    bp, (longlong_t)BP_GET_PSIZE(bp));
1159 	}
1160 
1161 	/*
1162 	 * Do not verify individual DVAs if the config is not trusted. This
1163 	 * will be done once the zio is executed in vdev_mirror_map_alloc.
1164 	 */
1165 	if (unlikely(!spa->spa_trust_config))
1166 		return (errors == 0);
1167 
1168 	switch (blk_config) {
1169 	case BLK_CONFIG_HELD:
1170 		ASSERT(spa_config_held(spa, SCL_VDEV, RW_WRITER));
1171 		break;
1172 	case BLK_CONFIG_NEEDED:
1173 		spa_config_enter(spa, SCL_VDEV, bp, RW_READER);
1174 		break;
1175 	case BLK_CONFIG_SKIP:
1176 		return (errors == 0);
1177 	default:
1178 		panic("invalid blk_config %u", blk_config);
1179 	}
1180 
1181 	/*
1182 	 * Pool-specific checks.
1183 	 *
1184 	 * Note: it would be nice to verify that the logical birth
1185 	 * and physical birth are not too large.  However,
1186 	 * spa_freeze() allows the birth time of log blocks (and
1187 	 * dmu_sync()-ed blocks that are in the log) to be arbitrarily
1188 	 * large.
1189 	 */
1190 	for (int i = 0; i < BP_GET_NDVAS(bp); i++) {
1191 		const dva_t *dva = &bp->blk_dva[i];
1192 		uint64_t vdevid = DVA_GET_VDEV(dva);
1193 
1194 		if (unlikely(vdevid >= spa->spa_root_vdev->vdev_children)) {
1195 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1196 			    "blkptr at %px DVA %u has invalid VDEV %llu",
1197 			    bp, i, (longlong_t)vdevid);
1198 			continue;
1199 		}
1200 		vdev_t *vd = spa->spa_root_vdev->vdev_child[vdevid];
1201 		if (unlikely(vd == NULL)) {
1202 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1203 			    "blkptr at %px DVA %u has invalid VDEV %llu",
1204 			    bp, i, (longlong_t)vdevid);
1205 			continue;
1206 		}
1207 		if (unlikely(vd->vdev_ops == &vdev_hole_ops)) {
1208 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1209 			    "blkptr at %px DVA %u has hole VDEV %llu",
1210 			    bp, i, (longlong_t)vdevid);
1211 			continue;
1212 		}
1213 		if (vd->vdev_ops == &vdev_missing_ops) {
1214 			/*
1215 			 * "missing" vdevs are valid during import, but we
1216 			 * don't have their detailed info (e.g. asize), so
1217 			 * we can't perform any more checks on them.
1218 			 */
1219 			continue;
1220 		}
1221 		uint64_t offset = DVA_GET_OFFSET(dva);
1222 		uint64_t asize = DVA_GET_ASIZE(dva);
1223 		if (DVA_GET_GANG(dva))
1224 			asize = vdev_gang_header_asize(vd);
1225 		if (unlikely(offset + asize > vd->vdev_asize)) {
1226 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1227 			    "blkptr at %px DVA %u has invalid OFFSET %llu",
1228 			    bp, i, (longlong_t)offset);
1229 		}
1230 	}
1231 	if (blk_config == BLK_CONFIG_NEEDED)
1232 		spa_config_exit(spa, SCL_VDEV, bp);
1233 
1234 	return (errors == 0);
1235 }
1236 
1237 boolean_t
1238 zfs_dva_valid(spa_t *spa, const dva_t *dva, const blkptr_t *bp)
1239 {
1240 	(void) bp;
1241 	uint64_t vdevid = DVA_GET_VDEV(dva);
1242 
1243 	if (vdevid >= spa->spa_root_vdev->vdev_children)
1244 		return (B_FALSE);
1245 
1246 	vdev_t *vd = spa->spa_root_vdev->vdev_child[vdevid];
1247 	if (vd == NULL)
1248 		return (B_FALSE);
1249 
1250 	if (vd->vdev_ops == &vdev_hole_ops)
1251 		return (B_FALSE);
1252 
1253 	if (vd->vdev_ops == &vdev_missing_ops) {
1254 		return (B_FALSE);
1255 	}
1256 
1257 	uint64_t offset = DVA_GET_OFFSET(dva);
1258 	uint64_t asize = DVA_GET_ASIZE(dva);
1259 
1260 	if (DVA_GET_GANG(dva))
1261 		asize = vdev_gang_header_asize(vd);
1262 	if (offset + asize > vd->vdev_asize)
1263 		return (B_FALSE);
1264 
1265 	return (B_TRUE);
1266 }
1267 
1268 zio_t *
1269 zio_read(zio_t *pio, spa_t *spa, const blkptr_t *bp,
1270     abd_t *data, uint64_t size, zio_done_func_t *done, void *private,
1271     zio_priority_t priority, zio_flag_t flags, const zbookmark_phys_t *zb)
1272 {
1273 	zio_t *zio;
1274 
1275 	zio = zio_create(pio, spa, BP_GET_BIRTH(bp), bp,
1276 	    data, size, size, done, private,
1277 	    ZIO_TYPE_READ, priority, flags, NULL, 0, zb,
1278 	    ZIO_STAGE_OPEN, (flags & ZIO_FLAG_DDT_CHILD) ?
1279 	    ZIO_DDT_CHILD_READ_PIPELINE : ZIO_READ_PIPELINE);
1280 
1281 	return (zio);
1282 }
1283 
1284 zio_t *
1285 zio_write(zio_t *pio, spa_t *spa, uint64_t txg, blkptr_t *bp,
1286     abd_t *data, uint64_t lsize, uint64_t psize, const zio_prop_t *zp,
1287     zio_done_func_t *ready, zio_done_func_t *children_ready,
1288     zio_done_func_t *done, void *private, zio_priority_t priority,
1289     zio_flag_t flags, const zbookmark_phys_t *zb)
1290 {
1291 	zio_t *zio;
1292 	enum zio_stage pipeline = zp->zp_direct_write == B_TRUE ?
1293 	    ZIO_DIRECT_WRITE_PIPELINE : (flags & ZIO_FLAG_DDT_CHILD) ?
1294 	    ZIO_DDT_CHILD_WRITE_PIPELINE : ZIO_WRITE_PIPELINE;
1295 
1296 
1297 	zio = zio_create(pio, spa, txg, bp, data, lsize, psize, done, private,
1298 	    ZIO_TYPE_WRITE, priority, flags, NULL, 0, zb,
1299 	    ZIO_STAGE_OPEN, pipeline);
1300 
1301 	zio->io_ready = ready;
1302 	zio->io_children_ready = children_ready;
1303 	zio->io_prop = *zp;
1304 
1305 	/*
1306 	 * Data can be NULL if we are going to call zio_write_override() to
1307 	 * provide the already-allocated BP.  But we may need the data to
1308 	 * verify a dedup hit (if requested).  In this case, don't try to
1309 	 * dedup (just take the already-allocated BP verbatim). Encrypted
1310 	 * dedup blocks need data as well so we also disable dedup in this
1311 	 * case.
1312 	 */
1313 	if (data == NULL &&
1314 	    (zio->io_prop.zp_dedup_verify || zio->io_prop.zp_encrypt)) {
1315 		zio->io_prop.zp_dedup = zio->io_prop.zp_dedup_verify = B_FALSE;
1316 	}
1317 
1318 	return (zio);
1319 }
1320 
1321 zio_t *
1322 zio_rewrite(zio_t *pio, spa_t *spa, uint64_t txg, blkptr_t *bp, abd_t *data,
1323     uint64_t size, zio_done_func_t *done, void *private,
1324     zio_priority_t priority, zio_flag_t flags, zbookmark_phys_t *zb)
1325 {
1326 	zio_t *zio;
1327 
1328 	zio = zio_create(pio, spa, txg, bp, data, size, size, done, private,
1329 	    ZIO_TYPE_WRITE, priority, flags | ZIO_FLAG_IO_REWRITE, NULL, 0, zb,
1330 	    ZIO_STAGE_OPEN, ZIO_REWRITE_PIPELINE);
1331 
1332 	return (zio);
1333 }
1334 
1335 void
1336 zio_write_override(zio_t *zio, blkptr_t *bp, int copies, boolean_t nopwrite,
1337     boolean_t brtwrite)
1338 {
1339 	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
1340 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
1341 	ASSERT(zio->io_stage == ZIO_STAGE_OPEN);
1342 	ASSERT(zio->io_txg == spa_syncing_txg(zio->io_spa));
1343 	ASSERT(!brtwrite || !nopwrite);
1344 
1345 	/*
1346 	 * We must reset the io_prop to match the values that existed
1347 	 * when the bp was first written by dmu_sync() keeping in mind
1348 	 * that nopwrite and dedup are mutually exclusive.
1349 	 */
1350 	zio->io_prop.zp_dedup = nopwrite ? B_FALSE : zio->io_prop.zp_dedup;
1351 	zio->io_prop.zp_nopwrite = nopwrite;
1352 	zio->io_prop.zp_brtwrite = brtwrite;
1353 	zio->io_prop.zp_copies = copies;
1354 	zio->io_bp_override = bp;
1355 }
1356 
1357 void
1358 zio_free(spa_t *spa, uint64_t txg, const blkptr_t *bp)
1359 {
1360 
1361 	(void) zfs_blkptr_verify(spa, bp, BLK_CONFIG_NEEDED, BLK_VERIFY_HALT);
1362 
1363 	/*
1364 	 * The check for EMBEDDED is a performance optimization.  We
1365 	 * process the free here (by ignoring it) rather than
1366 	 * putting it on the list and then processing it in zio_free_sync().
1367 	 */
1368 	if (BP_IS_EMBEDDED(bp))
1369 		return;
1370 
1371 	/*
1372 	 * Frees that are for the currently-syncing txg, are not going to be
1373 	 * deferred, and which will not need to do a read (i.e. not GANG or
1374 	 * DEDUP), can be processed immediately.  Otherwise, put them on the
1375 	 * in-memory list for later processing.
1376 	 *
1377 	 * Note that we only defer frees after zfs_sync_pass_deferred_free
1378 	 * when the log space map feature is disabled. [see relevant comment
1379 	 * in spa_sync_iterate_to_convergence()]
1380 	 */
1381 	if (BP_IS_GANG(bp) ||
1382 	    BP_GET_DEDUP(bp) ||
1383 	    txg != spa->spa_syncing_txg ||
1384 	    (spa_sync_pass(spa) >= zfs_sync_pass_deferred_free &&
1385 	    !spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP)) ||
1386 	    brt_maybe_exists(spa, bp)) {
1387 		metaslab_check_free(spa, bp);
1388 		bplist_append(&spa->spa_free_bplist[txg & TXG_MASK], bp);
1389 	} else {
1390 		VERIFY3P(zio_free_sync(NULL, spa, txg, bp, 0), ==, NULL);
1391 	}
1392 }
1393 
1394 /*
1395  * To improve performance, this function may return NULL if we were able
1396  * to do the free immediately.  This avoids the cost of creating a zio
1397  * (and linking it to the parent, etc).
1398  */
1399 zio_t *
1400 zio_free_sync(zio_t *pio, spa_t *spa, uint64_t txg, const blkptr_t *bp,
1401     zio_flag_t flags)
1402 {
1403 	ASSERT(!BP_IS_HOLE(bp));
1404 	ASSERT(spa_syncing_txg(spa) == txg);
1405 
1406 	if (BP_IS_EMBEDDED(bp))
1407 		return (NULL);
1408 
1409 	metaslab_check_free(spa, bp);
1410 	arc_freed(spa, bp);
1411 	dsl_scan_freed(spa, bp);
1412 
1413 	if (BP_IS_GANG(bp) ||
1414 	    BP_GET_DEDUP(bp) ||
1415 	    brt_maybe_exists(spa, bp)) {
1416 		/*
1417 		 * GANG, DEDUP and BRT blocks can induce a read (for the gang
1418 		 * block header, the DDT or the BRT), so issue them
1419 		 * asynchronously so that this thread is not tied up.
1420 		 */
1421 		enum zio_stage stage =
1422 		    ZIO_FREE_PIPELINE | ZIO_STAGE_ISSUE_ASYNC;
1423 
1424 		return (zio_create(pio, spa, txg, bp, NULL, BP_GET_PSIZE(bp),
1425 		    BP_GET_PSIZE(bp), NULL, NULL,
1426 		    ZIO_TYPE_FREE, ZIO_PRIORITY_NOW,
1427 		    flags, NULL, 0, NULL, ZIO_STAGE_OPEN, stage));
1428 	} else {
1429 		metaslab_free(spa, bp, txg, B_FALSE);
1430 		return (NULL);
1431 	}
1432 }
1433 
1434 zio_t *
1435 zio_claim(zio_t *pio, spa_t *spa, uint64_t txg, const blkptr_t *bp,
1436     zio_done_func_t *done, void *private, zio_flag_t flags)
1437 {
1438 	zio_t *zio;
1439 
1440 	(void) zfs_blkptr_verify(spa, bp, (flags & ZIO_FLAG_CONFIG_WRITER) ?
1441 	    BLK_CONFIG_HELD : BLK_CONFIG_NEEDED, BLK_VERIFY_HALT);
1442 
1443 	if (BP_IS_EMBEDDED(bp))
1444 		return (zio_null(pio, spa, NULL, NULL, NULL, 0));
1445 
1446 	/*
1447 	 * A claim is an allocation of a specific block.  Claims are needed
1448 	 * to support immediate writes in the intent log.  The issue is that
1449 	 * immediate writes contain committed data, but in a txg that was
1450 	 * *not* committed.  Upon opening the pool after an unclean shutdown,
1451 	 * the intent log claims all blocks that contain immediate write data
1452 	 * so that the SPA knows they're in use.
1453 	 *
1454 	 * All claims *must* be resolved in the first txg -- before the SPA
1455 	 * starts allocating blocks -- so that nothing is allocated twice.
1456 	 * If txg == 0 we just verify that the block is claimable.
1457 	 */
1458 	ASSERT3U(BP_GET_LOGICAL_BIRTH(&spa->spa_uberblock.ub_rootbp), <,
1459 	    spa_min_claim_txg(spa));
1460 	ASSERT(txg == spa_min_claim_txg(spa) || txg == 0);
1461 	ASSERT(!BP_GET_DEDUP(bp) || !spa_writeable(spa));	/* zdb(8) */
1462 
1463 	zio = zio_create(pio, spa, txg, bp, NULL, BP_GET_PSIZE(bp),
1464 	    BP_GET_PSIZE(bp), done, private, ZIO_TYPE_CLAIM, ZIO_PRIORITY_NOW,
1465 	    flags, NULL, 0, NULL, ZIO_STAGE_OPEN, ZIO_CLAIM_PIPELINE);
1466 	ASSERT0(zio->io_queued_timestamp);
1467 
1468 	return (zio);
1469 }
1470 
1471 zio_t *
1472 zio_trim(zio_t *pio, vdev_t *vd, uint64_t offset, uint64_t size,
1473     zio_done_func_t *done, void *private, zio_priority_t priority,
1474     zio_flag_t flags, enum trim_flag trim_flags)
1475 {
1476 	zio_t *zio;
1477 
1478 	ASSERT0(vd->vdev_children);
1479 	ASSERT0(P2PHASE(offset, 1ULL << vd->vdev_ashift));
1480 	ASSERT0(P2PHASE(size, 1ULL << vd->vdev_ashift));
1481 	ASSERT3U(size, !=, 0);
1482 
1483 	zio = zio_create(pio, vd->vdev_spa, 0, NULL, NULL, size, size, done,
1484 	    private, ZIO_TYPE_TRIM, priority, flags | ZIO_FLAG_PHYSICAL,
1485 	    vd, offset, NULL, ZIO_STAGE_OPEN, ZIO_TRIM_PIPELINE);
1486 	zio->io_trim_flags = trim_flags;
1487 
1488 	return (zio);
1489 }
1490 
1491 zio_t *
1492 zio_read_phys(zio_t *pio, vdev_t *vd, uint64_t offset, uint64_t size,
1493     abd_t *data, int checksum, zio_done_func_t *done, void *private,
1494     zio_priority_t priority, zio_flag_t flags, boolean_t labels)
1495 {
1496 	zio_t *zio;
1497 
1498 	ASSERT(vd->vdev_children == 0);
1499 	ASSERT(!labels || offset + size <= VDEV_LABEL_START_SIZE ||
1500 	    offset >= vd->vdev_psize - VDEV_LABEL_END_SIZE);
1501 	ASSERT3U(offset + size, <=, vd->vdev_psize);
1502 
1503 	zio = zio_create(pio, vd->vdev_spa, 0, NULL, data, size, size, done,
1504 	    private, ZIO_TYPE_READ, priority, flags | ZIO_FLAG_PHYSICAL, vd,
1505 	    offset, NULL, ZIO_STAGE_OPEN, ZIO_READ_PHYS_PIPELINE);
1506 
1507 	zio->io_prop.zp_checksum = checksum;
1508 
1509 	return (zio);
1510 }
1511 
1512 zio_t *
1513 zio_write_phys(zio_t *pio, vdev_t *vd, uint64_t offset, uint64_t size,
1514     abd_t *data, int checksum, zio_done_func_t *done, void *private,
1515     zio_priority_t priority, zio_flag_t flags, boolean_t labels)
1516 {
1517 	zio_t *zio;
1518 
1519 	ASSERT(vd->vdev_children == 0);
1520 	ASSERT(!labels || offset + size <= VDEV_LABEL_START_SIZE ||
1521 	    offset >= vd->vdev_psize - VDEV_LABEL_END_SIZE);
1522 	ASSERT3U(offset + size, <=, vd->vdev_psize);
1523 
1524 	zio = zio_create(pio, vd->vdev_spa, 0, NULL, data, size, size, done,
1525 	    private, ZIO_TYPE_WRITE, priority, flags | ZIO_FLAG_PHYSICAL, vd,
1526 	    offset, NULL, ZIO_STAGE_OPEN, ZIO_WRITE_PHYS_PIPELINE);
1527 
1528 	zio->io_prop.zp_checksum = checksum;
1529 
1530 	if (zio_checksum_table[checksum].ci_flags & ZCHECKSUM_FLAG_EMBEDDED) {
1531 		/*
1532 		 * zec checksums are necessarily destructive -- they modify
1533 		 * the end of the write buffer to hold the verifier/checksum.
1534 		 * Therefore, we must make a local copy in case the data is
1535 		 * being written to multiple places in parallel.
1536 		 */
1537 		abd_t *wbuf = abd_alloc_sametype(data, size);
1538 		abd_copy(wbuf, data, size);
1539 
1540 		zio_push_transform(zio, wbuf, size, size, NULL);
1541 	}
1542 
1543 	return (zio);
1544 }
1545 
1546 /*
1547  * Create a child I/O to do some work for us.
1548  */
1549 zio_t *
1550 zio_vdev_child_io(zio_t *pio, blkptr_t *bp, vdev_t *vd, uint64_t offset,
1551     abd_t *data, uint64_t size, int type, zio_priority_t priority,
1552     zio_flag_t flags, zio_done_func_t *done, void *private)
1553 {
1554 	enum zio_stage pipeline = ZIO_VDEV_CHILD_PIPELINE;
1555 	zio_t *zio;
1556 
1557 	/*
1558 	 * vdev child I/Os do not propagate their error to the parent.
1559 	 * Therefore, for correct operation the caller *must* check for
1560 	 * and handle the error in the child i/o's done callback.
1561 	 * The only exceptions are i/os that we don't care about
1562 	 * (OPTIONAL or REPAIR).
1563 	 */
1564 	ASSERT((flags & ZIO_FLAG_OPTIONAL) || (flags & ZIO_FLAG_IO_REPAIR) ||
1565 	    done != NULL);
1566 
1567 	if (type == ZIO_TYPE_READ && bp != NULL) {
1568 		/*
1569 		 * If we have the bp, then the child should perform the
1570 		 * checksum and the parent need not.  This pushes error
1571 		 * detection as close to the leaves as possible and
1572 		 * eliminates redundant checksums in the interior nodes.
1573 		 */
1574 		pipeline |= ZIO_STAGE_CHECKSUM_VERIFY;
1575 		pio->io_pipeline &= ~ZIO_STAGE_CHECKSUM_VERIFY;
1576 		/*
1577 		 * We never allow the mirror VDEV to attempt reading from any
1578 		 * additional data copies after the first Direct I/O checksum
1579 		 * verify failure. This is to avoid bad data being written out
1580 		 * through the mirror during self healing. See comment in
1581 		 * vdev_mirror_io_done() for more details.
1582 		 */
1583 		ASSERT0(pio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR);
1584 	} else if (type == ZIO_TYPE_WRITE &&
1585 	    pio->io_prop.zp_direct_write == B_TRUE) {
1586 		/*
1587 		 * By default we only will verify checksums for Direct I/O
1588 		 * writes for Linux. FreeBSD is able to place user pages under
1589 		 * write protection before issuing them to the ZIO pipeline.
1590 		 *
1591 		 * Checksum validation errors will only be reported through
1592 		 * the top-level VDEV, which is set by this child ZIO.
1593 		 */
1594 		ASSERT3P(bp, !=, NULL);
1595 		ASSERT3U(pio->io_child_type, ==, ZIO_CHILD_LOGICAL);
1596 		pipeline |= ZIO_STAGE_DIO_CHECKSUM_VERIFY;
1597 	}
1598 
1599 	if (vd->vdev_ops->vdev_op_leaf) {
1600 		ASSERT0(vd->vdev_children);
1601 		offset += VDEV_LABEL_START_SIZE;
1602 	}
1603 
1604 	flags |= ZIO_VDEV_CHILD_FLAGS(pio);
1605 
1606 	/*
1607 	 * If we've decided to do a repair, the write is not speculative --
1608 	 * even if the original read was.
1609 	 */
1610 	if (flags & ZIO_FLAG_IO_REPAIR)
1611 		flags &= ~ZIO_FLAG_SPECULATIVE;
1612 
1613 	/*
1614 	 * If we're creating a child I/O that is not associated with a
1615 	 * top-level vdev, then the child zio is not an allocating I/O.
1616 	 * If this is a retried I/O then we ignore it since we will
1617 	 * have already processed the original allocating I/O.
1618 	 */
1619 	if (flags & ZIO_FLAG_IO_ALLOCATING &&
1620 	    (vd != vd->vdev_top || (flags & ZIO_FLAG_IO_RETRY))) {
1621 		ASSERT(pio->io_metaslab_class != NULL);
1622 		ASSERT(pio->io_metaslab_class->mc_alloc_throttle_enabled);
1623 		ASSERT(type == ZIO_TYPE_WRITE);
1624 		ASSERT(priority == ZIO_PRIORITY_ASYNC_WRITE);
1625 		ASSERT(!(flags & ZIO_FLAG_IO_REPAIR));
1626 		ASSERT(!(pio->io_flags & ZIO_FLAG_IO_REWRITE) ||
1627 		    pio->io_child_type == ZIO_CHILD_GANG);
1628 
1629 		flags &= ~ZIO_FLAG_IO_ALLOCATING;
1630 	}
1631 
1632 	zio = zio_create(pio, pio->io_spa, pio->io_txg, bp, data, size, size,
1633 	    done, private, type, priority, flags, vd, offset, &pio->io_bookmark,
1634 	    ZIO_STAGE_VDEV_IO_START >> 1, pipeline);
1635 	ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_VDEV);
1636 
1637 	return (zio);
1638 }
1639 
1640 zio_t *
1641 zio_vdev_delegated_io(vdev_t *vd, uint64_t offset, abd_t *data, uint64_t size,
1642     zio_type_t type, zio_priority_t priority, zio_flag_t flags,
1643     zio_done_func_t *done, void *private)
1644 {
1645 	zio_t *zio;
1646 
1647 	ASSERT(vd->vdev_ops->vdev_op_leaf);
1648 
1649 	zio = zio_create(NULL, vd->vdev_spa, 0, NULL,
1650 	    data, size, size, done, private, type, priority,
1651 	    flags | ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_RETRY | ZIO_FLAG_DELEGATED,
1652 	    vd, offset, NULL,
1653 	    ZIO_STAGE_VDEV_IO_START >> 1, ZIO_VDEV_CHILD_PIPELINE);
1654 
1655 	return (zio);
1656 }
1657 
1658 
1659 /*
1660  * Send a flush command to the given vdev. Unlike most zio creation functions,
1661  * the flush zios are issued immediately. You can wait on pio to pause until
1662  * the flushes complete.
1663  */
1664 void
1665 zio_flush(zio_t *pio, vdev_t *vd)
1666 {
1667 	const zio_flag_t flags = ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_PROPAGATE |
1668 	    ZIO_FLAG_DONT_RETRY;
1669 
1670 	if (vd->vdev_nowritecache)
1671 		return;
1672 
1673 	if (vd->vdev_children == 0) {
1674 		zio_nowait(zio_create(pio, vd->vdev_spa, 0, NULL, NULL, 0, 0,
1675 		    NULL, NULL, ZIO_TYPE_FLUSH, ZIO_PRIORITY_NOW, flags, vd, 0,
1676 		    NULL, ZIO_STAGE_OPEN, ZIO_FLUSH_PIPELINE));
1677 	} else {
1678 		for (uint64_t c = 0; c < vd->vdev_children; c++)
1679 			zio_flush(pio, vd->vdev_child[c]);
1680 	}
1681 }
1682 
1683 void
1684 zio_shrink(zio_t *zio, uint64_t size)
1685 {
1686 	ASSERT3P(zio->io_executor, ==, NULL);
1687 	ASSERT3U(zio->io_orig_size, ==, zio->io_size);
1688 	ASSERT3U(size, <=, zio->io_size);
1689 
1690 	/*
1691 	 * We don't shrink for raidz because of problems with the
1692 	 * reconstruction when reading back less than the block size.
