xref: /freebsd/sys/contrib/openzfs/module/zfs/zio.c (revision a2b560cc69eb254c92caf2027a69cadf9865d273)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or https://opensource.org/licenses/CDDL-1.0.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2011, 2022 by Delphix. All rights reserved.
24  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
25  * Copyright (c) 2017, Intel Corporation.
26  * Copyright (c) 2019, Klara Inc.
27  * Copyright (c) 2019, Allan Jude
28  * Copyright (c) 2021, Datto, Inc.
29  */
30 
31 #include <sys/sysmacros.h>
32 #include <sys/zfs_context.h>
33 #include <sys/fm/fs/zfs.h>
34 #include <sys/spa.h>
35 #include <sys/txg.h>
36 #include <sys/spa_impl.h>
37 #include <sys/vdev_impl.h>
38 #include <sys/vdev_trim.h>
39 #include <sys/zio_impl.h>
40 #include <sys/zio_compress.h>
41 #include <sys/zio_checksum.h>
42 #include <sys/dmu_objset.h>
43 #include <sys/arc.h>
44 #include <sys/brt.h>
45 #include <sys/ddt.h>
46 #include <sys/blkptr.h>
47 #include <sys/zfeature.h>
48 #include <sys/dsl_scan.h>
49 #include <sys/metaslab_impl.h>
50 #include <sys/time.h>
51 #include <sys/trace_zfs.h>
52 #include <sys/abd.h>
53 #include <sys/dsl_crypt.h>
54 #include <cityhash.h>
55 
56 /*
57  * ==========================================================================
58  * I/O type descriptions
59  * ==========================================================================
60  */
61 const char *const zio_type_name[ZIO_TYPES] = {
62 	/*
63 	 * Note: Linux kernel thread name length is limited
64 	 * so these names will differ from upstream open zfs.
65 	 */
66 	"z_null", "z_rd", "z_wr", "z_fr", "z_cl", "z_ioctl", "z_trim"
67 };
68 
69 int zio_dva_throttle_enabled = B_TRUE;
70 static int zio_deadman_log_all = B_FALSE;
71 
72 /*
73  * ==========================================================================
74  * I/O kmem caches
75  * ==========================================================================
76  */
77 static kmem_cache_t *zio_cache;
78 static kmem_cache_t *zio_link_cache;
79 kmem_cache_t *zio_buf_cache[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
80 kmem_cache_t *zio_data_buf_cache[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
81 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
82 static uint64_t zio_buf_cache_allocs[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
83 static uint64_t zio_buf_cache_frees[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
84 #endif
85 
86 /* Mark IOs as "slow" if they take longer than 30 seconds */
87 static uint_t zio_slow_io_ms = (30 * MILLISEC);
88 
89 #define	BP_SPANB(indblkshift, level) \
90 	(((uint64_t)1) << ((level) * ((indblkshift) - SPA_BLKPTRSHIFT)))
91 #define	COMPARE_META_LEVEL	0x80000000ul
92 /*
93  * The following actions directly effect the spa's sync-to-convergence logic.
94  * The values below define the sync pass when we start performing the action.
95  * Care should be taken when changing these values as they directly impact
96  * spa_sync() performance. Tuning these values may introduce subtle performance
97  * pathologies and should only be done in the context of performance analysis.
98  * These tunables will eventually be removed and replaced with #defines once
99  * enough analysis has been done to determine optimal values.
100  *
101  * The 'zfs_sync_pass_deferred_free' pass must be greater than 1 to ensure that
102  * regular blocks are not deferred.
103  *
104  * Starting in sync pass 8 (zfs_sync_pass_dont_compress), we disable
105  * compression (including of metadata).  In practice, we don't have this
106  * many sync passes, so this has no effect.
107  *
108  * The original intent was that disabling compression would help the sync
109  * passes to converge. However, in practice disabling compression increases
110  * the average number of sync passes, because when we turn compression off, a
111  * lot of block's size will change and thus we have to re-allocate (not
112  * overwrite) them. It also increases the number of 128KB allocations (e.g.
113  * for indirect blocks and spacemaps) because these will not be compressed.
114  * The 128K allocations are especially detrimental to performance on highly
115  * fragmented systems, which may have very few free segments of this size,
116  * and may need to load new metaslabs to satisfy 128K allocations.
117  */
118 
119 /* defer frees starting in this pass */
120 uint_t zfs_sync_pass_deferred_free = 2;
121 
122 /* don't compress starting in this pass */
123 static uint_t zfs_sync_pass_dont_compress = 8;
124 
125 /* rewrite new bps starting in this pass */
126 static uint_t zfs_sync_pass_rewrite = 2;
127 
128 /*
129  * An allocating zio is one that either currently has the DVA allocate
130  * stage set or will have it later in its lifetime.
131  */
132 #define	IO_IS_ALLOCATING(zio) ((zio)->io_orig_pipeline & ZIO_STAGE_DVA_ALLOCATE)
133 
134 /*
135  * Enable smaller cores by excluding metadata
136  * allocations as well.
137  */
138 int zio_exclude_metadata = 0;
139 static int zio_requeue_io_start_cut_in_line = 1;
140 
141 #ifdef ZFS_DEBUG
142 static const int zio_buf_debug_limit = 16384;
143 #else
144 static const int zio_buf_debug_limit = 0;
145 #endif
146 
147 static inline void __zio_execute(zio_t *zio);
148 
149 static void zio_taskq_dispatch(zio_t *, zio_taskq_type_t, boolean_t);
150 
151 void
152 zio_init(void)
153 {
154 	size_t c;
155 
156 	zio_cache = kmem_cache_create("zio_cache",
157 	    sizeof (zio_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
158 	zio_link_cache = kmem_cache_create("zio_link_cache",
159 	    sizeof (zio_link_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
160 
161 	for (c = 0; c < SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT; c++) {
162 		size_t size = (c + 1) << SPA_MINBLOCKSHIFT;
163 		size_t align, cflags, data_cflags;
164 		char name[32];
165 
166 		/*
167 		 * Create cache for each half-power of 2 size, starting from
168 		 * SPA_MINBLOCKSIZE.  It should give us memory space efficiency
169 		 * of ~7/8, sufficient for transient allocations mostly using
170 		 * these caches.
171 		 */
172 		size_t p2 = size;
173 		while (!ISP2(p2))
174 			p2 &= p2 - 1;
175 		if (!IS_P2ALIGNED(size, p2 / 2))
176 			continue;
177 
178 #ifndef _KERNEL
179 		/*
180 		 * If we are using watchpoints, put each buffer on its own page,
181 		 * to eliminate the performance overhead of trapping to the
182 		 * kernel when modifying a non-watched buffer that shares the
183 		 * page with a watched buffer.
184 		 */
185 		if (arc_watch && !IS_P2ALIGNED(size, PAGESIZE))
186 			continue;
187 #endif
188 
189 		if (IS_P2ALIGNED(size, PAGESIZE))
190 			align = PAGESIZE;
191 		else
192 			align = 1 << (highbit64(size ^ (size - 1)) - 1);
193 
194 		cflags = (zio_exclude_metadata || size > zio_buf_debug_limit) ?
195 		    KMC_NODEBUG : 0;
196 		data_cflags = KMC_NODEBUG;
197 		if (cflags == data_cflags) {
198 			/*
199 			 * Resulting kmem caches would be identical.
200 			 * Save memory by creating only one.
201 			 */
202 			(void) snprintf(name, sizeof (name),
203 			    "zio_buf_comb_%lu", (ulong_t)size);
204 			zio_buf_cache[c] = kmem_cache_create(name, size, align,
205 			    NULL, NULL, NULL, NULL, NULL, cflags);
206 			zio_data_buf_cache[c] = zio_buf_cache[c];
207 			continue;
208 		}
209 		(void) snprintf(name, sizeof (name), "zio_buf_%lu",
210 		    (ulong_t)size);
211 		zio_buf_cache[c] = kmem_cache_create(name, size, align,
212 		    NULL, NULL, NULL, NULL, NULL, cflags);
213 
214 		(void) snprintf(name, sizeof (name), "zio_data_buf_%lu",
215 		    (ulong_t)size);
216 		zio_data_buf_cache[c] = kmem_cache_create(name, size, align,
217 		    NULL, NULL, NULL, NULL, NULL, data_cflags);
218 	}
219 
220 	while (--c != 0) {
221 		ASSERT(zio_buf_cache[c] != NULL);
222 		if (zio_buf_cache[c - 1] == NULL)
223 			zio_buf_cache[c - 1] = zio_buf_cache[c];
224 
225 		ASSERT(zio_data_buf_cache[c] != NULL);
226 		if (zio_data_buf_cache[c - 1] == NULL)
227 			zio_data_buf_cache[c - 1] = zio_data_buf_cache[c];
228 	}
229 
230 	zio_inject_init();
231 
232 	lz4_init();
233 }
234 
235 void
236 zio_fini(void)
237 {
238 	size_t n = SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT;
239 
240 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
241 	for (size_t i = 0; i < n; i++) {
242 		if (zio_buf_cache_allocs[i] != zio_buf_cache_frees[i])
243 			(void) printf("zio_fini: [%d] %llu != %llu\n",
244 			    (int)((i + 1) << SPA_MINBLOCKSHIFT),
245 			    (long long unsigned)zio_buf_cache_allocs[i],
246 			    (long long unsigned)zio_buf_cache_frees[i]);
247 	}
248 #endif
249 
250 	/*
251 	 * The same kmem cache can show up multiple times in both zio_buf_cache
252 	 * and zio_data_buf_cache. Do a wasteful but trivially correct scan to
253 	 * sort it out.
254 	 */
255 	for (size_t i = 0; i < n; i++) {
256 		kmem_cache_t *cache = zio_buf_cache[i];
257 		if (cache == NULL)
258 			continue;
259 		for (size_t j = i; j < n; j++) {
260 			if (cache == zio_buf_cache[j])
261 				zio_buf_cache[j] = NULL;
262 			if (cache == zio_data_buf_cache[j])
263 				zio_data_buf_cache[j] = NULL;
264 		}
265 		kmem_cache_destroy(cache);
266 	}
267 
268 	for (size_t i = 0; i < n; i++) {
269 		kmem_cache_t *cache = zio_data_buf_cache[i];
270 		if (cache == NULL)
271 			continue;
272 		for (size_t j = i; j < n; j++) {
273 			if (cache == zio_data_buf_cache[j])
274 				zio_data_buf_cache[j] = NULL;
275 		}
276 		kmem_cache_destroy(cache);
277 	}
278 
279 	for (size_t i = 0; i < n; i++) {
280 		VERIFY3P(zio_buf_cache[i], ==, NULL);
281 		VERIFY3P(zio_data_buf_cache[i], ==, NULL);
282 	}
283 
284 	kmem_cache_destroy(zio_link_cache);
285 	kmem_cache_destroy(zio_cache);
286 
287 	zio_inject_fini();
288 
289 	lz4_fini();
290 }
291 
292 /*
293  * ==========================================================================
294  * Allocate and free I/O buffers
295  * ==========================================================================
296  */
297 
298 /*
299  * Use zio_buf_alloc to allocate ZFS metadata.  This data will appear in a
300  * crashdump if the kernel panics, so use it judiciously.  Obviously, it's
301  * useful to inspect ZFS metadata, but if possible, we should avoid keeping
302  * excess / transient data in-core during a crashdump.
303  */
304 void *
305 zio_buf_alloc(size_t size)
306 {
307 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
308 
309 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
310 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
311 	atomic_add_64(&zio_buf_cache_allocs[c], 1);
312 #endif
313 
314 	return (kmem_cache_alloc(zio_buf_cache[c], KM_PUSHPAGE));
315 }
316 
317 /*
318  * Use zio_data_buf_alloc to allocate data.  The data will not appear in a
319  * crashdump if the kernel panics.  This exists so that we will limit the amount
320  * of ZFS data that shows up in a kernel crashdump.  (Thus reducing the amount
321  * of kernel heap dumped to disk when the kernel panics)
322  */
323 void *
324 zio_data_buf_alloc(size_t size)
325 {
326 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
327 
328 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
329 
330 	return (kmem_cache_alloc(zio_data_buf_cache[c], KM_PUSHPAGE));
331 }
332 
333 void
334 zio_buf_free(void *buf, size_t size)
335 {
336 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
337 
338 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
339 #if defined(ZFS_DEBUG) && !defined(_KERNEL)
340 	atomic_add_64(&zio_buf_cache_frees[c], 1);
341 #endif
342 
343 	kmem_cache_free(zio_buf_cache[c], buf);
344 }
345 
346 void
347 zio_data_buf_free(void *buf, size_t size)
348 {
349 	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;
350 
351 	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
352 
353 	kmem_cache_free(zio_data_buf_cache[c], buf);
354 }
355 
356 static void
357 zio_abd_free(void *abd, size_t size)
358 {
359 	(void) size;
360 	abd_free((abd_t *)abd);
361 }
362 
363 /*
364  * ==========================================================================
365  * Push and pop I/O transform buffers
366  * ==========================================================================
367  */
368 void
369 zio_push_transform(zio_t *zio, abd_t *data, uint64_t size, uint64_t bufsize,
370     zio_transform_func_t *transform)
371 {
372 	zio_transform_t *zt = kmem_alloc(sizeof (zio_transform_t), KM_SLEEP);
373 
374 	zt->zt_orig_abd = zio->io_abd;
375 	zt->zt_orig_size = zio->io_size;
376 	zt->zt_bufsize = bufsize;
377 	zt->zt_transform = transform;
378 
379 	zt->zt_next = zio->io_transform_stack;
380 	zio->io_transform_stack = zt;
381 
382 	zio->io_abd = data;
383 	zio->io_size = size;
384 }
385 
386 void
387 zio_pop_transforms(zio_t *zio)
388 {
389 	zio_transform_t *zt;
390 
391 	while ((zt = zio->io_transform_stack) != NULL) {
392 		if (zt->zt_transform != NULL)
393 			zt->zt_transform(zio,
394 			    zt->zt_orig_abd, zt->zt_orig_size);
395 
396 		if (zt->zt_bufsize != 0)
397 			abd_free(zio->io_abd);
398 
399 		zio->io_abd = zt->zt_orig_abd;
400 		zio->io_size = zt->zt_orig_size;
401 		zio->io_transform_stack = zt->zt_next;
402 
403 		kmem_free(zt, sizeof (zio_transform_t));
404 	}
405 }
406 
407 /*
408  * ==========================================================================
409  * I/O transform callbacks for subblocks, decompression, and decryption
410  * ==========================================================================
411  */
412 static void
413 zio_subblock(zio_t *zio, abd_t *data, uint64_t size)
414 {
415 	ASSERT(zio->io_size > size);
416 
417 	if (zio->io_type == ZIO_TYPE_READ)
418 		abd_copy(data, zio->io_abd, size);
419 }
420 
421 static void
422 zio_decompress(zio_t *zio, abd_t *data, uint64_t size)
423 {
424 	if (zio->io_error == 0) {
425 		void *tmp = abd_borrow_buf(data, size);
426 		int ret = zio_decompress_data(BP_GET_COMPRESS(zio->io_bp),
427 		    zio->io_abd, tmp, zio->io_size, size,
428 		    &zio->io_prop.zp_complevel);
429 		abd_return_buf_copy(data, tmp, size);
430 
431 		if (zio_injection_enabled && ret == 0)
432 			ret = zio_handle_fault_injection(zio, EINVAL);
433 
434 		if (ret != 0)
435 			zio->io_error = SET_ERROR(EIO);
436 	}
437 }
438 
439 static void
440 zio_decrypt(zio_t *zio, abd_t *data, uint64_t size)
441 {
442 	int ret;
443 	void *tmp;
444 	blkptr_t *bp = zio->io_bp;
445 	spa_t *spa = zio->io_spa;
446 	uint64_t dsobj = zio->io_bookmark.zb_objset;
447 	uint64_t lsize = BP_GET_LSIZE(bp);
448 	dmu_object_type_t ot = BP_GET_TYPE(bp);
449 	uint8_t salt[ZIO_DATA_SALT_LEN];
450 	uint8_t iv[ZIO_DATA_IV_LEN];
451 	uint8_t mac[ZIO_DATA_MAC_LEN];
452 	boolean_t no_crypt = B_FALSE;
453 
454 	ASSERT(BP_USES_CRYPT(bp));
455 	ASSERT3U(size, !=, 0);
456 
457 	if (zio->io_error != 0)
458 		return;
459 
460 	/*
461 	 * Verify the cksum of MACs stored in an indirect bp. It will always
462 	 * be possible to verify this since it does not require an encryption
463 	 * key.
464 	 */
465 	if (BP_HAS_INDIRECT_MAC_CKSUM(bp)) {
466 		zio_crypt_decode_mac_bp(bp, mac);
467 
468 		if (BP_GET_COMPRESS(bp) != ZIO_COMPRESS_OFF) {
469 			/*
470 			 * We haven't decompressed the data yet, but
471 			 * zio_crypt_do_indirect_mac_checksum() requires
472 			 * decompressed data to be able to parse out the MACs
473 			 * from the indirect block. We decompress it now and
474 			 * throw away the result after we are finished.
475 			 */
476 			tmp = zio_buf_alloc(lsize);
477 			ret = zio_decompress_data(BP_GET_COMPRESS(bp),
478 			    zio->io_abd, tmp, zio->io_size, lsize,
479 			    &zio->io_prop.zp_complevel);
480 			if (ret != 0) {
481 				ret = SET_ERROR(EIO);
482 				goto error;
483 			}
484 			ret = zio_crypt_do_indirect_mac_checksum(B_FALSE,
485 			    tmp, lsize, BP_SHOULD_BYTESWAP(bp), mac);
486 			zio_buf_free(tmp, lsize);
487 		} else {
488 			ret = zio_crypt_do_indirect_mac_checksum_abd(B_FALSE,
489 			    zio->io_abd, size, BP_SHOULD_BYTESWAP(bp), mac);
490 		}
491 		abd_copy(data, zio->io_abd, size);
492 
493 		if (zio_injection_enabled && ot != DMU_OT_DNODE && ret == 0) {
494 			ret = zio_handle_decrypt_injection(spa,
495 			    &zio->io_bookmark, ot, ECKSUM);
496 		}
497 		if (ret != 0)
498 			goto error;
499 
500 		return;
501 	}
502 
503 	/*
504 	 * If this is an authenticated block, just check the MAC. It would be
505 	 * nice to separate this out into its own flag, but when this was done,
506 	 * we had run out of bits in what is now zio_flag_t. Future cleanup
507 	 * could make this a flag bit.
508 	 */
509 	if (BP_IS_AUTHENTICATED(bp)) {
510 		if (ot == DMU_OT_OBJSET) {
511 			ret = spa_do_crypt_objset_mac_abd(B_FALSE, spa,
512 			    dsobj, zio->io_abd, size, BP_SHOULD_BYTESWAP(bp));
513 		} else {
514 			zio_crypt_decode_mac_bp(bp, mac);
515 			ret = spa_do_crypt_mac_abd(B_FALSE, spa, dsobj,
516 			    zio->io_abd, size, mac);
517 			if (zio_injection_enabled && ret == 0) {
518 				ret = zio_handle_decrypt_injection(spa,
519 				    &zio->io_bookmark, ot, ECKSUM);
520 			}
521 		}
522 		abd_copy(data, zio->io_abd, size);
523 
524 		if (ret != 0)
525 			goto error;
526 
527 		return;
528 	}
529 
530 	zio_crypt_decode_params_bp(bp, salt, iv);
531 
532 	if (ot == DMU_OT_INTENT_LOG) {
533 		tmp = abd_borrow_buf_copy(zio->io_abd, sizeof (zil_chain_t));
534 		zio_crypt_decode_mac_zil(tmp, mac);
535 		abd_return_buf(zio->io_abd, tmp, sizeof (zil_chain_t));
536 	} else {
537 		zio_crypt_decode_mac_bp(bp, mac);
538 	}
539 
540 	ret = spa_do_crypt_abd(B_FALSE, spa, &zio->io_bookmark, BP_GET_TYPE(bp),
541 	    BP_GET_DEDUP(bp), BP_SHOULD_BYTESWAP(bp), salt, iv, mac, size, data,
542 	    zio->io_abd, &no_crypt);
543 	if (no_crypt)
544 		abd_copy(data, zio->io_abd, size);
545 
546 	if (ret != 0)
547 		goto error;
548 
549 	return;
550 
551 error:
552 	/* assert that the key was found unless this was speculative */
553 	ASSERT(ret != EACCES || (zio->io_flags & ZIO_FLAG_SPECULATIVE));
554 
555 	/*
556 	 * If there was a decryption / authentication error return EIO as
557 	 * the io_error. If this was not a speculative zio, create an ereport.