1693 	 * Note, BP_IS_RAIDZ() assumes no compression.
1694 	 */
1695 	ASSERT(BP_GET_COMPRESS(zio->io_bp) == ZIO_COMPRESS_OFF);
1696 	if (!BP_IS_RAIDZ(zio->io_bp)) {
1697 		/* we are not doing a raw write */
1698 		ASSERT3U(zio->io_size, ==, zio->io_lsize);
1699 		zio->io_orig_size = zio->io_size = zio->io_lsize = size;
1700 	}
1701 }
1702 
1703 /*
1704  * Round provided allocation size up to a value that can be allocated
1705  * by at least some vdev(s) in the pool with minimum or no additional
1706  * padding and without extra space usage on others
1707  */
1708 static uint64_t
1709 zio_roundup_alloc_size(spa_t *spa, uint64_t size)
1710 {
1711 	if (size > spa->spa_min_alloc)
1712 		return (roundup(size, spa->spa_gcd_alloc));
1713 	return (spa->spa_min_alloc);
1714 }
1715 
1716 size_t
1717 zio_get_compression_max_size(enum zio_compress compress, uint64_t gcd_alloc,
1718     uint64_t min_alloc, size_t s_len)
1719 {
1720 	size_t d_len;
1721 
1722 	/* minimum 12.5% must be saved (legacy value, may be changed later) */
1723 	d_len = s_len - (s_len >> 3);
1724 
1725 	/* ZLE can't use exactly d_len bytes, it needs more, so ignore it */
1726 	if (compress == ZIO_COMPRESS_ZLE)
1727 		return (d_len);
1728 
1729 	d_len = d_len - d_len % gcd_alloc;
1730 
1731 	if (d_len < min_alloc)
1732 		return (BPE_PAYLOAD_SIZE);
1733 	return (d_len);
1734 }
1735 
1736 /*
1737  * ==========================================================================
1738  * Prepare to read and write logical blocks
1739  * ==========================================================================
1740  */
1741 
1742 static zio_t *
1743 zio_read_bp_init(zio_t *zio)
1744 {
1745 	blkptr_t *bp = zio->io_bp;
1746 	uint64_t psize =
1747 	    BP_IS_EMBEDDED(bp) ? BPE_GET_PSIZE(bp) : BP_GET_PSIZE(bp);
1748 
1749 	ASSERT3P(zio->io_bp, ==, &zio->io_bp_copy);
1750 
1751 	if (BP_GET_COMPRESS(bp) != ZIO_COMPRESS_OFF &&
1752 	    zio->io_child_type == ZIO_CHILD_LOGICAL &&
1753 	    !(zio->io_flags & ZIO_FLAG_RAW_COMPRESS)) {
1754 		zio_push_transform(zio, abd_alloc_sametype(zio->io_abd, psize),
1755 		    psize, psize, zio_decompress);
1756 	}
1757 
1758 	if (((BP_IS_PROTECTED(bp) && !(zio->io_flags & ZIO_FLAG_RAW_ENCRYPT)) ||
1759 	    BP_HAS_INDIRECT_MAC_CKSUM(bp)) &&
1760 	    zio->io_child_type == ZIO_CHILD_LOGICAL) {
1761 		zio_push_transform(zio, abd_alloc_sametype(zio->io_abd, psize),
1762 		    psize, psize, zio_decrypt);
1763 	}
1764 
1765 	if (BP_IS_EMBEDDED(bp) && BPE_GET_ETYPE(bp) == BP_EMBEDDED_TYPE_DATA) {
1766 		int psize = BPE_GET_PSIZE(bp);
1767 		void *data = abd_borrow_buf(zio->io_abd, psize);
1768 
1769 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
1770 		decode_embedded_bp_compressed(bp, data);
1771 		abd_return_buf_copy(zio->io_abd, data, psize);
1772 	} else {
1773 		ASSERT(!BP_IS_EMBEDDED(bp));
1774 	}
1775 
1776 	if (BP_GET_DEDUP(bp) && zio->io_child_type == ZIO_CHILD_LOGICAL)
1777 		zio->io_pipeline = ZIO_DDT_READ_PIPELINE;
1778 
1779 	return (zio);
1780 }
1781 
1782 static zio_t *
1783 zio_write_bp_init(zio_t *zio)
1784 {
1785 	if (!IO_IS_ALLOCATING(zio))
1786 		return (zio);
1787 
1788 	ASSERT(zio->io_child_type != ZIO_CHILD_DDT);
1789 
1790 	if (zio->io_bp_override) {
1791 		blkptr_t *bp = zio->io_bp;
1792 		zio_prop_t *zp = &zio->io_prop;
1793 
1794 		ASSERT(BP_GET_LOGICAL_BIRTH(bp) != zio->io_txg);
1795 
1796 		*bp = *zio->io_bp_override;
1797 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
1798 
1799 		if (zp->zp_brtwrite)
1800 			return (zio);
1801 
1802 		ASSERT(!BP_GET_DEDUP(zio->io_bp_override));
1803 
1804 		if (BP_IS_EMBEDDED(bp))
1805 			return (zio);
1806 
1807 		/*
1808 		 * If we've been overridden and nopwrite is set then
1809 		 * set the flag accordingly to indicate that a nopwrite
1810 		 * has already occurred.
1811 		 */
1812 		if (!BP_IS_HOLE(bp) && zp->zp_nopwrite) {
1813 			ASSERT(!zp->zp_dedup);
1814 			ASSERT3U(BP_GET_CHECKSUM(bp), ==, zp->zp_checksum);
1815 			zio->io_flags |= ZIO_FLAG_NOPWRITE;
1816 			return (zio);
1817 		}
1818 
1819 		ASSERT(!zp->zp_nopwrite);
1820 
1821 		if (BP_IS_HOLE(bp) || !zp->zp_dedup)
1822 			return (zio);
1823 
1824 		ASSERT((zio_checksum_table[zp->zp_checksum].ci_flags &
1825 		    ZCHECKSUM_FLAG_DEDUP) || zp->zp_dedup_verify);
1826 
1827 		if (BP_GET_CHECKSUM(bp) == zp->zp_checksum &&
1828 		    !zp->zp_encrypt) {
1829 			BP_SET_DEDUP(bp, 1);
1830 			zio->io_pipeline |= ZIO_STAGE_DDT_WRITE;
1831 			return (zio);
1832 		}
1833 
1834 		/*
1835 		 * We were unable to handle this as an override bp, treat
1836 		 * it as a regular write I/O.
1837 		 */
1838 		zio->io_bp_override = NULL;
1839 		*bp = zio->io_bp_orig;
1840 		zio->io_pipeline = zio->io_orig_pipeline;
1841 	}
1842 
1843 	return (zio);
1844 }
1845 
1846 static zio_t *
1847 zio_write_compress(zio_t *zio)
1848 {
1849 	spa_t *spa = zio->io_spa;
1850 	zio_prop_t *zp = &zio->io_prop;
1851 	enum zio_compress compress = zp->zp_compress;
1852 	blkptr_t *bp = zio->io_bp;
1853 	uint64_t lsize = zio->io_lsize;
1854 	uint64_t psize = zio->io_size;
1855 	uint32_t pass = 1;
1856 
1857 	/*
1858 	 * If our children haven't all reached the ready stage,
1859 	 * wait for them and then repeat this pipeline stage.
1860 	 */
1861 	if (zio_wait_for_children(zio, ZIO_CHILD_LOGICAL_BIT |
1862 	    ZIO_CHILD_GANG_BIT, ZIO_WAIT_READY)) {
1863 		return (NULL);
1864 	}
1865 
1866 	if (!IO_IS_ALLOCATING(zio))
1867 		return (zio);
1868 
1869 	if (zio->io_children_ready != NULL) {
1870 		/*
1871 		 * Now that all our children are ready, run the callback
1872 		 * associated with this zio in case it wants to modify the
1873 		 * data to be written.
1874 		 */
1875 		ASSERT3U(zp->zp_level, >, 0);
1876 		zio->io_children_ready(zio);
1877 	}
1878 
1879 	ASSERT(zio->io_child_type != ZIO_CHILD_DDT);
1880 	ASSERT(zio->io_bp_override == NULL);
1881 
1882 	if (!BP_IS_HOLE(bp) && BP_GET_LOGICAL_BIRTH(bp) == zio->io_txg) {
1883 		/*
1884 		 * We're rewriting an existing block, which means we're
1885 		 * working on behalf of spa_sync().  For spa_sync() to
1886 		 * converge, it must eventually be the case that we don't
1887 		 * have to allocate new blocks.  But compression changes
1888 		 * the blocksize, which forces a reallocate, and makes
1889 		 * convergence take longer.  Therefore, after the first
1890 		 * few passes, stop compressing to ensure convergence.
1891 		 */
1892 		pass = spa_sync_pass(spa);
1893 
1894 		ASSERT(zio->io_txg == spa_syncing_txg(spa));
1895 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
1896 		ASSERT(!BP_GET_DEDUP(bp));
1897 
1898 		if (pass >= zfs_sync_pass_dont_compress)
1899 			compress = ZIO_COMPRESS_OFF;
1900 
1901 		/* Make sure someone doesn't change their mind on overwrites */
1902 		ASSERT(BP_IS_EMBEDDED(bp) || BP_IS_GANG(bp) ||
1903 		    MIN(zp->zp_copies, spa_max_replication(spa))
1904 		    == BP_GET_NDVAS(bp));
1905 	}
1906 
1907 	/* If it's a compressed write that is not raw, compress the buffer. */
1908 	if (compress != ZIO_COMPRESS_OFF &&
1909 	    !(zio->io_flags & ZIO_FLAG_RAW_COMPRESS)) {
1910 		abd_t *cabd = NULL;
1911 		if (abd_cmp_zero(zio->io_abd, lsize) == 0)
1912 			psize = 0;
1913 		else if (compress == ZIO_COMPRESS_EMPTY)
1914 			psize = lsize;
1915 		else
1916 			psize = zio_compress_data(compress, zio->io_abd, &cabd,
1917 			    lsize,
1918 			    zio_get_compression_max_size(compress,
1919 			    spa->spa_gcd_alloc, spa->spa_min_alloc, lsize),
1920 			    zp->zp_complevel);
1921 		if (psize == 0) {
1922 			compress = ZIO_COMPRESS_OFF;
1923 		} else if (psize >= lsize) {
1924 			compress = ZIO_COMPRESS_OFF;
1925 			if (cabd != NULL)
1926 				abd_free(cabd);
1927 		} else if (!zp->zp_dedup && !zp->zp_encrypt &&
1928 		    psize <= BPE_PAYLOAD_SIZE &&
1929 		    zp->zp_level == 0 && !DMU_OT_HAS_FILL(zp->zp_type) &&
1930 		    spa_feature_is_enabled(spa, SPA_FEATURE_EMBEDDED_DATA)) {
1931 			void *cbuf = abd_borrow_buf_copy(cabd, lsize);
1932 			encode_embedded_bp_compressed(bp,
1933 			    cbuf, compress, lsize, psize);
1934 			BPE_SET_ETYPE(bp, BP_EMBEDDED_TYPE_DATA);
1935 			BP_SET_TYPE(bp, zio->io_prop.zp_type);
1936 			BP_SET_LEVEL(bp, zio->io_prop.zp_level);
1937 			abd_return_buf(cabd, cbuf, lsize);
1938 			abd_free(cabd);
1939 			BP_SET_LOGICAL_BIRTH(bp, zio->io_txg);
1940 			zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
1941 			ASSERT(spa_feature_is_active(spa,
1942 			    SPA_FEATURE_EMBEDDED_DATA));
1943 			return (zio);
1944 		} else {
1945 			/*
1946 			 * Round compressed size up to the minimum allocation
1947 			 * size of the smallest-ashift device, and zero the
1948 			 * tail. This ensures that the compressed size of the
1949 			 * BP (and thus compressratio property) are correct,
1950 			 * in that we charge for the padding used to fill out
1951 			 * the last sector.
1952 			 */
1953 			size_t rounded = (size_t)zio_roundup_alloc_size(spa,
1954 			    psize);
1955 			if (rounded >= lsize) {
1956 				compress = ZIO_COMPRESS_OFF;
1957 				abd_free(cabd);
1958 				psize = lsize;
1959 			} else {
1960 				abd_zero_off(cabd, psize, rounded - psize);
1961 				psize = rounded;
1962 				zio_push_transform(zio, cabd,
1963 				    psize, lsize, NULL);
1964 			}
1965 		}
1966 
1967 		/*
1968 		 * We were unable to handle this as an override bp, treat
1969 		 * it as a regular write I/O.
1970 		 */
1971 		zio->io_bp_override = NULL;
1972 		*bp = zio->io_bp_orig;
1973 		zio->io_pipeline = zio->io_orig_pipeline;
1974 
1975 	} else if ((zio->io_flags & ZIO_FLAG_RAW_ENCRYPT) != 0 &&
1976 	    zp->zp_type == DMU_OT_DNODE) {
1977 		/*
1978 		 * The DMU actually relies on the zio layer's compression
1979 		 * to free metadnode blocks that have had all contained
1980 		 * dnodes freed. As a result, even when doing a raw
1981 		 * receive, we must check whether the block can be compressed
1982 		 * to a hole.
1983 		 */
1984 		if (abd_cmp_zero(zio->io_abd, lsize) == 0) {
1985 			psize = 0;
1986 			compress = ZIO_COMPRESS_OFF;
1987 		} else {
1988 			psize = lsize;
1989 		}
1990 	} else if (zio->io_flags & ZIO_FLAG_RAW_COMPRESS &&
1991 	    !(zio->io_flags & ZIO_FLAG_RAW_ENCRYPT)) {
1992 		/*
1993 		 * If we are raw receiving an encrypted dataset we should not
1994 		 * take this codepath because it will change the on-disk block
1995 		 * and decryption will fail.
1996 		 */
1997 		size_t rounded = MIN((size_t)zio_roundup_alloc_size(spa, psize),
1998 		    lsize);
1999 
2000 		if (rounded != psize) {
2001 			abd_t *cdata = abd_alloc_linear(rounded, B_TRUE);
2002 			abd_zero_off(cdata, psize, rounded - psize);
2003 			abd_copy_off(cdata, zio->io_abd, 0, 0, psize);
2004 			psize = rounded;
2005 			zio_push_transform(zio, cdata,
2006 			    psize, rounded, NULL);
2007 		}
2008 	} else {
2009 		ASSERT3U(psize, !=, 0);
2010 	}
2011 
2012 	/*
2013 	 * The final pass of spa_sync() must be all rewrites, but the first
2014 	 * few passes offer a trade-off: allocating blocks defers convergence,
2015 	 * but newly allocated blocks are sequential, so they can be written
2016 	 * to disk faster.  Therefore, we allow the first few passes of
2017 	 * spa_sync() to allocate new blocks, but force rewrites after that.
2018 	 * There should only be a handful of blocks after pass 1 in any case.
2019 	 */
2020 	if (!BP_IS_HOLE(bp) && BP_GET_LOGICAL_BIRTH(bp) == zio->io_txg &&
2021 	    BP_GET_PSIZE(bp) == psize &&
2022 	    pass >= zfs_sync_pass_rewrite) {
2023 		VERIFY3U(psize, !=, 0);
2024 		enum zio_stage gang_stages = zio->io_pipeline & ZIO_GANG_STAGES;
2025 
2026 		zio->io_pipeline = ZIO_REWRITE_PIPELINE | gang_stages;
2027 		zio->io_flags |= ZIO_FLAG_IO_REWRITE;
2028 	} else {
2029 		BP_ZERO(bp);
2030 		zio->io_pipeline = ZIO_WRITE_PIPELINE;
2031 	}
2032 
2033 	if (psize == 0) {
2034 		if (BP_GET_LOGICAL_BIRTH(&zio->io_bp_orig) != 0 &&
2035 		    spa_feature_is_active(spa, SPA_FEATURE_HOLE_BIRTH)) {
2036 			BP_SET_LSIZE(bp, lsize);
2037 			BP_SET_TYPE(bp, zp->zp_type);
2038 			BP_SET_LEVEL(bp, zp->zp_level);
2039 			BP_SET_BIRTH(bp, zio->io_txg, 0);
2040 		}
2041 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
2042 	} else {
2043 		ASSERT(zp->zp_checksum != ZIO_CHECKSUM_GANG_HEADER);
2044 		BP_SET_LSIZE(bp, lsize);
2045 		BP_SET_TYPE(bp, zp->zp_type);
2046 		BP_SET_LEVEL(bp, zp->zp_level);
2047 		BP_SET_PSIZE(bp, psize);
2048 		BP_SET_COMPRESS(bp, compress);
2049 		BP_SET_CHECKSUM(bp, zp->zp_checksum);
2050 		BP_SET_DEDUP(bp, zp->zp_dedup);
2051 		BP_SET_BYTEORDER(bp, ZFS_HOST_BYTEORDER);
2052 		if (zp->zp_dedup) {
2053 			ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
2054 			ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
2055 			ASSERT(!zp->zp_encrypt ||
2056 			    DMU_OT_IS_ENCRYPTED(zp->zp_type));
2057 			zio->io_pipeline = ZIO_DDT_WRITE_PIPELINE;
2058 		}
2059 		if (zp->zp_nopwrite) {
2060 			ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
2061 			ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
2062 			zio->io_pipeline |= ZIO_STAGE_NOP_WRITE;
2063 		}
2064 	}
2065 	return (zio);
2066 }
2067 
2068 static zio_t *
2069 zio_free_bp_init(zio_t *zio)
2070 {
2071 	blkptr_t *bp = zio->io_bp;
2072 
2073 	if (zio->io_child_type == ZIO_CHILD_LOGICAL) {
2074 		if (BP_GET_DEDUP(bp))
2075 			zio->io_pipeline = ZIO_DDT_FREE_PIPELINE;
2076 	}
2077 
2078 	ASSERT3P(zio->io_bp, ==, &zio->io_bp_copy);
2079 
2080 	return (zio);
2081 }
2082 
2083 /*
2084  * ==========================================================================
2085  * Execute the I/O pipeline
2086  * ==========================================================================
2087  */
2088 
2089 static void
2090 zio_taskq_dispatch(zio_t *zio, zio_taskq_type_t q, boolean_t cutinline)
2091 {
2092 	spa_t *spa = zio->io_spa;
2093 	zio_type_t t = zio->io_type;
2094 
2095 	/*
2096 	 * If we're a config writer or a probe, the normal issue and
2097 	 * interrupt threads may all be blocked waiting for the config lock.
2098 	 * In this case, select the otherwise-unused taskq for ZIO_TYPE_NULL.
2099 	 */
2100 	if (zio->io_flags & (ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_PROBE))
2101 		t = ZIO_TYPE_NULL;
2102 
2103 	/*
2104 	 * A similar issue exists for the L2ARC write thread until L2ARC 2.0.
2105 	 */
2106 	if (t == ZIO_TYPE_WRITE && zio->io_vd && zio->io_vd->vdev_aux)
2107 		t = ZIO_TYPE_NULL;
2108 
2109 	/*
2110 	 * If this is a high priority I/O, then use the high priority taskq if
2111 	 * available or cut the line otherwise.
2112 	 */
2113 	if (zio->io_priority == ZIO_PRIORITY_SYNC_WRITE) {
2114 		if (spa->spa_zio_taskq[t][q + 1].stqs_count != 0)
2115 			q++;
2116 		else
2117 			cutinline = B_TRUE;
2118 	}
2119 
2120 	ASSERT3U(q, <, ZIO_TASKQ_TYPES);
2121 
2122 	spa_taskq_dispatch(spa, t, q, zio_execute, zio, cutinline);
2123 }
2124 
2125 static boolean_t
2126 zio_taskq_member(zio_t *zio, zio_taskq_type_t q)
2127 {
2128 	spa_t *spa = zio->io_spa;
2129 
2130 	taskq_t *tq = taskq_of_curthread();
2131 
2132 	for (zio_type_t t = 0; t < ZIO_TYPES; t++) {
2133 		spa_taskqs_t *tqs = &spa->spa_zio_taskq[t][q];
2134 		uint_t i;
2135 		for (i = 0; i < tqs->stqs_count; i++) {
2136 			if (tqs->stqs_taskq[i] == tq)
2137 				return (B_TRUE);
2138 		}
2139 	}
2140 
2141 	return (B_FALSE);
2142 }
2143 
2144 static zio_t *
2145 zio_issue_async(zio_t *zio)
2146 {
2147 	ASSERT((zio->io_type != ZIO_TYPE_WRITE) || ZIO_HAS_ALLOCATOR(zio));
2148 	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_FALSE);
2149 	return (NULL);
2150 }
2151 
2152 void
2153 zio_interrupt(void *zio)
2154 {
2155 	zio_taskq_dispatch(zio, ZIO_TASKQ_INTERRUPT, B_FALSE);
2156 }
2157 
2158 void
2159 zio_delay_interrupt(zio_t *zio)
2160 {
2161 	/*
2162 	 * The timeout_generic() function isn't defined in userspace, so
2163 	 * rather than trying to implement the function, the zio delay
2164 	 * functionality has been disabled for userspace builds.
2165 	 */
2166 
2167 #ifdef _KERNEL
2168 	/*
2169 	 * If io_target_timestamp is zero, then no delay has been registered
2170 	 * for this IO, thus jump to the end of this function and "skip" the
2171 	 * delay; issuing it directly to the zio layer.
2172 	 */
2173 	if (zio->io_target_timestamp != 0) {
2174 		hrtime_t now = gethrtime();
2175 
2176 		if (now >= zio->io_target_timestamp) {
2177 			/*
2178 			 * This IO has already taken longer than the target
2179 			 * delay to complete, so we don't want to delay it
2180 			 * any longer; we "miss" the delay and issue it
2181 			 * directly to the zio layer. This is likely due to
2182 			 * the target latency being set to a value less than
2183 			 * the underlying hardware can satisfy (e.g. delay
2184 			 * set to 1ms, but the disks take 10ms to complete an
2185 			 * IO request).
2186 			 */
2187 
2188 			DTRACE_PROBE2(zio__delay__miss, zio_t *, zio,
2189 			    hrtime_t, now);
2190 
2191 			zio_interrupt(zio);
2192 		} else {
2193 			taskqid_t tid;
2194 			hrtime_t diff = zio->io_target_timestamp - now;
2195 			clock_t expire_at_tick = ddi_get_lbolt() +
2196 			    NSEC_TO_TICK(diff);
2197 
2198 			DTRACE_PROBE3(zio__delay__hit, zio_t *, zio,
2199 			    hrtime_t, now, hrtime_t, diff);
2200 
2201 			if (NSEC_TO_TICK(diff) == 0) {
2202 				/* Our delay is less than a jiffy - just spin */
2203 				zfs_sleep_until(zio->io_target_timestamp);
2204 				zio_interrupt(zio);
2205 			} else {
2206 				/*
2207 				 * Use taskq_dispatch_delay() in the place of
2208 				 * OpenZFS's timeout_generic().
2209 				 */
2210 				tid = taskq_dispatch_delay(system_taskq,
2211 				    zio_interrupt, zio, TQ_NOSLEEP,
2212 				    expire_at_tick);
2213 				if (tid == TASKQID_INVALID) {
2214 					/*
2215 					 * Couldn't allocate a task.  Just
2216 					 * finish the zio without a delay.
2217 					 */
2218 					zio_interrupt(zio);
2219 				}
2220 			}
2221 		}
2222 		return;
2223 	}
2224 #endif
2225 	DTRACE_PROBE1(zio__delay__skip, zio_t *, zio);
2226 	zio_interrupt(zio);
2227 }
2228 
2229 static void
2230 zio_deadman_impl(zio_t *pio, int ziodepth)
2231 {
2232 	zio_t *cio, *cio_next;
2233 	zio_link_t *zl = NULL;
2234 	vdev_t *vd = pio->io_vd;
2235 
2236 	if (zio_deadman_log_all || (vd != NULL && vd->vdev_ops->vdev_op_leaf)) {
2237 		vdev_queue_t *vq = vd ? &vd->vdev_queue : NULL;
2238 		zbookmark_phys_t *zb = &pio->io_bookmark;
2239 		uint64_t delta = gethrtime() - pio->io_timestamp;
2240 		uint64_t failmode = spa_get_deadman_failmode(pio->io_spa);
2241 
2242 		zfs_dbgmsg("slow zio[%d]: zio=%px timestamp=%llu "
2243 		    "delta=%llu queued=%llu io=%llu "
2244 		    "path=%s "
2245 		    "last=%llu type=%d "
2246 		    "priority=%d flags=0x%llx stage=0x%x "
2247 		    "pipeline=0x%x pipeline-trace=0x%x "
2248 		    "objset=%llu object=%llu "
2249 		    "level=%llu blkid=%llu "
2250 		    "offset=%llu size=%llu "
2251 		    "error=%d",
2252 		    ziodepth, pio, pio->io_timestamp,
2253 		    (u_longlong_t)delta, pio->io_delta, pio->io_delay,
2254 		    vd ? vd->vdev_path : "NULL",
2255 		    vq ? vq->vq_io_complete_ts : 0, pio->io_type,
2256 		    pio->io_priority, (u_longlong_t)pio->io_flags,
2257 		    pio->io_stage, pio->io_pipeline, pio->io_pipeline_trace,
2258 		    (u_longlong_t)zb->zb_objset, (u_longlong_t)zb->zb_object,
2259 		    (u_longlong_t)zb->zb_level, (u_longlong_t)zb->zb_blkid,
2260 		    (u_longlong_t)pio->io_offset, (u_longlong_t)pio->io_size,
2261 		    pio->io_error);
2262 		(void) zfs_ereport_post(FM_EREPORT_ZFS_DEADMAN,
2263 		    pio->io_spa, vd, zb, pio, 0);
2264 
2265 		if (failmode == ZIO_FAILURE_MODE_CONTINUE &&
2266 		    taskq_empty_ent(&pio->io_tqent)) {
2267 			zio_interrupt(pio);
2268 		}
2269 	}
2270 
2271 	mutex_enter(&pio->io_lock);
2272 	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
2273 		cio_next = zio_walk_children(pio, &zl);
2274 		zio_deadman_impl(cio, ziodepth + 1);
2275 	}
2276 	mutex_exit(&pio->io_lock);
2277 }
2278 
2279 /*
2280  * Log the critical information describing this zio and all of its children
2281  * using the zfs_dbgmsg() interface then post deadman event for the ZED.
2282  */
2283 void
2284 zio_deadman(zio_t *pio, const char *tag)
2285 {
2286 	spa_t *spa = pio->io_spa;
2287 	char *name = spa_name(spa);
2288 
2289 	if (!zfs_deadman_enabled || spa_suspended(spa))
2290 		return;
2291 
2292 	zio_deadman_impl(pio, 0);
2293 
2294 	switch (spa_get_deadman_failmode(spa)) {
2295 	case ZIO_FAILURE_MODE_WAIT:
2296 		zfs_dbgmsg("%s waiting for hung I/O to pool '%s'", tag, name);
2297 		break;
2298 
2299 	case ZIO_FAILURE_MODE_CONTINUE:
2300 		zfs_dbgmsg("%s restarting hung I/O for pool '%s'", tag, name);
2301 		break;
2302 
2303 	case ZIO_FAILURE_MODE_PANIC:
2304 		fm_panic("%s determined I/O to pool '%s' is hung.", tag, name);
2305 		break;
2306 	}
2307 }
2308 
2309 /*
2310  * Execute the I/O pipeline until one of the following occurs:
2311  * (1) the I/O completes; (2) the pipeline stalls waiting for
2312  * dependent child I/Os; (3) the I/O issues, so we're waiting
2313  * for an I/O completion interrupt; (4) the I/O is delegated by
2314  * vdev-level caching or aggregation; (5) the I/O is deferred
2315  * due to vdev-level queueing; (6) the I/O is handed off to
2316  * another thread.  In all cases, the pipeline stops whenever
2317  * there's no CPU work; it never burns a thread in cv_wait_io().
2318  *
2319  * There's no locking on io_stage because there's no legitimate way
2320  * for multiple threads to be attempting to process the same I/O.
2321  */
2322 static zio_pipe_stage_t *zio_pipeline[];
2323 
2324 /*
2325  * zio_execute() is a wrapper around the static function
2326  * __zio_execute() so that we can force  __zio_execute() to be
2327  * inlined.  This reduces stack overhead which is important
2328  * because __zio_execute() is called recursively in several zio
2329  * code paths.  zio_execute() itself cannot be inlined because
2330  * it is externally visible.
2331  */
2332 void
2333 zio_execute(void *zio)
2334 {
2335 	fstrans_cookie_t cookie;
2336 
2337 	cookie = spl_fstrans_mark();
2338 	__zio_execute(zio);
2339 	spl_fstrans_unmark(cookie);
2340 }
2341 
2342 /*
2343  * Used to determine if in the current context the stack is sized large
2344  * enough to allow zio_execute() to be called recursively.  A minimum
2345  * stack size of 16K is required to avoid needing to re-dispatch the zio.
2346  */
2347 static boolean_t
2348 zio_execute_stack_check(zio_t *zio)
2349 {
2350 #if !defined(HAVE_LARGE_STACKS)
2351 	dsl_pool_t *dp = spa_get_dsl(zio->io_spa);
2352 
2353 	/* Executing in txg_sync_thread() context. */
2354 	if (dp && curthread == dp->dp_tx.tx_sync_thread)
2355 		return (B_TRUE);
2356 
2357 	/* Pool initialization outside of zio_taskq context. */
2358 	if (dp && spa_is_initializing(dp->dp_spa) &&
2359 	    !zio_taskq_member(zio, ZIO_TASKQ_ISSUE) &&
2360 	    !zio_taskq_member(zio, ZIO_TASKQ_ISSUE_HIGH))
2361 		return (B_TRUE);
2362 #else
2363 	(void) zio;
2364 #endif /* HAVE_LARGE_STACKS */
2365 
2366 	return (B_FALSE);
2367 }
2368 
2369 __attribute__((always_inline))
2370 static inline void
2371 __zio_execute(zio_t *zio)
2372 {
2373 	ASSERT3U(zio->io_queued_timestamp, >, 0);
2374 
2375 	while (zio->io_stage < ZIO_STAGE_DONE) {
2376 		enum zio_stage pipeline = zio->io_pipeline;
2377 		enum zio_stage stage = zio->io_stage;
2378 
2379 		zio->io_executor = curthread;
2380 
2381 		ASSERT(!MUTEX_HELD(&zio->io_lock));
2382 		ASSERT(ISP2(stage));
2383 		ASSERT(zio->io_stall == NULL);
2384 
2385 		do {
2386 			stage <<= 1;
2387 		} while ((stage & pipeline) == 0);
2388 
2389 		ASSERT(stage <= ZIO_STAGE_DONE);
2390 
2391 		/*
2392 		 * If we are in interrupt context and this pipeline stage
2393 		 * will grab a config lock that is held across I/O,
2394 		 * or may wait for an I/O that needs an interrupt thread
2395 		 * to complete, issue async to avoid deadlock.
2396 		 *
2397 		 * For VDEV_IO_START, we cut in line so that the io will
2398 		 * be sent to disk promptly.
2399 		 */
2400 		if ((stage & ZIO_BLOCKING_STAGES) && zio->io_vd == NULL &&
2401 		    zio_taskq_member(zio, ZIO_TASKQ_INTERRUPT)) {
2402 			boolean_t cut = (stage == ZIO_STAGE_VDEV_IO_START) ?
2403 			    zio_requeue_io_start_cut_in_line : B_FALSE;
2404 			zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, cut);
2405 			return;
2406 		}
2407 
2408 		/*
2409 		 * If the current context doesn't have large enough stacks
2410 		 * the zio must be issued asynchronously to prevent overflow.
2411 		 */
2412 		if (zio_execute_stack_check(zio)) {
2413 			boolean_t cut = (stage == ZIO_STAGE_VDEV_IO_START) ?
2414 			    zio_requeue_io_start_cut_in_line : B_FALSE;
2415 			zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, cut);
2416 			return;
2417 		}
2418 
2419 		zio->io_stage = stage;
2420 		zio->io_pipeline_trace |= zio->io_stage;
2421 
2422 		/*
2423 		 * The zio pipeline stage returns the next zio to execute
2424 		 * (typically the same as this one), or NULL if we should
2425 		 * stop.
2426 		 */
2427 		zio = zio_pipeline[highbit64(stage) - 1](zio);
2428 
2429 		if (zio == NULL)
2430 			return;
2431 	}
2432 }
2433 
2434 
2435 /*
2436  * ==========================================================================
2437  * Initiate I/O, either sync or async
2438  * ==========================================================================
2439  */
2440 int
2441 zio_wait(zio_t *zio)
2442 {
2443 	/*
2444 	 * Some routines, like zio_free_sync(), may return a NULL zio
2445 	 * to avoid the performance overhead of creating and then destroying
2446 	 * an unneeded zio.  For the callers' simplicity, we accept a NULL
2447 	 * zio and ignore it.
2448 	 */
2449 	if (zio == NULL)
2450 		return (0);
2451 
2452 	long timeout = MSEC_TO_TICK(zfs_deadman_ziotime_ms);
2453 	int error;
2454 
2455 	ASSERT3S(zio->io_stage, ==, ZIO_STAGE_OPEN);
2456 	ASSERT3P(zio->io_executor, ==, NULL);
2457 
2458 	zio->io_waiter = curthread;
2459 	ASSERT0(zio->io_queued_timestamp);
2460 	zio->io_queued_timestamp = gethrtime();
2461 
2462 	if (zio->io_type == ZIO_TYPE_WRITE) {
2463 		spa_select_allocator(zio);
2464 	}
2465 	__zio_execute(zio);
2466 
2467 	mutex_enter(&zio->io_lock);
2468 	while (zio->io_executor != NULL) {
2469 		error = cv_timedwait_io(&zio->io_cv, &zio->io_lock,
2470 		    ddi_get_lbolt() + timeout);
2471 
2472 		if (zfs_deadman_enabled && error == -1 &&
2473 		    gethrtime() - zio->io_queued_timestamp >
2474 		    spa_deadman_ziotime(zio->io_spa)) {
2475 			mutex_exit(&zio->io_lock);
2476 			timeout = MSEC_TO_TICK(zfs_deadman_checktime_ms);
2477 			zio_deadman(zio, FTAG);
2478 			mutex_enter(&zio->io_lock);
2479 		}
2480 	}
2481 	mutex_exit(&zio->io_lock);
2482 
2483 	error = zio->io_error;
2484 	zio_destroy(zio);
2485 
2486 	return (error);
2487 }
2488 
2489 void
2490 zio_nowait(zio_t *zio)
2491 {
2492 	/*
2493 	 * See comment in zio_wait().
2494 	 */
2495 	if (zio == NULL)
2496 		return;
2497 
2498 	ASSERT3P(zio->io_executor, ==, NULL);
2499 
2500 	if (zio->io_child_type == ZIO_CHILD_LOGICAL &&
2501 	    list_is_empty(&zio->io_parent_list)) {
2502 		zio_t *pio;
2503 
2504 		/*
2505 		 * This is a logical async I/O with no parent to wait for it.
2506 		 * We add it to the spa_async_root_zio "Godfather" I/O which
2507 		 * will ensure they complete prior to unloading the pool.
2508 		 */
2509 		spa_t *spa = zio->io_spa;
2510 		pio = spa->spa_async_zio_root[CPU_SEQID_UNSTABLE];
2511 
2512 		zio_add_child(pio, zio);
2513 	}
2514 
2515 	ASSERT0(zio->io_queued_timestamp);
2516 	zio->io_queued_timestamp = gethrtime();
2517 	if (zio->io_type == ZIO_TYPE_WRITE) {
2518 		spa_select_allocator(zio);
2519 	}
2520 	__zio_execute(zio);
2521 }
2522 
2523 /*
2524  * ==========================================================================
2525  * Reexecute, cancel, or suspend/resume failed I/O
2526  * ==========================================================================
2527  */
2528 
2529 static void
2530 zio_reexecute(void *arg)
2531 {
2532 	zio_t *pio = arg;
2533 	zio_t *cio, *cio_next, *gio;
2534 
2535 	ASSERT(pio->io_child_type == ZIO_CHILD_LOGICAL);
2536 	ASSERT(pio->io_orig_stage == ZIO_STAGE_OPEN);
2537 	ASSERT(pio->io_gang_leader == NULL);
2538 	ASSERT(pio->io_gang_tree == NULL);
2539 
2540 	mutex_enter(&pio->io_lock);
2541 	pio->io_flags = pio->io_orig_flags;
2542 	pio->io_stage = pio->io_orig_stage;
2543 	pio->io_pipeline = pio->io_orig_pipeline;
2544 	pio->io_reexecute = 0;
2545 	pio->io_flags |= ZIO_FLAG_REEXECUTED;
2546 	pio->io_pipeline_trace = 0;
2547 	pio->io_error = 0;
2548 	pio->io_state[ZIO_WAIT_READY] = (pio->io_stage >= ZIO_STAGE_READY) ||
2549 	    (pio->io_pipeline & ZIO_STAGE_READY) == 0;
2550 	pio->io_state[ZIO_WAIT_DONE] = (pio->io_stage >= ZIO_STAGE_DONE);
2551 	zio_link_t *zl = NULL;
2552 	while ((gio = zio_walk_parents(pio, &zl)) != NULL) {
2553 		for (int w = 0; w < ZIO_WAIT_TYPES; w++) {
2554 			gio->io_children[pio->io_child_type][w] +=
2555 			    !pio->io_state[w];
2556 		}
2557 	}
2558 	for (int c = 0; c < ZIO_CHILD_TYPES; c++)
2559 		pio->io_child_error[c] = 0;
2560 
2561 	if (IO_IS_ALLOCATING(pio))
2562 		BP_ZERO(pio->io_bp);
2563 
2564 	/*
2565 	 * As we reexecute pio's children, new children could be created.
2566 	 * New children go to the head of pio's io_child_list, however,
2567 	 * so we will (correctly) not reexecute them.  The key is that
2568 	 * the remainder of pio's io_child_list, from 'cio_next' onward,
2569 	 * cannot be affected by any side effects of reexecuting 'cio'.
2570 	 */
2571 	zl = NULL;
2572 	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
2573 		cio_next = zio_walk_children(pio, &zl);
2574 		mutex_exit(&pio->io_lock);
2575 		zio_reexecute(cio);
2576 		mutex_enter(&pio->io_lock);
2577 	}
2578 	mutex_exit(&pio->io_lock);
2579 
2580 	/*
2581 	 * Now that all children have been reexecuted, execute the parent.
2582 	 * We don't reexecute "The Godfather" I/O here as it's the
2583 	 * responsibility of the caller to wait on it.
2584 	 */
2585 	if (!(pio->io_flags & ZIO_FLAG_GODFATHER)) {
2586 		pio->io_queued_timestamp = gethrtime();
2587 		__zio_execute(pio);
2588 	}
2589 }
2590 
2591 void
2592 zio_suspend(spa_t *spa, zio_t *zio, zio_suspend_reason_t reason)
2593 {
2594 	if (spa_get_failmode(spa) == ZIO_FAILURE_MODE_PANIC)
2595 		fm_panic("Pool '%s' has encountered an uncorrectable I/O "
2596 		    "failure and the failure mode property for this pool "
2597 		    "is set to panic.", spa_name(spa));
2598 
2599 	if (reason != ZIO_SUSPEND_MMP) {
2600 		cmn_err(CE_WARN, "Pool '%s' has encountered an uncorrectable "
2601 		    "I/O failure and has been suspended.", spa_name(spa));
2602 	}
2603 
2604 	(void) zfs_ereport_post(FM_EREPORT_ZFS_IO_FAILURE, spa, NULL,
2605 	    NULL, NULL, 0);
2606 
2607 	mutex_enter(&spa->spa_suspend_lock);
2608 
2609 	if (spa->spa_suspend_zio_root == NULL)
2610 		spa->spa_suspend_zio_root = zio_root(spa, NULL, NULL,
2611 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE |
2612 		    ZIO_FLAG_GODFATHER);
2613 
2614 	spa->spa_suspended = reason;
2615 
2616 	if (zio != NULL) {
2617 		ASSERT(!(zio->io_flags & ZIO_FLAG_GODFATHER));
2618 		ASSERT(zio != spa->spa_suspend_zio_root);
2619 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
2620 		ASSERT(zio_unique_parent(zio) == NULL);
2621 		ASSERT(zio->io_stage == ZIO_STAGE_DONE);
2622 		zio_add_child(spa->spa_suspend_zio_root, zio);
2623 	}
2624 
2625 	mutex_exit(&spa->spa_suspend_lock);
2626 }
2627 
2628 int
2629 zio_resume(spa_t *spa)
2630 {
2631 	zio_t *pio;
2632 
2633 	/*
2634 	 * Reexecute all previously suspended i/o.
2635 	 */
2636 	mutex_enter(&spa->spa_suspend_lock);
2637 	if (spa->spa_suspended != ZIO_SUSPEND_NONE)
2638 		cmn_err(CE_WARN, "Pool '%s' was suspended and is being "
2639 		    "resumed. Failed I/O will be retried.",
2640 		    spa_name(spa));
2641 	spa->spa_suspended = ZIO_SUSPEND_NONE;
2642 	cv_broadcast(&spa->spa_suspend_cv);
2643 	pio = spa->spa_suspend_zio_root;
2644 	spa->spa_suspend_zio_root = NULL;
2645 	mutex_exit(&spa->spa_suspend_lock);
2646 
2647 	if (pio == NULL)
2648 		return (0);
2649 
2650 	zio_reexecute(pio);
2651 	return (zio_wait(pio));
2652 }
2653 
2654 void
2655 zio_resume_wait(spa_t *spa)
2656 {
2657 	mutex_enter(&spa->spa_suspend_lock);
2658 	while (spa_suspended(spa))
2659 		cv_wait(&spa->spa_suspend_cv, &spa->spa_suspend_lock);
2660 	mutex_exit(&spa->spa_suspend_lock);
2661 }
2662 
2663 /*
2664  * ==========================================================================
2665  * Gang blocks.
2666  *
2667  * A gang block is a collection of small blocks that looks to the DMU
2668  * like one large block.  When zio_dva_allocate() cannot find a block
2669  * of the requested size, due to either severe fragmentation or the pool
2670  * being nearly full, it calls zio_write_gang_block() to construct the
2671  * block from smaller fragments.
2672  *
2673  * A gang block consists of a gang header (zio_gbh_phys_t) and up to
2674  * three (SPA_GBH_NBLKPTRS) gang members.  The gang header is just like
2675  * an indirect block: it's an array of block pointers.  It consumes
2676  * only one sector and hence is allocatable regardless of fragmentation.
2677  * The gang header's bps point to its gang members, which hold the data.
2678  *
2679  * Gang blocks are self-checksumming, using the bp's <vdev, offset, txg>
2680  * as the verifier to ensure uniqueness of the SHA256 checksum.
2681  * Critically, the gang block bp's blk_cksum is the checksum of the data,
2682  * not the gang header.  This ensures that data block signatures (needed for
2683  * deduplication) are independent of how the block is physically stored.
2684  *
2685  * Gang blocks can be nested: a gang member may itself be a gang block.
2686  * Thus every gang block is a tree in which root and all interior nodes are
2687  * gang headers, and the leaves are normal blocks that contain user data.
2688  * The root of the gang tree is called the gang leader.
2689  *
2690  * To perform any operation (read, rewrite, free, claim) on a gang block,
2691  * zio_gang_assemble() first assembles the gang tree (minus data leaves)
2692  * in the io_gang_tree field of the original logical i/o by recursively
2693  * reading the gang leader and all gang headers below it.  This yields
2694  * an in-core tree containing the contents of every gang header and the
2695  * bps for every constituent of the gang block.
2696  *
2697  * With the gang tree now assembled, zio_gang_issue() just walks the gang tree
2698  * and invokes a callback on each bp.  To free a gang block, zio_gang_issue()
2699  * calls zio_free_gang() -- a trivial wrapper around zio_free() -- for each bp.
2700  * zio_claim_gang() provides a similarly trivial wrapper for zio_claim().
2701  * zio_read_gang() is a wrapper around zio_read() that omits reading gang
2702  * headers, since we already have those in io_gang_tree.  zio_rewrite_gang()
2703  * performs a zio_rewrite() of the data or, for gang headers, a zio_rewrite()
2704  * of the gang header plus zio_checksum_compute() of the data to update the
2705  * gang header's blk_cksum as described above.
2706  *
2707  * The two-phase assemble/issue model solves the problem of partial failure --
2708  * what if you'd freed part of a gang block but then couldn't read the
2709  * gang header for another part?  Assembling the entire gang tree first
2710  * ensures that all the necessary gang header I/O has succeeded before
2711  * starting the actual work of free, claim, or write.  Once the gang tree
2712  * is assembled, free and claim are in-memory operations that cannot fail.
2713  *
2714  * In the event that a gang write fails, zio_dva_unallocate() walks the
2715  * gang tree to immediately free (i.e. insert back into the space map)
2716  * everything we've allocated.  This ensures that we don't get ENOSPC
2717  * errors during repeated suspend/resume cycles due to a flaky device.
2718  *
2719  * Gang rewrites only happen during sync-to-convergence.  If we can't assemble
2720  * the gang tree, we won't modify the block, so we can safely defer the free
2721  * (knowing that the block is still intact).  If we *can* assemble the gang
2722  * tree, then even if some of the rewrites fail, zio_dva_unallocate() will free
2723  * each constituent bp and we can allocate a new block on the next sync pass.
2724  *
2725  * In all cases, the gang tree allows complete recovery from partial failure.
2726  * ==========================================================================
2727  */
2728 
2729 static void
2730 zio_gang_issue_func_done(zio_t *zio)
2731 {
2732 	abd_free(zio->io_abd);
2733 }
2734 
2735 static zio_t *
2736 zio_read_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2737     uint64_t offset)
2738 {
2739 	if (gn != NULL)
2740 		return (pio);
2741 
2742 	return (zio_read(pio, pio->io_spa, bp, abd_get_offset(data, offset),
2743 	    BP_GET_PSIZE(bp), zio_gang_issue_func_done,
2744 	    NULL, pio->io_priority, ZIO_GANG_CHILD_FLAGS(pio),
2745 	    &pio->io_bookmark));
2746 }
2747 
2748 static zio_t *
2749 zio_rewrite_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2750     uint64_t offset)
2751 {
2752 	zio_t *zio;
2753 
2754 	if (gn != NULL) {
2755 		abd_t *gbh_abd =
2756 		    abd_get_from_buf(gn->gn_gbh, SPA_GANGBLOCKSIZE);
2757 		zio = zio_rewrite(pio, pio->io_spa, pio->io_txg, bp,
2758 		    gbh_abd, SPA_GANGBLOCKSIZE, zio_gang_issue_func_done, NULL,
2759 		    pio->io_priority, ZIO_GANG_CHILD_FLAGS(pio),
2760 		    &pio->io_bookmark);
2761 		/*
2762 		 * As we rewrite each gang header, the pipeline will compute
2763 		 * a new gang block header checksum for it; but no one will
2764 		 * compute a new data checksum, so we do that here.  The one
2765 		 * exception is the gang leader: the pipeline already computed
2766 		 * its data checksum because that stage precedes gang assembly.
2767 		 * (Presently, nothing actually uses interior data checksums;
2768 		 * this is just good hygiene.)
2769 		 */
2770 		if (gn != pio->io_gang_leader->io_gang_tree) {
2771 			abd_t *buf = abd_get_offset(data, offset);
2772 
2773 			zio_checksum_compute(zio, BP_GET_CHECKSUM(bp),
2774 			    buf, BP_GET_PSIZE(bp));
2775 
2776 			abd_free(buf);
2777 		}
2778 		/*
2779 		 * If we are here to damage data for testing purposes,
2780 		 * leave the GBH alone so that we can detect the damage.
2781 		 */
2782 		if (pio->io_gang_leader->io_flags & ZIO_FLAG_INDUCE_DAMAGE)
2783 			zio->io_pipeline &= ~ZIO_VDEV_IO_STAGES;
2784 	} else {
2785 		zio = zio_rewrite(pio, pio->io_spa, pio->io_txg, bp,
2786 		    abd_get_offset(data, offset), BP_GET_PSIZE(bp),
2787 		    zio_gang_issue_func_done, NULL, pio->io_priority,
2788 		    ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);
2789 	}
2790 
2791 	return (zio);
2792 }
2793 
2794 static zio_t *
2795 zio_free_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2796     uint64_t offset)
2797 {
2798 	(void) gn, (void) data, (void) offset;
2799 
2800 	zio_t *zio = zio_free_sync(pio, pio->io_spa, pio->io_txg, bp,
2801 	    ZIO_GANG_CHILD_FLAGS(pio));
2802 	if (zio == NULL) {
2803 		zio = zio_null(pio, pio->io_spa,
2804 		    NULL, NULL, NULL, ZIO_GANG_CHILD_FLAGS(pio));
2805 	}
2806 	return (zio);
2807 }
2808 
2809 static zio_t *
2810 zio_claim_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2811     uint64_t offset)
2812 {
2813 	(void) gn, (void) data, (void) offset;
2814 	return (zio_claim(pio, pio->io_spa, pio->io_txg, bp,
2815 	    NULL, NULL, ZIO_GANG_CHILD_FLAGS(pio)));
2816 }
2817 
2818 static zio_gang_issue_func_t *zio_gang_issue_func[ZIO_TYPES] = {
2819 	NULL,
2820 	zio_read_gang,
2821 	zio_rewrite_gang,
2822 	zio_free_gang,
2823 	zio_claim_gang,
2824 	NULL
2825 };
2826 
2827 static void zio_gang_tree_assemble_done(zio_t *zio);
2828 
2829 static zio_gang_node_t *
2830 zio_gang_node_alloc(zio_gang_node_t **gnpp)
2831 {
2832 	zio_gang_node_t *gn;
2833 
2834 	ASSERT(*gnpp == NULL);
2835 
2836 	gn = kmem_zalloc(sizeof (*gn), KM_SLEEP);
2837 	gn->gn_gbh = zio_buf_alloc(SPA_GANGBLOCKSIZE);
2838 	*gnpp = gn;
2839 
2840 	return (gn);
2841 }
2842 
2843 static void
2844 zio_gang_node_free(zio_gang_node_t **gnpp)
2845 {
2846 	zio_gang_node_t *gn = *gnpp;
2847 
2848 	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++)
2849 		ASSERT(gn->gn_child[g] == NULL);
2850 
2851 	zio_buf_free(gn->gn_gbh, SPA_GANGBLOCKSIZE);
2852 	kmem_free(gn, sizeof (*gn));
2853 	*gnpp = NULL;
2854 }
2855 
2856 static void
2857 zio_gang_tree_free(zio_gang_node_t **gnpp)
2858 {
2859 	zio_gang_node_t *gn = *gnpp;
2860 
2861 	if (gn == NULL)
2862 		return;
2863 
2864 	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++)
2865 		zio_gang_tree_free(&gn->gn_child[g]);
2866 
2867 	zio_gang_node_free(gnpp);
2868 }
2869 
2870 static void
2871 zio_gang_tree_assemble(zio_t *gio, blkptr_t *bp, zio_gang_node_t **gnpp)
2872 {
2873 	zio_gang_node_t *gn = zio_gang_node_alloc(gnpp);
2874 	abd_t *gbh_abd = abd_get_from_buf(gn->gn_gbh, SPA_GANGBLOCKSIZE);
2875 
2876 	ASSERT(gio->io_gang_leader == gio);
2877 	ASSERT(BP_IS_GANG(bp));
2878 
2879 	zio_nowait(zio_read(gio, gio->io_spa, bp, gbh_abd, SPA_GANGBLOCKSIZE,
2880 	    zio_gang_tree_assemble_done, gn, gio->io_priority,
2881 	    ZIO_GANG_CHILD_FLAGS(gio), &gio->io_bookmark));
2882 }
2883 
2884 static void
2885 zio_gang_tree_assemble_done(zio_t *zio)
2886 {
2887 	zio_t *gio = zio->io_gang_leader;
2888 	zio_gang_node_t *gn = zio->io_private;
2889 	blkptr_t *bp = zio->io_bp;
2890 
2891 	ASSERT(gio == zio_unique_parent(zio));
2892 	ASSERT(list_is_empty(&zio->io_child_list));
2893 
2894 	if (zio->io_error)
2895 		return;
2896 
2897 	/* this ABD was created from a linear buf in zio_gang_tree_assemble */
2898 	if (BP_SHOULD_BYTESWAP(bp))
2899 		byteswap_uint64_array(abd_to_buf(zio->io_abd), zio->io_size);
2900 
2901 	ASSERT3P(abd_to_buf(zio->io_abd), ==, gn->gn_gbh);
2902 	ASSERT(zio->io_size == SPA_GANGBLOCKSIZE);
2903 	ASSERT(gn->gn_gbh->zg_tail.zec_magic == ZEC_MAGIC);
2904 
2905 	abd_free(zio->io_abd);
2906 
2907 	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
2908 		blkptr_t *gbp = &gn->gn_gbh->zg_blkptr[g];
2909 		if (!BP_IS_GANG(gbp))
2910 			continue;
2911 		zio_gang_tree_assemble(gio, gbp, &gn->gn_child[g]);
2912 	}
2913 }
2914 
2915 static void
2916 zio_gang_tree_issue(zio_t *pio, zio_gang_node_t *gn, blkptr_t *bp, abd_t *data,
2917     uint64_t offset)
2918 {
2919 	zio_t *gio = pio->io_gang_leader;
2920 	zio_t *zio;
2921 
2922 	ASSERT(BP_IS_GANG(bp) == !!gn);
2923 	ASSERT(BP_GET_CHECKSUM(bp) == BP_GET_CHECKSUM(gio->io_bp));
2924 	ASSERT(BP_GET_LSIZE(bp) == BP_GET_PSIZE(bp) || gn == gio->io_gang_tree);
2925 
2926 	/*
2927 	 * If you're a gang header, your data is in gn->gn_gbh.