558 	 */
559 	if (ret == ECKSUM) {
560 		zio->io_error = SET_ERROR(EIO);
561 		if ((zio->io_flags & ZIO_FLAG_SPECULATIVE) == 0) {
562 			spa_log_error(spa, &zio->io_bookmark,
563 			    &zio->io_bp->blk_birth);
564 			(void) zfs_ereport_post(FM_EREPORT_ZFS_AUTHENTICATION,
565 			    spa, NULL, &zio->io_bookmark, zio, 0);
566 		}
567 	} else {
568 		zio->io_error = ret;
569 	}
570 }
571 
572 /*
573  * ==========================================================================
574  * I/O parent/child relationships and pipeline interlocks
575  * ==========================================================================
576  */
577 zio_t *
578 zio_walk_parents(zio_t *cio, zio_link_t **zl)
579 {
580 	list_t *pl = &cio->io_parent_list;
581 
582 	*zl = (*zl == NULL) ? list_head(pl) : list_next(pl, *zl);
583 	if (*zl == NULL)
584 		return (NULL);
585 
586 	ASSERT((*zl)->zl_child == cio);
587 	return ((*zl)->zl_parent);
588 }
589 
590 zio_t *
591 zio_walk_children(zio_t *pio, zio_link_t **zl)
592 {
593 	list_t *cl = &pio->io_child_list;
594 
595 	ASSERT(MUTEX_HELD(&pio->io_lock));
596 
597 	*zl = (*zl == NULL) ? list_head(cl) : list_next(cl, *zl);
598 	if (*zl == NULL)
599 		return (NULL);
600 
601 	ASSERT((*zl)->zl_parent == pio);
602 	return ((*zl)->zl_child);
603 }
604 
605 zio_t *
606 zio_unique_parent(zio_t *cio)
607 {
608 	zio_link_t *zl = NULL;
609 	zio_t *pio = zio_walk_parents(cio, &zl);
610 
611 	VERIFY3P(zio_walk_parents(cio, &zl), ==, NULL);
612 	return (pio);
613 }
614 
615 void
616 zio_add_child(zio_t *pio, zio_t *cio)
617 {
618 	/*
619 	 * Logical I/Os can have logical, gang, or vdev children.
620 	 * Gang I/Os can have gang or vdev children.
621 	 * Vdev I/Os can only have vdev children.
622 	 * The following ASSERT captures all of these constraints.
623 	 */
624 	ASSERT3S(cio->io_child_type, <=, pio->io_child_type);
625 
626 	/* Parent should not have READY stage if child doesn't have it. */
627 	IMPLY((cio->io_pipeline & ZIO_STAGE_READY) == 0 &&
628 	    (cio->io_child_type != ZIO_CHILD_VDEV),
629 	    (pio->io_pipeline & ZIO_STAGE_READY) == 0);
630 
631 	zio_link_t *zl = kmem_cache_alloc(zio_link_cache, KM_SLEEP);
632 	zl->zl_parent = pio;
633 	zl->zl_child = cio;
634 
635 	mutex_enter(&pio->io_lock);
636 	mutex_enter(&cio->io_lock);
637 
638 	ASSERT(pio->io_state[ZIO_WAIT_DONE] == 0);
639 
640 	uint64_t *countp = pio->io_children[cio->io_child_type];
641 	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
642 		countp[w] += !cio->io_state[w];
643 
644 	list_insert_head(&pio->io_child_list, zl);
645 	list_insert_head(&cio->io_parent_list, zl);
646 
647 	mutex_exit(&cio->io_lock);
648 	mutex_exit(&pio->io_lock);
649 }
650 
651 void
652 zio_add_child_first(zio_t *pio, zio_t *cio)
653 {
654 	/*
655 	 * Logical I/Os can have logical, gang, or vdev children.
656 	 * Gang I/Os can have gang or vdev children.
657 	 * Vdev I/Os can only have vdev children.
658 	 * The following ASSERT captures all of these constraints.
659 	 */
660 	ASSERT3S(cio->io_child_type, <=, pio->io_child_type);
661 
662 	/* Parent should not have READY stage if child doesn't have it. */
663 	IMPLY((cio->io_pipeline & ZIO_STAGE_READY) == 0 &&
664 	    (cio->io_child_type != ZIO_CHILD_VDEV),
665 	    (pio->io_pipeline & ZIO_STAGE_READY) == 0);
666 
667 	zio_link_t *zl = kmem_cache_alloc(zio_link_cache, KM_SLEEP);
668 	zl->zl_parent = pio;
669 	zl->zl_child = cio;
670 
671 	ASSERT(list_is_empty(&cio->io_parent_list));
672 	list_insert_head(&cio->io_parent_list, zl);
673 
674 	mutex_enter(&pio->io_lock);
675 
676 	ASSERT(pio->io_state[ZIO_WAIT_DONE] == 0);
677 
678 	uint64_t *countp = pio->io_children[cio->io_child_type];
679 	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
680 		countp[w] += !cio->io_state[w];
681 
682 	list_insert_head(&pio->io_child_list, zl);
683 
684 	mutex_exit(&pio->io_lock);
685 }
686 
687 static void
688 zio_remove_child(zio_t *pio, zio_t *cio, zio_link_t *zl)
689 {
690 	ASSERT(zl->zl_parent == pio);
691 	ASSERT(zl->zl_child == cio);
692 
693 	mutex_enter(&pio->io_lock);
694 	mutex_enter(&cio->io_lock);
695 
696 	list_remove(&pio->io_child_list, zl);
697 	list_remove(&cio->io_parent_list, zl);
698 
699 	mutex_exit(&cio->io_lock);
700 	mutex_exit(&pio->io_lock);
701 	kmem_cache_free(zio_link_cache, zl);
702 }
703 
704 static boolean_t
705 zio_wait_for_children(zio_t *zio, uint8_t childbits, enum zio_wait_type wait)
706 {
707 	boolean_t waiting = B_FALSE;
708 
709 	mutex_enter(&zio->io_lock);
710 	ASSERT(zio->io_stall == NULL);
711 	for (int c = 0; c < ZIO_CHILD_TYPES; c++) {
712 		if (!(ZIO_CHILD_BIT_IS_SET(childbits, c)))
713 			continue;
714 
715 		uint64_t *countp = &zio->io_children[c][wait];
716 		if (*countp != 0) {
717 			zio->io_stage >>= 1;
718 			ASSERT3U(zio->io_stage, !=, ZIO_STAGE_OPEN);
719 			zio->io_stall = countp;
720 			waiting = B_TRUE;
721 			break;
722 		}
723 	}
724 	mutex_exit(&zio->io_lock);
725 	return (waiting);
726 }
727 
728 __attribute__((always_inline))
729 static inline void
730 zio_notify_parent(zio_t *pio, zio_t *zio, enum zio_wait_type wait,
731     zio_t **next_to_executep)
732 {
733 	uint64_t *countp = &pio->io_children[zio->io_child_type][wait];
734 	int *errorp = &pio->io_child_error[zio->io_child_type];
735 
736 	mutex_enter(&pio->io_lock);
737 	if (zio->io_error && !(zio->io_flags & ZIO_FLAG_DONT_PROPAGATE))
738 		*errorp = zio_worst_error(*errorp, zio->io_error);
739 	pio->io_reexecute |= zio->io_reexecute;
740 	ASSERT3U(*countp, >, 0);
741 
742 	(*countp)--;
743 
744 	if (*countp == 0 && pio->io_stall == countp) {
745 		zio_taskq_type_t type =
746 		    pio->io_stage < ZIO_STAGE_VDEV_IO_START ? ZIO_TASKQ_ISSUE :
747 		    ZIO_TASKQ_INTERRUPT;
748 		pio->io_stall = NULL;
749 		mutex_exit(&pio->io_lock);
750 
751 		/*
752 		 * If we can tell the caller to execute this parent next, do
753 		 * so. We only do this if the parent's zio type matches the
754 		 * child's type. Otherwise dispatch the parent zio in its
755 		 * own taskq.
756 		 *
757 		 * Having the caller execute the parent when possible reduces
758 		 * locking on the zio taskq's, reduces context switch
759 		 * overhead, and has no recursion penalty.  Note that one
760 		 * read from disk typically causes at least 3 zio's: a
761 		 * zio_null(), the logical zio_read(), and then a physical
762 		 * zio.  When the physical ZIO completes, we are able to call
763 		 * zio_done() on all 3 of these zio's from one invocation of
764 		 * zio_execute() by returning the parent back to
765 		 * zio_execute().  Since the parent isn't executed until this
766 		 * thread returns back to zio_execute(), the caller should do
767 		 * so promptly.
768 		 *
769 		 * In other cases, dispatching the parent prevents
770 		 * overflowing the stack when we have deeply nested
771 		 * parent-child relationships, as we do with the "mega zio"
772 		 * of writes for spa_sync(), and the chain of ZIL blocks.
773 		 */
774 		if (next_to_executep != NULL && *next_to_executep == NULL &&
775 		    pio->io_type == zio->io_type) {
776 			*next_to_executep = pio;
777 		} else {
778 			zio_taskq_dispatch(pio, type, B_FALSE);
779 		}
780 	} else {
781 		mutex_exit(&pio->io_lock);
782 	}
783 }
784 
785 static void
786 zio_inherit_child_errors(zio_t *zio, enum zio_child c)
787 {
788 	if (zio->io_child_error[c] != 0 && zio->io_error == 0)
789 		zio->io_error = zio->io_child_error[c];
790 }
791 
792 int
793 zio_bookmark_compare(const void *x1, const void *x2)
794 {
795 	const zio_t *z1 = x1;
796 	const zio_t *z2 = x2;
797 
798 	if (z1->io_bookmark.zb_objset < z2->io_bookmark.zb_objset)
799 		return (-1);
800 	if (z1->io_bookmark.zb_objset > z2->io_bookmark.zb_objset)
801 		return (1);
802 
803 	if (z1->io_bookmark.zb_object < z2->io_bookmark.zb_object)
804 		return (-1);
805 	if (z1->io_bookmark.zb_object > z2->io_bookmark.zb_object)
806 		return (1);
807 
808 	if (z1->io_bookmark.zb_level < z2->io_bookmark.zb_level)
809 		return (-1);
810 	if (z1->io_bookmark.zb_level > z2->io_bookmark.zb_level)
811 		return (1);
812 
813 	if (z1->io_bookmark.zb_blkid < z2->io_bookmark.zb_blkid)
814 		return (-1);
815 	if (z1->io_bookmark.zb_blkid > z2->io_bookmark.zb_blkid)
816 		return (1);
817 
818 	if (z1 < z2)
819 		return (-1);
820 	if (z1 > z2)
821 		return (1);
822 
823 	return (0);
824 }
825 
826 /*
827  * ==========================================================================
828  * Create the various types of I/O (read, write, free, etc)
829  * ==========================================================================
830  */
831 static zio_t *
832 zio_create(zio_t *pio, spa_t *spa, uint64_t txg, const blkptr_t *bp,
833     abd_t *data, uint64_t lsize, uint64_t psize, zio_done_func_t *done,
834     void *private, zio_type_t type, zio_priority_t priority,
835     zio_flag_t flags, vdev_t *vd, uint64_t offset,
836     const zbookmark_phys_t *zb, enum zio_stage stage,
837     enum zio_stage pipeline)
838 {
839 	zio_t *zio;
840 
841 	IMPLY(type != ZIO_TYPE_TRIM, psize <= SPA_MAXBLOCKSIZE);
842 	ASSERT(P2PHASE(psize, SPA_MINBLOCKSIZE) == 0);
843 	ASSERT(P2PHASE(offset, SPA_MINBLOCKSIZE) == 0);
844 
845 	ASSERT(!vd || spa_config_held(spa, SCL_STATE_ALL, RW_READER));
846 	ASSERT(!bp || !(flags & ZIO_FLAG_CONFIG_WRITER));
847 	ASSERT(vd || stage == ZIO_STAGE_OPEN);
848 
849 	IMPLY(lsize != psize, (flags & ZIO_FLAG_RAW_COMPRESS) != 0);
850 
851 	zio = kmem_cache_alloc(zio_cache, KM_SLEEP);
852 	memset(zio, 0, sizeof (zio_t));
853 
854 	mutex_init(&zio->io_lock, NULL, MUTEX_NOLOCKDEP, NULL);
855 	cv_init(&zio->io_cv, NULL, CV_DEFAULT, NULL);
856 
857 	list_create(&zio->io_parent_list, sizeof (zio_link_t),
858 	    offsetof(zio_link_t, zl_parent_node));
859 	list_create(&zio->io_child_list, sizeof (zio_link_t),
860 	    offsetof(zio_link_t, zl_child_node));
861 	metaslab_trace_init(&zio->io_alloc_list);
862 
863 	if (vd != NULL)
864 		zio->io_child_type = ZIO_CHILD_VDEV;
865 	else if (flags & ZIO_FLAG_GANG_CHILD)
866 		zio->io_child_type = ZIO_CHILD_GANG;
867 	else if (flags & ZIO_FLAG_DDT_CHILD)
868 		zio->io_child_type = ZIO_CHILD_DDT;
869 	else
870 		zio->io_child_type = ZIO_CHILD_LOGICAL;
871 
872 	if (bp != NULL) {
873 		if (type != ZIO_TYPE_WRITE ||
874 		    zio->io_child_type == ZIO_CHILD_DDT) {
875 			zio->io_bp_copy = *bp;
876 			zio->io_bp = &zio->io_bp_copy;	/* so caller can free */
877 		} else {
878 			zio->io_bp = (blkptr_t *)bp;
879 		}
880 		zio->io_bp_orig = *bp;
881 		if (zio->io_child_type == ZIO_CHILD_LOGICAL)
882 			zio->io_logical = zio;
883 		if (zio->io_child_type > ZIO_CHILD_GANG && BP_IS_GANG(bp))
884 			pipeline |= ZIO_GANG_STAGES;
885 	}
886 
887 	zio->io_spa = spa;
888 	zio->io_txg = txg;
889 	zio->io_done = done;
890 	zio->io_private = private;
891 	zio->io_type = type;
892 	zio->io_priority = priority;
893 	zio->io_vd = vd;
894 	zio->io_offset = offset;
895 	zio->io_orig_abd = zio->io_abd = data;
896 	zio->io_orig_size = zio->io_size = psize;
897 	zio->io_lsize = lsize;
898 	zio->io_orig_flags = zio->io_flags = flags;
899 	zio->io_orig_stage = zio->io_stage = stage;
900 	zio->io_orig_pipeline = zio->io_pipeline = pipeline;
901 	zio->io_pipeline_trace = ZIO_STAGE_OPEN;
902 	zio->io_allocator = ZIO_ALLOCATOR_NONE;
903 
904 	zio->io_state[ZIO_WAIT_READY] = (stage >= ZIO_STAGE_READY) ||
905 	    (pipeline & ZIO_STAGE_READY) == 0;
906 	zio->io_state[ZIO_WAIT_DONE] = (stage >= ZIO_STAGE_DONE);
907 
908 	if (zb != NULL)
909 		zio->io_bookmark = *zb;
910 
911 	if (pio != NULL) {
912 		zio->io_metaslab_class = pio->io_metaslab_class;
913 		if (zio->io_logical == NULL)
914 			zio->io_logical = pio->io_logical;
915 		if (zio->io_child_type == ZIO_CHILD_GANG)
916 			zio->io_gang_leader = pio->io_gang_leader;
917 		zio_add_child_first(pio, zio);
918 	}
919 
920 	taskq_init_ent(&zio->io_tqent);
921 
922 	return (zio);
923 }
924 
925 void
926 zio_destroy(zio_t *zio)
927 {
928 	metaslab_trace_fini(&zio->io_alloc_list);
929 	list_destroy(&zio->io_parent_list);
930 	list_destroy(&zio->io_child_list);
931 	mutex_destroy(&zio->io_lock);
932 	cv_destroy(&zio->io_cv);
933 	kmem_cache_free(zio_cache, zio);
934 }
935 
936 /*
937  * ZIO intended to be between others.  Provides synchronization at READY
938  * and DONE pipeline stages and calls the respective callbacks.
939  */
940 zio_t *
941 zio_null(zio_t *pio, spa_t *spa, vdev_t *vd, zio_done_func_t *done,
942     void *private, zio_flag_t flags)
943 {
944 	zio_t *zio;
945 
946 	zio = zio_create(pio, spa, 0, NULL, NULL, 0, 0, done, private,
947 	    ZIO_TYPE_NULL, ZIO_PRIORITY_NOW, flags, vd, 0, NULL,
948 	    ZIO_STAGE_OPEN, ZIO_INTERLOCK_PIPELINE);
949 
950 	return (zio);
951 }
952 
953 /*
954  * ZIO intended to be a root of a tree.  Unlike null ZIO does not have a
955  * READY pipeline stage (is ready on creation), so it should not be used
956  * as child of any ZIO that may need waiting for grandchildren READY stage
957  * (any other ZIO type).
958  */
959 zio_t *
960 zio_root(spa_t *spa, zio_done_func_t *done, void *private, zio_flag_t flags)
961 {
962 	zio_t *zio;
963 
964 	zio = zio_create(NULL, spa, 0, NULL, NULL, 0, 0, done, private,
965 	    ZIO_TYPE_NULL, ZIO_PRIORITY_NOW, flags, NULL, 0, NULL,
966 	    ZIO_STAGE_OPEN, ZIO_ROOT_PIPELINE);
967 
968 	return (zio);
969 }
970 
971 static int
972 zfs_blkptr_verify_log(spa_t *spa, const blkptr_t *bp,
973     enum blk_verify_flag blk_verify, const char *fmt, ...)
974 {
975 	va_list adx;
976 	char buf[256];
977 
978 	va_start(adx, fmt);
979 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
980 	va_end(adx);
981 
982 	zfs_dbgmsg("bad blkptr at %px: "
983 	    "DVA[0]=%#llx/%#llx "
984 	    "DVA[1]=%#llx/%#llx "
985 	    "DVA[2]=%#llx/%#llx "
986 	    "prop=%#llx "
987 	    "pad=%#llx,%#llx "
988 	    "phys_birth=%#llx "
989 	    "birth=%#llx "
990 	    "fill=%#llx "
991 	    "cksum=%#llx/%#llx/%#llx/%#llx",
992 	    bp,
993 	    (long long)bp->blk_dva[0].dva_word[0],
994 	    (long long)bp->blk_dva[0].dva_word[1],
995 	    (long long)bp->blk_dva[1].dva_word[0],
996 	    (long long)bp->blk_dva[1].dva_word[1],
997 	    (long long)bp->blk_dva[2].dva_word[0],
998 	    (long long)bp->blk_dva[2].dva_word[1],
999 	    (long long)bp->blk_prop,
1000 	    (long long)bp->blk_pad[0],
1001 	    (long long)bp->blk_pad[1],
1002 	    (long long)bp->blk_phys_birth,
1003 	    (long long)bp->blk_birth,
1004 	    (long long)bp->blk_fill,
1005 	    (long long)bp->blk_cksum.zc_word[0],
1006 	    (long long)bp->blk_cksum.zc_word[1],
1007 	    (long long)bp->blk_cksum.zc_word[2],
1008 	    (long long)bp->blk_cksum.zc_word[3]);
1009 	switch (blk_verify) {
1010 	case BLK_VERIFY_HALT:
1011 		zfs_panic_recover("%s: %s", spa_name(spa), buf);
1012 		break;
1013 	case BLK_VERIFY_LOG:
1014 		zfs_dbgmsg("%s: %s", spa_name(spa), buf);
1015 		break;
1016 	case BLK_VERIFY_ONLY:
1017 		break;
1018 	}
1019 
1020 	return (1);
1021 }
1022 
1023 /*
1024  * Verify the block pointer fields contain reasonable values.  This means
1025  * it only contains known object types, checksum/compression identifiers,
1026  * block sizes within the maximum allowed limits, valid DVAs, etc.
1027  *
1028  * If everything checks out B_TRUE is returned.  The zfs_blkptr_verify
1029  * argument controls the behavior when an invalid field is detected.
1030  *
1031  * Values for blk_verify_flag:
1032  *   BLK_VERIFY_ONLY: evaluate the block
1033  *   BLK_VERIFY_LOG: evaluate the block and log problems
1034  *   BLK_VERIFY_HALT: call zfs_panic_recover on error
1035  *
1036  * Values for blk_config_flag:
1037  *   BLK_CONFIG_HELD: caller holds SCL_VDEV for writer
1038  *   BLK_CONFIG_NEEDED: caller holds no config lock, SCL_VDEV will be
1039  *   obtained for reader
1040  *   BLK_CONFIG_SKIP: skip checks which require SCL_VDEV, for better
1041  *   performance
1042  */
1043 boolean_t
1044 zfs_blkptr_verify(spa_t *spa, const blkptr_t *bp,
1045     enum blk_config_flag blk_config, enum blk_verify_flag blk_verify)
1046 {
1047 	int errors = 0;
1048 
1049 	if (!DMU_OT_IS_VALID(BP_GET_TYPE(bp))) {
1050 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1051 		    "blkptr at %px has invalid TYPE %llu",
1052 		    bp, (longlong_t)BP_GET_TYPE(bp));
1053 	}
1054 	if (BP_GET_CHECKSUM(bp) >= ZIO_CHECKSUM_FUNCTIONS) {
1055 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1056 		    "blkptr at %px has invalid CHECKSUM %llu",
1057 		    bp, (longlong_t)BP_GET_CHECKSUM(bp));
1058 	}
1059 	if (BP_GET_COMPRESS(bp) >= ZIO_COMPRESS_FUNCTIONS) {
1060 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1061 		    "blkptr at %px has invalid COMPRESS %llu",
1062 		    bp, (longlong_t)BP_GET_COMPRESS(bp));
1063 	}
1064 	if (BP_GET_LSIZE(bp) > SPA_MAXBLOCKSIZE) {
1065 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1066 		    "blkptr at %px has invalid LSIZE %llu",
1067 		    bp, (longlong_t)BP_GET_LSIZE(bp));
1068 	}
1069 	if (BP_GET_PSIZE(bp) > SPA_MAXBLOCKSIZE) {
1070 		errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1071 		    "blkptr at %px has invalid PSIZE %llu",
1072 		    bp, (longlong_t)BP_GET_PSIZE(bp));
1073 	}
1074 
1075 	if (BP_IS_EMBEDDED(bp)) {
1076 		if (BPE_GET_ETYPE(bp) >= NUM_BP_EMBEDDED_TYPES) {
1077 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1078 			    "blkptr at %px has invalid ETYPE %llu",
1079 			    bp, (longlong_t)BPE_GET_ETYPE(bp));
1080 		}
1081 	}
1082 
1083 	/*
1084 	 * Do not verify individual DVAs if the config is not trusted. This
1085 	 * will be done once the zio is executed in vdev_mirror_map_alloc.