2928 	 * If you're a gang member, your data is in 'data' and gn == NULL.
2929 	 */
2930 	zio = zio_gang_issue_func[gio->io_type](pio, bp, gn, data, offset);
2931 
2932 	if (gn != NULL) {
2933 		ASSERT(gn->gn_gbh->zg_tail.zec_magic == ZEC_MAGIC);
2934 
2935 		for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
2936 			blkptr_t *gbp = &gn->gn_gbh->zg_blkptr[g];
2937 			if (BP_IS_HOLE(gbp))
2938 				continue;
2939 			zio_gang_tree_issue(zio, gn->gn_child[g], gbp, data,
2940 			    offset);
2941 			offset += BP_GET_PSIZE(gbp);
2942 		}
2943 	}
2944 
2945 	if (gn == gio->io_gang_tree)
2946 		ASSERT3U(gio->io_size, ==, offset);
2947 
2948 	if (zio != pio)
2949 		zio_nowait(zio);
2950 }
2951 
2952 static zio_t *
2953 zio_gang_assemble(zio_t *zio)
2954 {
2955 	blkptr_t *bp = zio->io_bp;
2956 
2957 	ASSERT(BP_IS_GANG(bp) && zio->io_gang_leader == NULL);
2958 	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
2959 
2960 	zio->io_gang_leader = zio;
2961 
2962 	zio_gang_tree_assemble(zio, bp, &zio->io_gang_tree);
2963 
2964 	return (zio);
2965 }
2966 
2967 static zio_t *
2968 zio_gang_issue(zio_t *zio)
2969 {
2970 	blkptr_t *bp = zio->io_bp;
2971 
2972 	if (zio_wait_for_children(zio, ZIO_CHILD_GANG_BIT, ZIO_WAIT_DONE)) {
2973 		return (NULL);
2974 	}
2975 
2976 	ASSERT(BP_IS_GANG(bp) && zio->io_gang_leader == zio);
2977 	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
2978 
2979 	if (zio->io_child_error[ZIO_CHILD_GANG] == 0)
2980 		zio_gang_tree_issue(zio, zio->io_gang_tree, bp, zio->io_abd,
2981 		    0);
2982 	else
2983 		zio_gang_tree_free(&zio->io_gang_tree);
2984 
2985 	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
2986 
2987 	return (zio);
2988 }
2989 
2990 static void
2991 zio_gang_inherit_allocator(zio_t *pio, zio_t *cio)
2992 {
2993 	cio->io_allocator = pio->io_allocator;
2994 }
2995 
2996 static void
2997 zio_write_gang_member_ready(zio_t *zio)
2998 {
2999 	zio_t *pio = zio_unique_parent(zio);
3000 	dva_t *cdva = zio->io_bp->blk_dva;
3001 	dva_t *pdva = pio->io_bp->blk_dva;
3002 	uint64_t asize;
3003 	zio_t *gio __maybe_unused = zio->io_gang_leader;
3004 
3005 	if (BP_IS_HOLE(zio->io_bp))
3006 		return;
3007 
3008 	ASSERT(BP_IS_HOLE(&zio->io_bp_orig));
3009 
3010 	ASSERT(zio->io_child_type == ZIO_CHILD_GANG);
3011 	ASSERT3U(zio->io_prop.zp_copies, ==, gio->io_prop.zp_copies);
3012 	ASSERT3U(zio->io_prop.zp_copies, <=, BP_GET_NDVAS(zio->io_bp));
3013 	ASSERT3U(pio->io_prop.zp_copies, <=, BP_GET_NDVAS(pio->io_bp));
3014 	VERIFY3U(BP_GET_NDVAS(zio->io_bp), <=, BP_GET_NDVAS(pio->io_bp));
3015 
3016 	mutex_enter(&pio->io_lock);
3017 	for (int d = 0; d < BP_GET_NDVAS(zio->io_bp); d++) {
3018 		ASSERT(DVA_GET_GANG(&pdva[d]));
3019 		asize = DVA_GET_ASIZE(&pdva[d]);
3020 		asize += DVA_GET_ASIZE(&cdva[d]);
3021 		DVA_SET_ASIZE(&pdva[d], asize);
3022 	}
3023 	mutex_exit(&pio->io_lock);
3024 }
3025 
3026 static void
3027 zio_write_gang_done(zio_t *zio)
3028 {
3029 	/*
3030 	 * The io_abd field will be NULL for a zio with no data.  The io_flags
3031 	 * will initially have the ZIO_FLAG_NODATA bit flag set, but we can't
3032 	 * check for it here as it is cleared in zio_ready.
3033 	 */
3034 	if (zio->io_abd != NULL)
3035 		abd_free(zio->io_abd);
3036 }
3037 
3038 static zio_t *
3039 zio_write_gang_block(zio_t *pio, metaslab_class_t *mc)
3040 {
3041 	spa_t *spa = pio->io_spa;
3042 	blkptr_t *bp = pio->io_bp;
3043 	zio_t *gio = pio->io_gang_leader;
3044 	zio_t *zio;
3045 	zio_gang_node_t *gn, **gnpp;
3046 	zio_gbh_phys_t *gbh;
3047 	abd_t *gbh_abd;
3048 	uint64_t txg = pio->io_txg;
3049 	uint64_t resid = pio->io_size;
3050 	uint64_t lsize;
3051 	int copies = gio->io_prop.zp_copies;
3052 	zio_prop_t zp;
3053 	int error;
3054 	boolean_t has_data = !(pio->io_flags & ZIO_FLAG_NODATA);
3055 
3056 	/*
3057 	 * If one copy was requested, store 2 copies of the GBH, so that we
3058 	 * can still traverse all the data (e.g. to free or scrub) even if a
3059 	 * block is damaged.  Note that we can't store 3 copies of the GBH in
3060 	 * all cases, e.g. with encryption, which uses DVA[2] for the IV+salt.
3061 	 */
3062 	int gbh_copies = copies;
3063 	if (gbh_copies == 1) {
3064 		gbh_copies = MIN(2, spa_max_replication(spa));
3065 	}
3066 
3067 	ASSERT(ZIO_HAS_ALLOCATOR(pio));
3068 	int flags = METASLAB_HINTBP_FAVOR | METASLAB_GANG_HEADER;
3069 	if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
3070 		ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
3071 		ASSERT(has_data);
3072 
3073 		flags |= METASLAB_ASYNC_ALLOC;
3074 		VERIFY(zfs_refcount_held(&mc->mc_allocator[pio->io_allocator].
3075 		    mca_alloc_slots, pio));
3076 
3077 		/*
3078 		 * The logical zio has already placed a reservation for
3079 		 * 'copies' allocation slots but gang blocks may require
3080 		 * additional copies. These additional copies
3081 		 * (i.e. gbh_copies - copies) are guaranteed to succeed
3082 		 * since metaslab_class_throttle_reserve() always allows
3083 		 * additional reservations for gang blocks.
3084 		 */
3085 		VERIFY(metaslab_class_throttle_reserve(mc, gbh_copies - copies,
3086 		    pio->io_allocator, pio, flags));
3087 	}
3088 
3089 	error = metaslab_alloc(spa, mc, SPA_GANGBLOCKSIZE,
3090 	    bp, gbh_copies, txg, pio == gio ? NULL : gio->io_bp, flags,
3091 	    &pio->io_alloc_list, pio, pio->io_allocator);
3092 	if (error) {
3093 		if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
3094 			ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
3095 			ASSERT(has_data);
3096 
3097 			/*
3098 			 * If we failed to allocate the gang block header then
3099 			 * we remove any additional allocation reservations that
3100 			 * we placed here. The original reservation will
3101 			 * be removed when the logical I/O goes to the ready
3102 			 * stage.
3103 			 */
3104 			metaslab_class_throttle_unreserve(mc,
3105 			    gbh_copies - copies, pio->io_allocator, pio);
3106 		}
3107 
3108 		pio->io_error = error;
3109 		return (pio);
3110 	}
3111 
3112 	if (pio == gio) {
3113 		gnpp = &gio->io_gang_tree;
3114 	} else {
3115 		gnpp = pio->io_private;
3116 		ASSERT(pio->io_ready == zio_write_gang_member_ready);
3117 	}
3118 
3119 	gn = zio_gang_node_alloc(gnpp);
3120 	gbh = gn->gn_gbh;
3121 	memset(gbh, 0, SPA_GANGBLOCKSIZE);
3122 	gbh_abd = abd_get_from_buf(gbh, SPA_GANGBLOCKSIZE);
3123 
3124 	/*
3125 	 * Create the gang header.
3126 	 */
3127 	zio = zio_rewrite(pio, spa, txg, bp, gbh_abd, SPA_GANGBLOCKSIZE,
3128 	    zio_write_gang_done, NULL, pio->io_priority,
3129 	    ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);
3130 
3131 	zio_gang_inherit_allocator(pio, zio);
3132 
3133 	/*
3134 	 * Create and nowait the gang children.
3135 	 */
3136 	for (int g = 0; resid != 0; resid -= lsize, g++) {
3137 		lsize = P2ROUNDUP(resid / (SPA_GBH_NBLKPTRS - g),
3138 		    SPA_MINBLOCKSIZE);
3139 		ASSERT(lsize >= SPA_MINBLOCKSIZE && lsize <= resid);
3140 
3141 		zp.zp_checksum = gio->io_prop.zp_checksum;
3142 		zp.zp_compress = ZIO_COMPRESS_OFF;
3143 		zp.zp_complevel = gio->io_prop.zp_complevel;
3144 		zp.zp_type = zp.zp_storage_type = DMU_OT_NONE;
3145 		zp.zp_level = 0;
3146 		zp.zp_copies = gio->io_prop.zp_copies;
3147 		zp.zp_dedup = B_FALSE;
3148 		zp.zp_dedup_verify = B_FALSE;
3149 		zp.zp_nopwrite = B_FALSE;
3150 		zp.zp_encrypt = gio->io_prop.zp_encrypt;
3151 		zp.zp_byteorder = gio->io_prop.zp_byteorder;
3152 		zp.zp_direct_write = B_FALSE;
3153 		memset(zp.zp_salt, 0, ZIO_DATA_SALT_LEN);
3154 		memset(zp.zp_iv, 0, ZIO_DATA_IV_LEN);
3155 		memset(zp.zp_mac, 0, ZIO_DATA_MAC_LEN);
3156 
3157 		zio_t *cio = zio_write(zio, spa, txg, &gbh->zg_blkptr[g],
3158 		    has_data ? abd_get_offset(pio->io_abd, pio->io_size -
3159 		    resid) : NULL, lsize, lsize, &zp,
3160 		    zio_write_gang_member_ready, NULL,
3161 		    zio_write_gang_done, &gn->gn_child[g], pio->io_priority,
3162 		    ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);
3163 
3164 		zio_gang_inherit_allocator(zio, cio);
3165 
3166 		if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
3167 			ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
3168 			ASSERT(has_data);
3169 
3170 			/*
3171 			 * Gang children won't throttle but we should
3172 			 * account for their work, so reserve an allocation
3173 			 * slot for them here.
3174 			 */
3175 			VERIFY(metaslab_class_throttle_reserve(mc,
3176 			    zp.zp_copies, cio->io_allocator, cio, flags));
3177 		}
3178 		zio_nowait(cio);
3179 	}
3180 
3181 	/*
3182 	 * Set pio's pipeline to just wait for zio to finish.
3183 	 */
3184 	pio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
3185 
3186 	zio_nowait(zio);
3187 
3188 	return (pio);
3189 }
3190 
3191 /*
3192  * The zio_nop_write stage in the pipeline determines if allocating a
3193  * new bp is necessary.  The nopwrite feature can handle writes in
3194  * either syncing or open context (i.e. zil writes) and as a result is
3195  * mutually exclusive with dedup.
3196  *
3197  * By leveraging a cryptographically secure checksum, such as SHA256, we
3198  * can compare the checksums of the new data and the old to determine if
3199  * allocating a new block is required.  Note that our requirements for
3200  * cryptographic strength are fairly weak: there can't be any accidental
3201  * hash collisions, but we don't need to be secure against intentional
3202  * (malicious) collisions.  To trigger a nopwrite, you have to be able
3203  * to write the file to begin with, and triggering an incorrect (hash
3204  * collision) nopwrite is no worse than simply writing to the file.
3205  * That said, there are no known attacks against the checksum algorithms
3206  * used for nopwrite, assuming that the salt and the checksums
3207  * themselves remain secret.
3208  */
3209 static zio_t *
3210 zio_nop_write(zio_t *zio)
3211 {
3212 	blkptr_t *bp = zio->io_bp;
3213 	blkptr_t *bp_orig = &zio->io_bp_orig;
3214 	zio_prop_t *zp = &zio->io_prop;
3215 
3216 	ASSERT(BP_IS_HOLE(bp));
3217 	ASSERT(BP_GET_LEVEL(bp) == 0);
3218 	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
3219 	ASSERT(zp->zp_nopwrite);
3220 	ASSERT(!zp->zp_dedup);
3221 	ASSERT(zio->io_bp_override == NULL);
3222 	ASSERT(IO_IS_ALLOCATING(zio));
3223 
3224 	/*
3225 	 * Check to see if the original bp and the new bp have matching
3226 	 * characteristics (i.e. same checksum, compression algorithms, etc).
3227 	 * If they don't then just continue with the pipeline which will
3228 	 * allocate a new bp.
3229 	 */
3230 	if (BP_IS_HOLE(bp_orig) ||
3231 	    !(zio_checksum_table[BP_GET_CHECKSUM(bp)].ci_flags &
3232 	    ZCHECKSUM_FLAG_NOPWRITE) ||
3233 	    BP_IS_ENCRYPTED(bp) || BP_IS_ENCRYPTED(bp_orig) ||
3234 	    BP_GET_CHECKSUM(bp) != BP_GET_CHECKSUM(bp_orig) ||
3235 	    BP_GET_COMPRESS(bp) != BP_GET_COMPRESS(bp_orig) ||
3236 	    BP_GET_DEDUP(bp) != BP_GET_DEDUP(bp_orig) ||
3237 	    zp->zp_copies != BP_GET_NDVAS(bp_orig))
3238 		return (zio);
3239 
3240 	/*
3241 	 * If the checksums match then reset the pipeline so that we
3242 	 * avoid allocating a new bp and issuing any I/O.
3243 	 */
3244 	if (ZIO_CHECKSUM_EQUAL(bp->blk_cksum, bp_orig->blk_cksum)) {
3245 		ASSERT(zio_checksum_table[zp->zp_checksum].ci_flags &
3246 		    ZCHECKSUM_FLAG_NOPWRITE);
3247 		ASSERT3U(BP_GET_PSIZE(bp), ==, BP_GET_PSIZE(bp_orig));
3248 		ASSERT3U(BP_GET_LSIZE(bp), ==, BP_GET_LSIZE(bp_orig));
3249 		ASSERT(zp->zp_compress != ZIO_COMPRESS_OFF);
3250 		ASSERT3U(bp->blk_prop, ==, bp_orig->blk_prop);
3251 
3252 		/*
3253 		 * If we're overwriting a block that is currently on an
3254 		 * indirect vdev, then ignore the nopwrite request and
3255 		 * allow a new block to be allocated on a concrete vdev.
3256 		 */
3257 		spa_config_enter(zio->io_spa, SCL_VDEV, FTAG, RW_READER);
3258 		for (int d = 0; d < BP_GET_NDVAS(bp_orig); d++) {
3259 			vdev_t *tvd = vdev_lookup_top(zio->io_spa,
3260 			    DVA_GET_VDEV(&bp_orig->blk_dva[d]));
3261 			if (tvd->vdev_ops == &vdev_indirect_ops) {
3262 				spa_config_exit(zio->io_spa, SCL_VDEV, FTAG);
3263 				return (zio);
3264 			}
3265 		}
3266 		spa_config_exit(zio->io_spa, SCL_VDEV, FTAG);
3267 
3268 		*bp = *bp_orig;
3269 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
3270 		zio->io_flags |= ZIO_FLAG_NOPWRITE;
3271 	}
3272 
3273 	return (zio);
3274 }
3275 
3276 /*
3277  * ==========================================================================
3278  * Block Reference Table
3279  * ==========================================================================
3280  */
3281 static zio_t *
3282 zio_brt_free(zio_t *zio)
3283 {
3284 	blkptr_t *bp;
3285 
3286 	bp = zio->io_bp;
3287 
3288 	if (BP_GET_LEVEL(bp) > 0 ||
3289 	    BP_IS_METADATA(bp) ||
3290 	    !brt_maybe_exists(zio->io_spa, bp)) {
3291 		return (zio);
3292 	}
3293 
3294 	if (!brt_entry_decref(zio->io_spa, bp)) {
3295 		/*
3296 		 * This isn't the last reference, so we cannot free
3297 		 * the data yet.
3298 		 */
3299 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
3300 	}
3301 
3302 	return (zio);
3303 }
3304 
3305 /*
3306  * ==========================================================================
3307  * Dedup
3308  * ==========================================================================
3309  */
3310 static void
3311 zio_ddt_child_read_done(zio_t *zio)
3312 {
3313 	blkptr_t *bp = zio->io_bp;
3314 	ddt_t *ddt;
3315 	ddt_entry_t *dde = zio->io_private;
3316 	zio_t *pio = zio_unique_parent(zio);
3317 
3318 	mutex_enter(&pio->io_lock);
3319 	ddt = ddt_select(zio->io_spa, bp);
3320 
3321 	if (zio->io_error == 0) {
3322 		ddt_phys_variant_t v = ddt_phys_select(ddt, dde, bp);
3323 		/* this phys variant doesn't need repair */
3324 		ddt_phys_clear(dde->dde_phys, v);
3325 	}
3326 
3327 	if (zio->io_error == 0 && dde->dde_io->dde_repair_abd == NULL)
3328 		dde->dde_io->dde_repair_abd = zio->io_abd;
3329 	else
3330 		abd_free(zio->io_abd);
3331 	mutex_exit(&pio->io_lock);
3332 }
3333 
3334 static zio_t *
3335 zio_ddt_read_start(zio_t *zio)
3336 {
3337 	blkptr_t *bp = zio->io_bp;
3338 
3339 	ASSERT(BP_GET_DEDUP(bp));
3340 	ASSERT(BP_GET_PSIZE(bp) == zio->io_size);
3341 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
3342 
3343 	if (zio->io_child_error[ZIO_CHILD_DDT]) {
3344 		ddt_t *ddt = ddt_select(zio->io_spa, bp);
3345 		ddt_entry_t *dde = ddt_repair_start(ddt, bp);
3346 		ddt_phys_variant_t v_self = ddt_phys_select(ddt, dde, bp);
3347 		ddt_univ_phys_t *ddp = dde->dde_phys;
3348 		blkptr_t blk;
3349 
3350 		ASSERT(zio->io_vsd == NULL);
3351 		zio->io_vsd = dde;
3352 
3353 		if (v_self == DDT_PHYS_NONE)
3354 			return (zio);
3355 
3356 		/* issue I/O for the other copies */
3357 		for (int p = 0; p < DDT_NPHYS(ddt); p++) {
3358 			ddt_phys_variant_t v = DDT_PHYS_VARIANT(ddt, p);
3359 
3360 			if (ddt_phys_birth(ddp, v) == 0 || v == v_self)
3361 				continue;
3362 
3363 			ddt_bp_create(ddt->ddt_checksum, &dde->dde_key,
3364 			    ddp, v, &blk);
3365 			zio_nowait(zio_read(zio, zio->io_spa, &blk,
3366 			    abd_alloc_for_io(zio->io_size, B_TRUE),
3367 			    zio->io_size, zio_ddt_child_read_done, dde,
3368 			    zio->io_priority, ZIO_DDT_CHILD_FLAGS(zio) |
3369 			    ZIO_FLAG_DONT_PROPAGATE, &zio->io_bookmark));
3370 		}
3371 		return (zio);
3372 	}
3373 
3374 	zio_nowait(zio_read(zio, zio->io_spa, bp,
3375 	    zio->io_abd, zio->io_size, NULL, NULL, zio->io_priority,
3376 	    ZIO_DDT_CHILD_FLAGS(zio), &zio->io_bookmark));
3377 
3378 	return (zio);
3379 }
3380 
3381 static zio_t *
3382 zio_ddt_read_done(zio_t *zio)
3383 {
3384 	blkptr_t *bp = zio->io_bp;
3385 
3386 	if (zio_wait_for_children(zio, ZIO_CHILD_DDT_BIT, ZIO_WAIT_DONE)) {
3387 		return (NULL);
3388 	}
3389 
3390 	ASSERT(BP_GET_DEDUP(bp));
3391 	ASSERT(BP_GET_PSIZE(bp) == zio->io_size);
3392 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
3393 
3394 	if (zio->io_child_error[ZIO_CHILD_DDT]) {
3395 		ddt_t *ddt = ddt_select(zio->io_spa, bp);
3396 		ddt_entry_t *dde = zio->io_vsd;
3397 		if (ddt == NULL) {
3398 			ASSERT(spa_load_state(zio->io_spa) != SPA_LOAD_NONE);
3399 			return (zio);
3400 		}
3401 		if (dde == NULL) {
3402 			zio->io_stage = ZIO_STAGE_DDT_READ_START >> 1;
3403 			zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_FALSE);
3404 			return (NULL);
3405 		}
3406 		if (dde->dde_io->dde_repair_abd != NULL) {
3407 			abd_copy(zio->io_abd, dde->dde_io->dde_repair_abd,
3408 			    zio->io_size);
3409 			zio->io_child_error[ZIO_CHILD_DDT] = 0;
3410 		}
3411 		ddt_repair_done(ddt, dde);
3412 		zio->io_vsd = NULL;
3413 	}
3414 
3415 	ASSERT(zio->io_vsd == NULL);
3416 
3417 	return (zio);
3418 }
3419 
3420 static boolean_t
3421 zio_ddt_collision(zio_t *zio, ddt_t *ddt, ddt_entry_t *dde)
3422 {
3423 	spa_t *spa = zio->io_spa;
3424 	boolean_t do_raw = !!(zio->io_flags & ZIO_FLAG_RAW);
3425 
3426 	ASSERT(!(zio->io_bp_override && do_raw));
3427 
3428 	/*
3429 	 * Note: we compare the original data, not the transformed data,
3430 	 * because when zio->io_bp is an override bp, we will not have
3431 	 * pushed the I/O transforms.  That's an important optimization
3432 	 * because otherwise we'd compress/encrypt all dmu_sync() data twice.
3433 	 * However, we should never get a raw, override zio so in these
3434 	 * cases we can compare the io_abd directly. This is useful because
3435 	 * it allows us to do dedup verification even if we don't have access
3436 	 * to the original data (for instance, if the encryption keys aren't
3437 	 * loaded).
3438 	 */
3439 
3440 	for (int p = 0; p < DDT_NPHYS(ddt); p++) {
3441 		if (DDT_PHYS_IS_DITTO(ddt, p))
3442 			continue;
3443 
3444 		if (dde->dde_io == NULL)
3445 			continue;
3446 
3447 		zio_t *lio = dde->dde_io->dde_lead_zio[p];
3448 		if (lio == NULL)
3449 			continue;
3450 
3451 		if (do_raw)
3452 			return (lio->io_size != zio->io_size ||
3453 			    abd_cmp(zio->io_abd, lio->io_abd) != 0);
3454 
3455 		return (lio->io_orig_size != zio->io_orig_size ||
3456 		    abd_cmp(zio->io_orig_abd, lio->io_orig_abd) != 0);
3457 	}
3458 
3459 	for (int p = 0; p < DDT_NPHYS(ddt); p++) {
3460 		ddt_phys_variant_t v = DDT_PHYS_VARIANT(ddt, p);
3461 		uint64_t phys_birth = ddt_phys_birth(dde->dde_phys, v);
3462 
3463 		if (phys_birth != 0 && do_raw) {
3464 			blkptr_t blk = *zio->io_bp;
3465 			uint64_t psize;
3466 			abd_t *tmpabd;
3467 			int error;
3468 
3469 			ddt_bp_fill(dde->dde_phys, v, &blk, phys_birth);
3470 			psize = BP_GET_PSIZE(&blk);
3471 
3472 			if (psize != zio->io_size)
3473 				return (B_TRUE);
3474 
3475 			ddt_exit(ddt);
3476 
3477 			tmpabd = abd_alloc_for_io(psize, B_TRUE);
3478 
3479 			error = zio_wait(zio_read(NULL, spa, &blk, tmpabd,
3480 			    psize, NULL, NULL, ZIO_PRIORITY_SYNC_READ,
3481 			    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE |
3482 			    ZIO_FLAG_RAW, &zio->io_bookmark));
3483 
3484 			if (error == 0) {
3485 				if (abd_cmp(tmpabd, zio->io_abd) != 0)
3486 					error = SET_ERROR(ENOENT);
3487 			}
3488 
3489 			abd_free(tmpabd);
3490 			ddt_enter(ddt);
3491 			return (error != 0);
3492 		} else if (phys_birth != 0) {
3493 			arc_buf_t *abuf = NULL;
3494 			arc_flags_t aflags = ARC_FLAG_WAIT;
3495 			blkptr_t blk = *zio->io_bp;
3496 			int error;
3497 
3498 			ddt_bp_fill(dde->dde_phys, v, &blk, phys_birth);
3499 
3500 			if (BP_GET_LSIZE(&blk) != zio->io_orig_size)
3501 				return (B_TRUE);
3502 
3503 			ddt_exit(ddt);
3504 
3505 			error = arc_read(NULL, spa, &blk,
3506 			    arc_getbuf_func, &abuf, ZIO_PRIORITY_SYNC_READ,
3507 			    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
3508 			    &aflags, &zio->io_bookmark);
3509 
3510 			if (error == 0) {
3511 				if (abd_cmp_buf(zio->io_orig_abd, abuf->b_data,
3512 				    zio->io_orig_size) != 0)
3513 					error = SET_ERROR(ENOENT);
3514 				arc_buf_destroy(abuf, &abuf);
3515 			}
3516 
3517 			ddt_enter(ddt);
3518 			return (error != 0);
3519 		}
3520 	}
3521 
3522 	return (B_FALSE);
3523 }
3524 
3525 static void
3526 zio_ddt_child_write_done(zio_t *zio)
3527 {
3528 	ddt_t *ddt = ddt_select(zio->io_spa, zio->io_bp);
3529 	ddt_entry_t *dde = zio->io_private;
3530 
3531 	zio_link_t *zl = NULL;
3532 	ASSERT3P(zio_walk_parents(zio, &zl), !=, NULL);
3533 
3534 	int p = DDT_PHYS_FOR_COPIES(ddt, zio->io_prop.zp_copies);
3535 	ddt_phys_variant_t v = DDT_PHYS_VARIANT(ddt, p);
3536 	ddt_univ_phys_t *ddp = dde->dde_phys;
3537 
3538 	ddt_enter(ddt);
3539 
3540 	/* we're the lead, so once we're done there's no one else outstanding */
3541 	if (dde->dde_io->dde_lead_zio[p] == zio)
3542 		dde->dde_io->dde_lead_zio[p] = NULL;
3543 
3544 	ddt_univ_phys_t *orig = &dde->dde_io->dde_orig_phys;
3545 
3546 	if (zio->io_error != 0) {
3547 		/*
3548 		 * The write failed, so we're about to abort the entire IO
3549 		 * chain. We need to revert the entry back to what it was at
3550 		 * the last time it was successfully extended.
3551 		 */
3552 		ddt_phys_copy(ddp, orig, v);
3553 		ddt_phys_clear(orig, v);
3554 
3555 		ddt_exit(ddt);
3556 		return;
3557 	}
3558 
3559 	/*
3560 	 * We've successfully added new DVAs to the entry. Clear the saved
3561 	 * state or, if there's still outstanding IO, remember it so we can
3562 	 * revert to a known good state if that IO fails.
3563 	 */
3564 	if (dde->dde_io->dde_lead_zio[p] == NULL)
3565 		ddt_phys_clear(orig, v);
3566 	else
3567 		ddt_phys_copy(orig, ddp, v);
3568 
3569 	/*
3570 	 * Add references for all dedup writes that were waiting on the
3571 	 * physical one, skipping any other physical writes that are waiting.
3572 	 */
3573 	zio_t *pio;
3574 	zl = NULL;
3575 	while ((pio = zio_walk_parents(zio, &zl)) != NULL) {
3576 		if (!(pio->io_flags & ZIO_FLAG_DDT_CHILD))
3577 			ddt_phys_addref(ddp, v);
3578 	}
3579 
3580 	ddt_exit(ddt);
3581 }
3582 
3583 static void
3584 zio_ddt_child_write_ready(zio_t *zio)
3585 {
3586 	ddt_t *ddt = ddt_select(zio->io_spa, zio->io_bp);
3587 	ddt_entry_t *dde = zio->io_private;
3588 
3589 	zio_link_t *zl = NULL;
3590 	ASSERT3P(zio_walk_parents(zio, &zl), !=, NULL);
3591 
3592 	int p = DDT_PHYS_FOR_COPIES(ddt, zio->io_prop.zp_copies);
3593 	ddt_phys_variant_t v = DDT_PHYS_VARIANT(ddt, p);
3594 
3595 	if (zio->io_error != 0)
3596 		return;
3597 
3598 	ddt_enter(ddt);
3599 
3600 	ddt_phys_extend(dde->dde_phys, v, zio->io_bp);
3601 
3602 	zio_t *pio;
3603 	zl = NULL;
3604 	while ((pio = zio_walk_parents(zio, &zl)) != NULL) {
3605 		if (!(pio->io_flags & ZIO_FLAG_DDT_CHILD))
3606 			ddt_bp_fill(dde->dde_phys, v, pio->io_bp, zio->io_txg);
3607 	}
3608 
3609 	ddt_exit(ddt);
3610 }
3611 
3612 static zio_t *
3613 zio_ddt_write(zio_t *zio)
3614 {
3615 	spa_t *spa = zio->io_spa;
3616 	blkptr_t *bp = zio->io_bp;
3617 	uint64_t txg = zio->io_txg;
3618 	zio_prop_t *zp = &zio->io_prop;
3619 	ddt_t *ddt = ddt_select(spa, bp);
3620 	ddt_entry_t *dde;
3621 
3622 	ASSERT(BP_GET_DEDUP(bp));
3623 	ASSERT(BP_GET_CHECKSUM(bp) == zp->zp_checksum);
3624 	ASSERT(BP_IS_HOLE(bp) || zio->io_bp_override);
3625 	ASSERT(!(zio->io_bp_override && (zio->io_flags & ZIO_FLAG_RAW)));
3626 	/*
3627 	 * Deduplication will not take place for Direct I/O writes. The
3628 	 * ddt_tree will be emptied in syncing context. Direct I/O writes take
3629 	 * place in the open-context. Direct I/O write can not attempt to
3630 	 * modify the ddt_tree while issuing out a write.
3631 	 */
3632 	ASSERT3B(zio->io_prop.zp_direct_write, ==, B_FALSE);
3633 
3634 	ddt_enter(ddt);
3635 	dde = ddt_lookup(ddt, bp);
3636 	if (dde == NULL) {
3637 		/* DDT size is over its quota so no new entries */
3638 		zp->zp_dedup = B_FALSE;
3639 		BP_SET_DEDUP(bp, B_FALSE);
3640 		if (zio->io_bp_override == NULL)
3641 			zio->io_pipeline = ZIO_WRITE_PIPELINE;
3642 		ddt_exit(ddt);
3643 		return (zio);
3644 	}
3645 
3646 	if (zp->zp_dedup_verify && zio_ddt_collision(zio, ddt, dde)) {
3647 		/*
3648 		 * If we're using a weak checksum, upgrade to a strong checksum
3649 		 * and try again.  If we're already using a strong checksum,
3650 		 * we can't resolve it, so just convert to an ordinary write.
3651 		 * (And automatically e-mail a paper to Nature?)
3652 		 */
3653 		if (!(zio_checksum_table[zp->zp_checksum].ci_flags &
3654 		    ZCHECKSUM_FLAG_DEDUP)) {
3655 			zp->zp_checksum = spa_dedup_checksum(spa);
3656 			zio_pop_transforms(zio);
3657 			zio->io_stage = ZIO_STAGE_OPEN;
3658 			BP_ZERO(bp);
3659 		} else {
3660 			zp->zp_dedup = B_FALSE;
3661 			BP_SET_DEDUP(bp, B_FALSE);
3662 		}
3663 		ASSERT(!BP_GET_DEDUP(bp));
3664 		zio->io_pipeline = ZIO_WRITE_PIPELINE;
3665 		ddt_exit(ddt);
3666 		return (zio);
3667 	}
3668 
3669 	int p = DDT_PHYS_FOR_COPIES(ddt, zp->zp_copies);
3670 	ddt_phys_variant_t v = DDT_PHYS_VARIANT(ddt, p);
3671 	ddt_univ_phys_t *ddp = dde->dde_phys;
3672 
3673 	/*
3674 	 * In the common cases, at this point we have a regular BP with no
3675 	 * allocated DVAs, and the corresponding DDT entry for its checksum.
3676 	 * Our goal is to fill the BP with enough DVAs to satisfy its copies=
3677 	 * requirement.
3678 	 *
3679 	 * One of three things needs to happen to fulfill this:
3680 	 *
3681 	 * - if the DDT entry has enough DVAs to satisfy the BP, we just copy
3682 	 *   them out of the entry and return;
3683 	 *
3684 	 * - if the DDT entry has no DVAs (ie its brand new), then we have to
3685 	 *   issue the write as normal so that DVAs can be allocated and the
3686 	 *   data land on disk. We then copy the DVAs into the DDT entry on
3687 	 *   return.
3688 	 *
3689 	 * - if the DDT entry has some DVAs, but too few, we have to issue the
3690 	 *   write, adjusted to have allocate fewer copies. When it returns, we
3691 	 *   add the new DVAs to the DDT entry, and update the BP to have the
3692 	 *   full amount it originally requested.
3693 	 *
3694 	 * In all cases, if there's already a writing IO in flight, we need to
3695 	 * defer the action until after the write is done. If our action is to
3696 	 * write, we need to adjust our request for additional DVAs to match
3697 	 * what will be in the DDT entry after it completes. In this way every
3698 	 * IO can be guaranteed to recieve enough DVAs simply by joining the
3699 	 * end of the chain and letting the sequence play out.
3700 	 */
3701 
3702 	/*
3703 	 * Number of DVAs in the DDT entry. If the BP is encrypted we ignore
3704 	 * the third one as normal.
3705 	 */
3706 	int have_dvas = ddt_phys_dva_count(ddp, v, BP_IS_ENCRYPTED(bp));
3707 	IMPLY(have_dvas == 0, ddt_phys_birth(ddp, v) == 0);
3708 
3709 	/* Number of DVAs requested bya the IO. */
3710 	uint8_t need_dvas = zp->zp_copies;
3711 
3712 	/*
3713 	 * What we do next depends on whether or not there's IO outstanding that
3714 	 * will update this entry.
3715 	 */
3716 	if (dde->dde_io == NULL || dde->dde_io->dde_lead_zio[p] == NULL) {
3717 		/*
3718 		 * No IO outstanding, so we only need to worry about ourselves.
3719 		 */
3720 
3721 		/*
3722 		 * Override BPs bring their own DVAs and their own problems.
3723 		 */
3724 		if (zio->io_bp_override) {
3725 			/*
3726 			 * For a brand-new entry, all the work has been done
3727 			 * for us, and we can just fill it out from the provided
3728 			 * block and leave.
3729 			 */
3730 			if (have_dvas == 0) {
3731 				ASSERT(BP_GET_LOGICAL_BIRTH(bp) == txg);
3732 				ASSERT(BP_EQUAL(bp, zio->io_bp_override));
3733 				ddt_phys_extend(ddp, v, bp);
3734 				ddt_phys_addref(ddp, v);
3735 				ddt_exit(ddt);
3736 				return (zio);
3737 			}
3738 
3739 			/*
3740 			 * If we already have this entry, then we want to treat
3741 			 * it like a regular write. To do this we just wipe
3742 			 * them out and proceed like a regular write.
3743 			 *
3744 			 * Even if there are some DVAs in the entry, we still
3745 			 * have to clear them out. We can't use them to fill
3746 			 * out the dedup entry, as they are all referenced
3747 			 * together by a bp already on disk, and will be freed
3748 			 * as a group.
3749 			 */
3750 			BP_ZERO_DVAS(bp);
3751 			BP_SET_BIRTH(bp, 0, 0);
3752 		}
3753 
3754 		/*
3755 		 * If there are enough DVAs in the entry to service our request,
3756 		 * then we can just use them as-is.
3757 		 */
3758 		if (have_dvas >= need_dvas) {
3759 			ddt_bp_fill(ddp, v, bp, txg);
3760 			ddt_phys_addref(ddp, v);
3761 			ddt_exit(ddt);
3762 			return (zio);
3763 		}
3764 
3765 		/*
3766 		 * Otherwise, we have to issue IO to fill the entry up to the
3767 		 * amount we need.
3768 		 */
3769 		need_dvas -= have_dvas;
3770 	} else {
3771 		/*
3772 		 * There's a write in-flight. If there's already enough DVAs on
3773 		 * the entry, then either there were already enough to start
3774 		 * with, or the in-flight IO is between READY and DONE, and so
3775 		 * has extended the entry with new DVAs. Either way, we don't
3776 		 * need to do anything, we can just slot in behind it.
3777 		 */
3778 
3779 		if (zio->io_bp_override) {
3780 			/*
3781 			 * If there's a write out, then we're soon going to
3782 			 * have our own copies of this block, so clear out the
3783 			 * override block and treat it as a regular dedup
3784 			 * write. See comment above.
3785 			 */
3786 			BP_ZERO_DVAS(bp);
3787 			BP_SET_BIRTH(bp, 0, 0);
3788 		}
3789 
3790 		if (have_dvas >= need_dvas) {
3791 			/*
3792 			 * A minor point: there might already be enough
3793 			 * committed DVAs in the entry to service our request,
3794 			 * but we don't know which are completed and which are
3795 			 * allocated but not yet written. In this case, should
3796 			 * the IO for the new DVAs fail, we will be on the end
3797 			 * of the IO chain and will also recieve an error, even
3798 			 * though our request could have been serviced.
3799 			 *
3800 			 * This is an extremely rare case, as it requires the
3801 			 * original block to be copied with a request for a
3802 			 * larger number of DVAs, then copied again requesting
3803 			 * the same (or already fulfilled) number of DVAs while
3804 			 * the first request is active, and then that first
3805 			 * request errors. In return, the logic required to
3806 			 * catch and handle it is complex. For now, I'm just
3807 			 * not going to bother with it.
3808 			 */
3809 
3810 			/*
3811 			 * We always fill the bp here as we may have arrived
3812 			 * after the in-flight write has passed READY, and so
3813 			 * missed out.
3814 			 */
3815 			ddt_bp_fill(ddp, v, bp, txg);
3816 			zio_add_child(zio, dde->dde_io->dde_lead_zio[p]);
3817 			ddt_exit(ddt);
3818 			return (zio);
3819 		}
3820 
3821 		/*
3822 		 * There's not enough in the entry yet, so we need to look at
3823 		 * the write in-flight and see how many DVAs it will have once
3824 		 * it completes.
3825 		 *
3826 		 * The in-flight write has potentially had its copies request
3827 		 * reduced (if we're filling out an existing entry), so we need
3828 		 * to reach in and get the original write to find out what it is
3829 		 * expecting.
3830 		 *
3831 		 * Note that the parent of the lead zio will always have the
3832 		 * highest zp_copies of any zio in the chain, because ones that
3833 		 * can be serviced without additional IO are always added to
3834 		 * the back of the chain.
3835 		 */
3836 		zio_link_t *zl = NULL;
3837 		zio_t *pio =
3838 		    zio_walk_parents(dde->dde_io->dde_lead_zio[p], &zl);
3839 		ASSERT(pio);
3840 		uint8_t parent_dvas = pio->io_prop.zp_copies;
3841 
3842 		if (parent_dvas >= need_dvas) {
3843 			zio_add_child(zio, dde->dde_io->dde_lead_zio[p]);
3844 			ddt_exit(ddt);
3845 			return (zio);
3846 		}
3847 
3848 		/*
3849 		 * Still not enough, so we will need to issue to get the
3850 		 * shortfall.
3851 		 */
3852 		need_dvas -= parent_dvas;
3853 	}
3854 
3855 	/*
3856 	 * We need to write. We will create a new write with the copies
3857 	 * property adjusted to match the number of DVAs we need to need to
3858 	 * grow the DDT entry by to satisfy the request.
3859 	 */
3860 	zio_prop_t czp = *zp;
3861 	czp.zp_copies = need_dvas;
3862 	zio_t *cio = zio_write(zio, spa, txg, bp, zio->io_orig_abd,
3863 	    zio->io_orig_size, zio->io_orig_size, &czp,
3864 	    zio_ddt_child_write_ready, NULL,
3865 	    zio_ddt_child_write_done, dde, zio->io_priority,
3866 	    ZIO_DDT_CHILD_FLAGS(zio), &zio->io_bookmark);
3867 
3868 	zio_push_transform(cio, zio->io_abd, zio->io_size, 0, NULL);
3869 
3870 	/*
3871 	 * We are the new lead zio, because our parent has the highest
3872 	 * zp_copies that has been requested for this entry so far.
3873 	 */
3874 	ddt_alloc_entry_io(dde);
3875 	if (dde->dde_io->dde_lead_zio[p] == NULL) {
3876 		/*
3877 		 * First time out, take a copy of the stable entry to revert
3878 		 * to if there's an error (see zio_ddt_child_write_done())
3879 		 */
3880 		ddt_phys_copy(&dde->dde_io->dde_orig_phys, dde->dde_phys, v);
3881 	} else {
3882 		/*
3883 		 * Make the existing chain our child, because it cannot
3884 		 * complete until we have.
3885 		 */
3886 		zio_add_child(cio, dde->dde_io->dde_lead_zio[p]);
3887 	}
3888 	dde->dde_io->dde_lead_zio[p] = cio;
3889 
3890 	ddt_exit(ddt);
3891 
3892 	zio_nowait(cio);
3893 
3894 	return (zio);
3895 }
3896 
3897 static ddt_entry_t *freedde; /* for debugging */
3898 
3899 static zio_t *
3900 zio_ddt_free(zio_t *zio)
3901 {
3902 	spa_t *spa = zio->io_spa;
3903 	blkptr_t *bp = zio->io_bp;
3904 	ddt_t *ddt = ddt_select(spa, bp);
3905 	ddt_entry_t *dde = NULL;
3906 
3907 	ASSERT(BP_GET_DEDUP(bp));
3908 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
3909 
3910 	ddt_enter(ddt);
3911 	freedde = dde = ddt_lookup(ddt, bp);
3912 	if (dde) {
3913 		ddt_phys_variant_t v = ddt_phys_select(ddt, dde, bp);
3914 		if (v != DDT_PHYS_NONE)
3915 			ddt_phys_decref(dde->dde_phys, v);
3916 	}
3917 	ddt_exit(ddt);
3918 
3919 	/*
3920 	 * When no entry was found, it must have been pruned,
3921 	 * so we can free it now instead of decrementing the
3922 	 * refcount in the DDT.
3923 	 */
3924 	if (!dde) {
3925 		BP_SET_DEDUP(bp, 0);
3926 		zio->io_pipeline |= ZIO_STAGE_DVA_FREE;
3927 	}
3928 
3929 	return (zio);
3930 }
3931 
3932 /*
3933  * ==========================================================================
3934  * Allocate and free blocks
3935  * ==========================================================================
3936  */
3937 
3938 static zio_t *
3939 zio_io_to_allocate(spa_t *spa, int allocator)
3940 {
3941 	zio_t *zio;
3942 
3943 	ASSERT(MUTEX_HELD(&spa->spa_allocs[allocator].spaa_lock));
3944 
3945 	zio = avl_first(&spa->spa_allocs[allocator].spaa_tree);
3946 	if (zio == NULL)
3947 		return (NULL);
3948 
3949 	ASSERT(IO_IS_ALLOCATING(zio));
3950 	ASSERT(ZIO_HAS_ALLOCATOR(zio));
3951 
3952 	/*
3953 	 * Try to place a reservation for this zio. If we're unable to
3954 	 * reserve then we throttle.
3955 	 */
3956 	ASSERT3U(zio->io_allocator, ==, allocator);
3957 	if (!metaslab_class_throttle_reserve(zio->io_metaslab_class,
3958 	    zio->io_prop.zp_copies, allocator, zio, 0)) {
3959 		return (NULL);
3960 	}
3961 
3962 	avl_remove(&spa->spa_allocs[allocator].spaa_tree, zio);
3963 	ASSERT3U(zio->io_stage, <, ZIO_STAGE_DVA_ALLOCATE);
3964 
3965 	return (zio);
3966 }
3967 
3968 static zio_t *
3969 zio_dva_throttle(zio_t *zio)
3970 {
3971 	spa_t *spa = zio->io_spa;
3972 	zio_t *nio;
3973 	metaslab_class_t *mc;
3974 
3975 	/* locate an appropriate allocation class */
3976 	mc = spa_preferred_class(spa, zio);
3977 
3978 	if (zio->io_priority == ZIO_PRIORITY_SYNC_WRITE ||
3979 	    !mc->mc_alloc_throttle_enabled ||
3980 	    zio->io_child_type == ZIO_CHILD_GANG ||
3981 	    zio->io_flags & ZIO_FLAG_NODATA) {
3982 		return (zio);
3983 	}
3984 
3985 	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
3986 	ASSERT(ZIO_HAS_ALLOCATOR(zio));
3987 	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
3988 	ASSERT3U(zio->io_queued_timestamp, >, 0);
3989 	ASSERT(zio->io_stage == ZIO_STAGE_DVA_THROTTLE);
3990 
3991 	int allocator = zio->io_allocator;
3992 	zio->io_metaslab_class = mc;
3993 	mutex_enter(&spa->spa_allocs[allocator].spaa_lock);
3994 	avl_add(&spa->spa_allocs[allocator].spaa_tree, zio);
3995 	nio = zio_io_to_allocate(spa, allocator);
3996 	mutex_exit(&spa->spa_allocs[allocator].spaa_lock);
3997 	return (nio);
3998 }
3999 
4000 static void
4001 zio_allocate_dispatch(spa_t *spa, int allocator)
4002 {
4003 	zio_t *zio;
4004 
4005 	mutex_enter(&spa->spa_allocs[allocator].spaa_lock);
4006 	zio = zio_io_to_allocate(spa, allocator);
4007 	mutex_exit(&spa->spa_allocs[allocator].spaa_lock);
4008 	if (zio == NULL)
4009 		return;
4010 
4011 	ASSERT3U(zio->io_stage, ==, ZIO_STAGE_DVA_THROTTLE);
4012 	ASSERT0(zio->io_error);
4013 	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_TRUE);
4014 }
4015 
4016 static zio_t *
4017 zio_dva_allocate(zio_t *zio)
4018 {
4019 	spa_t *spa = zio->io_spa;
4020 	metaslab_class_t *mc;
4021 	blkptr_t *bp = zio->io_bp;
4022 	int error;
4023 	int flags = 0;
4024 
4025 	if (zio->io_gang_leader == NULL) {
4026 		ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
4027 		zio->io_gang_leader = zio;
4028 	}
4029 
4030 	ASSERT(BP_IS_HOLE(bp));
4031 	ASSERT0(BP_GET_NDVAS(bp));
4032 	ASSERT3U(zio->io_prop.zp_copies, >, 0);
4033 	ASSERT3U(zio->io_prop.zp_copies, <=, spa_max_replication(spa));
4034 	ASSERT3U(zio->io_size, ==, BP_GET_PSIZE(bp));
4035 
4036 	if (zio->io_flags & ZIO_FLAG_NODATA)
4037 		flags |= METASLAB_DONT_THROTTLE;
4038 	if (zio->io_flags & ZIO_FLAG_GANG_CHILD)
4039 		flags |= METASLAB_GANG_CHILD;
4040 	if (zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE)
4041 		flags |= METASLAB_ASYNC_ALLOC;
4042 
4043 	/*
4044 	 * if not already chosen, locate an appropriate allocation class
4045 	 */
4046 	mc = zio->io_metaslab_class;
4047 	if (mc == NULL) {
4048 		mc = spa_preferred_class(spa, zio);
4049 		zio->io_metaslab_class = mc;
4050 	}
4051 
4052 	/*
4053 	 * Try allocating the block in the usual metaslab class.
4054 	 * If that's full, allocate it in the normal class.
4055 	 * If that's full, allocate as a gang block,
4056 	 * and if all are full, the allocation fails (which shouldn't happen).