1086 	 */
1087 	if (!spa->spa_trust_config)
1088 		return (errors == 0);
1089 
1090 	switch (blk_config) {
1091 	case BLK_CONFIG_HELD:
1092 		ASSERT(spa_config_held(spa, SCL_VDEV, RW_WRITER));
1093 		break;
1094 	case BLK_CONFIG_NEEDED:
1095 		spa_config_enter(spa, SCL_VDEV, bp, RW_READER);
1096 		break;
1097 	case BLK_CONFIG_SKIP:
1098 		return (errors == 0);
1099 	default:
1100 		panic("invalid blk_config %u", blk_config);
1101 	}
1102 
1103 	/*
1104 	 * Pool-specific checks.
1105 	 *
1106 	 * Note: it would be nice to verify that the blk_birth and
1107 	 * BP_PHYSICAL_BIRTH() are not too large.  However, spa_freeze()
1108 	 * allows the birth time of log blocks (and dmu_sync()-ed blocks
1109 	 * that are in the log) to be arbitrarily large.
1110 	 */
1111 	for (int i = 0; i < BP_GET_NDVAS(bp); i++) {
1112 		const dva_t *dva = &bp->blk_dva[i];
1113 		uint64_t vdevid = DVA_GET_VDEV(dva);
1114 
1115 		if (vdevid >= spa->spa_root_vdev->vdev_children) {
1116 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1117 			    "blkptr at %px DVA %u has invalid VDEV %llu",
1118 			    bp, i, (longlong_t)vdevid);
1119 			continue;
1120 		}
1121 		vdev_t *vd = spa->spa_root_vdev->vdev_child[vdevid];
1122 		if (vd == NULL) {
1123 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1124 			    "blkptr at %px DVA %u has invalid VDEV %llu",
1125 			    bp, i, (longlong_t)vdevid);
1126 			continue;
1127 		}
1128 		if (vd->vdev_ops == &vdev_hole_ops) {
1129 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1130 			    "blkptr at %px DVA %u has hole VDEV %llu",
1131 			    bp, i, (longlong_t)vdevid);
1132 			continue;
1133 		}
1134 		if (vd->vdev_ops == &vdev_missing_ops) {
1135 			/*
1136 			 * "missing" vdevs are valid during import, but we
1137 			 * don't have their detailed info (e.g. asize), so
1138 			 * we can't perform any more checks on them.
1139 			 */
1140 			continue;
1141 		}
1142 		uint64_t offset = DVA_GET_OFFSET(dva);
1143 		uint64_t asize = DVA_GET_ASIZE(dva);
1144 		if (DVA_GET_GANG(dva))
1145 			asize = vdev_gang_header_asize(vd);
1146 		if (offset + asize > vd->vdev_asize) {
1147 			errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
1148 			    "blkptr at %px DVA %u has invalid OFFSET %llu",
1149 			    bp, i, (longlong_t)offset);
1150 		}
1151 	}
1152 	if (blk_config == BLK_CONFIG_NEEDED)
1153 		spa_config_exit(spa, SCL_VDEV, bp);
1154 
1155 	return (errors == 0);
1156 }
1157 
1158 boolean_t
1159 zfs_dva_valid(spa_t *spa, const dva_t *dva, const blkptr_t *bp)
1160 {
1161 	(void) bp;
1162 	uint64_t vdevid = DVA_GET_VDEV(dva);
1163 
1164 	if (vdevid >= spa->spa_root_vdev->vdev_children)
1165 		return (B_FALSE);
1166 
1167 	vdev_t *vd = spa->spa_root_vdev->vdev_child[vdevid];
1168 	if (vd == NULL)
1169 		return (B_FALSE);
1170 
1171 	if (vd->vdev_ops == &vdev_hole_ops)
1172 		return (B_FALSE);
1173 
1174 	if (vd->vdev_ops == &vdev_missing_ops) {
1175 		return (B_FALSE);
1176 	}
1177 
1178 	uint64_t offset = DVA_GET_OFFSET(dva);
1179 	uint64_t asize = DVA_GET_ASIZE(dva);
1180 
1181 	if (DVA_GET_GANG(dva))
1182 		asize = vdev_gang_header_asize(vd);
1183 	if (offset + asize > vd->vdev_asize)
1184 		return (B_FALSE);
1185 
1186 	return (B_TRUE);
1187 }
1188 
1189 zio_t *
1190 zio_read(zio_t *pio, spa_t *spa, const blkptr_t *bp,
1191     abd_t *data, uint64_t size, zio_done_func_t *done, void *private,
1192     zio_priority_t priority, zio_flag_t flags, const zbookmark_phys_t *zb)
1193 {
1194 	zio_t *zio;
1195 
1196 	zio = zio_create(pio, spa, BP_PHYSICAL_BIRTH(bp), bp,
1197 	    data, size, size, done, private,
1198 	    ZIO_TYPE_READ, priority, flags, NULL, 0, zb,
1199 	    ZIO_STAGE_OPEN, (flags & ZIO_FLAG_DDT_CHILD) ?
1200 	    ZIO_DDT_CHILD_READ_PIPELINE : ZIO_READ_PIPELINE);
1201 
1202 	return (zio);
1203 }
1204 
1205 zio_t *
1206 zio_write(zio_t *pio, spa_t *spa, uint64_t txg, blkptr_t *bp,
1207     abd_t *data, uint64_t lsize, uint64_t psize, const zio_prop_t *zp,
1208     zio_done_func_t *ready, zio_done_func_t *children_ready,
1209     zio_done_func_t *done, void *private, zio_priority_t priority,
1210     zio_flag_t flags, const zbookmark_phys_t *zb)
1211 {
1212 	zio_t *zio;
1213 
1214 	ASSERT(zp->zp_checksum >= ZIO_CHECKSUM_OFF &&
1215 	    zp->zp_checksum < ZIO_CHECKSUM_FUNCTIONS &&
1216 	    zp->zp_compress >= ZIO_COMPRESS_OFF &&
1217 	    zp->zp_compress < ZIO_COMPRESS_FUNCTIONS &&
1218 	    DMU_OT_IS_VALID(zp->zp_type) &&
1219 	    zp->zp_level < 32 &&
1220 	    zp->zp_copies > 0 &&
1221 	    zp->zp_copies <= spa_max_replication(spa));
1222 
1223 	zio = zio_create(pio, spa, txg, bp, data, lsize, psize, done, private,
1224 	    ZIO_TYPE_WRITE, priority, flags, NULL, 0, zb,
1225 	    ZIO_STAGE_OPEN, (flags & ZIO_FLAG_DDT_CHILD) ?
1226 	    ZIO_DDT_CHILD_WRITE_PIPELINE : ZIO_WRITE_PIPELINE);
1227 
1228 	zio->io_ready = ready;
1229 	zio->io_children_ready = children_ready;
1230 	zio->io_prop = *zp;
1231 
1232 	/*
1233 	 * Data can be NULL if we are going to call zio_write_override() to
1234 	 * provide the already-allocated BP.  But we may need the data to
1235 	 * verify a dedup hit (if requested).  In this case, don't try to
1236 	 * dedup (just take the already-allocated BP verbatim). Encrypted
1237 	 * dedup blocks need data as well so we also disable dedup in this
1238 	 * case.
1239 	 */
1240 	if (data == NULL &&
1241 	    (zio->io_prop.zp_dedup_verify || zio->io_prop.zp_encrypt)) {
1242 		zio->io_prop.zp_dedup = zio->io_prop.zp_dedup_verify = B_FALSE;
1243 	}
1244 
1245 	return (zio);
1246 }
1247 
1248 zio_t *
1249 zio_rewrite(zio_t *pio, spa_t *spa, uint64_t txg, blkptr_t *bp, abd_t *data,
1250     uint64_t size, zio_done_func_t *done, void *private,
1251     zio_priority_t priority, zio_flag_t flags, zbookmark_phys_t *zb)
1252 {
1253 	zio_t *zio;
1254 
1255 	zio = zio_create(pio, spa, txg, bp, data, size, size, done, private,
1256 	    ZIO_TYPE_WRITE, priority, flags | ZIO_FLAG_IO_REWRITE, NULL, 0, zb,
1257 	    ZIO_STAGE_OPEN, ZIO_REWRITE_PIPELINE);
1258 
1259 	return (zio);
1260 }
1261 
1262 void
1263 zio_write_override(zio_t *zio, blkptr_t *bp, int copies, boolean_t nopwrite,
1264     boolean_t brtwrite)
1265 {
1266 	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
1267 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
1268 	ASSERT(zio->io_stage == ZIO_STAGE_OPEN);
1269 	ASSERT(zio->io_txg == spa_syncing_txg(zio->io_spa));
1270 	ASSERT(!brtwrite || !nopwrite);
1271 
1272 	/*
1273 	 * We must reset the io_prop to match the values that existed
1274 	 * when the bp was first written by dmu_sync() keeping in mind
1275 	 * that nopwrite and dedup are mutually exclusive.
1276 	 */
1277 	zio->io_prop.zp_dedup = nopwrite ? B_FALSE : zio->io_prop.zp_dedup;
1278 	zio->io_prop.zp_nopwrite = nopwrite;
1279 	zio->io_prop.zp_brtwrite = brtwrite;
1280 	zio->io_prop.zp_copies = copies;
1281 	zio->io_bp_override = bp;
1282 }
1283 
1284 void
1285 zio_free(spa_t *spa, uint64_t txg, const blkptr_t *bp)
1286 {
1287 
1288 	(void) zfs_blkptr_verify(spa, bp, BLK_CONFIG_NEEDED, BLK_VERIFY_HALT);
1289 
1290 	/*
1291 	 * The check for EMBEDDED is a performance optimization.  We
1292 	 * process the free here (by ignoring it) rather than
1293 	 * putting it on the list and then processing it in zio_free_sync().
1294 	 */
1295 	if (BP_IS_EMBEDDED(bp))
1296 		return;
1297 
1298 	/*
1299 	 * Frees that are for the currently-syncing txg, are not going to be
1300 	 * deferred, and which will not need to do a read (i.e. not GANG or
1301 	 * DEDUP), can be processed immediately.  Otherwise, put them on the
1302 	 * in-memory list for later processing.
1303 	 *
1304 	 * Note that we only defer frees after zfs_sync_pass_deferred_free
1305 	 * when the log space map feature is disabled. [see relevant comment
1306 	 * in spa_sync_iterate_to_convergence()]
1307 	 */
1308 	if (BP_IS_GANG(bp) ||
1309 	    BP_GET_DEDUP(bp) ||
1310 	    txg != spa->spa_syncing_txg ||
1311 	    (spa_sync_pass(spa) >= zfs_sync_pass_deferred_free &&
1312 	    !spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP)) ||
1313 	    brt_maybe_exists(spa, bp)) {
1314 		metaslab_check_free(spa, bp);
1315 		bplist_append(&spa->spa_free_bplist[txg & TXG_MASK], bp);
1316 	} else {
1317 		VERIFY3P(zio_free_sync(NULL, spa, txg, bp, 0), ==, NULL);
1318 	}
1319 }
1320 
1321 /*
1322  * To improve performance, this function may return NULL if we were able
1323  * to do the free immediately.  This avoids the cost of creating a zio
1324  * (and linking it to the parent, etc).
1325  */
1326 zio_t *
1327 zio_free_sync(zio_t *pio, spa_t *spa, uint64_t txg, const blkptr_t *bp,
1328     zio_flag_t flags)
1329 {
1330 	ASSERT(!BP_IS_HOLE(bp));
1331 	ASSERT(spa_syncing_txg(spa) == txg);
1332 
1333 	if (BP_IS_EMBEDDED(bp))
1334 		return (NULL);
1335 
1336 	metaslab_check_free(spa, bp);
1337 	arc_freed(spa, bp);
1338 	dsl_scan_freed(spa, bp);
1339 
1340 	if (BP_IS_GANG(bp) ||
1341 	    BP_GET_DEDUP(bp) ||
1342 	    brt_maybe_exists(spa, bp)) {
1343 		/*
1344 		 * GANG, DEDUP and BRT blocks can induce a read (for the gang
1345 		 * block header, the DDT or the BRT), so issue them
1346 		 * asynchronously so that this thread is not tied up.
1347 		 */
1348 		enum zio_stage stage =
1349 		    ZIO_FREE_PIPELINE | ZIO_STAGE_ISSUE_ASYNC;
1350 
1351 		return (zio_create(pio, spa, txg, bp, NULL, BP_GET_PSIZE(bp),
1352 		    BP_GET_PSIZE(bp), NULL, NULL,
1353 		    ZIO_TYPE_FREE, ZIO_PRIORITY_NOW,
1354 		    flags, NULL, 0, NULL, ZIO_STAGE_OPEN, stage));
1355 	} else {
1356 		metaslab_free(spa, bp, txg, B_FALSE);
1357 		return (NULL);
1358 	}
1359 }
1360 
1361 zio_t *
1362 zio_claim(zio_t *pio, spa_t *spa, uint64_t txg, const blkptr_t *bp,
1363     zio_done_func_t *done, void *private, zio_flag_t flags)
1364 {
1365 	zio_t *zio;
1366 
1367 	(void) zfs_blkptr_verify(spa, bp, (flags & ZIO_FLAG_CONFIG_WRITER) ?
1368 	    BLK_CONFIG_HELD : BLK_CONFIG_NEEDED, BLK_VERIFY_HALT);
1369 
1370 	if (BP_IS_EMBEDDED(bp))
1371 		return (zio_null(pio, spa, NULL, NULL, NULL, 0));
1372 
1373 	/*
1374 	 * A claim is an allocation of a specific block.  Claims are needed
1375 	 * to support immediate writes in the intent log.  The issue is that
1376 	 * immediate writes contain committed data, but in a txg that was
1377 	 * *not* committed.  Upon opening the pool after an unclean shutdown,
1378 	 * the intent log claims all blocks that contain immediate write data
1379 	 * so that the SPA knows they're in use.
1380 	 *
1381 	 * All claims *must* be resolved in the first txg -- before the SPA
1382 	 * starts allocating blocks -- so that nothing is allocated twice.
1383 	 * If txg == 0 we just verify that the block is claimable.
1384 	 */
1385 	ASSERT3U(spa->spa_uberblock.ub_rootbp.blk_birth, <,
1386 	    spa_min_claim_txg(spa));
1387 	ASSERT(txg == spa_min_claim_txg(spa) || txg == 0);
1388 	ASSERT(!BP_GET_DEDUP(bp) || !spa_writeable(spa));	/* zdb(8) */
1389 
1390 	zio = zio_create(pio, spa, txg, bp, NULL, BP_GET_PSIZE(bp),
1391 	    BP_GET_PSIZE(bp), done, private, ZIO_TYPE_CLAIM, ZIO_PRIORITY_NOW,
1392 	    flags, NULL, 0, NULL, ZIO_STAGE_OPEN, ZIO_CLAIM_PIPELINE);
1393 	ASSERT0(zio->io_queued_timestamp);
1394 
1395 	return (zio);
1396 }
1397 
1398 zio_t *
1399 zio_ioctl(zio_t *pio, spa_t *spa, vdev_t *vd, int cmd,
1400     zio_done_func_t *done, void *private, zio_flag_t flags)
1401 {
1402 	zio_t *zio = zio_create(pio, spa, 0, NULL, NULL, 0, 0, done, private,
1403 	    ZIO_TYPE_IOCTL, ZIO_PRIORITY_NOW, flags, vd, 0, NULL,
1404 	    ZIO_STAGE_OPEN, ZIO_IOCTL_PIPELINE);
1405 	zio->io_cmd = cmd;
1406 	return (zio);
1407 }
1408 
1409 zio_t *
1410 zio_trim(zio_t *pio, vdev_t *vd, uint64_t offset, uint64_t size,
1411     zio_done_func_t *done, void *private, zio_priority_t priority,
1412     zio_flag_t flags, enum trim_flag trim_flags)
1413 {
1414 	zio_t *zio;
1415 
1416 	ASSERT0(vd->vdev_children);
1417 	ASSERT0(P2PHASE(offset, 1ULL << vd->vdev_ashift));
1418 	ASSERT0(P2PHASE(size, 1ULL << vd->vdev_ashift));
1419 	ASSERT3U(size, !=, 0);
1420 
1421 	zio = zio_create(pio, vd->vdev_spa, 0, NULL, NULL, size, size, done,
1422 	    private, ZIO_TYPE_TRIM, priority, flags | ZIO_FLAG_PHYSICAL,
1423 	    vd, offset, NULL, ZIO_STAGE_OPEN, ZIO_TRIM_PIPELINE);
1424 	zio->io_trim_flags = trim_flags;
1425 
1426 	return (zio);
1427 }
1428 
1429 zio_t *
1430 zio_read_phys(zio_t *pio, vdev_t *vd, uint64_t offset, uint64_t size,
1431     abd_t *data, int checksum, zio_done_func_t *done, void *private,
1432     zio_priority_t priority, zio_flag_t flags, boolean_t labels)
1433 {
1434 	zio_t *zio;
1435 
1436 	ASSERT(vd->vdev_children == 0);
1437 	ASSERT(!labels || offset + size <= VDEV_LABEL_START_SIZE ||
1438 	    offset >= vd->vdev_psize - VDEV_LABEL_END_SIZE);
1439 	ASSERT3U(offset + size, <=, vd->vdev_psize);
1440 
1441 	zio = zio_create(pio, vd->vdev_spa, 0, NULL, data, size, size, done,
1442 	    private, ZIO_TYPE_READ, priority, flags | ZIO_FLAG_PHYSICAL, vd,
1443 	    offset, NULL, ZIO_STAGE_OPEN, ZIO_READ_PHYS_PIPELINE);
1444 
1445 	zio->io_prop.zp_checksum = checksum;
1446 
1447 	return (zio);
1448 }
1449 
1450 zio_t *
1451 zio_write_phys(zio_t *pio, vdev_t *vd, uint64_t offset, uint64_t size,
1452     abd_t *data, int checksum, zio_done_func_t *done, void *private,
1453     zio_priority_t priority, zio_flag_t flags, boolean_t labels)
1454 {
1455 	zio_t *zio;
1456 
1457 	ASSERT(vd->vdev_children == 0);
1458 	ASSERT(!labels || offset + size <= VDEV_LABEL_START_SIZE ||
1459 	    offset >= vd->vdev_psize - VDEV_LABEL_END_SIZE);
1460 	ASSERT3U(offset + size, <=, vd->vdev_psize);
1461 
1462 	zio = zio_create(pio, vd->vdev_spa, 0, NULL, data, size, size, done,
1463 	    private, ZIO_TYPE_WRITE, priority, flags | ZIO_FLAG_PHYSICAL, vd,
1464 	    offset, NULL, ZIO_STAGE_OPEN, ZIO_WRITE_PHYS_PIPELINE);
1465 
1466 	zio->io_prop.zp_checksum = checksum;
1467 
1468 	if (zio_checksum_table[checksum].ci_flags & ZCHECKSUM_FLAG_EMBEDDED) {
1469 		/*
1470 		 * zec checksums are necessarily destructive -- they modify
1471 		 * the end of the write buffer to hold the verifier/checksum.
1472 		 * Therefore, we must make a local copy in case the data is
1473 		 * being written to multiple places in parallel.
1474 		 */
1475 		abd_t *wbuf = abd_alloc_sametype(data, size);
1476 		abd_copy(wbuf, data, size);
1477 
1478 		zio_push_transform(zio, wbuf, size, size, NULL);
1479 	}
1480 
1481 	return (zio);
1482 }
1483 
1484 /*
1485  * Create a child I/O to do some work for us.
1486  */
1487 zio_t *
1488 zio_vdev_child_io(zio_t *pio, blkptr_t *bp, vdev_t *vd, uint64_t offset,
1489     abd_t *data, uint64_t size, int type, zio_priority_t priority,
1490     zio_flag_t flags, zio_done_func_t *done, void *private)
1491 {
1492 	enum zio_stage pipeline = ZIO_VDEV_CHILD_PIPELINE;
1493 	zio_t *zio;
1494 
1495 	/*
1496 	 * vdev child I/Os do not propagate their error to the parent.
1497 	 * Therefore, for correct operation the caller *must* check for
1498 	 * and handle the error in the child i/o's done callback.
1499 	 * The only exceptions are i/os that we don't care about
1500 	 * (OPTIONAL or REPAIR).
1501 	 */
1502 	ASSERT((flags & ZIO_FLAG_OPTIONAL) || (flags & ZIO_FLAG_IO_REPAIR) ||
1503 	    done != NULL);
1504 
1505 	if (type == ZIO_TYPE_READ && bp != NULL) {
1506 		/*
1507 		 * If we have the bp, then the child should perform the
1508 		 * checksum and the parent need not.  This pushes error
1509 		 * detection as close to the leaves as possible and
1510 		 * eliminates redundant checksums in the interior nodes.
1511 		 */
1512 		pipeline |= ZIO_STAGE_CHECKSUM_VERIFY;
1513 		pio->io_pipeline &= ~ZIO_STAGE_CHECKSUM_VERIFY;
1514 	}
1515 
1516 	if (vd->vdev_ops->vdev_op_leaf) {
1517 		ASSERT0(vd->vdev_children);
1518 		offset += VDEV_LABEL_START_SIZE;
1519 	}
1520 
1521 	flags |= ZIO_VDEV_CHILD_FLAGS(pio);
1522 
1523 	/*
1524 	 * If we've decided to do a repair, the write is not speculative --
1525 	 * even if the original read was.