4057 	 *
4058 	 * Note that we do not fall back on embedded slog (ZIL) space, to
4059 	 * preserve unfragmented slog space, which is critical for decent
4060 	 * sync write performance.  If a log allocation fails, we will fall
4061 	 * back to spa_sync() which is abysmal for performance.
4062 	 */
4063 	ASSERT(ZIO_HAS_ALLOCATOR(zio));
4064 	error = metaslab_alloc(spa, mc, zio->io_size, bp,
4065 	    zio->io_prop.zp_copies, zio->io_txg, NULL, flags,
4066 	    &zio->io_alloc_list, zio, zio->io_allocator);
4067 
4068 	/*
4069 	 * Fallback to normal class when an alloc class is full
4070 	 */
4071 	if (error == ENOSPC && mc != spa_normal_class(spa)) {
4072 		/*
4073 		 * When the dedup or special class is spilling into the  normal
4074 		 * class, there can still be significant space available due
4075 		 * to deferred frees that are in-flight.  We track the txg when
4076 		 * this occurred and back off adding new DDT entries for a few
4077 		 * txgs to allow the free blocks to be processed.
4078 		 */
4079 		if ((mc == spa_dedup_class(spa) || (spa_special_has_ddt(spa) &&
4080 		    mc == spa_special_class(spa))) &&
4081 		    spa->spa_dedup_class_full_txg != zio->io_txg) {
4082 			spa->spa_dedup_class_full_txg = zio->io_txg;
4083 			zfs_dbgmsg("%s[%d]: %s class spilling, req size %d, "
4084 			    "%llu allocated of %llu",
4085 			    spa_name(spa), (int)zio->io_txg,
4086 			    mc == spa_dedup_class(spa) ? "dedup" : "special",
4087 			    (int)zio->io_size,
4088 			    (u_longlong_t)metaslab_class_get_alloc(mc),
4089 			    (u_longlong_t)metaslab_class_get_space(mc));
4090 		}
4091 
4092 		/*
4093 		 * If throttling, transfer reservation over to normal class.
4094 		 * The io_allocator slot can remain the same even though we
4095 		 * are switching classes.
4096 		 */
4097 		if (mc->mc_alloc_throttle_enabled &&
4098 		    (zio->io_flags & ZIO_FLAG_IO_ALLOCATING)) {
4099 			metaslab_class_throttle_unreserve(mc,
4100 			    zio->io_prop.zp_copies, zio->io_allocator, zio);
4101 			zio->io_flags &= ~ZIO_FLAG_IO_ALLOCATING;
4102 
4103 			VERIFY(metaslab_class_throttle_reserve(
4104 			    spa_normal_class(spa),
4105 			    zio->io_prop.zp_copies, zio->io_allocator, zio,
4106 			    flags | METASLAB_MUST_RESERVE));
4107 		}
4108 		zio->io_metaslab_class = mc = spa_normal_class(spa);
4109 		if (zfs_flags & ZFS_DEBUG_METASLAB_ALLOC) {
4110 			zfs_dbgmsg("%s: metaslab allocation failure, "
4111 			    "trying normal class: zio %px, size %llu, error %d",
4112 			    spa_name(spa), zio, (u_longlong_t)zio->io_size,
4113 			    error);
4114 		}
4115 
4116 		error = metaslab_alloc(spa, mc, zio->io_size, bp,
4117 		    zio->io_prop.zp_copies, zio->io_txg, NULL, flags,
4118 		    &zio->io_alloc_list, zio, zio->io_allocator);
4119 	}
4120 
4121 	if (error == ENOSPC && zio->io_size > SPA_MINBLOCKSIZE) {
4122 		if (zfs_flags & ZFS_DEBUG_METASLAB_ALLOC) {
4123 			zfs_dbgmsg("%s: metaslab allocation failure, "
4124 			    "trying ganging: zio %px, size %llu, error %d",
4125 			    spa_name(spa), zio, (u_longlong_t)zio->io_size,
4126 			    error);
4127 		}
4128 		return (zio_write_gang_block(zio, mc));
4129 	}
4130 	if (error != 0) {
4131 		if (error != ENOSPC ||
4132 		    (zfs_flags & ZFS_DEBUG_METASLAB_ALLOC)) {
4133 			zfs_dbgmsg("%s: metaslab allocation failure: zio %px, "
4134 			    "size %llu, error %d",
4135 			    spa_name(spa), zio, (u_longlong_t)zio->io_size,
4136 			    error);
4137 		}
4138 		zio->io_error = error;
4139 	}
4140 
4141 	return (zio);
4142 }
4143 
4144 static zio_t *
4145 zio_dva_free(zio_t *zio)
4146 {
4147 	metaslab_free(zio->io_spa, zio->io_bp, zio->io_txg, B_FALSE);
4148 
4149 	return (zio);
4150 }
4151 
4152 static zio_t *
4153 zio_dva_claim(zio_t *zio)
4154 {
4155 	int error;
4156 
4157 	error = metaslab_claim(zio->io_spa, zio->io_bp, zio->io_txg);
4158 	if (error)
4159 		zio->io_error = error;
4160 
4161 	return (zio);
4162 }
4163 
4164 /*
4165  * Undo an allocation.  This is used by zio_done() when an I/O fails
4166  * and we want to give back the block we just allocated.
4167  * This handles both normal blocks and gang blocks.
4168  */
4169 static void
4170 zio_dva_unallocate(zio_t *zio, zio_gang_node_t *gn, blkptr_t *bp)
4171 {
4172 	ASSERT(BP_GET_LOGICAL_BIRTH(bp) == zio->io_txg || BP_IS_HOLE(bp));
4173 	ASSERT(zio->io_bp_override == NULL);
4174 
4175 	if (!BP_IS_HOLE(bp)) {
4176 		metaslab_free(zio->io_spa, bp, BP_GET_LOGICAL_BIRTH(bp),
4177 		    B_TRUE);
4178 	}
4179 
4180 	if (gn != NULL) {
4181 		for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
4182 			zio_dva_unallocate(zio, gn->gn_child[g],
4183 			    &gn->gn_gbh->zg_blkptr[g]);
4184 		}
4185 	}
4186 }
4187 
4188 /*
4189  * Try to allocate an intent log block.  Return 0 on success, errno on failure.
4190  */
4191 int
4192 zio_alloc_zil(spa_t *spa, objset_t *os, uint64_t txg, blkptr_t *new_bp,
4193     uint64_t size, boolean_t *slog)
4194 {
4195 	int error = 1;
4196 	zio_alloc_list_t io_alloc_list;
4197 
4198 	ASSERT(txg > spa_syncing_txg(spa));
4199 
4200 	metaslab_trace_init(&io_alloc_list);
4201 
4202 	/*
4203 	 * Block pointer fields are useful to metaslabs for stats and debugging.
4204 	 * Fill in the obvious ones before calling into metaslab_alloc().
4205 	 */
4206 	BP_SET_TYPE(new_bp, DMU_OT_INTENT_LOG);
4207 	BP_SET_PSIZE(new_bp, size);
4208 	BP_SET_LEVEL(new_bp, 0);
4209 
4210 	/*
4211 	 * When allocating a zil block, we don't have information about
4212 	 * the final destination of the block except the objset it's part
4213 	 * of, so we just hash the objset ID to pick the allocator to get
4214 	 * some parallelism.
4215 	 */
4216 	int flags = METASLAB_ZIL;
4217 	int allocator = (uint_t)cityhash1(os->os_dsl_dataset->ds_object)
4218 	    % spa->spa_alloc_count;
4219 	error = metaslab_alloc(spa, spa_log_class(spa), size, new_bp, 1,
4220 	    txg, NULL, flags, &io_alloc_list, NULL, allocator);
4221 	*slog = (error == 0);
4222 	if (error != 0) {
4223 		error = metaslab_alloc(spa, spa_embedded_log_class(spa), size,
4224 		    new_bp, 1, txg, NULL, flags,
4225 		    &io_alloc_list, NULL, allocator);
4226 	}
4227 	if (error != 0) {
4228 		error = metaslab_alloc(spa, spa_normal_class(spa), size,
4229 		    new_bp, 1, txg, NULL, flags,
4230 		    &io_alloc_list, NULL, allocator);
4231 	}
4232 	metaslab_trace_fini(&io_alloc_list);
4233 
4234 	if (error == 0) {
4235 		BP_SET_LSIZE(new_bp, size);
4236 		BP_SET_PSIZE(new_bp, size);
4237 		BP_SET_COMPRESS(new_bp, ZIO_COMPRESS_OFF);
4238 		BP_SET_CHECKSUM(new_bp,
4239 		    spa_version(spa) >= SPA_VERSION_SLIM_ZIL
4240 		    ? ZIO_CHECKSUM_ZILOG2 : ZIO_CHECKSUM_ZILOG);
4241 		BP_SET_TYPE(new_bp, DMU_OT_INTENT_LOG);
4242 		BP_SET_LEVEL(new_bp, 0);
4243 		BP_SET_DEDUP(new_bp, 0);
4244 		BP_SET_BYTEORDER(new_bp, ZFS_HOST_BYTEORDER);
4245 
4246 		/*
4247 		 * encrypted blocks will require an IV and salt. We generate
4248 		 * these now since we will not be rewriting the bp at
4249 		 * rewrite time.
4250 		 */
4251 		if (os->os_encrypted) {
4252 			uint8_t iv[ZIO_DATA_IV_LEN];
4253 			uint8_t salt[ZIO_DATA_SALT_LEN];
4254 
4255 			BP_SET_CRYPT(new_bp, B_TRUE);
4256 			VERIFY0(spa_crypt_get_salt(spa,
4257 			    dmu_objset_id(os), salt));
4258 			VERIFY0(zio_crypt_generate_iv(iv));
4259 
4260 			zio_crypt_encode_params_bp(new_bp, salt, iv);
4261 		}
4262 	} else {
4263 		zfs_dbgmsg("%s: zil block allocation failure: "
4264 		    "size %llu, error %d", spa_name(spa), (u_longlong_t)size,
4265 		    error);
4266 	}
4267 
4268 	return (error);
4269 }
4270 
4271 /*
4272  * ==========================================================================
4273  * Read and write to physical devices
4274  * ==========================================================================
4275  */
4276 
4277 /*
4278  * Issue an I/O to the underlying vdev. Typically the issue pipeline
4279  * stops after this stage and will resume upon I/O completion.
4280  * However, there are instances where the vdev layer may need to
4281  * continue the pipeline when an I/O was not issued. Since the I/O
4282  * that was sent to the vdev layer might be different than the one
4283  * currently active in the pipeline (see vdev_queue_io()), we explicitly
4284  * force the underlying vdev layers to call either zio_execute() or
4285  * zio_interrupt() to ensure that the pipeline continues with the correct I/O.
4286  */
4287 static zio_t *
4288 zio_vdev_io_start(zio_t *zio)
4289 {
4290 	vdev_t *vd = zio->io_vd;
4291 	uint64_t align;
4292 	spa_t *spa = zio->io_spa;
4293 
4294 	zio->io_delay = 0;
4295 
4296 	ASSERT(zio->io_error == 0);
4297 	ASSERT(zio->io_child_error[ZIO_CHILD_VDEV] == 0);
4298 
4299 	if (vd == NULL) {
4300 		if (!(zio->io_flags & ZIO_FLAG_CONFIG_WRITER))
4301 			spa_config_enter(spa, SCL_ZIO, zio, RW_READER);
4302 
4303 		/*
4304 		 * The mirror_ops handle multiple DVAs in a single BP.
4305 		 */
4306 		vdev_mirror_ops.vdev_op_io_start(zio);
4307 		return (NULL);
4308 	}
4309 
4310 	ASSERT3P(zio->io_logical, !=, zio);
4311 	if (zio->io_type == ZIO_TYPE_WRITE) {
4312 		ASSERT(spa->spa_trust_config);
4313 
4314 		/*
4315 		 * Note: the code can handle other kinds of writes,
4316 		 * but we don't expect them.
4317 		 */
4318 		if (zio->io_vd->vdev_noalloc) {
4319 			ASSERT(zio->io_flags &
4320 			    (ZIO_FLAG_PHYSICAL | ZIO_FLAG_SELF_HEAL |
4321 			    ZIO_FLAG_RESILVER | ZIO_FLAG_INDUCE_DAMAGE));
4322 		}
4323 	}
4324 
4325 	align = 1ULL << vd->vdev_top->vdev_ashift;
4326 
4327 	if (!(zio->io_flags & ZIO_FLAG_PHYSICAL) &&
4328 	    P2PHASE(zio->io_size, align) != 0) {
4329 		/* Transform logical writes to be a full physical block size. */
4330 		uint64_t asize = P2ROUNDUP(zio->io_size, align);
4331 		abd_t *abuf = abd_alloc_sametype(zio->io_abd, asize);
4332 		ASSERT(vd == vd->vdev_top);
4333 		if (zio->io_type == ZIO_TYPE_WRITE) {
4334 			abd_copy(abuf, zio->io_abd, zio->io_size);
4335 			abd_zero_off(abuf, zio->io_size, asize - zio->io_size);
4336 		}
4337 		zio_push_transform(zio, abuf, asize, asize, zio_subblock);
4338 	}
4339 
4340 	/*
4341 	 * If this is not a physical io, make sure that it is properly aligned
4342 	 * before proceeding.
4343 	 */
4344 	if (!(zio->io_flags & ZIO_FLAG_PHYSICAL)) {
4345 		ASSERT0(P2PHASE(zio->io_offset, align));
4346 		ASSERT0(P2PHASE(zio->io_size, align));
4347 	} else {
4348 		/*
4349 		 * For physical writes, we allow 512b aligned writes and assume
4350 		 * the device will perform a read-modify-write as necessary.
4351 		 */
4352 		ASSERT0(P2PHASE(zio->io_offset, SPA_MINBLOCKSIZE));
4353 		ASSERT0(P2PHASE(zio->io_size, SPA_MINBLOCKSIZE));
4354 	}
4355 
4356 	VERIFY(zio->io_type != ZIO_TYPE_WRITE || spa_writeable(spa));
4357 
4358 	/*
4359 	 * If this is a repair I/O, and there's no self-healing involved --
4360 	 * that is, we're just resilvering what we expect to resilver --
4361 	 * then don't do the I/O unless zio's txg is actually in vd's DTL.
4362 	 * This prevents spurious resilvering.
4363 	 *
4364 	 * There are a few ways that we can end up creating these spurious
4365 	 * resilver i/os:
4366 	 *
4367 	 * 1. A resilver i/o will be issued if any DVA in the BP has a
4368 	 * dirty DTL.  The mirror code will issue resilver writes to
4369 	 * each DVA, including the one(s) that are not on vdevs with dirty
4370 	 * DTLs.
4371 	 *
4372 	 * 2. With nested replication, which happens when we have a
4373 	 * "replacing" or "spare" vdev that's a child of a mirror or raidz.
4374 	 * For example, given mirror(replacing(A+B), C), it's likely that
4375 	 * only A is out of date (it's the new device). In this case, we'll
4376 	 * read from C, then use the data to resilver A+B -- but we don't
4377 	 * actually want to resilver B, just A. The top-level mirror has no
4378 	 * way to know this, so instead we just discard unnecessary repairs
4379 	 * as we work our way down the vdev tree.
4380 	 *
4381 	 * 3. ZTEST also creates mirrors of mirrors, mirrors of raidz, etc.
4382 	 * The same logic applies to any form of nested replication: ditto
4383 	 * + mirror, RAID-Z + replacing, etc.
4384 	 *
4385 	 * However, indirect vdevs point off to other vdevs which may have
4386 	 * DTL's, so we never bypass them.  The child i/os on concrete vdevs
4387 	 * will be properly bypassed instead.
4388 	 *
4389 	 * Leaf DTL_PARTIAL can be empty when a legitimate write comes from
4390 	 * a dRAID spare vdev. For example, when a dRAID spare is first
4391 	 * used, its spare blocks need to be written to but the leaf vdev's
4392 	 * of such blocks can have empty DTL_PARTIAL.
4393 	 *
4394 	 * There seemed no clean way to allow such writes while bypassing
4395 	 * spurious ones. At this point, just avoid all bypassing for dRAID
4396 	 * for correctness.
4397 	 */
4398 	if ((zio->io_flags & ZIO_FLAG_IO_REPAIR) &&
4399 	    !(zio->io_flags & ZIO_FLAG_SELF_HEAL) &&
4400 	    zio->io_txg != 0 &&	/* not a delegated i/o */
4401 	    vd->vdev_ops != &vdev_indirect_ops &&
4402 	    vd->vdev_top->vdev_ops != &vdev_draid_ops &&
4403 	    !vdev_dtl_contains(vd, DTL_PARTIAL, zio->io_txg, 1)) {
4404 		ASSERT(zio->io_type == ZIO_TYPE_WRITE);
4405 		zio_vdev_io_bypass(zio);
4406 		return (zio);
4407 	}
4408 
4409 	/*
4410 	 * Select the next best leaf I/O to process.  Distributed spares are
4411 	 * excluded since they dispatch the I/O directly to a leaf vdev after
4412 	 * applying the dRAID mapping.
4413 	 */
4414 	if (vd->vdev_ops->vdev_op_leaf &&
4415 	    vd->vdev_ops != &vdev_draid_spare_ops &&
4416 	    (zio->io_type == ZIO_TYPE_READ ||
4417 	    zio->io_type == ZIO_TYPE_WRITE ||
4418 	    zio->io_type == ZIO_TYPE_TRIM)) {
4419 
4420 		if (zio_handle_device_injection(vd, zio, ENOSYS) != 0) {
4421 			/*
4422 			 * "no-op" injections return success, but do no actual
4423 			 * work. Just skip the remaining vdev stages.
4424 			 */
4425 			zio_vdev_io_bypass(zio);
4426 			zio_interrupt(zio);
4427 			return (NULL);
4428 		}
4429 
4430 		if ((zio = vdev_queue_io(zio)) == NULL)
4431 			return (NULL);
4432 
4433 		if (!vdev_accessible(vd, zio)) {
4434 			zio->io_error = SET_ERROR(ENXIO);
4435 			zio_interrupt(zio);
4436 			return (NULL);
4437 		}
4438 		zio->io_delay = gethrtime();
4439 	}
4440 
4441 	vd->vdev_ops->vdev_op_io_start(zio);
4442 	return (NULL);
4443 }
4444 
4445 static zio_t *
4446 zio_vdev_io_done(zio_t *zio)
4447 {
4448 	vdev_t *vd = zio->io_vd;
4449 	vdev_ops_t *ops = vd ? vd->vdev_ops : &vdev_mirror_ops;
4450 	boolean_t unexpected_error = B_FALSE;
4451 
4452 	if (zio_wait_for_children(zio, ZIO_CHILD_VDEV_BIT, ZIO_WAIT_DONE)) {
4453 		return (NULL);
4454 	}
4455 
4456 	ASSERT(zio->io_type == ZIO_TYPE_READ ||
4457 	    zio->io_type == ZIO_TYPE_WRITE ||
4458 	    zio->io_type == ZIO_TYPE_FLUSH ||
4459 	    zio->io_type == ZIO_TYPE_TRIM);
4460 
4461 	if (zio->io_delay)
4462 		zio->io_delay = gethrtime() - zio->io_delay;
4463 
4464 	if (vd != NULL && vd->vdev_ops->vdev_op_leaf &&
4465 	    vd->vdev_ops != &vdev_draid_spare_ops) {
4466 		if (zio->io_type != ZIO_TYPE_FLUSH)
4467 			vdev_queue_io_done(zio);
4468 
4469 		if (zio_injection_enabled && zio->io_error == 0)
4470 			zio->io_error = zio_handle_device_injections(vd, zio,
4471 			    EIO, EILSEQ);
4472 
4473 		if (zio_injection_enabled && zio->io_error == 0)
4474 			zio->io_error = zio_handle_label_injection(zio, EIO);
4475 
4476 		if (zio->io_error && zio->io_type != ZIO_TYPE_FLUSH &&
4477 		    zio->io_type != ZIO_TYPE_TRIM) {
4478 			if (!vdev_accessible(vd, zio)) {
4479 				zio->io_error = SET_ERROR(ENXIO);
4480 			} else {
4481 				unexpected_error = B_TRUE;
4482 			}
4483 		}
4484 	}
4485 
4486 	ops->vdev_op_io_done(zio);
4487 
4488 	if (unexpected_error && vd->vdev_remove_wanted == B_FALSE)
4489 		VERIFY(vdev_probe(vd, zio) == NULL);
4490 
4491 	return (zio);
4492 }
4493 
4494 /*
4495  * This function is used to change the priority of an existing zio that is
4496  * currently in-flight. This is used by the arc to upgrade priority in the
4497  * event that a demand read is made for a block that is currently queued
4498  * as a scrub or async read IO. Otherwise, the high priority read request
4499  * would end up having to wait for the lower priority IO.
4500  */
4501 void
4502 zio_change_priority(zio_t *pio, zio_priority_t priority)
4503 {
4504 	zio_t *cio, *cio_next;
4505 	zio_link_t *zl = NULL;
4506 
4507 	ASSERT3U(priority, <, ZIO_PRIORITY_NUM_QUEUEABLE);
4508 
4509 	if (pio->io_vd != NULL && pio->io_vd->vdev_ops->vdev_op_leaf) {
4510 		vdev_queue_change_io_priority(pio, priority);
4511 	} else {
4512 		pio->io_priority = priority;
4513 	}
4514 
4515 	mutex_enter(&pio->io_lock);
4516 	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
4517 		cio_next = zio_walk_children(pio, &zl);
4518 		zio_change_priority(cio, priority);
4519 	}
4520 	mutex_exit(&pio->io_lock);
4521 }
4522 
4523 /*
4524  * For non-raidz ZIOs, we can just copy aside the bad data read from the
4525  * disk, and use that to finish the checksum ereport later.
4526  */
4527 static void
4528 zio_vsd_default_cksum_finish(zio_cksum_report_t *zcr,
4529     const abd_t *good_buf)
4530 {
4531 	/* no processing needed */
4532 	zfs_ereport_finish_checksum(zcr, good_buf, zcr->zcr_cbdata, B_FALSE);
4533 }
4534 
4535 void
4536 zio_vsd_default_cksum_report(zio_t *zio, zio_cksum_report_t *zcr)
4537 {
4538 	void *abd = abd_alloc_sametype(zio->io_abd, zio->io_size);
4539 
4540 	abd_copy(abd, zio->io_abd, zio->io_size);
4541 
4542 	zcr->zcr_cbinfo = zio->io_size;
4543 	zcr->zcr_cbdata = abd;
4544 	zcr->zcr_finish = zio_vsd_default_cksum_finish;
4545 	zcr->zcr_free = zio_abd_free;
4546 }
4547 
4548 static zio_t *
4549 zio_vdev_io_assess(zio_t *zio)
4550 {
4551 	vdev_t *vd = zio->io_vd;
4552 
4553 	if (zio_wait_for_children(zio, ZIO_CHILD_VDEV_BIT, ZIO_WAIT_DONE)) {
4554 		return (NULL);
4555 	}
4556 
4557 	if (vd == NULL && !(zio->io_flags & ZIO_FLAG_CONFIG_WRITER))
4558 		spa_config_exit(zio->io_spa, SCL_ZIO, zio);
4559 
4560 	if (zio->io_vsd != NULL) {
4561 		zio->io_vsd_ops->vsd_free(zio);
4562 		zio->io_vsd = NULL;
4563 	}
4564 
4565 	/*
4566 	 * If a Direct I/O operation has a checksum verify error then this I/O
4567 	 * should not attempt to be issued again.
4568 	 */
4569 	if (zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR) {
4570 		if (zio->io_type == ZIO_TYPE_WRITE) {
4571 			ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_LOGICAL);
4572 			ASSERT3U(zio->io_error, ==, EIO);
4573 		}
4574 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
4575 		return (zio);
4576 	}
4577 
4578 	if (zio_injection_enabled && zio->io_error == 0)
4579 		zio->io_error = zio_handle_fault_injection(zio, EIO);
4580 
4581 	/*
4582 	 * If the I/O failed, determine whether we should attempt to retry it.
4583 	 *
4584 	 * On retry, we cut in line in the issue queue, since we don't want
4585 	 * compression/checksumming/etc. work to prevent our (cheap) IO reissue.
4586 	 */
4587 	if (zio->io_error && vd == NULL &&
4588 	    !(zio->io_flags & (ZIO_FLAG_DONT_RETRY | ZIO_FLAG_IO_RETRY))) {
4589 		ASSERT(!(zio->io_flags & ZIO_FLAG_DONT_QUEUE));	/* not a leaf */
4590 		ASSERT(!(zio->io_flags & ZIO_FLAG_IO_BYPASS));	/* not a leaf */
4591 		zio->io_error = 0;
4592 		zio->io_flags |= ZIO_FLAG_IO_RETRY | ZIO_FLAG_DONT_AGGREGATE;
4593 		zio->io_stage = ZIO_STAGE_VDEV_IO_START >> 1;
4594 		zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE,
4595 		    zio_requeue_io_start_cut_in_line);
4596 		return (NULL);
4597 	}
4598 
4599 	/*
4600 	 * If we got an error on a leaf device, convert it to ENXIO
4601 	 * if the device is not accessible at all.
4602 	 */
4603 	if (zio->io_error && vd != NULL && vd->vdev_ops->vdev_op_leaf &&
4604 	    !vdev_accessible(vd, zio))
4605 		zio->io_error = SET_ERROR(ENXIO);
4606 
4607 	/*
4608 	 * If we can't write to an interior vdev (mirror or RAID-Z),
4609 	 * set vdev_cant_write so that we stop trying to allocate from it.
4610 	 */
4611 	if (zio->io_error == ENXIO && zio->io_type == ZIO_TYPE_WRITE &&
4612 	    vd != NULL && !vd->vdev_ops->vdev_op_leaf) {
4613 		vdev_dbgmsg(vd, "zio_vdev_io_assess(zio=%px) setting "
4614 		    "cant_write=TRUE due to write failure with ENXIO",
4615 		    zio);
4616 		vd->vdev_cant_write = B_TRUE;
4617 	}
4618 
4619 	/*
4620 	 * If a cache flush returns ENOTSUP or ENOTTY, we know that no future
4621 	 * attempts will ever succeed. In this case we set a persistent
4622 	 * boolean flag so that we don't bother with it in the future.
4623 	 */
4624 	if ((zio->io_error == ENOTSUP || zio->io_error == ENOTTY) &&
4625 	    zio->io_type == ZIO_TYPE_FLUSH && vd != NULL)
4626 		vd->vdev_nowritecache = B_TRUE;
4627 
4628 	if (zio->io_error)
4629 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
4630 
4631 	return (zio);
4632 }
4633 
4634 void
4635 zio_vdev_io_reissue(zio_t *zio)
4636 {
4637 	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_START);
4638 	ASSERT(zio->io_error == 0);
4639 
4640 	zio->io_stage >>= 1;
4641 }
4642 
4643 void
4644 zio_vdev_io_redone(zio_t *zio)
4645 {
4646 	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_DONE);
4647 
4648 	zio->io_stage >>= 1;
4649 }
4650 
4651 void
4652 zio_vdev_io_bypass(zio_t *zio)
4653 {
4654 	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_START);
4655 	ASSERT(zio->io_error == 0);
4656 
4657 	zio->io_flags |= ZIO_FLAG_IO_BYPASS;
4658 	zio->io_stage = ZIO_STAGE_VDEV_IO_ASSESS >> 1;
4659 }
4660 
4661 /*
4662  * ==========================================================================
4663  * Encrypt and store encryption parameters
4664  * ==========================================================================
4665  */
4666 
4667 
4668 /*
4669  * This function is used for ZIO_STAGE_ENCRYPT. It is responsible for
4670  * managing the storage of encryption parameters and passing them to the
4671  * lower-level encryption functions.
4672  */
4673 static zio_t *
4674 zio_encrypt(zio_t *zio)
4675 {
4676 	zio_prop_t *zp = &zio->io_prop;
4677 	spa_t *spa = zio->io_spa;
4678 	blkptr_t *bp = zio->io_bp;
4679 	uint64_t psize = BP_GET_PSIZE(bp);
4680 	uint64_t dsobj = zio->io_bookmark.zb_objset;
4681 	dmu_object_type_t ot = BP_GET_TYPE(bp);
4682 	void *enc_buf = NULL;
4683 	abd_t *eabd = NULL;
4684 	uint8_t salt[ZIO_DATA_SALT_LEN];
4685 	uint8_t iv[ZIO_DATA_IV_LEN];
4686 	uint8_t mac[ZIO_DATA_MAC_LEN];
4687 	boolean_t no_crypt = B_FALSE;
4688 
4689 	/* the root zio already encrypted the data */
4690 	if (zio->io_child_type == ZIO_CHILD_GANG)
4691 		return (zio);
4692 
4693 	/* only ZIL blocks are re-encrypted on rewrite */
4694 	if (!IO_IS_ALLOCATING(zio) && ot != DMU_OT_INTENT_LOG)
4695 		return (zio);
4696 
4697 	if (!(zp->zp_encrypt || BP_IS_ENCRYPTED(bp))) {
4698 		BP_SET_CRYPT(bp, B_FALSE);
4699 		return (zio);
4700 	}
4701 
4702 	/* if we are doing raw encryption set the provided encryption params */
4703 	if (zio->io_flags & ZIO_FLAG_RAW_ENCRYPT) {
4704 		ASSERT0(BP_GET_LEVEL(bp));
4705 		BP_SET_CRYPT(bp, B_TRUE);
4706 		BP_SET_BYTEORDER(bp, zp->zp_byteorder);
4707 		if (ot != DMU_OT_OBJSET)
4708 			zio_crypt_encode_mac_bp(bp, zp->zp_mac);
4709 
4710 		/* dnode blocks must be written out in the provided byteorder */
4711 		if (zp->zp_byteorder != ZFS_HOST_BYTEORDER &&
4712 		    ot == DMU_OT_DNODE) {
4713 			void *bswap_buf = zio_buf_alloc(psize);
4714 			abd_t *babd = abd_get_from_buf(bswap_buf, psize);
4715 
4716 			ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
4717 			abd_copy_to_buf(bswap_buf, zio->io_abd, psize);
4718 			dmu_ot_byteswap[DMU_OT_BYTESWAP(ot)].ob_func(bswap_buf,
4719 			    psize);
4720 
4721 			abd_take_ownership_of_buf(babd, B_TRUE);
4722 			zio_push_transform(zio, babd, psize, psize, NULL);
4723 		}
4724 
4725 		if (DMU_OT_IS_ENCRYPTED(ot))
4726 			zio_crypt_encode_params_bp(bp, zp->zp_salt, zp->zp_iv);
4727 		return (zio);
4728 	}
4729 
4730 	/* indirect blocks only maintain a cksum of the lower level MACs */
4731 	if (BP_GET_LEVEL(bp) > 0) {
4732 		BP_SET_CRYPT(bp, B_TRUE);
4733 		VERIFY0(zio_crypt_do_indirect_mac_checksum_abd(B_TRUE,
4734 		    zio->io_orig_abd, BP_GET_LSIZE(bp), BP_SHOULD_BYTESWAP(bp),
4735 		    mac));
4736 		zio_crypt_encode_mac_bp(bp, mac);
4737 		return (zio);
4738 	}
4739 
4740 	/*
4741 	 * Objset blocks are a special case since they have 2 256-bit MACs
4742 	 * embedded within them.
4743 	 */
4744 	if (ot == DMU_OT_OBJSET) {
4745 		ASSERT0(DMU_OT_IS_ENCRYPTED(ot));
4746 		ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
4747 		BP_SET_CRYPT(bp, B_TRUE);
4748 		VERIFY0(spa_do_crypt_objset_mac_abd(B_TRUE, spa, dsobj,
4749 		    zio->io_abd, psize, BP_SHOULD_BYTESWAP(bp)));
4750 		return (zio);
4751 	}
4752 
4753 	/* unencrypted object types are only authenticated with a MAC */
4754 	if (!DMU_OT_IS_ENCRYPTED(ot)) {
4755 		BP_SET_CRYPT(bp, B_TRUE);
4756 		VERIFY0(spa_do_crypt_mac_abd(B_TRUE, spa, dsobj,
4757 		    zio->io_abd, psize, mac));
4758 		zio_crypt_encode_mac_bp(bp, mac);
4759 		return (zio);
4760 	}
4761 
4762 	/*
4763 	 * Later passes of sync-to-convergence may decide to rewrite data
4764 	 * in place to avoid more disk reallocations. This presents a problem
4765 	 * for encryption because this constitutes rewriting the new data with
4766 	 * the same encryption key and IV. However, this only applies to blocks
4767 	 * in the MOS (particularly the spacemaps) and we do not encrypt the
4768 	 * MOS. We assert that the zio is allocating or an intent log write
4769 	 * to enforce this.
4770 	 */
4771 	ASSERT(IO_IS_ALLOCATING(zio) || ot == DMU_OT_INTENT_LOG);
4772 	ASSERT(BP_GET_LEVEL(bp) == 0 || ot == DMU_OT_INTENT_LOG);
4773 	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_ENCRYPTION));
4774 	ASSERT3U(psize, !=, 0);
4775 
4776 	enc_buf = zio_buf_alloc(psize);
4777 	eabd = abd_get_from_buf(enc_buf, psize);
4778 	abd_take_ownership_of_buf(eabd, B_TRUE);
4779 
4780 	/*
4781 	 * For an explanation of what encryption parameters are stored
4782 	 * where, see the block comment in zio_crypt.c.
4783 	 */
4784 	if (ot == DMU_OT_INTENT_LOG) {
4785 		zio_crypt_decode_params_bp(bp, salt, iv);
4786 	} else {
4787 		BP_SET_CRYPT(bp, B_TRUE);
4788 	}
4789 
4790 	/* Perform the encryption. This should not fail */
4791 	VERIFY0(spa_do_crypt_abd(B_TRUE, spa, &zio->io_bookmark,
4792 	    BP_GET_TYPE(bp), BP_GET_DEDUP(bp), BP_SHOULD_BYTESWAP(bp),
4793 	    salt, iv, mac, psize, zio->io_abd, eabd, &no_crypt));
4794 
4795 	/* encode encryption metadata into the bp */
4796 	if (ot == DMU_OT_INTENT_LOG) {
4797 		/*
4798 		 * ZIL blocks store the MAC in the embedded checksum, so the
4799 		 * transform must always be applied.
4800 		 */
4801 		zio_crypt_encode_mac_zil(enc_buf, mac);
4802 		zio_push_transform(zio, eabd, psize, psize, NULL);
4803 	} else {
4804 		BP_SET_CRYPT(bp, B_TRUE);
4805 		zio_crypt_encode_params_bp(bp, salt, iv);
4806 		zio_crypt_encode_mac_bp(bp, mac);
4807 
4808 		if (no_crypt) {
4809 			ASSERT3U(ot, ==, DMU_OT_DNODE);
4810 			abd_free(eabd);
4811 		} else {
4812 			zio_push_transform(zio, eabd, psize, psize, NULL);
4813 		}
4814 	}
4815 
4816 	return (zio);
4817 }
4818 
4819 /*
4820  * ==========================================================================
4821  * Generate and verify checksums
4822  * ==========================================================================
4823  */
4824 static zio_t *
4825 zio_checksum_generate(zio_t *zio)
4826 {
4827 	blkptr_t *bp = zio->io_bp;
4828 	enum zio_checksum checksum;
4829 
4830 	if (bp == NULL) {
4831 		/*
4832 		 * This is zio_write_phys().
4833 		 * We're either generating a label checksum, or none at all.
4834 		 */
4835 		checksum = zio->io_prop.zp_checksum;
4836 
4837 		if (checksum == ZIO_CHECKSUM_OFF)
4838 			return (zio);
4839 
4840 		ASSERT(checksum == ZIO_CHECKSUM_LABEL);
4841 	} else {
4842 		if (BP_IS_GANG(bp) && zio->io_child_type == ZIO_CHILD_GANG) {
4843 			ASSERT(!IO_IS_ALLOCATING(zio));
4844 			checksum = ZIO_CHECKSUM_GANG_HEADER;
4845 		} else {
4846 			checksum = BP_GET_CHECKSUM(bp);
4847 		}
4848 	}
4849 
4850 	zio_checksum_compute(zio, checksum, zio->io_abd, zio->io_size);
4851 
4852 	return (zio);
4853 }
4854 
4855 static zio_t *
4856 zio_checksum_verify(zio_t *zio)
4857 {
4858 	zio_bad_cksum_t info;
4859 	blkptr_t *bp = zio->io_bp;
4860 	int error;
4861 
4862 	ASSERT(zio->io_vd != NULL);
4863 
4864 	if (bp == NULL) {
4865 		/*
4866 		 * This is zio_read_phys().
4867 		 * We're either verifying a label checksum, or nothing at all.
4868 		 */
4869 		if (zio->io_prop.zp_checksum == ZIO_CHECKSUM_OFF)
4870 			return (zio);
4871 
4872 		ASSERT3U(zio->io_prop.zp_checksum, ==, ZIO_CHECKSUM_LABEL);
4873 	}
4874 
4875 	ASSERT0(zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR);
4876 	IMPLY(zio->io_flags & ZIO_FLAG_DIO_READ,
4877 	    !(zio->io_flags & ZIO_FLAG_SPECULATIVE));
4878 
4879 	if ((error = zio_checksum_error(zio, &info)) != 0) {
4880 		zio->io_error = error;
4881 		if (error == ECKSUM &&
4882 		    !(zio->io_flags & ZIO_FLAG_SPECULATIVE)) {
4883 			if (zio->io_flags & ZIO_FLAG_DIO_READ) {
4884 				zio->io_flags |= ZIO_FLAG_DIO_CHKSUM_ERR;
4885 				zio_t *pio = zio_unique_parent(zio);
4886 				/*
4887 				 * Any Direct I/O read that has a checksum
4888 				 * error must be treated as suspicous as the
4889 				 * contents of the buffer could be getting
4890 				 * manipulated while the I/O is taking place.
4891 				 *
4892 				 * The checksum verify error will only be
4893 				 * reported here for disk and file VDEV's and
4894 				 * will be reported on those that the failure
4895 				 * occurred on. Other types of VDEV's report the
4896 				 * verify failure in their own code paths.
4897 				 */
4898 				if (pio->io_child_type == ZIO_CHILD_LOGICAL) {
4899 					zio_dio_chksum_verify_error_report(zio);
4900 				}
4901 			} else {
4902 				mutex_enter(&zio->io_vd->vdev_stat_lock);
4903 				zio->io_vd->vdev_stat.vs_checksum_errors++;
4904 				mutex_exit(&zio->io_vd->vdev_stat_lock);
4905 				(void) zfs_ereport_start_checksum(zio->io_spa,
4906 				    zio->io_vd, &zio->io_bookmark, zio,
4907 				    zio->io_offset, zio->io_size, &info);
4908 			}
4909 		}
4910 	}
4911 
4912 	return (zio);
4913 }
4914 
4915 static zio_t *
4916 zio_dio_checksum_verify(zio_t *zio)
4917 {
4918 	zio_t *pio = zio_unique_parent(zio);
4919 	int error;
4920 
4921 	ASSERT3P(zio->io_vd, !=, NULL);
4922 	ASSERT3P(zio->io_bp, !=, NULL);
4923 	ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_VDEV);
4924 	ASSERT3U(zio->io_type, ==, ZIO_TYPE_WRITE);
4925 	ASSERT3B(pio->io_prop.zp_direct_write, ==, B_TRUE);
4926 	ASSERT3U(pio->io_child_type, ==, ZIO_CHILD_LOGICAL);
4927 
4928 	if (zfs_vdev_direct_write_verify == 0 || zio->io_error != 0)
4929 		goto out;
4930 
4931 	if ((error = zio_checksum_error(zio, NULL)) != 0) {
4932 		zio->io_error = error;
4933 		if (error == ECKSUM) {
4934 			zio->io_flags |= ZIO_FLAG_DIO_CHKSUM_ERR;
4935 			zio_dio_chksum_verify_error_report(zio);
4936 		}
4937 	}
4938 
4939 out:
4940 	return (zio);
4941 }
4942 
4943 
4944 /*
4945  * Called by RAID-Z to ensure we don't compute the checksum twice.
4946  */
4947 void
4948 zio_checksum_verified(zio_t *zio)
4949 {
4950 	zio->io_pipeline &= ~ZIO_STAGE_CHECKSUM_VERIFY;
4951 }
4952 
4953 /*
4954  * Report Direct I/O checksum verify error and create ZED event.
4955  */
4956 void
4957 zio_dio_chksum_verify_error_report(zio_t *zio)
4958 {
4959 	ASSERT(zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR);
4960 
4961 	if (zio->io_child_type == ZIO_CHILD_LOGICAL)
4962 		return;
4963 
4964 	mutex_enter(&zio->io_vd->vdev_stat_lock);
4965 	zio->io_vd->vdev_stat.vs_dio_verify_errors++;
4966 	mutex_exit(&zio->io_vd->vdev_stat_lock);
4967 	if (zio->io_type == ZIO_TYPE_WRITE) {
4968 		/*
4969 		 * Convert checksum error for writes into EIO.
4970 		 */
4971 		zio->io_error = SET_ERROR(EIO);
4972 		/*
4973 		 * Report dio_verify_wr ZED event.
4974 		 */
4975 		(void) zfs_ereport_post(FM_EREPORT_ZFS_DIO_VERIFY_WR,
4976 		    zio->io_spa,  zio->io_vd, &zio->io_bookmark, zio, 0);
4977 	} else {
4978 		/*
4979 		 * Report dio_verify_rd ZED event.
4980 		 */
4981 		(void) zfs_ereport_post(FM_EREPORT_ZFS_DIO_VERIFY_RD,
4982 		    zio->io_spa, zio->io_vd, &zio->io_bookmark, zio, 0);
4983 	}
4984 }
4985 
4986 /*
4987  * ==========================================================================
4988  * Error rank.  Error are ranked in the order 0, ENXIO, ECKSUM, EIO, other.
4989  * An error of 0 indicates success.  ENXIO indicates whole-device failure,
4990  * which may be transient (e.g. unplugged) or permanent.  ECKSUM and EIO
4991  * indicate errors that are specific to one I/O, and most likely permanent.
4992  * Any other error is presumed to be worse because we weren't expecting it.
4993  * ==========================================================================
4994  */
4995 int
4996 zio_worst_error(int e1, int e2)
4997 {
4998 	static int zio_error_rank[] = { 0, ENXIO, ECKSUM, EIO };
4999 	int r1, r2;
5000 
5001 	for (r1 = 0; r1 < sizeof (zio_error_rank) / sizeof (int); r1++)
5002 		if (e1 == zio_error_rank[r1])
5003 			break;
5004 
5005 	for (r2 = 0; r2 < sizeof (zio_error_rank) / sizeof (int); r2++)
5006 		if (e2 == zio_error_rank[r2])
5007 			break;
5008 
5009 	return (r1 > r2 ? e1 : e2);
5010 }
5011 
5012 /*
5013  * ==========================================================================
5014  * I/O completion
5015  * ==========================================================================
5016  */
5017 static zio_t *
5018 zio_ready(zio_t *zio)
5019 {
5020 	blkptr_t *bp = zio->io_bp;
5021 	zio_t *pio, *pio_next;
5022 	zio_link_t *zl = NULL;
5023 
5024 	if (zio_wait_for_children(zio, ZIO_CHILD_LOGICAL_BIT |
5025 	    ZIO_CHILD_GANG_BIT | ZIO_CHILD_DDT_BIT, ZIO_WAIT_READY)) {
5026 		return (NULL);
5027 	}
5028 
5029 	if (zio->io_ready) {
5030 		ASSERT(IO_IS_ALLOCATING(zio));
5031 		ASSERT(BP_GET_LOGICAL_BIRTH(bp) == zio->io_txg ||
5032 		    BP_IS_HOLE(bp) || (zio->io_flags & ZIO_FLAG_NOPWRITE));
5033 		ASSERT(zio->io_children[ZIO_CHILD_GANG][ZIO_WAIT_READY] == 0);
5034 
5035 		zio->io_ready(zio);
5036 	}
5037 
5038 #ifdef ZFS_DEBUG
5039 	if (bp != NULL && bp != &zio->io_bp_copy)
5040 		zio->io_bp_copy = *bp;
5041 #endif
5042 
5043 	if (zio->io_error != 0) {
5044 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
5045 
5046 		if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
5047 			ASSERT(IO_IS_ALLOCATING(zio));
5048 			ASSERT(zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
5049 			ASSERT(zio->io_metaslab_class != NULL);
5050 			ASSERT(ZIO_HAS_ALLOCATOR(zio));
5051 
5052 			/*
5053 			 * We were unable to allocate anything, unreserve and
5054 			 * issue the next I/O to allocate.
5055 			 */
5056 			metaslab_class_throttle_unreserve(
5057 			    zio->io_metaslab_class, zio->io_prop.zp_copies,
5058 			    zio->io_allocator, zio);
5059 			zio_allocate_dispatch(zio->io_spa, zio->io_allocator);
5060 		}
5061 	}
5062 
5063 	mutex_enter(&zio->io_lock);
5064 	zio->io_state[ZIO_WAIT_READY] = 1;
5065 	pio = zio_walk_parents(zio, &zl);
5066 	mutex_exit(&zio->io_lock);
5067 
5068 	/*
5069 	 * As we notify zio's parents, new parents could be added.
5070 	 * New parents go to the head of zio's io_parent_list, however,
5071 	 * so we will (correctly) not notify them.  The remainder of zio's
5072 	 * io_parent_list, from 'pio_next' onward, cannot change because
5073 	 * all parents must wait for us to be done before they can be done.
5074 	 */
5075 	for (; pio != NULL; pio = pio_next) {
5076 		pio_next = zio_walk_parents(zio, &zl);
5077 		zio_notify_parent(pio, zio, ZIO_WAIT_READY, NULL);
5078 	}
5079 
5080 	if (zio->io_flags & ZIO_FLAG_NODATA) {
5081 		if (bp != NULL && BP_IS_GANG(bp)) {
5082 			zio->io_flags &= ~ZIO_FLAG_NODATA;
5083 		} else {
5084 			ASSERT((uintptr_t)zio->io_abd < SPA_MAXBLOCKSIZE);
5085 			zio->io_pipeline &= ~ZIO_VDEV_IO_STAGES;
5086 		}
5087 	}
5088 
5089 	if (zio_injection_enabled &&
5090 	    zio->io_spa->spa_syncing_txg == zio->io_txg)
5091 		zio_handle_ignored_writes(zio);
5092 
5093 	return (zio);
5094 }
5095 
5096 /*
5097  * Update the allocation throttle accounting.
5098  */
5099 static void
5100 zio_dva_throttle_done(zio_t *zio)
5101 {
5102 	zio_t *lio __maybe_unused = zio->io_logical;
5103 	zio_t *pio = zio_unique_parent(zio);
5104 	vdev_t *vd = zio->io_vd;
5105 	int flags = METASLAB_ASYNC_ALLOC;
5106 
5107 	ASSERT3P(zio->io_bp, !=, NULL);
5108 	ASSERT3U(zio->io_type, ==, ZIO_TYPE_WRITE);
5109 	ASSERT3U(zio->io_priority, ==, ZIO_PRIORITY_ASYNC_WRITE);
5110 	ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_VDEV);
5111 	ASSERT(vd != NULL);
5112 	ASSERT3P(vd, ==, vd->vdev_top);
5113 	ASSERT(zio_injection_enabled || !(zio->io_flags & ZIO_FLAG_IO_RETRY));
5114 	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REPAIR));
5115 	ASSERT(zio->io_flags & ZIO_FLAG_IO_ALLOCATING);
5116 	ASSERT(!(lio->io_flags & ZIO_FLAG_IO_REWRITE));
5117 	ASSERT(!(lio->io_orig_flags & ZIO_FLAG_NODATA));
5118 
5119 	/*
5120 	 * Parents of gang children can have two flavors -- ones that
5121 	 * allocated the gang header (will have ZIO_FLAG_IO_REWRITE set)
5122 	 * and ones that allocated the constituent blocks. The allocation
5123 	 * throttle needs to know the allocating parent zio so we must find
5124 	 * it here.
5125 	 */
5126 	if (pio->io_child_type == ZIO_CHILD_GANG) {
5127 		/*
5128 		 * If our parent is a rewrite gang child then our grandparent
5129 		 * would have been the one that performed the allocation.
5130 		 */
5131 		if (pio->io_flags & ZIO_FLAG_IO_REWRITE)
5132 			pio = zio_unique_parent(pio);
5133 		flags |= METASLAB_GANG_CHILD;
5134 	}
5135 
5136 	ASSERT(IO_IS_ALLOCATING(pio));
5137 	ASSERT(ZIO_HAS_ALLOCATOR(pio));
5138 	ASSERT3P(zio, !=, zio->io_logical);
5139 	ASSERT(zio->io_logical != NULL);
5140 	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REPAIR));
5141 	ASSERT0(zio->io_flags & ZIO_FLAG_NOPWRITE);
5142 	ASSERT(zio->io_metaslab_class != NULL);
5143 
5144 	mutex_enter(&pio->io_lock);
5145 	metaslab_group_alloc_decrement(zio->io_spa, vd->vdev_id, pio, flags,
5146 	    pio->io_allocator, B_TRUE);
5147 	mutex_exit(&pio->io_lock);
5148 
5149 	metaslab_class_throttle_unreserve(zio->io_metaslab_class, 1,
5150 	    pio->io_allocator, pio);
5151 
5152 	/*
5153 	 * Call into the pipeline to see if there is more work that
5154 	 * needs to be done. If there is work to be done it will be
5155 	 * dispatched to another taskq thread.
5156 	 */
5157 	zio_allocate_dispatch(zio->io_spa, pio->io_allocator);
5158 }
5159 
5160 static zio_t *
5161 zio_done(zio_t *zio)
5162 {
5163 	/*
5164 	 * Always attempt to keep stack usage minimal here since
5165 	 * we can be called recursively up to 19 levels deep.
5166 	 */
5167 	const uint64_t psize = zio->io_size;
5168 	zio_t *pio, *pio_next;
5169 	zio_link_t *zl = NULL;
5170 
5171 	/*
5172 	 * If our children haven't all completed,
5173 	 * wait for them and then repeat this pipeline stage.
5174 	 */
5175 	if (zio_wait_for_children(zio, ZIO_CHILD_ALL_BITS, ZIO_WAIT_DONE)) {
5176 		return (NULL);
5177 	}
5178 
5179 	/*
5180 	 * If the allocation throttle is enabled, then update the accounting.
5181 	 * We only track child I/Os that are part of an allocating async
5182 	 * write. We must do this since the allocation is performed
5183 	 * by the logical I/O but the actual write is done by child I/Os.
5184 	 */
5185 	if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING &&
5186 	    zio->io_child_type == ZIO_CHILD_VDEV) {
5187 		ASSERT(zio->io_metaslab_class != NULL);
5188 		ASSERT(zio->io_metaslab_class->mc_alloc_throttle_enabled);
5189 		zio_dva_throttle_done(zio);
5190 	}
5191 
5192 	/*
5193 	 * If the allocation throttle is enabled, verify that
5194 	 * we have decremented the refcounts for every I/O that was throttled.