1526 	 */
1527 	if (flags & ZIO_FLAG_IO_REPAIR)
1528 		flags &= ~ZIO_FLAG_SPECULATIVE;
1529 
1530 	/*
1531 	 * If we're creating a child I/O that is not associated with a
1532 	 * top-level vdev, then the child zio is not an allocating I/O.
1533 	 * If this is a retried I/O then we ignore it since we will
1534 	 * have already processed the original allocating I/O.
1535 	 */
1536 	if (flags & ZIO_FLAG_IO_ALLOCATING &&
1537 	    (vd != vd->vdev_top || (flags & ZIO_FLAG_IO_RETRY))) {
1538 		ASSERT(pio->io_metaslab_class != NULL);
1539 		ASSERT(pio->io_metaslab_class->mc_alloc_throttle_enabled);
1540 		ASSERT(type == ZIO_TYPE_WRITE);
1541 		ASSERT(priority == ZIO_PRIORITY_ASYNC_WRITE);
1542 		ASSERT(!(flags & ZIO_FLAG_IO_REPAIR));
1543 		ASSERT(!(pio->io_flags & ZIO_FLAG_IO_REWRITE) ||
1544 		    pio->io_child_type == ZIO_CHILD_GANG);
1545 
1546 		flags &= ~ZIO_FLAG_IO_ALLOCATING;
1547 	}
1548 
1549 	zio = zio_create(pio, pio->io_spa, pio->io_txg, bp, data, size, size,
1550 	    done, private, type, priority, flags, vd, offset, &pio->io_bookmark,
1551 	    ZIO_STAGE_VDEV_IO_START >> 1, pipeline);
1552 	ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_VDEV);
1553 
1554 	return (zio);
1555 }
1556 
1557 zio_t *
1558 zio_vdev_delegated_io(vdev_t *vd, uint64_t offset, abd_t *data, uint64_t size,
1559     zio_type_t type, zio_priority_t priority, zio_flag_t flags,
1560     zio_done_func_t *done, void *private)
1561 {
1562 	zio_t *zio;
1563 
1564 	ASSERT(vd->vdev_ops->vdev_op_leaf);
1565 
1566 	zio = zio_create(NULL, vd->vdev_spa, 0, NULL,
1567 	    data, size, size, done, private, type, priority,
1568 	    flags | ZIO_FLAG_CANFAIL | ZIO_FLAG_DONT_RETRY | ZIO_FLAG_DELEGATED,
1569 	    vd, offset, NULL,
1570 	    ZIO_STAGE_VDEV_IO_START >> 1, ZIO_VDEV_CHILD_PIPELINE);
1571 
1572 	return (zio);
1573 }
1574 
1575 void
1576 zio_flush(zio_t *pio, vdev_t *vd)
1577 {
1578 	if (vd->vdev_nowritecache)
1579 		return;
1580 	if (vd->vdev_children == 0) {
1581 		zio_nowait(zio_ioctl(pio, vd->vdev_spa, vd,
1582 		    DKIOCFLUSHWRITECACHE, NULL, NULL, ZIO_FLAG_CANFAIL |
1583 		    ZIO_FLAG_DONT_PROPAGATE | ZIO_FLAG_DONT_RETRY));
1584 	} else {
1585 		for (uint64_t c = 0; c < vd->vdev_children; c++)
1586 			zio_flush(pio, vd->vdev_child[c]);
1587 	}
1588 }
1589 
1590 void
1591 zio_shrink(zio_t *zio, uint64_t size)
1592 {
1593 	ASSERT3P(zio->io_executor, ==, NULL);
1594 	ASSERT3U(zio->io_orig_size, ==, zio->io_size);
1595 	ASSERT3U(size, <=, zio->io_size);
1596 
1597 	/*
1598 	 * We don't shrink for raidz because of problems with the
1599 	 * reconstruction when reading back less than the block size.
1600 	 * Note, BP_IS_RAIDZ() assumes no compression.
1601 	 */
1602 	ASSERT(BP_GET_COMPRESS(zio->io_bp) == ZIO_COMPRESS_OFF);
1603 	if (!BP_IS_RAIDZ(zio->io_bp)) {
1604 		/* we are not doing a raw write */
1605 		ASSERT3U(zio->io_size, ==, zio->io_lsize);
1606 		zio->io_orig_size = zio->io_size = zio->io_lsize = size;
1607 	}
1608 }
1609 
1610 /*
1611  * Round provided allocation size up to a value that can be allocated
1612  * by at least some vdev(s) in the pool with minimum or no additional
1613  * padding and without extra space usage on others
1614  */
1615 static uint64_t
1616 zio_roundup_alloc_size(spa_t *spa, uint64_t size)
1617 {
1618 	if (size > spa->spa_min_alloc)
1619 		return (roundup(size, spa->spa_gcd_alloc));
1620 	return (spa->spa_min_alloc);
1621 }
1622 
1623 /*
1624  * ==========================================================================
1625  * Prepare to read and write logical blocks
1626  * ==========================================================================
1627  */
1628 
1629 static zio_t *
1630 zio_read_bp_init(zio_t *zio)
1631 {
1632 	blkptr_t *bp = zio->io_bp;
1633 	uint64_t psize =
1634 	    BP_IS_EMBEDDED(bp) ? BPE_GET_PSIZE(bp) : BP_GET_PSIZE(bp);
1635 
1636 	ASSERT3P(zio->io_bp, ==, &zio->io_bp_copy);
1637 
1638 	if (BP_GET_COMPRESS(bp) != ZIO_COMPRESS_OFF &&
1639 	    zio->io_child_type == ZIO_CHILD_LOGICAL &&
1640 	    !(zio->io_flags & ZIO_FLAG_RAW_COMPRESS)) {
1641 		zio_push_transform(zio, abd_alloc_sametype(zio->io_abd, psize),
1642 		    psize, psize, zio_decompress);
1643 	}
1644 
1645 	if (((BP_IS_PROTECTED(bp) && !(zio->io_flags & ZIO_FLAG_RAW_ENCRYPT)) ||
1646 	    BP_HAS_INDIRECT_MAC_CKSUM(bp)) &&
1647 	    zio->io_child_type == ZIO_CHILD_LOGICAL) {
1648 		zio_push_transform(zio, abd_alloc_sametype(zio->io_abd, psize),
1649 		    psize, psize, zio_decrypt);
1650 	}
1651 
1652 	if (BP_IS_EMBEDDED(bp) && BPE_GET_ETYPE(bp) == BP_EMBEDDED_TYPE_DATA) {
1653 		int psize = BPE_GET_PSIZE(bp);
1654 		void *data = abd_borrow_buf(zio->io_abd, psize);
1655 
1656 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
1657 		decode_embedded_bp_compressed(bp, data);
1658 		abd_return_buf_copy(zio->io_abd, data, psize);
1659 	} else {
1660 		ASSERT(!BP_IS_EMBEDDED(bp));
1661 	}
1662 
1663 	if (BP_GET_DEDUP(bp) && zio->io_child_type == ZIO_CHILD_LOGICAL)
1664 		zio->io_pipeline = ZIO_DDT_READ_PIPELINE;
1665 
1666 	return (zio);
1667 }
1668 
1669 static zio_t *
1670 zio_write_bp_init(zio_t *zio)
1671 {
1672 	if (!IO_IS_ALLOCATING(zio))
1673 		return (zio);
1674 
1675 	ASSERT(zio->io_child_type != ZIO_CHILD_DDT);
1676 
1677 	if (zio->io_bp_override) {
1678 		blkptr_t *bp = zio->io_bp;
1679 		zio_prop_t *zp = &zio->io_prop;
1680 
1681 		ASSERT(bp->blk_birth != zio->io_txg);
1682 
1683 		*bp = *zio->io_bp_override;
1684 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
1685 
1686 		if (zp->zp_brtwrite)
1687 			return (zio);
1688 
1689 		ASSERT(!BP_GET_DEDUP(zio->io_bp_override));
1690 
1691 		if (BP_IS_EMBEDDED(bp))
1692 			return (zio);
1693 
1694 		/*
1695 		 * If we've been overridden and nopwrite is set then
1696 		 * set the flag accordingly to indicate that a nopwrite
1697 		 * has already occurred.
1698 		 */
1699 		if (!BP_IS_HOLE(bp) && zp->zp_nopwrite) {
1700 			ASSERT(!zp->zp_dedup);
1701 			ASSERT3U(BP_GET_CHECKSUM(bp), ==, zp->zp_checksum);
1702 			zio->io_flags |= ZIO_FLAG_NOPWRITE;
1703 			return (zio);
1704 		}
1705 
1706 		ASSERT(!zp->zp_nopwrite);
1707 
1708 		if (BP_IS_HOLE(bp) || !zp->zp_dedup)
1709 			return (zio);
1710 
1711 		ASSERT((zio_checksum_table[zp->zp_checksum].ci_flags &
1712 		    ZCHECKSUM_FLAG_DEDUP) || zp->zp_dedup_verify);
1713 
1714 		if (BP_GET_CHECKSUM(bp) == zp->zp_checksum &&
1715 		    !zp->zp_encrypt) {
1716 			BP_SET_DEDUP(bp, 1);
1717 			zio->io_pipeline |= ZIO_STAGE_DDT_WRITE;
1718 			return (zio);
1719 		}
1720 
1721 		/*
1722 		 * We were unable to handle this as an override bp, treat
1723 		 * it as a regular write I/O.
1724 		 */
1725 		zio->io_bp_override = NULL;
1726 		*bp = zio->io_bp_orig;
1727 		zio->io_pipeline = zio->io_orig_pipeline;
1728 	}
1729 
1730 	return (zio);
1731 }
1732 
1733 static zio_t *
1734 zio_write_compress(zio_t *zio)
1735 {
1736 	spa_t *spa = zio->io_spa;
1737 	zio_prop_t *zp = &zio->io_prop;
1738 	enum zio_compress compress = zp->zp_compress;
1739 	blkptr_t *bp = zio->io_bp;
1740 	uint64_t lsize = zio->io_lsize;
1741 	uint64_t psize = zio->io_size;
1742 	uint32_t pass = 1;
1743 
1744 	/*
1745 	 * If our children haven't all reached the ready stage,
1746 	 * wait for them and then repeat this pipeline stage.
1747 	 */
1748 	if (zio_wait_for_children(zio, ZIO_CHILD_LOGICAL_BIT |
1749 	    ZIO_CHILD_GANG_BIT, ZIO_WAIT_READY)) {
1750 		return (NULL);
1751 	}
1752 
1753 	if (!IO_IS_ALLOCATING(zio))
1754 		return (zio);
1755 
1756 	if (zio->io_children_ready != NULL) {
1757 		/*
1758 		 * Now that all our children are ready, run the callback
1759 		 * associated with this zio in case it wants to modify the
1760 		 * data to be written.
1761 		 */
1762 		ASSERT3U(zp->zp_level, >, 0);
1763 		zio->io_children_ready(zio);
1764 	}
1765 
1766 	ASSERT(zio->io_child_type != ZIO_CHILD_DDT);
1767 	ASSERT(zio->io_bp_override == NULL);
1768 
1769 	if (!BP_IS_HOLE(bp) && bp->blk_birth == zio->io_txg) {
1770 		/*
1771 		 * We're rewriting an existing block, which means we're
1772 		 * working on behalf of spa_sync().  For spa_sync() to
1773 		 * converge, it must eventually be the case that we don't
1774 		 * have to allocate new blocks.  But compression changes
1775 		 * the blocksize, which forces a reallocate, and makes
1776 		 * convergence take longer.  Therefore, after the first
1777 		 * few passes, stop compressing to ensure convergence.
1778 		 */
1779 		pass = spa_sync_pass(spa);
1780 
1781 		ASSERT(zio->io_txg == spa_syncing_txg(spa));
1782 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
1783 		ASSERT(!BP_GET_DEDUP(bp));
1784 
1785 		if (pass >= zfs_sync_pass_dont_compress)
1786 			compress = ZIO_COMPRESS_OFF;
1787 
1788 		/* Make sure someone doesn't change their mind on overwrites */
1789 		ASSERT(BP_IS_EMBEDDED(bp) || BP_IS_GANG(bp) ||
1790 		    MIN(zp->zp_copies, spa_max_replication(spa))
1791 		    == BP_GET_NDVAS(bp));
1792 	}
1793 
1794 	/* If it's a compressed write that is not raw, compress the buffer. */
1795 	if (compress != ZIO_COMPRESS_OFF &&
1796 	    !(zio->io_flags & ZIO_FLAG_RAW_COMPRESS)) {
1797 		void *cbuf = NULL;
1798 		psize = zio_compress_data(compress, zio->io_abd, &cbuf, lsize,
1799 		    zp->zp_complevel);
1800 		if (psize == 0) {
1801 			compress = ZIO_COMPRESS_OFF;
1802 		} else if (psize >= lsize) {
1803 			compress = ZIO_COMPRESS_OFF;
1804 			if (cbuf != NULL)
1805 				zio_buf_free(cbuf, lsize);
1806 		} else if (!zp->zp_dedup && !zp->zp_encrypt &&
1807 		    psize <= BPE_PAYLOAD_SIZE &&
1808 		    zp->zp_level == 0 && !DMU_OT_HAS_FILL(zp->zp_type) &&
1809 		    spa_feature_is_enabled(spa, SPA_FEATURE_EMBEDDED_DATA)) {
1810 			encode_embedded_bp_compressed(bp,
1811 			    cbuf, compress, lsize, psize);
1812 			BPE_SET_ETYPE(bp, BP_EMBEDDED_TYPE_DATA);
1813 			BP_SET_TYPE(bp, zio->io_prop.zp_type);
1814 			BP_SET_LEVEL(bp, zio->io_prop.zp_level);
1815 			zio_buf_free(cbuf, lsize);
1816 			bp->blk_birth = zio->io_txg;
1817 			zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
1818 			ASSERT(spa_feature_is_active(spa,
1819 			    SPA_FEATURE_EMBEDDED_DATA));
1820 			return (zio);
1821 		} else {
1822 			/*
1823 			 * Round compressed size up to the minimum allocation
1824 			 * size of the smallest-ashift device, and zero the
1825 			 * tail. This ensures that the compressed size of the
1826 			 * BP (and thus compressratio property) are correct,
1827 			 * in that we charge for the padding used to fill out
1828 			 * the last sector.
1829 			 */
1830 			size_t rounded = (size_t)zio_roundup_alloc_size(spa,
1831 			    psize);
1832 			if (rounded >= lsize) {
1833 				compress = ZIO_COMPRESS_OFF;
1834 				zio_buf_free(cbuf, lsize);
1835 				psize = lsize;
1836 			} else {
1837 				abd_t *cdata = abd_get_from_buf(cbuf, lsize);
1838 				abd_take_ownership_of_buf(cdata, B_TRUE);
1839 				abd_zero_off(cdata, psize, rounded - psize);
1840 				psize = rounded;
1841 				zio_push_transform(zio, cdata,
1842 				    psize, lsize, NULL);
1843 			}
1844 		}
1845 
1846 		/*
1847 		 * We were unable to handle this as an override bp, treat
1848 		 * it as a regular write I/O.
1849 		 */
1850 		zio->io_bp_override = NULL;
1851 		*bp = zio->io_bp_orig;
1852 		zio->io_pipeline = zio->io_orig_pipeline;
1853 
1854 	} else if ((zio->io_flags & ZIO_FLAG_RAW_ENCRYPT) != 0 &&
1855 	    zp->zp_type == DMU_OT_DNODE) {
1856 		/*
1857 		 * The DMU actually relies on the zio layer's compression
1858 		 * to free metadnode blocks that have had all contained
1859 		 * dnodes freed. As a result, even when doing a raw
1860 		 * receive, we must check whether the block can be compressed
1861 		 * to a hole.
1862 		 */
1863 		psize = zio_compress_data(ZIO_COMPRESS_EMPTY,
1864 		    zio->io_abd, NULL, lsize, zp->zp_complevel);
1865 		if (psize == 0 || psize >= lsize)
1866 			compress = ZIO_COMPRESS_OFF;
1867 	} else if (zio->io_flags & ZIO_FLAG_RAW_COMPRESS &&
1868 	    !(zio->io_flags & ZIO_FLAG_RAW_ENCRYPT)) {
1869 		/*
1870 		 * If we are raw receiving an encrypted dataset we should not
1871 		 * take this codepath because it will change the on-disk block
1872 		 * and decryption will fail.
1873 		 */
1874 		size_t rounded = MIN((size_t)zio_roundup_alloc_size(spa, psize),
1875 		    lsize);
1876 
1877 		if (rounded != psize) {
1878 			abd_t *cdata = abd_alloc_linear(rounded, B_TRUE);
1879 			abd_zero_off(cdata, psize, rounded - psize);
1880 			abd_copy_off(cdata, zio->io_abd, 0, 0, psize);
1881 			psize = rounded;
1882 			zio_push_transform(zio, cdata,
1883 			    psize, rounded, NULL);
1884 		}
1885 	} else {
1886 		ASSERT3U(psize, !=, 0);
1887 	}
1888 
1889 	/*
1890 	 * The final pass of spa_sync() must be all rewrites, but the first
1891 	 * few passes offer a trade-off: allocating blocks defers convergence,
1892 	 * but newly allocated blocks are sequential, so they can be written
1893 	 * to disk faster.  Therefore, we allow the first few passes of
1894 	 * spa_sync() to allocate new blocks, but force rewrites after that.
1895 	 * There should only be a handful of blocks after pass 1 in any case.
1896 	 */
1897 	if (!BP_IS_HOLE(bp) && bp->blk_birth == zio->io_txg &&
1898 	    BP_GET_PSIZE(bp) == psize &&
1899 	    pass >= zfs_sync_pass_rewrite) {
1900 		VERIFY3U(psize, !=, 0);
1901 		enum zio_stage gang_stages = zio->io_pipeline & ZIO_GANG_STAGES;
1902 
1903 		zio->io_pipeline = ZIO_REWRITE_PIPELINE | gang_stages;
1904 		zio->io_flags |= ZIO_FLAG_IO_REWRITE;
1905 	} else {
1906 		BP_ZERO(bp);
1907 		zio->io_pipeline = ZIO_WRITE_PIPELINE;
1908 	}
1909 
1910 	if (psize == 0) {
1911 		if (zio->io_bp_orig.blk_birth != 0 &&
1912 		    spa_feature_is_active(spa, SPA_FEATURE_HOLE_BIRTH)) {
1913 			BP_SET_LSIZE(bp, lsize);
1914 			BP_SET_TYPE(bp, zp->zp_type);
1915 			BP_SET_LEVEL(bp, zp->zp_level);
1916 			BP_SET_BIRTH(bp, zio->io_txg, 0);
1917 		}
1918 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
1919 	} else {
1920 		ASSERT(zp->zp_checksum != ZIO_CHECKSUM_GANG_HEADER);
1921 		BP_SET_LSIZE(bp, lsize);
1922 		BP_SET_TYPE(bp, zp->zp_type);
1923 		BP_SET_LEVEL(bp, zp->zp_level);
1924 		BP_SET_PSIZE(bp, psize);
1925 		BP_SET_COMPRESS(bp, compress);
1926 		BP_SET_CHECKSUM(bp, zp->zp_checksum);
1927 		BP_SET_DEDUP(bp, zp->zp_dedup);
1928 		BP_SET_BYTEORDER(bp, ZFS_HOST_BYTEORDER);
1929 		if (zp->zp_dedup) {
1930 			ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
1931 			ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
1932 			ASSERT(!zp->zp_encrypt ||
1933 			    DMU_OT_IS_ENCRYPTED(zp->zp_type));
1934 			zio->io_pipeline = ZIO_DDT_WRITE_PIPELINE;
1935 		}
1936 		if (zp->zp_nopwrite) {
1937 			ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
1938 			ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
1939 			zio->io_pipeline |= ZIO_STAGE_NOP_WRITE;
1940 		}
1941 	}
1942 	return (zio);
1943 }
1944 
1945 static zio_t *
1946 zio_free_bp_init(zio_t *zio)
1947 {
1948 	blkptr_t *bp = zio->io_bp;
1949 
1950 	if (zio->io_child_type == ZIO_CHILD_LOGICAL) {
1951 		if (BP_GET_DEDUP(bp))
1952 			zio->io_pipeline = ZIO_DDT_FREE_PIPELINE;
1953 	}
1954 
1955 	ASSERT3P(zio->io_bp, ==, &zio->io_bp_copy);
1956 
1957 	return (zio);
1958 }
1959 
1960 /*
1961  * ==========================================================================
1962  * Execute the I/O pipeline
1963  * ==========================================================================
1964  */
1965 
1966 static void
1967 zio_taskq_dispatch(zio_t *zio, zio_taskq_type_t q, boolean_t cutinline)
1968 {
1969 	spa_t *spa = zio->io_spa;
1970 	zio_type_t t = zio->io_type;
1971 	int flags = (cutinline ? TQ_FRONT : 0);
1972 
1973 	/*
1974 	 * If we're a config writer or a probe, the normal issue and
1975 	 * interrupt threads may all be blocked waiting for the config lock.
1976 	 * In this case, select the otherwise-unused taskq for ZIO_TYPE_NULL.
1977 	 */
1978 	if (zio->io_flags & (ZIO_FLAG_CONFIG_WRITER | ZIO_FLAG_PROBE))
1979 		t = ZIO_TYPE_NULL;
1980 
1981 	/*
1982 	 * A similar issue exists for the L2ARC write thread until L2ARC 2.0.