5195 	 */
5196 	if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
5197 		ASSERT(zio->io_type == ZIO_TYPE_WRITE);
5198 		ASSERT(zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
5199 		ASSERT(zio->io_bp != NULL);
5200 		ASSERT(ZIO_HAS_ALLOCATOR(zio));
5201 
5202 		metaslab_group_alloc_verify(zio->io_spa, zio->io_bp, zio,
5203 		    zio->io_allocator);
5204 		VERIFY(zfs_refcount_not_held(&zio->io_metaslab_class->
5205 		    mc_allocator[zio->io_allocator].mca_alloc_slots, zio));
5206 	}
5207 
5208 
5209 	for (int c = 0; c < ZIO_CHILD_TYPES; c++)
5210 		for (int w = 0; w < ZIO_WAIT_TYPES; w++)
5211 			ASSERT(zio->io_children[c][w] == 0);
5212 
5213 	if (zio->io_bp != NULL && !BP_IS_EMBEDDED(zio->io_bp)) {
5214 		ASSERT(zio->io_bp->blk_pad[0] == 0);
5215 		ASSERT(zio->io_bp->blk_pad[1] == 0);
5216 		ASSERT(memcmp(zio->io_bp, &zio->io_bp_copy,
5217 		    sizeof (blkptr_t)) == 0 ||
5218 		    (zio->io_bp == zio_unique_parent(zio)->io_bp));
5219 		if (zio->io_type == ZIO_TYPE_WRITE && !BP_IS_HOLE(zio->io_bp) &&
5220 		    zio->io_bp_override == NULL &&
5221 		    !(zio->io_flags & ZIO_FLAG_IO_REPAIR)) {
5222 			ASSERT3U(zio->io_prop.zp_copies, <=,
5223 			    BP_GET_NDVAS(zio->io_bp));
5224 			ASSERT(BP_COUNT_GANG(zio->io_bp) == 0 ||
5225 			    (BP_COUNT_GANG(zio->io_bp) ==
5226 			    BP_GET_NDVAS(zio->io_bp)));
5227 		}
5228 		if (zio->io_flags & ZIO_FLAG_NOPWRITE)
5229 			VERIFY(BP_EQUAL(zio->io_bp, &zio->io_bp_orig));
5230 	}
5231 
5232 	/*
5233 	 * If there were child vdev/gang/ddt errors, they apply to us now.
5234 	 */
5235 	zio_inherit_child_errors(zio, ZIO_CHILD_VDEV);
5236 	zio_inherit_child_errors(zio, ZIO_CHILD_GANG);
5237 	zio_inherit_child_errors(zio, ZIO_CHILD_DDT);
5238 
5239 	/*
5240 	 * If the I/O on the transformed data was successful, generate any
5241 	 * checksum reports now while we still have the transformed data.
5242 	 */
5243 	if (zio->io_error == 0) {
5244 		while (zio->io_cksum_report != NULL) {
5245 			zio_cksum_report_t *zcr = zio->io_cksum_report;
5246 			uint64_t align = zcr->zcr_align;
5247 			uint64_t asize = P2ROUNDUP(psize, align);
5248 			abd_t *adata = zio->io_abd;
5249 
5250 			if (adata != NULL && asize != psize) {
5251 				adata = abd_alloc(asize, B_TRUE);
5252 				abd_copy(adata, zio->io_abd, psize);
5253 				abd_zero_off(adata, psize, asize - psize);
5254 			}
5255 
5256 			zio->io_cksum_report = zcr->zcr_next;
5257 			zcr->zcr_next = NULL;
5258 			zcr->zcr_finish(zcr, adata);
5259 			zfs_ereport_free_checksum(zcr);
5260 
5261 			if (adata != NULL && asize != psize)
5262 				abd_free(adata);
5263 		}
5264 	}
5265 
5266 	zio_pop_transforms(zio);	/* note: may set zio->io_error */
5267 
5268 	vdev_stat_update(zio, psize);
5269 
5270 	/*
5271 	 * If this I/O is attached to a particular vdev is slow, exceeding
5272 	 * 30 seconds to complete, post an error described the I/O delay.
5273 	 * We ignore these errors if the device is currently unavailable.
5274 	 */
5275 	if (zio->io_delay >= MSEC2NSEC(zio_slow_io_ms)) {
5276 		if (zio->io_vd != NULL && !vdev_is_dead(zio->io_vd)) {
5277 			/*
5278 			 * We want to only increment our slow IO counters if
5279 			 * the IO is valid (i.e. not if the drive is removed).
5280 			 *
5281 			 * zfs_ereport_post() will also do these checks, but
5282 			 * it can also ratelimit and have other failures, so we
5283 			 * need to increment the slow_io counters independent
5284 			 * of it.
5285 			 */
5286 			if (zfs_ereport_is_valid(FM_EREPORT_ZFS_DELAY,
5287 			    zio->io_spa, zio->io_vd, zio)) {
5288 				mutex_enter(&zio->io_vd->vdev_stat_lock);
5289 				zio->io_vd->vdev_stat.vs_slow_ios++;
5290 				mutex_exit(&zio->io_vd->vdev_stat_lock);
5291 
5292 				(void) zfs_ereport_post(FM_EREPORT_ZFS_DELAY,
5293 				    zio->io_spa, zio->io_vd, &zio->io_bookmark,
5294 				    zio, 0);
5295 			}
5296 		}
5297 	}
5298 
5299 	if (zio->io_error) {
5300 		/*
5301 		 * If this I/O is attached to a particular vdev,
5302 		 * generate an error message describing the I/O failure
5303 		 * at the block level.  We ignore these errors if the
5304 		 * device is currently unavailable.
5305 		 */
5306 		if (zio->io_error != ECKSUM && zio->io_vd != NULL &&
5307 		    !vdev_is_dead(zio->io_vd) &&
5308 		    !(zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR)) {
5309 			int ret = zfs_ereport_post(FM_EREPORT_ZFS_IO,
5310 			    zio->io_spa, zio->io_vd, &zio->io_bookmark, zio, 0);
5311 			if (ret != EALREADY) {
5312 				mutex_enter(&zio->io_vd->vdev_stat_lock);
5313 				if (zio->io_type == ZIO_TYPE_READ)
5314 					zio->io_vd->vdev_stat.vs_read_errors++;
5315 				else if (zio->io_type == ZIO_TYPE_WRITE)
5316 					zio->io_vd->vdev_stat.vs_write_errors++;
5317 				mutex_exit(&zio->io_vd->vdev_stat_lock);
5318 			}
5319 		}
5320 
5321 		if ((zio->io_error == EIO || !(zio->io_flags &
5322 		    (ZIO_FLAG_SPECULATIVE | ZIO_FLAG_DONT_PROPAGATE))) &&
5323 		    !(zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR) &&
5324 		    zio == zio->io_logical) {
5325 			/*
5326 			 * For logical I/O requests, tell the SPA to log the
5327 			 * error and generate a logical data ereport.
5328 			 */
5329 			spa_log_error(zio->io_spa, &zio->io_bookmark,
5330 			    BP_GET_LOGICAL_BIRTH(zio->io_bp));
5331 			(void) zfs_ereport_post(FM_EREPORT_ZFS_DATA,
5332 			    zio->io_spa, NULL, &zio->io_bookmark, zio, 0);
5333 		}
5334 	}
5335 
5336 	if (zio->io_error && zio == zio->io_logical) {
5337 		/*
5338 		 * Determine whether zio should be reexecuted.  This will
5339 		 * propagate all the way to the root via zio_notify_parent().
5340 		 */
5341 		ASSERT(zio->io_vd == NULL && zio->io_bp != NULL);
5342 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
5343 
5344 		if (IO_IS_ALLOCATING(zio) &&
5345 		    !(zio->io_flags & ZIO_FLAG_CANFAIL) &&
5346 		    !(zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR)) {
5347 			if (zio->io_error != ENOSPC)
5348 				zio->io_reexecute |= ZIO_REEXECUTE_NOW;
5349 			else
5350 				zio->io_reexecute |= ZIO_REEXECUTE_SUSPEND;
5351 		}
5352 
5353 		if ((zio->io_type == ZIO_TYPE_READ ||
5354 		    zio->io_type == ZIO_TYPE_FREE) &&
5355 		    !(zio->io_flags & ZIO_FLAG_SCAN_THREAD) &&
5356 		    zio->io_error == ENXIO &&
5357 		    spa_load_state(zio->io_spa) == SPA_LOAD_NONE &&
5358 		    spa_get_failmode(zio->io_spa) != ZIO_FAILURE_MODE_CONTINUE)
5359 			zio->io_reexecute |= ZIO_REEXECUTE_SUSPEND;
5360 
5361 		if (!(zio->io_flags & ZIO_FLAG_CANFAIL) && !zio->io_reexecute)
5362 			zio->io_reexecute |= ZIO_REEXECUTE_SUSPEND;
5363 
5364 		/*
5365 		 * Here is a possibly good place to attempt to do
5366 		 * either combinatorial reconstruction or error correction
5367 		 * based on checksums.  It also might be a good place
5368 		 * to send out preliminary ereports before we suspend
5369 		 * processing.
5370 		 */
5371 	}
5372 
5373 	/*
5374 	 * If there were logical child errors, they apply to us now.
5375 	 * We defer this until now to avoid conflating logical child
5376 	 * errors with errors that happened to the zio itself when
5377 	 * updating vdev stats and reporting FMA events above.
5378 	 */
5379 	zio_inherit_child_errors(zio, ZIO_CHILD_LOGICAL);
5380 
5381 	if ((zio->io_error || zio->io_reexecute) &&
5382 	    IO_IS_ALLOCATING(zio) && zio->io_gang_leader == zio &&
5383 	    !(zio->io_flags & (ZIO_FLAG_IO_REWRITE | ZIO_FLAG_NOPWRITE)))
5384 		zio_dva_unallocate(zio, zio->io_gang_tree, zio->io_bp);
5385 
5386 	zio_gang_tree_free(&zio->io_gang_tree);
5387 
5388 	/*
5389 	 * Godfather I/Os should never suspend.
5390 	 */
5391 	if ((zio->io_flags & ZIO_FLAG_GODFATHER) &&
5392 	    (zio->io_reexecute & ZIO_REEXECUTE_SUSPEND))
5393 		zio->io_reexecute &= ~ZIO_REEXECUTE_SUSPEND;
5394 
5395 	if (zio->io_reexecute) {
5396 		/*
5397 		 * A Direct I/O operation that has a checksum verify error
5398 		 * should not attempt to reexecute. Instead, the error should
5399 		 * just be propagated back.
5400 		 */
5401 		ASSERT(!(zio->io_flags & ZIO_FLAG_DIO_CHKSUM_ERR));
5402 
5403 		/*
5404 		 * This is a logical I/O that wants to reexecute.
5405 		 *
5406 		 * Reexecute is top-down.  When an i/o fails, if it's not
5407 		 * the root, it simply notifies its parent and sticks around.
5408 		 * The parent, seeing that it still has children in zio_done(),
5409 		 * does the same.  This percolates all the way up to the root.
5410 		 * The root i/o will reexecute or suspend the entire tree.
5411 		 *
5412 		 * This approach ensures that zio_reexecute() honors
5413 		 * all the original i/o dependency relationships, e.g.
5414 		 * parents not executing until children are ready.
5415 		 */
5416 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
5417 
5418 		zio->io_gang_leader = NULL;
5419 
5420 		mutex_enter(&zio->io_lock);
5421 		zio->io_state[ZIO_WAIT_DONE] = 1;
5422 		mutex_exit(&zio->io_lock);
5423 
5424 		/*
5425 		 * "The Godfather" I/O monitors its children but is
5426 		 * not a true parent to them. It will track them through
5427 		 * the pipeline but severs its ties whenever they get into
5428 		 * trouble (e.g. suspended). This allows "The Godfather"
5429 		 * I/O to return status without blocking.
5430 		 */
5431 		zl = NULL;
5432 		for (pio = zio_walk_parents(zio, &zl); pio != NULL;
5433 		    pio = pio_next) {
5434 			zio_link_t *remove_zl = zl;
5435 			pio_next = zio_walk_parents(zio, &zl);
5436 
5437 			if ((pio->io_flags & ZIO_FLAG_GODFATHER) &&
5438 			    (zio->io_reexecute & ZIO_REEXECUTE_SUSPEND)) {
5439 				zio_remove_child(pio, zio, remove_zl);
5440 				/*
5441 				 * This is a rare code path, so we don't
5442 				 * bother with "next_to_execute".
5443 				 */
5444 				zio_notify_parent(pio, zio, ZIO_WAIT_DONE,
5445 				    NULL);
5446 			}
5447 		}
5448 
5449 		if ((pio = zio_unique_parent(zio)) != NULL) {
5450 			/*
5451 			 * We're not a root i/o, so there's nothing to do
5452 			 * but notify our parent.  Don't propagate errors
5453 			 * upward since we haven't permanently failed yet.
5454 			 */
5455 			ASSERT(!(zio->io_flags & ZIO_FLAG_GODFATHER));
5456 			zio->io_flags |= ZIO_FLAG_DONT_PROPAGATE;
5457 			/*
5458 			 * This is a rare code path, so we don't bother with
5459 			 * "next_to_execute".
5460 			 */
5461 			zio_notify_parent(pio, zio, ZIO_WAIT_DONE, NULL);
5462 		} else if (zio->io_reexecute & ZIO_REEXECUTE_SUSPEND) {
5463 			/*
5464 			 * We'd fail again if we reexecuted now, so suspend
5465 			 * until conditions improve (e.g. device comes online).
5466 			 */
5467 			zio_suspend(zio->io_spa, zio, ZIO_SUSPEND_IOERR);
5468 		} else {
5469 			/*
5470 			 * Reexecution is potentially a huge amount of work.
5471 			 * Hand it off to the otherwise-unused claim taskq.
5472 			 */
5473 			spa_taskq_dispatch(zio->io_spa,
5474 			    ZIO_TYPE_CLAIM, ZIO_TASKQ_ISSUE,
5475 			    zio_reexecute, zio, B_FALSE);
5476 		}
5477 		return (NULL);
5478 	}
5479 
5480 	ASSERT(list_is_empty(&zio->io_child_list));
5481 	ASSERT(zio->io_reexecute == 0);
5482 	ASSERT(zio->io_error == 0 || (zio->io_flags & ZIO_FLAG_CANFAIL));
5483 
5484 	/*
5485 	 * Report any checksum errors, since the I/O is complete.
5486 	 */
5487 	while (zio->io_cksum_report != NULL) {
5488 		zio_cksum_report_t *zcr = zio->io_cksum_report;
5489 		zio->io_cksum_report = zcr->zcr_next;
5490 		zcr->zcr_next = NULL;
5491 		zcr->zcr_finish(zcr, NULL);
5492 		zfs_ereport_free_checksum(zcr);
5493 	}
5494 
5495 	/*
5496 	 * It is the responsibility of the done callback to ensure that this
5497 	 * particular zio is no longer discoverable for adoption, and as
5498 	 * such, cannot acquire any new parents.
5499 	 */
5500 	if (zio->io_done)
5501 		zio->io_done(zio);
5502 
5503 	mutex_enter(&zio->io_lock);
5504 	zio->io_state[ZIO_WAIT_DONE] = 1;
5505 	mutex_exit(&zio->io_lock);
5506 
5507 	/*
5508 	 * We are done executing this zio.  We may want to execute a parent
5509 	 * next.  See the comment in zio_notify_parent().
5510 	 */
5511 	zio_t *next_to_execute = NULL;
5512 	zl = NULL;
5513 	for (pio = zio_walk_parents(zio, &zl); pio != NULL; pio = pio_next) {
5514 		zio_link_t *remove_zl = zl;
5515 		pio_next = zio_walk_parents(zio, &zl);
5516 		zio_remove_child(pio, zio, remove_zl);
5517 		zio_notify_parent(pio, zio, ZIO_WAIT_DONE, &next_to_execute);
5518 	}
5519 
5520 	if (zio->io_waiter != NULL) {
5521 		mutex_enter(&zio->io_lock);
5522 		zio->io_executor = NULL;
5523 		cv_broadcast(&zio->io_cv);
5524 		mutex_exit(&zio->io_lock);
5525 	} else {
5526 		zio_destroy(zio);
5527 	}
5528 
5529 	return (next_to_execute);
5530 }
5531 
5532 /*
5533  * ==========================================================================
5534  * I/O pipeline definition
5535  * ==========================================================================
5536  */
5537 static zio_pipe_stage_t *zio_pipeline[] = {
5538 	NULL,
5539 	zio_read_bp_init,
5540 	zio_write_bp_init,
5541 	zio_free_bp_init,
5542 	zio_issue_async,
5543 	zio_write_compress,
5544 	zio_encrypt,
5545 	zio_checksum_generate,
5546 	zio_nop_write,
5547 	zio_brt_free,
5548 	zio_ddt_read_start,
5549 	zio_ddt_read_done,
5550 	zio_ddt_write,
5551 	zio_ddt_free,
5552 	zio_gang_assemble,
5553 	zio_gang_issue,
5554 	zio_dva_throttle,
5555 	zio_dva_allocate,
5556 	zio_dva_free,
5557 	zio_dva_claim,
5558 	zio_ready,
5559 	zio_vdev_io_start,
5560 	zio_vdev_io_done,
5561 	zio_vdev_io_assess,
5562 	zio_checksum_verify,
5563 	zio_dio_checksum_verify,
5564 	zio_done
5565 };
5566 
5567 
5568 
5569 
5570 /*
5571  * Compare two zbookmark_phys_t's to see which we would reach first in a
5572  * pre-order traversal of the object tree.
5573  *
5574  * This is simple in every case aside from the meta-dnode object. For all other
5575  * objects, we traverse them in order (object 1 before object 2, and so on).
5576  * However, all of these objects are traversed while traversing object 0, since
5577  * the data it points to is the list of objects.  Thus, we need to convert to a
5578  * canonical representation so we can compare meta-dnode bookmarks to
5579  * non-meta-dnode bookmarks.
5580  *
5581  * We do this by calculating "equivalents" for each field of the zbookmark.
5582  * zbookmarks outside of the meta-dnode use their own object and level, and
5583  * calculate the level 0 equivalent (the first L0 blkid that is contained in the
5584  * blocks this bookmark refers to) by multiplying their blkid by their span
5585  * (the number of L0 blocks contained within one block at their level).
5586  * zbookmarks inside the meta-dnode calculate their object equivalent
5587  * (which is L0equiv * dnodes per data block), use 0 for their L0equiv, and use
5588  * level + 1<<31 (any value larger than a level could ever be) for their level.
5589  * This causes them to always compare before a bookmark in their object
5590  * equivalent, compare appropriately to bookmarks in other objects, and to
5591  * compare appropriately to other bookmarks in the meta-dnode.
5592  */
5593 int
5594 zbookmark_compare(uint16_t dbss1, uint8_t ibs1, uint16_t dbss2, uint8_t ibs2,
5595     const zbookmark_phys_t *zb1, const zbookmark_phys_t *zb2)
5596 {
5597 	/*
5598 	 * These variables represent the "equivalent" values for the zbookmark,
5599 	 * after converting zbookmarks inside the meta dnode to their
5600 	 * normal-object equivalents.
5601 	 */
5602 	uint64_t zb1obj, zb2obj;
5603 	uint64_t zb1L0, zb2L0;
5604 	uint64_t zb1level, zb2level;
5605 
5606 	if (zb1->zb_object == zb2->zb_object &&
5607 	    zb1->zb_level == zb2->zb_level &&
5608 	    zb1->zb_blkid == zb2->zb_blkid)
5609 		return (0);
5610 
5611 	IMPLY(zb1->zb_level > 0, ibs1 >= SPA_MINBLOCKSHIFT);
5612 	IMPLY(zb2->zb_level > 0, ibs2 >= SPA_MINBLOCKSHIFT);
5613 
5614 	/*
5615 	 * BP_SPANB calculates the span in blocks.
5616 	 */
5617 	zb1L0 = (zb1->zb_blkid) * BP_SPANB(ibs1, zb1->zb_level);
5618 	zb2L0 = (zb2->zb_blkid) * BP_SPANB(ibs2, zb2->zb_level);
5619 
5620 	if (zb1->zb_object == DMU_META_DNODE_OBJECT) {
5621 		zb1obj = zb1L0 * (dbss1 << (SPA_MINBLOCKSHIFT - DNODE_SHIFT));
5622 		zb1L0 = 0;
5623 		zb1level = zb1->zb_level + COMPARE_META_LEVEL;
5624 	} else {
5625 		zb1obj = zb1->zb_object;
5626 		zb1level = zb1->zb_level;
5627 	}
5628 
5629 	if (zb2->zb_object == DMU_META_DNODE_OBJECT) {
5630 		zb2obj = zb2L0 * (dbss2 << (SPA_MINBLOCKSHIFT - DNODE_SHIFT));
5631 		zb2L0 = 0;
5632 		zb2level = zb2->zb_level + COMPARE_META_LEVEL;
5633 	} else {
5634 		zb2obj = zb2->zb_object;
5635 		zb2level = zb2->zb_level;
5636 	}
5637 
5638 	/* Now that we have a canonical representation, do the comparison. */
5639 	if (zb1obj != zb2obj)
5640 		return (zb1obj < zb2obj ? -1 : 1);
5641 	else if (zb1L0 != zb2L0)
5642 		return (zb1L0 < zb2L0 ? -1 : 1);
5643 	else if (zb1level != zb2level)
5644 		return (zb1level > zb2level ? -1 : 1);
5645 	/*
5646 	 * This can (theoretically) happen if the bookmarks have the same object
5647 	 * and level, but different blkids, if the block sizes are not the same.
5648 	 * There is presently no way to change the indirect block sizes
5649 	 */
5650 	return (0);
5651 }
5652 
5653 /*
5654  *  This function checks the following: given that last_block is the place that
5655  *  our traversal stopped last time, does that guarantee that we've visited
5656  *  every node under subtree_root?  Therefore, we can't just use the raw output
5657  *  of zbookmark_compare.  We have to pass in a modified version of
5658  *  subtree_root; by incrementing the block id, and then checking whether
5659  *  last_block is before or equal to that, we can tell whether or not having
5660  *  visited last_block implies that all of subtree_root's children have been
5661  *  visited.
5662  */
5663 boolean_t
5664 zbookmark_subtree_completed(const dnode_phys_t *dnp,
5665     const zbookmark_phys_t *subtree_root, const zbookmark_phys_t *last_block)
5666 {
5667 	zbookmark_phys_t mod_zb = *subtree_root;
5668 	mod_zb.zb_blkid++;
5669 	ASSERT0(last_block->zb_level);
5670 
5671 	/* The objset_phys_t isn't before anything. */
5672 	if (dnp == NULL)
5673 		return (B_FALSE);
5674 
5675 	/*
5676 	 * We pass in 1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT) for the
5677 	 * data block size in sectors, because that variable is only used if
5678 	 * the bookmark refers to a block in the meta-dnode.  Since we don't
5679 	 * know without examining it what object it refers to, and there's no
5680 	 * harm in passing in this value in other cases, we always pass it in.
5681 	 *
5682 	 * We pass in 0 for the indirect block size shift because zb2 must be
5683 	 * level 0.  The indirect block size is only used to calculate the span
5684 	 * of the bookmark, but since the bookmark must be level 0, the span is
5685 	 * always 1, so the math works out.
5686 	 *
5687 	 * If you make changes to how the zbookmark_compare code works, be sure
5688 	 * to make sure that this code still works afterwards.
5689 	 */
5690 	return (zbookmark_compare(dnp->dn_datablkszsec, dnp->dn_indblkshift,
5691 	    1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT), 0, &mod_zb,
5692 	    last_block) <= 0);
5693 }
5694 
5695 /*
5696  * This function is similar to zbookmark_subtree_completed(), but returns true
5697  * if subtree_root is equal or ahead of last_block, i.e. still to be done.
5698  */
5699 boolean_t
5700 zbookmark_subtree_tbd(const dnode_phys_t *dnp,
5701     const zbookmark_phys_t *subtree_root, const zbookmark_phys_t *last_block)
5702 {
5703 	ASSERT0(last_block->zb_level);
5704 	if (dnp == NULL)
5705 		return (B_FALSE);
5706 	return (zbookmark_compare(dnp->dn_datablkszsec, dnp->dn_indblkshift,
5707 	    1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT), 0, subtree_root,
5708 	    last_block) >= 0);
5709 }
5710 
5711 EXPORT_SYMBOL(zio_type_name);
5712 EXPORT_SYMBOL(zio_buf_alloc);
5713 EXPORT_SYMBOL(zio_data_buf_alloc);
5714 EXPORT_SYMBOL(zio_buf_free);
5715 EXPORT_SYMBOL(zio_data_buf_free);
5716 
5717 ZFS_MODULE_PARAM(zfs_zio, zio_, slow_io_ms, INT, ZMOD_RW,
5718 	"Max I/O completion time (milliseconds) before marking it as slow");
5719 
5720 ZFS_MODULE_PARAM(zfs_zio, zio_, requeue_io_start_cut_in_line, INT, ZMOD_RW,
5721 	"Prioritize requeued I/O");
5722 
5723 ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_deferred_free,  UINT, ZMOD_RW,
5724 	"Defer frees starting in this pass");
5725 
5726 ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_dont_compress, UINT, ZMOD_RW,
5727 	"Don't compress starting in this pass");
5728 
5729 ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_rewrite, UINT, ZMOD_RW,
5730 	"Rewrite new bps starting in this pass");
5731 
5732 ZFS_MODULE_PARAM(zfs_zio, zio_, dva_throttle_enabled, INT, ZMOD_RW,
5733 	"Throttle block allocations in the ZIO pipeline");
5734 
5735 ZFS_MODULE_PARAM(zfs_zio, zio_, deadman_log_all, INT, ZMOD_RW,
5736 	"Log all slow ZIOs, not just those with vdevs");
5737