1983 	 */
1984 	if (t == ZIO_TYPE_WRITE && zio->io_vd && zio->io_vd->vdev_aux)
1985 		t = ZIO_TYPE_NULL;
1986 
1987 	/*
1988 	 * If this is a high priority I/O, then use the high priority taskq if
1989 	 * available.
1990 	 */
1991 	if ((zio->io_priority == ZIO_PRIORITY_NOW ||
1992 	    zio->io_priority == ZIO_PRIORITY_SYNC_WRITE) &&
1993 	    spa->spa_zio_taskq[t][q + 1].stqs_count != 0)
1994 		q++;
1995 
1996 	ASSERT3U(q, <, ZIO_TASKQ_TYPES);
1997 
1998 	/*
1999 	 * NB: We are assuming that the zio can only be dispatched
2000 	 * to a single taskq at a time.  It would be a grievous error
2001 	 * to dispatch the zio to another taskq at the same time.
2002 	 */
2003 	ASSERT(taskq_empty_ent(&zio->io_tqent));
2004 	spa_taskq_dispatch_ent(spa, t, q, zio_execute, zio, flags,
2005 	    &zio->io_tqent, zio);
2006 }
2007 
2008 static boolean_t
2009 zio_taskq_member(zio_t *zio, zio_taskq_type_t q)
2010 {
2011 	spa_t *spa = zio->io_spa;
2012 
2013 	taskq_t *tq = taskq_of_curthread();
2014 
2015 	for (zio_type_t t = 0; t < ZIO_TYPES; t++) {
2016 		spa_taskqs_t *tqs = &spa->spa_zio_taskq[t][q];
2017 		uint_t i;
2018 		for (i = 0; i < tqs->stqs_count; i++) {
2019 			if (tqs->stqs_taskq[i] == tq)
2020 				return (B_TRUE);
2021 		}
2022 	}
2023 
2024 	return (B_FALSE);
2025 }
2026 
2027 static zio_t *
2028 zio_issue_async(zio_t *zio)
2029 {
2030 	ASSERT((zio->io_type != ZIO_TYPE_WRITE) || ZIO_HAS_ALLOCATOR(zio));
2031 	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_FALSE);
2032 	return (NULL);
2033 }
2034 
2035 void
2036 zio_interrupt(void *zio)
2037 {
2038 	zio_taskq_dispatch(zio, ZIO_TASKQ_INTERRUPT, B_FALSE);
2039 }
2040 
2041 void
2042 zio_delay_interrupt(zio_t *zio)
2043 {
2044 	/*
2045 	 * The timeout_generic() function isn't defined in userspace, so
2046 	 * rather than trying to implement the function, the zio delay
2047 	 * functionality has been disabled for userspace builds.
2048 	 */
2049 
2050 #ifdef _KERNEL
2051 	/*
2052 	 * If io_target_timestamp is zero, then no delay has been registered
2053 	 * for this IO, thus jump to the end of this function and "skip" the
2054 	 * delay; issuing it directly to the zio layer.
2055 	 */
2056 	if (zio->io_target_timestamp != 0) {
2057 		hrtime_t now = gethrtime();
2058 
2059 		if (now >= zio->io_target_timestamp) {
2060 			/*
2061 			 * This IO has already taken longer than the target
2062 			 * delay to complete, so we don't want to delay it
2063 			 * any longer; we "miss" the delay and issue it
2064 			 * directly to the zio layer. This is likely due to
2065 			 * the target latency being set to a value less than
2066 			 * the underlying hardware can satisfy (e.g. delay
2067 			 * set to 1ms, but the disks take 10ms to complete an
2068 			 * IO request).
2069 			 */
2070 
2071 			DTRACE_PROBE2(zio__delay__miss, zio_t *, zio,
2072 			    hrtime_t, now);
2073 
2074 			zio_interrupt(zio);
2075 		} else {
2076 			taskqid_t tid;
2077 			hrtime_t diff = zio->io_target_timestamp - now;
2078 			clock_t expire_at_tick = ddi_get_lbolt() +
2079 			    NSEC_TO_TICK(diff);
2080 
2081 			DTRACE_PROBE3(zio__delay__hit, zio_t *, zio,
2082 			    hrtime_t, now, hrtime_t, diff);
2083 
2084 			if (NSEC_TO_TICK(diff) == 0) {
2085 				/* Our delay is less than a jiffy - just spin */
2086 				zfs_sleep_until(zio->io_target_timestamp);
2087 				zio_interrupt(zio);
2088 			} else {
2089 				/*
2090 				 * Use taskq_dispatch_delay() in the place of
2091 				 * OpenZFS's timeout_generic().
2092 				 */
2093 				tid = taskq_dispatch_delay(system_taskq,
2094 				    zio_interrupt, zio, TQ_NOSLEEP,
2095 				    expire_at_tick);
2096 				if (tid == TASKQID_INVALID) {
2097 					/*
2098 					 * Couldn't allocate a task.  Just
2099 					 * finish the zio without a delay.
2100 					 */
2101 					zio_interrupt(zio);
2102 				}
2103 			}
2104 		}
2105 		return;
2106 	}
2107 #endif
2108 	DTRACE_PROBE1(zio__delay__skip, zio_t *, zio);
2109 	zio_interrupt(zio);
2110 }
2111 
2112 static void
2113 zio_deadman_impl(zio_t *pio, int ziodepth)
2114 {
2115 	zio_t *cio, *cio_next;
2116 	zio_link_t *zl = NULL;
2117 	vdev_t *vd = pio->io_vd;
2118 
2119 	if (zio_deadman_log_all || (vd != NULL && vd->vdev_ops->vdev_op_leaf)) {
2120 		vdev_queue_t *vq = vd ? &vd->vdev_queue : NULL;
2121 		zbookmark_phys_t *zb = &pio->io_bookmark;
2122 		uint64_t delta = gethrtime() - pio->io_timestamp;
2123 		uint64_t failmode = spa_get_deadman_failmode(pio->io_spa);
2124 
2125 		zfs_dbgmsg("slow zio[%d]: zio=%px timestamp=%llu "
2126 		    "delta=%llu queued=%llu io=%llu "
2127 		    "path=%s "
2128 		    "last=%llu type=%d "
2129 		    "priority=%d flags=0x%llx stage=0x%x "
2130 		    "pipeline=0x%x pipeline-trace=0x%x "
2131 		    "objset=%llu object=%llu "
2132 		    "level=%llu blkid=%llu "
2133 		    "offset=%llu size=%llu "
2134 		    "error=%d",
2135 		    ziodepth, pio, pio->io_timestamp,
2136 		    (u_longlong_t)delta, pio->io_delta, pio->io_delay,
2137 		    vd ? vd->vdev_path : "NULL",
2138 		    vq ? vq->vq_io_complete_ts : 0, pio->io_type,
2139 		    pio->io_priority, (u_longlong_t)pio->io_flags,
2140 		    pio->io_stage, pio->io_pipeline, pio->io_pipeline_trace,
2141 		    (u_longlong_t)zb->zb_objset, (u_longlong_t)zb->zb_object,
2142 		    (u_longlong_t)zb->zb_level, (u_longlong_t)zb->zb_blkid,
2143 		    (u_longlong_t)pio->io_offset, (u_longlong_t)pio->io_size,
2144 		    pio->io_error);
2145 		(void) zfs_ereport_post(FM_EREPORT_ZFS_DEADMAN,
2146 		    pio->io_spa, vd, zb, pio, 0);
2147 
2148 		if (failmode == ZIO_FAILURE_MODE_CONTINUE &&
2149 		    taskq_empty_ent(&pio->io_tqent)) {
2150 			zio_interrupt(pio);
2151 		}
2152 	}
2153 
2154 	mutex_enter(&pio->io_lock);
2155 	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
2156 		cio_next = zio_walk_children(pio, &zl);
2157 		zio_deadman_impl(cio, ziodepth + 1);
2158 	}
2159 	mutex_exit(&pio->io_lock);
2160 }
2161 
2162 /*
2163  * Log the critical information describing this zio and all of its children
2164  * using the zfs_dbgmsg() interface then post deadman event for the ZED.
2165  */
2166 void
2167 zio_deadman(zio_t *pio, const char *tag)
2168 {
2169 	spa_t *spa = pio->io_spa;
2170 	char *name = spa_name(spa);
2171 
2172 	if (!zfs_deadman_enabled || spa_suspended(spa))
2173 		return;
2174 
2175 	zio_deadman_impl(pio, 0);
2176 
2177 	switch (spa_get_deadman_failmode(spa)) {
2178 	case ZIO_FAILURE_MODE_WAIT:
2179 		zfs_dbgmsg("%s waiting for hung I/O to pool '%s'", tag, name);
2180 		break;
2181 
2182 	case ZIO_FAILURE_MODE_CONTINUE:
2183 		zfs_dbgmsg("%s restarting hung I/O for pool '%s'", tag, name);
2184 		break;
2185 
2186 	case ZIO_FAILURE_MODE_PANIC:
2187 		fm_panic("%s determined I/O to pool '%s' is hung.", tag, name);
2188 		break;
2189 	}
2190 }
2191 
2192 /*
2193  * Execute the I/O pipeline until one of the following occurs:
2194  * (1) the I/O completes; (2) the pipeline stalls waiting for
2195  * dependent child I/Os; (3) the I/O issues, so we're waiting
2196  * for an I/O completion interrupt; (4) the I/O is delegated by
2197  * vdev-level caching or aggregation; (5) the I/O is deferred
2198  * due to vdev-level queueing; (6) the I/O is handed off to
2199  * another thread.  In all cases, the pipeline stops whenever
2200  * there's no CPU work; it never burns a thread in cv_wait_io().
2201  *
2202  * There's no locking on io_stage because there's no legitimate way
2203  * for multiple threads to be attempting to process the same I/O.
2204  */
2205 static zio_pipe_stage_t *zio_pipeline[];
2206 
2207 /*
2208  * zio_execute() is a wrapper around the static function
2209  * __zio_execute() so that we can force  __zio_execute() to be
2210  * inlined.  This reduces stack overhead which is important
2211  * because __zio_execute() is called recursively in several zio
2212  * code paths.  zio_execute() itself cannot be inlined because
2213  * it is externally visible.
2214  */
2215 void
2216 zio_execute(void *zio)
2217 {
2218 	fstrans_cookie_t cookie;
2219 
2220 	cookie = spl_fstrans_mark();
2221 	__zio_execute(zio);
2222 	spl_fstrans_unmark(cookie);
2223 }
2224 
2225 /*
2226  * Used to determine if in the current context the stack is sized large
2227  * enough to allow zio_execute() to be called recursively.  A minimum
2228  * stack size of 16K is required to avoid needing to re-dispatch the zio.
2229  */
2230 static boolean_t
2231 zio_execute_stack_check(zio_t *zio)
2232 {
2233 #if !defined(HAVE_LARGE_STACKS)
2234 	dsl_pool_t *dp = spa_get_dsl(zio->io_spa);
2235 
2236 	/* Executing in txg_sync_thread() context. */
2237 	if (dp && curthread == dp->dp_tx.tx_sync_thread)
2238 		return (B_TRUE);
2239 
2240 	/* Pool initialization outside of zio_taskq context. */
2241 	if (dp && spa_is_initializing(dp->dp_spa) &&
2242 	    !zio_taskq_member(zio, ZIO_TASKQ_ISSUE) &&
2243 	    !zio_taskq_member(zio, ZIO_TASKQ_ISSUE_HIGH))
2244 		return (B_TRUE);
2245 #else
2246 	(void) zio;
2247 #endif /* HAVE_LARGE_STACKS */
2248 
2249 	return (B_FALSE);
2250 }
2251 
2252 __attribute__((always_inline))
2253 static inline void
2254 __zio_execute(zio_t *zio)
2255 {
2256 	ASSERT3U(zio->io_queued_timestamp, >, 0);
2257 
2258 	while (zio->io_stage < ZIO_STAGE_DONE) {
2259 		enum zio_stage pipeline = zio->io_pipeline;
2260 		enum zio_stage stage = zio->io_stage;
2261 
2262 		zio->io_executor = curthread;
2263 
2264 		ASSERT(!MUTEX_HELD(&zio->io_lock));
2265 		ASSERT(ISP2(stage));
2266 		ASSERT(zio->io_stall == NULL);
2267 
2268 		do {
2269 			stage <<= 1;
2270 		} while ((stage & pipeline) == 0);
2271 
2272 		ASSERT(stage <= ZIO_STAGE_DONE);
2273 
2274 		/*
2275 		 * If we are in interrupt context and this pipeline stage
2276 		 * will grab a config lock that is held across I/O,
2277 		 * or may wait for an I/O that needs an interrupt thread
2278 		 * to complete, issue async to avoid deadlock.
2279 		 *
2280 		 * For VDEV_IO_START, we cut in line so that the io will
2281 		 * be sent to disk promptly.
2282 		 */
2283 		if ((stage & ZIO_BLOCKING_STAGES) && zio->io_vd == NULL &&
2284 		    zio_taskq_member(zio, ZIO_TASKQ_INTERRUPT)) {
2285 			boolean_t cut = (stage == ZIO_STAGE_VDEV_IO_START) ?
2286 			    zio_requeue_io_start_cut_in_line : B_FALSE;
2287 			zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, cut);
2288 			return;
2289 		}
2290 
2291 		/*
2292 		 * If the current context doesn't have large enough stacks
2293 		 * the zio must be issued asynchronously to prevent overflow.
2294 		 */
2295 		if (zio_execute_stack_check(zio)) {
2296 			boolean_t cut = (stage == ZIO_STAGE_VDEV_IO_START) ?
2297 			    zio_requeue_io_start_cut_in_line : B_FALSE;
2298 			zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, cut);
2299 			return;
2300 		}
2301 
2302 		zio->io_stage = stage;
2303 		zio->io_pipeline_trace |= zio->io_stage;
2304 
2305 		/*
2306 		 * The zio pipeline stage returns the next zio to execute
2307 		 * (typically the same as this one), or NULL if we should
2308 		 * stop.
2309 		 */
2310 		zio = zio_pipeline[highbit64(stage) - 1](zio);
2311 
2312 		if (zio == NULL)
2313 			return;
2314 	}
2315 }
2316 
2317 
2318 /*
2319  * ==========================================================================
2320  * Initiate I/O, either sync or async
2321  * ==========================================================================
2322  */
2323 int
2324 zio_wait(zio_t *zio)
2325 {
2326 	/*
2327 	 * Some routines, like zio_free_sync(), may return a NULL zio
2328 	 * to avoid the performance overhead of creating and then destroying
2329 	 * an unneeded zio.  For the callers' simplicity, we accept a NULL
2330 	 * zio and ignore it.
2331 	 */
2332 	if (zio == NULL)
2333 		return (0);
2334 
2335 	long timeout = MSEC_TO_TICK(zfs_deadman_ziotime_ms);
2336 	int error;
2337 
2338 	ASSERT3S(zio->io_stage, ==, ZIO_STAGE_OPEN);
2339 	ASSERT3P(zio->io_executor, ==, NULL);
2340 
2341 	zio->io_waiter = curthread;
2342 	ASSERT0(zio->io_queued_timestamp);
2343 	zio->io_queued_timestamp = gethrtime();
2344 
2345 	if (zio->io_type == ZIO_TYPE_WRITE) {
2346 		spa_select_allocator(zio);
2347 	}
2348 	__zio_execute(zio);
2349 
2350 	mutex_enter(&zio->io_lock);
2351 	while (zio->io_executor != NULL) {
2352 		error = cv_timedwait_io(&zio->io_cv, &zio->io_lock,
2353 		    ddi_get_lbolt() + timeout);
2354 
2355 		if (zfs_deadman_enabled && error == -1 &&
2356 		    gethrtime() - zio->io_queued_timestamp >
2357 		    spa_deadman_ziotime(zio->io_spa)) {
2358 			mutex_exit(&zio->io_lock);
2359 			timeout = MSEC_TO_TICK(zfs_deadman_checktime_ms);
2360 			zio_deadman(zio, FTAG);
2361 			mutex_enter(&zio->io_lock);
2362 		}
2363 	}
2364 	mutex_exit(&zio->io_lock);
2365 
2366 	error = zio->io_error;
2367 	zio_destroy(zio);
2368 
2369 	return (error);
2370 }
2371 
2372 void
2373 zio_nowait(zio_t *zio)
2374 {
2375 	/*
2376 	 * See comment in zio_wait().
2377 	 */
2378 	if (zio == NULL)
2379 		return;
2380 
2381 	ASSERT3P(zio->io_executor, ==, NULL);
2382 
2383 	if (zio->io_child_type == ZIO_CHILD_LOGICAL &&
2384 	    list_is_empty(&zio->io_parent_list)) {
2385 		zio_t *pio;
2386 
2387 		/*
2388 		 * This is a logical async I/O with no parent to wait for it.
2389 		 * We add it to the spa_async_root_zio "Godfather" I/O which
2390 		 * will ensure they complete prior to unloading the pool.
2391 		 */
2392 		spa_t *spa = zio->io_spa;
2393 		pio = spa->spa_async_zio_root[CPU_SEQID_UNSTABLE];
2394 
2395 		zio_add_child(pio, zio);
2396 	}
2397 
2398 	ASSERT0(zio->io_queued_timestamp);
2399 	zio->io_queued_timestamp = gethrtime();
2400 	if (zio->io_type == ZIO_TYPE_WRITE) {
2401 		spa_select_allocator(zio);
2402 	}
2403 	__zio_execute(zio);
2404 }
2405 
2406 /*
2407  * ==========================================================================
2408  * Reexecute, cancel, or suspend/resume failed I/O
2409  * ==========================================================================
2410  */
2411 
2412 static void
2413 zio_reexecute(void *arg)
2414 {
2415 	zio_t *pio = arg;
2416 	zio_t *cio, *cio_next, *gio;
2417 
2418 	ASSERT(pio->io_child_type == ZIO_CHILD_LOGICAL);
2419 	ASSERT(pio->io_orig_stage == ZIO_STAGE_OPEN);
2420 	ASSERT(pio->io_gang_leader == NULL);
2421 	ASSERT(pio->io_gang_tree == NULL);
2422 
2423 	mutex_enter(&pio->io_lock);
2424 	pio->io_flags = pio->io_orig_flags;
2425 	pio->io_stage = pio->io_orig_stage;
2426 	pio->io_pipeline = pio->io_orig_pipeline;
2427 	pio->io_reexecute = 0;
2428 	pio->io_flags |= ZIO_FLAG_REEXECUTED;
2429 	pio->io_pipeline_trace = 0;
2430 	pio->io_error = 0;
2431 	pio->io_state[ZIO_WAIT_READY] = (pio->io_stage >= ZIO_STAGE_READY) ||
2432 	    (pio->io_pipeline & ZIO_STAGE_READY) == 0;
2433 	pio->io_state[ZIO_WAIT_DONE] = (pio->io_stage >= ZIO_STAGE_DONE);
2434 	zio_link_t *zl = NULL;
2435 	while ((gio = zio_walk_parents(pio, &zl)) != NULL) {
2436 		for (int w = 0; w < ZIO_WAIT_TYPES; w++) {
2437 			gio->io_children[pio->io_child_type][w] +=
2438 			    !pio->io_state[w];
2439 		}
2440 	}
2441 	for (int c = 0; c < ZIO_CHILD_TYPES; c++)
2442 		pio->io_child_error[c] = 0;
2443 
2444 	if (IO_IS_ALLOCATING(pio))
2445 		BP_ZERO(pio->io_bp);
2446 
2447 	/*
2448 	 * As we reexecute pio's children, new children could be created.
2449 	 * New children go to the head of pio's io_child_list, however,
2450 	 * so we will (correctly) not reexecute them.  The key is that
2451 	 * the remainder of pio's io_child_list, from 'cio_next' onward,
2452 	 * cannot be affected by any side effects of reexecuting 'cio'.
2453 	 */
2454 	zl = NULL;
2455 	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
2456 		cio_next = zio_walk_children(pio, &zl);
2457 		mutex_exit(&pio->io_lock);
2458 		zio_reexecute(cio);
2459 		mutex_enter(&pio->io_lock);
2460 	}
2461 	mutex_exit(&pio->io_lock);
2462 
2463 	/*
2464 	 * Now that all children have been reexecuted, execute the parent.
2465 	 * We don't reexecute "The Godfather" I/O here as it's the
2466 	 * responsibility of the caller to wait on it.
2467 	 */
2468 	if (!(pio->io_flags & ZIO_FLAG_GODFATHER)) {
2469 		pio->io_queued_timestamp = gethrtime();
2470 		__zio_execute(pio);
2471 	}
2472 }
2473 
2474 void
2475 zio_suspend(spa_t *spa, zio_t *zio, zio_suspend_reason_t reason)
2476 {
2477 	if (spa_get_failmode(spa) == ZIO_FAILURE_MODE_PANIC)
2478 		fm_panic("Pool '%s' has encountered an uncorrectable I/O "
2479 		    "failure and the failure mode property for this pool "
2480 		    "is set to panic.", spa_name(spa));
2481 
2482 	cmn_err(CE_WARN, "Pool '%s' has encountered an uncorrectable I/O "
2483 	    "failure and has been suspended.\n", spa_name(spa));
2484 
2485 	(void) zfs_ereport_post(FM_EREPORT_ZFS_IO_FAILURE, spa, NULL,
2486 	    NULL, NULL, 0);
2487 
2488 	mutex_enter(&spa->spa_suspend_lock);
2489 
2490 	if (spa->spa_suspend_zio_root == NULL)
2491 		spa->spa_suspend_zio_root = zio_root(spa, NULL, NULL,
2492 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE |
2493 		    ZIO_FLAG_GODFATHER);
2494 
2495 	spa->spa_suspended = reason;
2496 
2497 	if (zio != NULL) {
2498 		ASSERT(!(zio->io_flags & ZIO_FLAG_GODFATHER));
2499 		ASSERT(zio != spa->spa_suspend_zio_root);
2500 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
2501 		ASSERT(zio_unique_parent(zio) == NULL);
2502 		ASSERT(zio->io_stage == ZIO_STAGE_DONE);
2503 		zio_add_child(spa->spa_suspend_zio_root, zio);
2504 	}
2505 
2506 	mutex_exit(&spa->spa_suspend_lock);
2507 }
2508 
2509 int
2510 zio_resume(spa_t *spa)
2511 {
2512 	zio_t *pio;
2513 
2514 	/*
2515 	 * Reexecute all previously suspended i/o.
2516 	 */
2517 	mutex_enter(&spa->spa_suspend_lock);
2518 	spa->spa_suspended = ZIO_SUSPEND_NONE;
2519 	cv_broadcast(&spa->spa_suspend_cv);
2520 	pio = spa->spa_suspend_zio_root;
2521 	spa->spa_suspend_zio_root = NULL;
2522 	mutex_exit(&spa->spa_suspend_lock);
2523 
2524 	if (pio == NULL)
2525 		return (0);
2526 
2527 	zio_reexecute(pio);
2528 	return (zio_wait(pio));
2529 }
2530 
2531 void
2532 zio_resume_wait(spa_t *spa)
2533 {
2534 	mutex_enter(&spa->spa_suspend_lock);
2535 	while (spa_suspended(spa))
2536 		cv_wait(&spa->spa_suspend_cv, &spa->spa_suspend_lock);
2537 	mutex_exit(&spa->spa_suspend_lock);
2538 }
2539 
2540 /*
2541  * ==========================================================================
2542  * Gang blocks.
2543  *
2544  * A gang block is a collection of small blocks that looks to the DMU
2545  * like one large block.  When zio_dva_allocate() cannot find a block
2546  * of the requested size, due to either severe fragmentation or the pool
2547  * being nearly full, it calls zio_write_gang_block() to construct the
2548  * block from smaller fragments.
2549  *
2550  * A gang block consists of a gang header (zio_gbh_phys_t) and up to
2551  * three (SPA_GBH_NBLKPTRS) gang members.  The gang header is just like
2552  * an indirect block: it's an array of block pointers.  It consumes
2553  * only one sector and hence is allocatable regardless of fragmentation.
2554  * The gang header's bps point to its gang members, which hold the data.
2555  *
2556  * Gang blocks are self-checksumming, using the bp's <vdev, offset, txg>
2557  * as the verifier to ensure uniqueness of the SHA256 checksum.
2558  * Critically, the gang block bp's blk_cksum is the checksum of the data,
2559  * not the gang header.  This ensures that data block signatures (needed for
2560  * deduplication) are independent of how the block is physically stored.
2561  *
2562  * Gang blocks can be nested: a gang member may itself be a gang block.
2563  * Thus every gang block is a tree in which root and all interior nodes are
2564  * gang headers, and the leaves are normal blocks that contain user data.
2565  * The root of the gang tree is called the gang leader.
2566  *
2567  * To perform any operation (read, rewrite, free, claim) on a gang block,
2568  * zio_gang_assemble() first assembles the gang tree (minus data leaves)
2569  * in the io_gang_tree field of the original logical i/o by recursively
2570  * reading the gang leader and all gang headers below it.  This yields
2571  * an in-core tree containing the contents of every gang header and the
2572  * bps for every constituent of the gang block.
2573  *
2574  * With the gang tree now assembled, zio_gang_issue() just walks the gang tree
2575  * and invokes a callback on each bp.  To free a gang block, zio_gang_issue()
2576  * calls zio_free_gang() -- a trivial wrapper around zio_free() -- for each bp.
2577  * zio_claim_gang() provides a similarly trivial wrapper for zio_claim().
2578  * zio_read_gang() is a wrapper around zio_read() that omits reading gang
2579  * headers, since we already have those in io_gang_tree.  zio_rewrite_gang()
2580  * performs a zio_rewrite() of the data or, for gang headers, a zio_rewrite()
2581  * of the gang header plus zio_checksum_compute() of the data to update the
2582  * gang header's blk_cksum as described above.
2583  *
2584  * The two-phase assemble/issue model solves the problem of partial failure --
2585  * what if you'd freed part of a gang block but then couldn't read the
2586  * gang header for another part?  Assembling the entire gang tree first
2587  * ensures that all the necessary gang header I/O has succeeded before
2588  * starting the actual work of free, claim, or write.  Once the gang tree
2589  * is assembled, free and claim are in-memory operations that cannot fail.
2590  *
2591  * In the event that a gang write fails, zio_dva_unallocate() walks the
2592  * gang tree to immediately free (i.e. insert back into the space map)
2593  * everything we've allocated.  This ensures that we don't get ENOSPC
2594  * errors during repeated suspend/resume cycles due to a flaky device.
2595  *
2596  * Gang rewrites only happen during sync-to-convergence.  If we can't assemble
2597  * the gang tree, we won't modify the block, so we can safely defer the free
2598  * (knowing that the block is still intact).  If we *can* assemble the gang
2599  * tree, then even if some of the rewrites fail, zio_dva_unallocate() will free
2600  * each constituent bp and we can allocate a new block on the next sync pass.
2601  *
2602  * In all cases, the gang tree allows complete recovery from partial failure.
2603  * ==========================================================================
2604  */
2605 
2606 static void
2607 zio_gang_issue_func_done(zio_t *zio)
2608 {
2609 	abd_free(zio->io_abd);
2610 }
2611 
2612 static zio_t *
2613 zio_read_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2614     uint64_t offset)
2615 {
2616 	if (gn != NULL)
2617 		return (pio);
2618 
2619 	return (zio_read(pio, pio->io_spa, bp, abd_get_offset(data, offset),
2620 	    BP_GET_PSIZE(bp), zio_gang_issue_func_done,
2621 	    NULL, pio->io_priority, ZIO_GANG_CHILD_FLAGS(pio),
2622 	    &pio->io_bookmark));
2623 }
2624 
2625 static zio_t *
2626 zio_rewrite_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2627     uint64_t offset)
2628 {
2629 	zio_t *zio;
2630 
2631 	if (gn != NULL) {
2632 		abd_t *gbh_abd =
2633 		    abd_get_from_buf(gn->gn_gbh, SPA_GANGBLOCKSIZE);
2634 		zio = zio_rewrite(pio, pio->io_spa, pio->io_txg, bp,
2635 		    gbh_abd, SPA_GANGBLOCKSIZE, zio_gang_issue_func_done, NULL,
2636 		    pio->io_priority, ZIO_GANG_CHILD_FLAGS(pio),
2637 		    &pio->io_bookmark);
2638 		/*
2639 		 * As we rewrite each gang header, the pipeline will compute
2640 		 * a new gang block header checksum for it; but no one will
2641 		 * compute a new data checksum, so we do that here.  The one
2642 		 * exception is the gang leader: the pipeline already computed
2643 		 * its data checksum because that stage precedes gang assembly.
2644 		 * (Presently, nothing actually uses interior data checksums;
2645 		 * this is just good hygiene.)
2646 		 */
2647 		if (gn != pio->io_gang_leader->io_gang_tree) {
2648 			abd_t *buf = abd_get_offset(data, offset);
2649 
2650 			zio_checksum_compute(zio, BP_GET_CHECKSUM(bp),
2651 			    buf, BP_GET_PSIZE(bp));
2652 
2653 			abd_free(buf);
2654 		}
2655 		/*
2656 		 * If we are here to damage data for testing purposes,
2657 		 * leave the GBH alone so that we can detect the damage.
2658 		 */
2659 		if (pio->io_gang_leader->io_flags & ZIO_FLAG_INDUCE_DAMAGE)
2660 			zio->io_pipeline &= ~ZIO_VDEV_IO_STAGES;
2661 	} else {
2662 		zio = zio_rewrite(pio, pio->io_spa, pio->io_txg, bp,
2663 		    abd_get_offset(data, offset), BP_GET_PSIZE(bp),
2664 		    zio_gang_issue_func_done, NULL, pio->io_priority,
2665 		    ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);
2666 	}
2667 
2668 	return (zio);
2669 }
2670 
2671 static zio_t *
2672 zio_free_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2673     uint64_t offset)
2674 {
2675 	(void) gn, (void) data, (void) offset;
2676 
2677 	zio_t *zio = zio_free_sync(pio, pio->io_spa, pio->io_txg, bp,
2678 	    ZIO_GANG_CHILD_FLAGS(pio));
2679 	if (zio == NULL) {
2680 		zio = zio_null(pio, pio->io_spa,
2681 		    NULL, NULL, NULL, ZIO_GANG_CHILD_FLAGS(pio));
2682 	}
2683 	return (zio);
2684 }
2685 
2686 static zio_t *
2687 zio_claim_gang(zio_t *pio, blkptr_t *bp, zio_gang_node_t *gn, abd_t *data,
2688     uint64_t offset)
2689 {
2690 	(void) gn, (void) data, (void) offset;
2691 	return (zio_claim(pio, pio->io_spa, pio->io_txg, bp,
2692 	    NULL, NULL, ZIO_GANG_CHILD_FLAGS(pio)));
2693 }
2694 
2695 static zio_gang_issue_func_t *zio_gang_issue_func[ZIO_TYPES] = {
2696 	NULL,
2697 	zio_read_gang,
2698 	zio_rewrite_gang,
2699 	zio_free_gang,
2700 	zio_claim_gang,
2701 	NULL
2702 };
2703 
2704 static void zio_gang_tree_assemble_done(zio_t *zio);
2705 
2706 static zio_gang_node_t *
2707 zio_gang_node_alloc(zio_gang_node_t **gnpp)
2708 {
2709 	zio_gang_node_t *gn;
2710 
2711 	ASSERT(*gnpp == NULL);
2712 
2713 	gn = kmem_zalloc(sizeof (*gn), KM_SLEEP);
2714 	gn->gn_gbh = zio_buf_alloc(SPA_GANGBLOCKSIZE);
2715 	*gnpp = gn;
2716 
2717 	return (gn);
2718 }
2719 
2720 static void
2721 zio_gang_node_free(zio_gang_node_t **gnpp)
2722 {
2723 	zio_gang_node_t *gn = *gnpp;
2724 
2725 	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++)
2726 		ASSERT(gn->gn_child[g] == NULL);
2727 
2728 	zio_buf_free(gn->gn_gbh, SPA_GANGBLOCKSIZE);
2729 	kmem_free(gn, sizeof (*gn));
2730 	*gnpp = NULL;
2731 }
2732 
2733 static void
2734 zio_gang_tree_free(zio_gang_node_t **gnpp)
2735 {
2736 	zio_gang_node_t *gn = *gnpp;
2737 
2738 	if (gn == NULL)
2739 		return;
2740 
2741 	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++)
2742 		zio_gang_tree_free(&gn->gn_child[g]);
2743 
2744 	zio_gang_node_free(gnpp);
2745 }
2746 
2747 static void
2748 zio_gang_tree_assemble(zio_t *gio, blkptr_t *bp, zio_gang_node_t **gnpp)
2749 {
2750 	zio_gang_node_t *gn = zio_gang_node_alloc(gnpp);
2751 	abd_t *gbh_abd = abd_get_from_buf(gn->gn_gbh, SPA_GANGBLOCKSIZE);
2752 
2753 	ASSERT(gio->io_gang_leader == gio);
2754 	ASSERT(BP_IS_GANG(bp));
2755 
2756 	zio_nowait(zio_read(gio, gio->io_spa, bp, gbh_abd, SPA_GANGBLOCKSIZE,
2757 	    zio_gang_tree_assemble_done, gn, gio->io_priority,
2758 	    ZIO_GANG_CHILD_FLAGS(gio), &gio->io_bookmark));
2759 }
2760 
2761 static void
2762 zio_gang_tree_assemble_done(zio_t *zio)
2763 {
2764 	zio_t *gio = zio->io_gang_leader;
2765 	zio_gang_node_t *gn = zio->io_private;
2766 	blkptr_t *bp = zio->io_bp;
2767 
2768 	ASSERT(gio == zio_unique_parent(zio));
2769 	ASSERT(list_is_empty(&zio->io_child_list));
2770 
2771 	if (zio->io_error)
2772 		return;
2773 
2774 	/* this ABD was created from a linear buf in zio_gang_tree_assemble */
2775 	if (BP_SHOULD_BYTESWAP(bp))
2776 		byteswap_uint64_array(abd_to_buf(zio->io_abd), zio->io_size);
2777 
2778 	ASSERT3P(abd_to_buf(zio->io_abd), ==, gn->gn_gbh);
2779 	ASSERT(zio->io_size == SPA_GANGBLOCKSIZE);
2780 	ASSERT(gn->gn_gbh->zg_tail.zec_magic == ZEC_MAGIC);
2781 
2782 	abd_free(zio->io_abd);
2783 
2784 	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
2785 		blkptr_t *gbp = &gn->gn_gbh->zg_blkptr[g];
2786 		if (!BP_IS_GANG(gbp))
2787 			continue;
2788 		zio_gang_tree_assemble(gio, gbp, &gn->gn_child[g]);
2789 	}
2790 }
2791 
2792 static void
2793 zio_gang_tree_issue(zio_t *pio, zio_gang_node_t *gn, blkptr_t *bp, abd_t *data,
2794     uint64_t offset)
2795 {
2796 	zio_t *gio = pio->io_gang_leader;
2797 	zio_t *zio;
2798 
2799 	ASSERT(BP_IS_GANG(bp) == !!gn);
2800 	ASSERT(BP_GET_CHECKSUM(bp) == BP_GET_CHECKSUM(gio->io_bp));
2801 	ASSERT(BP_GET_LSIZE(bp) == BP_GET_PSIZE(bp) || gn == gio->io_gang_tree);
2802 
2803 	/*
2804 	 * If you're a gang header, your data is in gn->gn_gbh.
2805 	 * If you're a gang member, your data is in 'data' and gn == NULL.
2806 	 */
2807 	zio = zio_gang_issue_func[gio->io_type](pio, bp, gn, data, offset);
2808 
2809 	if (gn != NULL) {
2810 		ASSERT(gn->gn_gbh->zg_tail.zec_magic == ZEC_MAGIC);
2811 
2812 		for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
2813 			blkptr_t *gbp = &gn->gn_gbh->zg_blkptr[g];
2814 			if (BP_IS_HOLE(gbp))
2815 				continue;
2816 			zio_gang_tree_issue(zio, gn->gn_child[g], gbp, data,
2817 			    offset);
2818 			offset += BP_GET_PSIZE(gbp);
2819 		}
2820 	}
2821 
2822 	if (gn == gio->io_gang_tree)
2823 		ASSERT3U(gio->io_size, ==, offset);
2824 
2825 	if (zio != pio)
2826 		zio_nowait(zio);
2827 }
2828 
2829 static zio_t *
2830 zio_gang_assemble(zio_t *zio)
2831 {
2832 	blkptr_t *bp = zio->io_bp;
2833 
2834 	ASSERT(BP_IS_GANG(bp) && zio->io_gang_leader == NULL);
2835 	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
2836 
2837 	zio->io_gang_leader = zio;
2838 
2839 	zio_gang_tree_assemble(zio, bp, &zio->io_gang_tree);
2840 
2841 	return (zio);
2842 }
2843 
2844 static zio_t *
2845 zio_gang_issue(zio_t *zio)
2846 {
2847 	blkptr_t *bp = zio->io_bp;
2848 
2849 	if (zio_wait_for_children(zio, ZIO_CHILD_GANG_BIT, ZIO_WAIT_DONE)) {
2850 		return (NULL);
2851 	}
2852 
2853 	ASSERT(BP_IS_GANG(bp) && zio->io_gang_leader == zio);
2854 	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
2855 
2856 	if (zio->io_child_error[ZIO_CHILD_GANG] == 0)
2857 		zio_gang_tree_issue(zio, zio->io_gang_tree, bp, zio->io_abd,
2858 		    0);
2859 	else
2860 		zio_gang_tree_free(&zio->io_gang_tree);
2861 
2862 	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
2863 
2864 	return (zio);
2865 }
2866 
2867 static void
2868 zio_gang_inherit_allocator(zio_t *pio, zio_t *cio)
2869 {
2870 	cio->io_allocator = pio->io_allocator;
2871 	cio->io_wr_iss_tq = pio->io_wr_iss_tq;
2872 }
2873 
2874 static void
2875 zio_write_gang_member_ready(zio_t *zio)
2876 {
2877 	zio_t *pio = zio_unique_parent(zio);
2878 	dva_t *cdva = zio->io_bp->blk_dva;
2879 	dva_t *pdva = pio->io_bp->blk_dva;
2880 	uint64_t asize;
2881 	zio_t *gio __maybe_unused = zio->io_gang_leader;
2882 
2883 	if (BP_IS_HOLE(zio->io_bp))
2884 		return;
2885 
2886 	ASSERT(BP_IS_HOLE(&zio->io_bp_orig));
2887 
2888 	ASSERT(zio->io_child_type == ZIO_CHILD_GANG);
2889 	ASSERT3U(zio->io_prop.zp_copies, ==, gio->io_prop.zp_copies);
2890 	ASSERT3U(zio->io_prop.zp_copies, <=, BP_GET_NDVAS(zio->io_bp));
2891 	ASSERT3U(pio->io_prop.zp_copies, <=, BP_GET_NDVAS(pio->io_bp));
2892 	VERIFY3U(BP_GET_NDVAS(zio->io_bp), <=, BP_GET_NDVAS(pio->io_bp));
2893 
2894 	mutex_enter(&pio->io_lock);
2895 	for (int d = 0; d < BP_GET_NDVAS(zio->io_bp); d++) {
2896 		ASSERT(DVA_GET_GANG(&pdva[d]));
2897 		asize = DVA_GET_ASIZE(&pdva[d]);
2898 		asize += DVA_GET_ASIZE(&cdva[d]);
2899 		DVA_SET_ASIZE(&pdva[d], asize);
2900 	}
2901 	mutex_exit(&pio->io_lock);
2902 }
2903 
2904 static void
2905 zio_write_gang_done(zio_t *zio)
2906 {
2907 	/*
2908 	 * The io_abd field will be NULL for a zio with no data.  The io_flags
2909 	 * will initially have the ZIO_FLAG_NODATA bit flag set, but we can't
2910 	 * check for it here as it is cleared in zio_ready.
2911 	 */
2912 	if (zio->io_abd != NULL)
2913 		abd_free(zio->io_abd);
2914 }
2915 
2916 static zio_t *
2917 zio_write_gang_block(zio_t *pio, metaslab_class_t *mc)
2918 {
2919 	spa_t *spa = pio->io_spa;
2920 	blkptr_t *bp = pio->io_bp;
2921 	zio_t *gio = pio->io_gang_leader;
2922 	zio_t *zio;
2923 	zio_gang_node_t *gn, **gnpp;
2924 	zio_gbh_phys_t *gbh;
2925 	abd_t *gbh_abd;
2926 	uint64_t txg = pio->io_txg;
2927 	uint64_t resid = pio->io_size;
2928 	uint64_t lsize;
2929 	int copies = gio->io_prop.zp_copies;
2930 	zio_prop_t zp;
2931 	int error;
2932 	boolean_t has_data = !(pio->io_flags & ZIO_FLAG_NODATA);
2933 
2934 	/*
2935 	 * If one copy was requested, store 2 copies of the GBH, so that we
2936 	 * can still traverse all the data (e.g. to free or scrub) even if a
2937 	 * block is damaged.  Note that we can't store 3 copies of the GBH in
2938 	 * all cases, e.g. with encryption, which uses DVA[2] for the IV+salt.
2939 	 */
2940 	int gbh_copies = copies;
2941 	if (gbh_copies == 1) {
2942 		gbh_copies = MIN(2, spa_max_replication(spa));
2943 	}
2944 
2945 	ASSERT(ZIO_HAS_ALLOCATOR(pio));
2946 	int flags = METASLAB_HINTBP_FAVOR | METASLAB_GANG_HEADER;
2947 	if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
2948 		ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
2949 		ASSERT(has_data);
2950 
2951 		flags |= METASLAB_ASYNC_ALLOC;
2952 		VERIFY(zfs_refcount_held(&mc->mc_allocator[pio->io_allocator].
2953 		    mca_alloc_slots, pio));
2954 
2955 		/*
2956 		 * The logical zio has already placed a reservation for
2957 		 * 'copies' allocation slots but gang blocks may require
2958 		 * additional copies. These additional copies
2959 		 * (i.e. gbh_copies - copies) are guaranteed to succeed
2960 		 * since metaslab_class_throttle_reserve() always allows
2961 		 * additional reservations for gang blocks.
2962 		 */
2963 		VERIFY(metaslab_class_throttle_reserve(mc, gbh_copies - copies,
2964 		    pio->io_allocator, pio, flags));
2965 	}
2966 
2967 	error = metaslab_alloc(spa, mc, SPA_GANGBLOCKSIZE,
2968 	    bp, gbh_copies, txg, pio == gio ? NULL : gio->io_bp, flags,
2969 	    &pio->io_alloc_list, pio, pio->io_allocator);
2970 	if (error) {
2971 		if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
2972 			ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
2973 			ASSERT(has_data);
2974 
2975 			/*
2976 			 * If we failed to allocate the gang block header then
2977 			 * we remove any additional allocation reservations that
2978 			 * we placed here. The original reservation will
2979 			 * be removed when the logical I/O goes to the ready
2980 			 * stage.
2981 			 */
2982 			metaslab_class_throttle_unreserve(mc,
2983 			    gbh_copies - copies, pio->io_allocator, pio);
2984 		}
2985 
2986 		pio->io_error = error;
2987 		return (pio);
2988 	}
2989 
2990 	if (pio == gio) {
2991 		gnpp = &gio->io_gang_tree;
2992 	} else {
2993 		gnpp = pio->io_private;
2994 		ASSERT(pio->io_ready == zio_write_gang_member_ready);
2995 	}
2996 
2997 	gn = zio_gang_node_alloc(gnpp);
2998 	gbh = gn->gn_gbh;
2999 	memset(gbh, 0, SPA_GANGBLOCKSIZE);
3000 	gbh_abd = abd_get_from_buf(gbh, SPA_GANGBLOCKSIZE);
3001 
3002 	/*
3003 	 * Create the gang header.
3004 	 */
3005 	zio = zio_rewrite(pio, spa, txg, bp, gbh_abd, SPA_GANGBLOCKSIZE,
3006 	    zio_write_gang_done, NULL, pio->io_priority,
3007 	    ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);
3008 
3009 	zio_gang_inherit_allocator(pio, zio);
3010 
3011 	/*
3012 	 * Create and nowait the gang children.
3013 	 */
3014 	for (int g = 0; resid != 0; resid -= lsize, g++) {
3015 		lsize = P2ROUNDUP(resid / (SPA_GBH_NBLKPTRS - g),
3016 		    SPA_MINBLOCKSIZE);
3017 		ASSERT(lsize >= SPA_MINBLOCKSIZE && lsize <= resid);
3018 
3019 		zp.zp_checksum = gio->io_prop.zp_checksum;
3020 		zp.zp_compress = ZIO_COMPRESS_OFF;
3021 		zp.zp_complevel = gio->io_prop.zp_complevel;
3022 		zp.zp_type = DMU_OT_NONE;
3023 		zp.zp_level = 0;
3024 		zp.zp_copies = gio->io_prop.zp_copies;
3025 		zp.zp_dedup = B_FALSE;
3026 		zp.zp_dedup_verify = B_FALSE;
3027 		zp.zp_nopwrite = B_FALSE;
3028 		zp.zp_encrypt = gio->io_prop.zp_encrypt;
3029 		zp.zp_byteorder = gio->io_prop.zp_byteorder;
3030 		memset(zp.zp_salt, 0, ZIO_DATA_SALT_LEN);
3031 		memset(zp.zp_iv, 0, ZIO_DATA_IV_LEN);
3032 		memset(zp.zp_mac, 0, ZIO_DATA_MAC_LEN);
3033 
3034 		zio_t *cio = zio_write(zio, spa, txg, &gbh->zg_blkptr[g],
3035 		    has_data ? abd_get_offset(pio->io_abd, pio->io_size -
3036 		    resid) : NULL, lsize, lsize, &zp,
3037 		    zio_write_gang_member_ready, NULL,
3038 		    zio_write_gang_done, &gn->gn_child[g], pio->io_priority,
3039 		    ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);
3040 
3041 		zio_gang_inherit_allocator(zio, cio);
3042 
3043 		if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
3044 			ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
3045 			ASSERT(has_data);
3046 
3047 			/*
3048 			 * Gang children won't throttle but we should
3049 			 * account for their work, so reserve an allocation
3050 			 * slot for them here.
3051 			 */
3052 			VERIFY(metaslab_class_throttle_reserve(mc,
3053 			    zp.zp_copies, cio->io_allocator, cio, flags));
3054 		}
3055 		zio_nowait(cio);
3056 	}
3057 
3058 	/*
3059 	 * Set pio's pipeline to just wait for zio to finish.
3060 	 */
3061 	pio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
3062 
3063 	zio_nowait(zio);
3064 
3065 	return (pio);
3066 }
3067 
3068 /*
3069  * The zio_nop_write stage in the pipeline determines if allocating a
3070  * new bp is necessary.  The nopwrite feature can handle writes in
3071  * either syncing or open context (i.e. zil writes) and as a result is
3072  * mutually exclusive with dedup.
3073  *
3074  * By leveraging a cryptographically secure checksum, such as SHA256, we
3075  * can compare the checksums of the new data and the old to determine if
3076  * allocating a new block is required.  Note that our requirements for
3077  * cryptographic strength are fairly weak: there can't be any accidental
3078  * hash collisions, but we don't need to be secure against intentional
3079  * (malicious) collisions.  To trigger a nopwrite, you have to be able
3080  * to write the file to begin with, and triggering an incorrect (hash
3081  * collision) nopwrite is no worse than simply writing to the file.
3082  * That said, there are no known attacks against the checksum algorithms
3083  * used for nopwrite, assuming that the salt and the checksums
3084  * themselves remain secret.
3085  */
3086 static zio_t *
3087 zio_nop_write(zio_t *zio)
3088 {
3089 	blkptr_t *bp = zio->io_bp;
3090 	blkptr_t *bp_orig = &zio->io_bp_orig;
3091 	zio_prop_t *zp = &zio->io_prop;
3092 
3093 	ASSERT(BP_IS_HOLE(bp));
3094 	ASSERT(BP_GET_LEVEL(bp) == 0);
3095 	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
3096 	ASSERT(zp->zp_nopwrite);
3097 	ASSERT(!zp->zp_dedup);
3098 	ASSERT(zio->io_bp_override == NULL);
3099 	ASSERT(IO_IS_ALLOCATING(zio));
3100 
3101 	/*
3102 	 * Check to see if the original bp and the new bp have matching
3103 	 * characteristics (i.e. same checksum, compression algorithms, etc).
3104 	 * If they don't then just continue with the pipeline which will
3105 	 * allocate a new bp.
3106 	 */
3107 	if (BP_IS_HOLE(bp_orig) ||
3108 	    !(zio_checksum_table[BP_GET_CHECKSUM(bp)].ci_flags &
3109 	    ZCHECKSUM_FLAG_NOPWRITE) ||
3110 	    BP_IS_ENCRYPTED(bp) || BP_IS_ENCRYPTED(bp_orig) ||
3111 	    BP_GET_CHECKSUM(bp) != BP_GET_CHECKSUM(bp_orig) ||
3112 	    BP_GET_COMPRESS(bp) != BP_GET_COMPRESS(bp_orig) ||
3113 	    BP_GET_DEDUP(bp) != BP_GET_DEDUP(bp_orig) ||
3114 	    zp->zp_copies != BP_GET_NDVAS(bp_orig))
3115 		return (zio);
3116 
3117 	/*
3118 	 * If the checksums match then reset the pipeline so that we
3119 	 * avoid allocating a new bp and issuing any I/O.
3120 	 */
3121 	if (ZIO_CHECKSUM_EQUAL(bp->blk_cksum, bp_orig->blk_cksum)) {
3122 		ASSERT(zio_checksum_table[zp->zp_checksum].ci_flags &
3123 		    ZCHECKSUM_FLAG_NOPWRITE);
3124 		ASSERT3U(BP_GET_PSIZE(bp), ==, BP_GET_PSIZE(bp_orig));
3125 		ASSERT3U(BP_GET_LSIZE(bp), ==, BP_GET_LSIZE(bp_orig));
3126 		ASSERT(zp->zp_compress != ZIO_COMPRESS_OFF);
3127 		ASSERT3U(bp->blk_prop, ==, bp_orig->blk_prop);
3128 
3129 		/*
3130 		 * If we're overwriting a block that is currently on an
3131 		 * indirect vdev, then ignore the nopwrite request and
3132 		 * allow a new block to be allocated on a concrete vdev.
3133 		 */
3134 		spa_config_enter(zio->io_spa, SCL_VDEV, FTAG, RW_READER);
3135 		for (int d = 0; d < BP_GET_NDVAS(bp_orig); d++) {
3136 			vdev_t *tvd = vdev_lookup_top(zio->io_spa,
3137 			    DVA_GET_VDEV(&bp_orig->blk_dva[d]));
3138 			if (tvd->vdev_ops == &vdev_indirect_ops) {
3139 				spa_config_exit(zio->io_spa, SCL_VDEV, FTAG);
3140 				return (zio);
3141 			}
3142 		}
3143 		spa_config_exit(zio->io_spa, SCL_VDEV, FTAG);
3144 
3145 		*bp = *bp_orig;
3146 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
3147 		zio->io_flags |= ZIO_FLAG_NOPWRITE;
3148 	}
3149 
3150 	return (zio);
3151 }
3152 
3153 /*
3154  * ==========================================================================
3155  * Block Reference Table
3156  * ==========================================================================
3157  */
3158 static zio_t *
3159 zio_brt_free(zio_t *zio)
3160 {
3161 	blkptr_t *bp;
3162 
3163 	bp = zio->io_bp;
3164 
3165 	if (BP_GET_LEVEL(bp) > 0 ||
3166 	    BP_IS_METADATA(bp) ||
3167 	    !brt_maybe_exists(zio->io_spa, bp)) {
3168 		return (zio);
3169 	}
3170 
3171 	if (!brt_entry_decref(zio->io_spa, bp)) {
3172 		/*
3173 		 * This isn't the last reference, so we cannot free
3174 		 * the data yet.
3175 		 */
3176 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
3177 	}
3178 
3179 	return (zio);
3180 }
3181 
3182 /*
3183  * ==========================================================================
3184  * Dedup
3185  * ==========================================================================
3186  */
3187 static void
3188 zio_ddt_child_read_done(zio_t *zio)
3189 {
3190 	blkptr_t *bp = zio->io_bp;
3191 	ddt_entry_t *dde = zio->io_private;
3192 	ddt_phys_t *ddp;
3193 	zio_t *pio = zio_unique_parent(zio);
3194 
3195 	mutex_enter(&pio->io_lock);
3196 	ddp = ddt_phys_select(dde, bp);
3197 	if (zio->io_error == 0)
3198 		ddt_phys_clear(ddp);	/* this ddp doesn't need repair */
3199 
3200 	if (zio->io_error == 0 && dde->dde_repair_abd == NULL)
3201 		dde->dde_repair_abd = zio->io_abd;
3202 	else
3203 		abd_free(zio->io_abd);
3204 	mutex_exit(&pio->io_lock);
3205 }
3206 
3207 static zio_t *
3208 zio_ddt_read_start(zio_t *zio)
3209 {
3210 	blkptr_t *bp = zio->io_bp;
3211 
3212 	ASSERT(BP_GET_DEDUP(bp));
3213 	ASSERT(BP_GET_PSIZE(bp) == zio->io_size);
3214 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
3215 
3216 	if (zio->io_child_error[ZIO_CHILD_DDT]) {
3217 		ddt_t *ddt = ddt_select(zio->io_spa, bp);
3218 		ddt_entry_t *dde = ddt_repair_start(ddt, bp);
3219 		ddt_phys_t *ddp = dde->dde_phys;
3220 		ddt_phys_t *ddp_self = ddt_phys_select(dde, bp);
3221 		blkptr_t blk;
3222 
3223 		ASSERT(zio->io_vsd == NULL);
3224 		zio->io_vsd = dde;
3225 
3226 		if (ddp_self == NULL)
3227 			return (zio);
3228 
3229 		for (int p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
3230 			if (ddp->ddp_phys_birth == 0 || ddp == ddp_self)
3231 				continue;
3232 			ddt_bp_create(ddt->ddt_checksum, &dde->dde_key, ddp,
3233 			    &blk);
3234 			zio_nowait(zio_read(zio, zio->io_spa, &blk,
3235 			    abd_alloc_for_io(zio->io_size, B_TRUE),
3236 			    zio->io_size, zio_ddt_child_read_done, dde,
3237 			    zio->io_priority, ZIO_DDT_CHILD_FLAGS(zio) |
3238 			    ZIO_FLAG_DONT_PROPAGATE, &zio->io_bookmark));
3239 		}
3240 		return (zio);
3241 	}
3242 
3243 	zio_nowait(zio_read(zio, zio->io_spa, bp,
3244 	    zio->io_abd, zio->io_size, NULL, NULL, zio->io_priority,
3245 	    ZIO_DDT_CHILD_FLAGS(zio), &zio->io_bookmark));
3246 
3247 	return (zio);
3248 }
3249 
3250 static zio_t *
3251 zio_ddt_read_done(zio_t *zio)
3252 {
3253 	blkptr_t *bp = zio->io_bp;
3254 
3255 	if (zio_wait_for_children(zio, ZIO_CHILD_DDT_BIT, ZIO_WAIT_DONE)) {
3256 		return (NULL);
3257 	}
3258 
3259 	ASSERT(BP_GET_DEDUP(bp));
3260 	ASSERT(BP_GET_PSIZE(bp) == zio->io_size);
3261 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
3262 
3263 	if (zio->io_child_error[ZIO_CHILD_DDT]) {
3264 		ddt_t *ddt = ddt_select(zio->io_spa, bp);
3265 		ddt_entry_t *dde = zio->io_vsd;
3266 		if (ddt == NULL) {
3267 			ASSERT(spa_load_state(zio->io_spa) != SPA_LOAD_NONE);
3268 			return (zio);
3269 		}
3270 		if (dde == NULL) {
3271 			zio->io_stage = ZIO_STAGE_DDT_READ_START >> 1;
3272 			zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_FALSE);
3273 			return (NULL);
3274 		}
3275 		if (dde->dde_repair_abd != NULL) {
3276 			abd_copy(zio->io_abd, dde->dde_repair_abd,
3277 			    zio->io_size);
3278 			zio->io_child_error[ZIO_CHILD_DDT] = 0;
3279 		}
3280 		ddt_repair_done(ddt, dde);
3281 		zio->io_vsd = NULL;
3282 	}
3283 
3284 	ASSERT(zio->io_vsd == NULL);
3285 
3286 	return (zio);
3287 }
3288 
3289 static boolean_t
3290 zio_ddt_collision(zio_t *zio, ddt_t *ddt, ddt_entry_t *dde)
3291 {
3292 	spa_t *spa = zio->io_spa;
3293 	boolean_t do_raw = !!(zio->io_flags & ZIO_FLAG_RAW);
3294 
3295 	ASSERT(!(zio->io_bp_override && do_raw));
3296 
3297 	/*
3298 	 * Note: we compare the original data, not the transformed data,
3299 	 * because when zio->io_bp is an override bp, we will not have
3300 	 * pushed the I/O transforms.  That's an important optimization
3301 	 * because otherwise we'd compress/encrypt all dmu_sync() data twice.
3302 	 * However, we should never get a raw, override zio so in these
3303 	 * cases we can compare the io_abd directly. This is useful because
3304 	 * it allows us to do dedup verification even if we don't have access
3305 	 * to the original data (for instance, if the encryption keys aren't
3306 	 * loaded).
3307 	 */
3308 
3309 	for (int p = DDT_PHYS_SINGLE; p <= DDT_PHYS_TRIPLE; p++) {
3310 		zio_t *lio = dde->dde_lead_zio[p];
3311 
3312 		if (lio != NULL && do_raw) {
3313 			return (lio->io_size != zio->io_size ||
3314 			    abd_cmp(zio->io_abd, lio->io_abd) != 0);
3315 		} else if (lio != NULL) {
3316 			return (lio->io_orig_size != zio->io_orig_size ||
3317 			    abd_cmp(zio->io_orig_abd, lio->io_orig_abd) != 0);
3318 		}
3319 	}
3320 
3321 	for (int p = DDT_PHYS_SINGLE; p <= DDT_PHYS_TRIPLE; p++) {
3322 		ddt_phys_t *ddp = &dde->dde_phys[p];
3323 
3324 		if (ddp->ddp_phys_birth != 0 && do_raw) {
3325 			blkptr_t blk = *zio->io_bp;
3326 			uint64_t psize;
3327 			abd_t *tmpabd;
3328 			int error;
3329 
3330 			ddt_bp_fill(ddp, &blk, ddp->ddp_phys_birth);
3331 			psize = BP_GET_PSIZE(&blk);
3332 
3333 			if (psize != zio->io_size)
3334 				return (B_TRUE);
3335 
3336 			ddt_exit(ddt);
3337 
3338 			tmpabd = abd_alloc_for_io(psize, B_TRUE);
3339 
3340 			error = zio_wait(zio_read(NULL, spa, &blk, tmpabd,
3341 			    psize, NULL, NULL, ZIO_PRIORITY_SYNC_READ,
3342 			    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE |
3343 			    ZIO_FLAG_RAW, &zio->io_bookmark));
3344 
3345 			if (error == 0) {
3346 				if (abd_cmp(tmpabd, zio->io_abd) != 0)
3347 					error = SET_ERROR(ENOENT);
3348 			}
3349 
3350 			abd_free(tmpabd);
3351 			ddt_enter(ddt);
3352 			return (error != 0);
3353 		} else if (ddp->ddp_phys_birth != 0) {
3354 			arc_buf_t *abuf = NULL;
3355 			arc_flags_t aflags = ARC_FLAG_WAIT;
3356 			blkptr_t blk = *zio->io_bp;
3357 			int error;
3358 
3359 			ddt_bp_fill(ddp, &blk, ddp->ddp_phys_birth);
3360 
3361 			if (BP_GET_LSIZE(&blk) != zio->io_orig_size)
3362 				return (B_TRUE);
3363 
3364 			ddt_exit(ddt);
3365 
3366 			error = arc_read(NULL, spa, &blk,
3367 			    arc_getbuf_func, &abuf, ZIO_PRIORITY_SYNC_READ,
3368 			    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
3369 			    &aflags, &zio->io_bookmark);
3370 
3371 			if (error == 0) {
3372 				if (abd_cmp_buf(zio->io_orig_abd, abuf->b_data,
3373 				    zio->io_orig_size) != 0)
3374 					error = SET_ERROR(ENOENT);
3375 				arc_buf_destroy(abuf, &abuf);
3376 			}
3377 
3378 			ddt_enter(ddt);
3379 			return (error != 0);
3380 		}
3381 	}
3382 
3383 	return (B_FALSE);
3384 }
3385 
3386 static void
3387 zio_ddt_child_write_ready(zio_t *zio)
3388 {
3389 	int p = zio->io_prop.zp_copies;
3390 	ddt_t *ddt = ddt_select(zio->io_spa, zio->io_bp);
3391 	ddt_entry_t *dde = zio->io_private;
3392 	ddt_phys_t *ddp = &dde->dde_phys[p];
3393 	zio_t *pio;
3394 
3395 	if (zio->io_error)
3396 		return;
3397 
3398 	ddt_enter(ddt);
3399 
3400 	ASSERT(dde->dde_lead_zio[p] == zio);
3401 
3402 	ddt_phys_fill(ddp, zio->io_bp);
3403 
3404 	zio_link_t *zl = NULL;
3405 	while ((pio = zio_walk_parents(zio, &zl)) != NULL)
3406 		ddt_bp_fill(ddp, pio->io_bp, zio->io_txg);
3407 
3408 	ddt_exit(ddt);
3409 }
3410 
3411 static void
3412 zio_ddt_child_write_done(zio_t *zio)
3413 {
3414 	int p = zio->io_prop.zp_copies;
3415 	ddt_t *ddt = ddt_select(zio->io_spa, zio->io_bp);
3416 	ddt_entry_t *dde = zio->io_private;
3417 	ddt_phys_t *ddp = &dde->dde_phys[p];
3418 
3419 	ddt_enter(ddt);
3420 
3421 	ASSERT(ddp->ddp_refcnt == 0);
3422 	ASSERT(dde->dde_lead_zio[p] == zio);
3423 	dde->dde_lead_zio[p] = NULL;
3424 
3425 	if (zio->io_error == 0) {
3426 		zio_link_t *zl = NULL;
3427 		while (zio_walk_parents(zio, &zl) != NULL)
3428 			ddt_phys_addref(ddp);
3429 	} else {
3430 		ddt_phys_clear(ddp);
3431 	}
3432 
3433 	ddt_exit(ddt);
3434 }
3435 
3436 static zio_t *
3437 zio_ddt_write(zio_t *zio)
3438 {
3439 	spa_t *spa = zio->io_spa;
3440 	blkptr_t *bp = zio->io_bp;
3441 	uint64_t txg = zio->io_txg;
3442 	zio_prop_t *zp = &zio->io_prop;
3443 	int p = zp->zp_copies;
3444 	zio_t *cio = NULL;
3445 	ddt_t *ddt = ddt_select(spa, bp);
3446 	ddt_entry_t *dde;
3447 	ddt_phys_t *ddp;
3448 
3449 	ASSERT(BP_GET_DEDUP(bp));
3450 	ASSERT(BP_GET_CHECKSUM(bp) == zp->zp_checksum);
3451 	ASSERT(BP_IS_HOLE(bp) || zio->io_bp_override);
3452 	ASSERT(!(zio->io_bp_override && (zio->io_flags & ZIO_FLAG_RAW)));
3453 
3454 	ddt_enter(ddt);
3455 	dde = ddt_lookup(ddt, bp, B_TRUE);
3456 	ddp = &dde->dde_phys[p];
3457 
3458 	if (zp->zp_dedup_verify && zio_ddt_collision(zio, ddt, dde)) {
3459 		/*
3460 		 * If we're using a weak checksum, upgrade to a strong checksum
3461 		 * and try again.  If we're already using a strong checksum,
3462 		 * we can't resolve it, so just convert to an ordinary write.
3463 		 * (And automatically e-mail a paper to Nature?)
3464 		 */
3465 		if (!(zio_checksum_table[zp->zp_checksum].ci_flags &
3466 		    ZCHECKSUM_FLAG_DEDUP)) {
3467 			zp->zp_checksum = spa_dedup_checksum(spa);
3468 			zio_pop_transforms(zio);
3469 			zio->io_stage = ZIO_STAGE_OPEN;
3470 			BP_ZERO(bp);
3471 		} else {
3472 			zp->zp_dedup = B_FALSE;
3473 			BP_SET_DEDUP(bp, B_FALSE);
3474 		}
3475 		ASSERT(!BP_GET_DEDUP(bp));
3476 		zio->io_pipeline = ZIO_WRITE_PIPELINE;
3477 		ddt_exit(ddt);
3478 		return (zio);
3479 	}
3480 
3481 	if (ddp->ddp_phys_birth != 0 || dde->dde_lead_zio[p] != NULL) {
3482 		if (ddp->ddp_phys_birth != 0)
3483 			ddt_bp_fill(ddp, bp, txg);
3484 		if (dde->dde_lead_zio[p] != NULL)
3485 			zio_add_child(zio, dde->dde_lead_zio[p]);
3486 		else
3487 			ddt_phys_addref(ddp);
3488 	} else if (zio->io_bp_override) {
3489 		ASSERT(bp->blk_birth == txg);
3490 		ASSERT(BP_EQUAL(bp, zio->io_bp_override));
3491 		ddt_phys_fill(ddp, bp);
3492 		ddt_phys_addref(ddp);
3493 	} else {
3494 		cio = zio_write(zio, spa, txg, bp, zio->io_orig_abd,
3495 		    zio->io_orig_size, zio->io_orig_size, zp,
3496 		    zio_ddt_child_write_ready, NULL,
3497 		    zio_ddt_child_write_done, dde, zio->io_priority,
3498 		    ZIO_DDT_CHILD_FLAGS(zio), &zio->io_bookmark);
3499 
3500 		zio_push_transform(cio, zio->io_abd, zio->io_size, 0, NULL);
3501 		dde->dde_lead_zio[p] = cio;
3502 	}
3503 
3504 	ddt_exit(ddt);
3505 
3506 	zio_nowait(cio);
3507 
3508 	return (zio);
3509 }
3510 
3511 static ddt_entry_t *freedde; /* for debugging */
3512 
3513 static zio_t *
3514 zio_ddt_free(zio_t *zio)
3515 {
3516 	spa_t *spa = zio->io_spa;
3517 	blkptr_t *bp = zio->io_bp;
3518 	ddt_t *ddt = ddt_select(spa, bp);
3519 	ddt_entry_t *dde;
3520 	ddt_phys_t *ddp;
3521 
3522 	ASSERT(BP_GET_DEDUP(bp));
3523 	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
3524 
3525 	ddt_enter(ddt);
3526 	freedde = dde = ddt_lookup(ddt, bp, B_TRUE);
3527 	if (dde) {
3528 		ddp = ddt_phys_select(dde, bp);
3529 		if (ddp)
3530 			ddt_phys_decref(ddp);
3531 	}
3532 	ddt_exit(ddt);
3533 
3534 	return (zio);
3535 }
3536 
3537 /*
3538  * ==========================================================================
3539  * Allocate and free blocks
3540  * ==========================================================================
3541  */
3542 
3543 static zio_t *
3544 zio_io_to_allocate(spa_t *spa, int allocator)
3545 {
3546 	zio_t *zio;
3547 
3548 	ASSERT(MUTEX_HELD(&spa->spa_allocs[allocator].spaa_lock));
3549 
3550 	zio = avl_first(&spa->spa_allocs[allocator].spaa_tree);
3551 	if (zio == NULL)
3552 		return (NULL);
3553 
3554 	ASSERT(IO_IS_ALLOCATING(zio));
3555 	ASSERT(ZIO_HAS_ALLOCATOR(zio));
3556 
3557 	/*
3558 	 * Try to place a reservation for this zio. If we're unable to
3559 	 * reserve then we throttle.
3560 	 */
3561 	ASSERT3U(zio->io_allocator, ==, allocator);
3562 	if (!metaslab_class_throttle_reserve(zio->io_metaslab_class,
3563 	    zio->io_prop.zp_copies, allocator, zio, 0)) {
3564 		return (NULL);
3565 	}
3566 
3567 	avl_remove(&spa->spa_allocs[allocator].spaa_tree, zio);
3568 	ASSERT3U(zio->io_stage, <, ZIO_STAGE_DVA_ALLOCATE);
3569 
3570 	return (zio);
3571 }
3572 
3573 static zio_t *
3574 zio_dva_throttle(zio_t *zio)
3575 {
3576 	spa_t *spa = zio->io_spa;
3577 	zio_t *nio;
3578 	metaslab_class_t *mc;
3579 
3580 	/* locate an appropriate allocation class */
3581 	mc = spa_preferred_class(spa, zio->io_size, zio->io_prop.zp_type,
3582 	    zio->io_prop.zp_level, zio->io_prop.zp_zpl_smallblk);
3583 
3584 	if (zio->io_priority == ZIO_PRIORITY_SYNC_WRITE ||
3585 	    !mc->mc_alloc_throttle_enabled ||
3586 	    zio->io_child_type == ZIO_CHILD_GANG ||
3587 	    zio->io_flags & ZIO_FLAG_NODATA) {
3588 		return (zio);
3589 	}
3590 
3591 	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
3592 	ASSERT(ZIO_HAS_ALLOCATOR(zio));
3593 	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
3594 	ASSERT3U(zio->io_queued_timestamp, >, 0);
3595 	ASSERT(zio->io_stage == ZIO_STAGE_DVA_THROTTLE);
3596 
3597 	int allocator = zio->io_allocator;
3598 	zio->io_metaslab_class = mc;
3599 	mutex_enter(&spa->spa_allocs[allocator].spaa_lock);
3600 	avl_add(&spa->spa_allocs[allocator].spaa_tree, zio);
3601 	nio = zio_io_to_allocate(spa, allocator);
3602 	mutex_exit(&spa->spa_allocs[allocator].spaa_lock);
3603 	return (nio);
3604 }
3605 
3606 static void
3607 zio_allocate_dispatch(spa_t *spa, int allocator)
3608 {
3609 	zio_t *zio;
3610 
3611 	mutex_enter(&spa->spa_allocs[allocator].spaa_lock);
3612 	zio = zio_io_to_allocate(spa, allocator);
3613 	mutex_exit(&spa->spa_allocs[allocator].spaa_lock);
3614 	if (zio == NULL)
3615 		return;
3616 
3617 	ASSERT3U(zio->io_stage, ==, ZIO_STAGE_DVA_THROTTLE);
3618 	ASSERT0(zio->io_error);
3619 	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_TRUE);
3620 }
3621 
3622 static zio_t *
3623 zio_dva_allocate(zio_t *zio)
3624 {
3625 	spa_t *spa = zio->io_spa;
3626 	metaslab_class_t *mc;
3627 	blkptr_t *bp = zio->io_bp;
3628 	int error;
3629 	int flags = 0;
3630 
3631 	if (zio->io_gang_leader == NULL) {
3632 		ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
3633 		zio->io_gang_leader = zio;
3634 	}
3635 
3636 	ASSERT(BP_IS_HOLE(bp));
3637 	ASSERT0(BP_GET_NDVAS(bp));
3638 	ASSERT3U(zio->io_prop.zp_copies, >, 0);
3639 	ASSERT3U(zio->io_prop.zp_copies, <=, spa_max_replication(spa));
3640 	ASSERT3U(zio->io_size, ==, BP_GET_PSIZE(bp));
3641 
3642 	if (zio->io_flags & ZIO_FLAG_NODATA)
3643 		flags |= METASLAB_DONT_THROTTLE;
3644 	if (zio->io_flags & ZIO_FLAG_GANG_CHILD)
3645 		flags |= METASLAB_GANG_CHILD;
3646 	if (zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE)
3647 		flags |= METASLAB_ASYNC_ALLOC;
3648 
3649 	/*
3650 	 * if not already chosen, locate an appropriate allocation class
3651 	 */
3652 	mc = zio->io_metaslab_class;
3653 	if (mc == NULL) {
3654 		mc = spa_preferred_class(spa, zio->io_size,
3655 		    zio->io_prop.zp_type, zio->io_prop.zp_level,
3656 		    zio->io_prop.zp_zpl_smallblk);
3657 		zio->io_metaslab_class = mc;
3658 	}
3659 
3660 	/*
3661 	 * Try allocating the block in the usual metaslab class.
3662 	 * If that's full, allocate it in the normal class.
3663 	 * If that's full, allocate as a gang block,
3664 	 * and if all are full, the allocation fails (which shouldn't happen).
3665 	 *
3666 	 * Note that we do not fall back on embedded slog (ZIL) space, to
3667 	 * preserve unfragmented slog space, which is critical for decent
3668 	 * sync write performance.  If a log allocation fails, we will fall
3669 	 * back to spa_sync() which is abysmal for performance.
3670 	 */
3671 	ASSERT(ZIO_HAS_ALLOCATOR(zio));
3672 	error = metaslab_alloc(spa, mc, zio->io_size, bp,
3673 	    zio->io_prop.zp_copies, zio->io_txg, NULL, flags,
3674 	    &zio->io_alloc_list, zio, zio->io_allocator);
3675 
3676 	/*
3677 	 * Fallback to normal class when an alloc class is full
3678 	 */
3679 	if (error == ENOSPC && mc != spa_normal_class(spa)) {
3680 		/*
3681 		 * If throttling, transfer reservation over to normal class.
3682 		 * The io_allocator slot can remain the same even though we
3683 		 * are switching classes.
3684 		 */
3685 		if (mc->mc_alloc_throttle_enabled &&
3686 		    (zio->io_flags & ZIO_FLAG_IO_ALLOCATING)) {
3687 			metaslab_class_throttle_unreserve(mc,
3688 			    zio->io_prop.zp_copies, zio->io_allocator, zio);
3689 			zio->io_flags &= ~ZIO_FLAG_IO_ALLOCATING;
3690 
3691 			VERIFY(metaslab_class_throttle_reserve(
3692 			    spa_normal_class(spa),
3693 			    zio->io_prop.zp_copies, zio->io_allocator, zio,
3694 			    flags | METASLAB_MUST_RESERVE));
3695 		}
3696 		zio->io_metaslab_class = mc = spa_normal_class(spa);
3697 		if (zfs_flags & ZFS_DEBUG_METASLAB_ALLOC) {
3698 			zfs_dbgmsg("%s: metaslab allocation failure, "
3699 			    "trying normal class: zio %px, size %llu, error %d",
3700 			    spa_name(spa), zio, (u_longlong_t)zio->io_size,
3701 			    error);
3702 		}
3703 
3704 		error = metaslab_alloc(spa, mc, zio->io_size, bp,
3705 		    zio->io_prop.zp_copies, zio->io_txg, NULL, flags,
3706 		    &zio->io_alloc_list, zio, zio->io_allocator);
3707 	}
3708 
3709 	if (error == ENOSPC && zio->io_size > SPA_MINBLOCKSIZE) {
3710 		if (zfs_flags & ZFS_DEBUG_METASLAB_ALLOC) {
3711 			zfs_dbgmsg("%s: metaslab allocation failure, "
3712 			    "trying ganging: zio %px, size %llu, error %d",
3713 			    spa_name(spa), zio, (u_longlong_t)zio->io_size,
3714 			    error);
3715 		}
3716 		return (zio_write_gang_block(zio, mc));
3717 	}
3718 	if (error != 0) {
3719 		if (error != ENOSPC ||
3720 		    (zfs_flags & ZFS_DEBUG_METASLAB_ALLOC)) {
3721 			zfs_dbgmsg("%s: metaslab allocation failure: zio %px, "
3722 			    "size %llu, error %d",
3723 			    spa_name(spa), zio, (u_longlong_t)zio->io_size,
3724 			    error);
3725 		}
3726 		zio->io_error = error;
3727 	}
3728 
3729 	return (zio);
3730 }
3731 
3732 static zio_t *
3733 zio_dva_free(zio_t *zio)
3734 {
3735 	metaslab_free(zio->io_spa, zio->io_bp, zio->io_txg, B_FALSE);
3736 
3737 	return (zio);
3738 }
3739 
3740 static zio_t *
3741 zio_dva_claim(zio_t *zio)
3742 {
3743 	int error;
3744 
3745 	error = metaslab_claim(zio->io_spa, zio->io_bp, zio->io_txg);
3746 	if (error)
3747 		zio->io_error = error;
3748 
3749 	return (zio);
3750 }
3751 
3752 /*
3753  * Undo an allocation.  This is used by zio_done() when an I/O fails
3754  * and we want to give back the block we just allocated.
3755  * This handles both normal blocks and gang blocks.
3756  */
3757 static void
3758 zio_dva_unallocate(zio_t *zio, zio_gang_node_t *gn, blkptr_t *bp)
3759 {
3760 	ASSERT(bp->blk_birth == zio->io_txg || BP_IS_HOLE(bp));
3761 	ASSERT(zio->io_bp_override == NULL);
3762 
3763 	if (!BP_IS_HOLE(bp))
3764 		metaslab_free(zio->io_spa, bp, bp->blk_birth, B_TRUE);
3765 
3766 	if (gn != NULL) {
3767 		for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
3768 			zio_dva_unallocate(zio, gn->gn_child[g],
3769 			    &gn->gn_gbh->zg_blkptr[g]);
3770 		}
3771 	}
3772 }
3773 
3774 /*
3775  * Try to allocate an intent log block.  Return 0 on success, errno on failure.
3776  */
3777 int
3778 zio_alloc_zil(spa_t *spa, objset_t *os, uint64_t txg, blkptr_t *new_bp,
3779     uint64_t size, boolean_t *slog)
3780 {
3781 	int error = 1;
3782 	zio_alloc_list_t io_alloc_list;
3783 
3784 	ASSERT(txg > spa_syncing_txg(spa));
3785 
3786 	metaslab_trace_init(&io_alloc_list);
3787 
3788 	/*
3789 	 * Block pointer fields are useful to metaslabs for stats and debugging.
3790 	 * Fill in the obvious ones before calling into metaslab_alloc().
3791 	 */
3792 	BP_SET_TYPE(new_bp, DMU_OT_INTENT_LOG);
3793 	BP_SET_PSIZE(new_bp, size);
3794 	BP_SET_LEVEL(new_bp, 0);
3795 
3796 	/*
3797 	 * When allocating a zil block, we don't have information about
3798 	 * the final destination of the block except the objset it's part
3799 	 * of, so we just hash the objset ID to pick the allocator to get
3800 	 * some parallelism.
3801 	 */
3802 	int flags = METASLAB_ZIL;
3803 	int allocator = (uint_t)cityhash4(0, 0, 0,
3804 	    os->os_dsl_dataset->ds_object) % spa->spa_alloc_count;
3805 	error = metaslab_alloc(spa, spa_log_class(spa), size, new_bp, 1,
3806 	    txg, NULL, flags, &io_alloc_list, NULL, allocator);
3807 	*slog = (error == 0);
3808 	if (error != 0) {
3809 		error = metaslab_alloc(spa, spa_embedded_log_class(spa), size,
3810 		    new_bp, 1, txg, NULL, flags,
3811 		    &io_alloc_list, NULL, allocator);
3812 	}
3813 	if (error != 0) {
3814 		error = metaslab_alloc(spa, spa_normal_class(spa), size,
3815 		    new_bp, 1, txg, NULL, flags,
3816 		    &io_alloc_list, NULL, allocator);
3817 	}
3818 	metaslab_trace_fini(&io_alloc_list);
3819 
3820 	if (error == 0) {
3821 		BP_SET_LSIZE(new_bp, size);
3822 		BP_SET_PSIZE(new_bp, size);
3823 		BP_SET_COMPRESS(new_bp, ZIO_COMPRESS_OFF);
3824 		BP_SET_CHECKSUM(new_bp,
3825 		    spa_version(spa) >= SPA_VERSION_SLIM_ZIL
3826 		    ? ZIO_CHECKSUM_ZILOG2 : ZIO_CHECKSUM_ZILOG);
3827 		BP_SET_TYPE(new_bp, DMU_OT_INTENT_LOG);
3828 		BP_SET_LEVEL(new_bp, 0);
3829 		BP_SET_DEDUP(new_bp, 0);
3830 		BP_SET_BYTEORDER(new_bp, ZFS_HOST_BYTEORDER);
3831 
3832 		/*
3833 		 * encrypted blocks will require an IV and salt. We generate
3834 		 * these now since we will not be rewriting the bp at
3835 		 * rewrite time.
3836 		 */
3837 		if (os->os_encrypted) {
3838 			uint8_t iv[ZIO_DATA_IV_LEN];
3839 			uint8_t salt[ZIO_DATA_SALT_LEN];
3840 
3841 			BP_SET_CRYPT(new_bp, B_TRUE);
3842 			VERIFY0(spa_crypt_get_salt(spa,
3843 			    dmu_objset_id(os), salt));
3844 			VERIFY0(zio_crypt_generate_iv(iv));
3845 
3846 			zio_crypt_encode_params_bp(new_bp, salt, iv);
3847 		}
3848 	} else {
3849 		zfs_dbgmsg("%s: zil block allocation failure: "
3850 		    "size %llu, error %d", spa_name(spa), (u_longlong_t)size,
3851 		    error);
3852 	}
3853 
3854 	return (error);
3855 }
3856 
3857 /*
3858  * ==========================================================================
3859  * Read and write to physical devices
3860  * ==========================================================================
3861  */
3862 
3863 /*
3864  * Issue an I/O to the underlying vdev. Typically the issue pipeline
3865  * stops after this stage and will resume upon I/O completion.
3866  * However, there are instances where the vdev layer may need to
3867  * continue the pipeline when an I/O was not issued. Since the I/O
3868  * that was sent to the vdev layer might be different than the one
3869  * currently active in the pipeline (see vdev_queue_io()), we explicitly
3870  * force the underlying vdev layers to call either zio_execute() or
3871  * zio_interrupt() to ensure that the pipeline continues with the correct I/O.
3872  */
3873 static zio_t *
3874 zio_vdev_io_start(zio_t *zio)
3875 {
3876 	vdev_t *vd = zio->io_vd;
3877 	uint64_t align;
3878 	spa_t *spa = zio->io_spa;
3879 
3880 	zio->io_delay = 0;
3881 
3882 	ASSERT(zio->io_error == 0);
3883 	ASSERT(zio->io_child_error[ZIO_CHILD_VDEV] == 0);
3884 
3885 	if (vd == NULL) {
3886 		if (!(zio->io_flags & ZIO_FLAG_CONFIG_WRITER))
3887 			spa_config_enter(spa, SCL_ZIO, zio, RW_READER);
3888 
3889 		/*
3890 		 * The mirror_ops handle multiple DVAs in a single BP.
3891 		 */
3892 		vdev_mirror_ops.vdev_op_io_start(zio);
3893 		return (NULL);
3894 	}
3895 
3896 	ASSERT3P(zio->io_logical, !=, zio);
3897 	if (zio->io_type == ZIO_TYPE_WRITE) {
3898 		ASSERT(spa->spa_trust_config);
3899 
3900 		/*
3901 		 * Note: the code can handle other kinds of writes,
3902 		 * but we don't expect them.
3903 		 */
3904 		if (zio->io_vd->vdev_noalloc) {
3905 			ASSERT(zio->io_flags &
3906 			    (ZIO_FLAG_PHYSICAL | ZIO_FLAG_SELF_HEAL |
3907 			    ZIO_FLAG_RESILVER | ZIO_FLAG_INDUCE_DAMAGE));
3908 		}
3909 	}
3910 
3911 	align = 1ULL << vd->vdev_top->vdev_ashift;
3912 
3913 	if (!(zio->io_flags & ZIO_FLAG_PHYSICAL) &&
3914 	    P2PHASE(zio->io_size, align) != 0) {
3915 		/* Transform logical writes to be a full physical block size. */
3916 		uint64_t asize = P2ROUNDUP(zio->io_size, align);
3917 		abd_t *abuf = abd_alloc_sametype(zio->io_abd, asize);
3918 		ASSERT(vd == vd->vdev_top);
3919 		if (zio->io_type == ZIO_TYPE_WRITE) {
3920 			abd_copy(abuf, zio->io_abd, zio->io_size);
3921 			abd_zero_off(abuf, zio->io_size, asize - zio->io_size);
3922 		}
3923 		zio_push_transform(zio, abuf, asize, asize, zio_subblock);
3924 	}
3925 
3926 	/*
3927 	 * If this is not a physical io, make sure that it is properly aligned
3928 	 * before proceeding.
3929 	 */
3930 	if (!(zio->io_flags & ZIO_FLAG_PHYSICAL)) {
3931 		ASSERT0(P2PHASE(zio->io_offset, align));
3932 		ASSERT0(P2PHASE(zio->io_size, align));
3933 	} else {
3934 		/*
3935 		 * For physical writes, we allow 512b aligned writes and assume
3936 		 * the device will perform a read-modify-write as necessary.
3937 		 */
3938 		ASSERT0(P2PHASE(zio->io_offset, SPA_MINBLOCKSIZE));
3939 		ASSERT0(P2PHASE(zio->io_size, SPA_MINBLOCKSIZE));
3940 	}
3941 
3942 	VERIFY(zio->io_type != ZIO_TYPE_WRITE || spa_writeable(spa));
3943 
3944 	/*
3945 	 * If this is a repair I/O, and there's no self-healing involved --
3946 	 * that is, we're just resilvering what we expect to resilver --
3947 	 * then don't do the I/O unless zio's txg is actually in vd's DTL.
3948 	 * This prevents spurious resilvering.
3949 	 *
3950 	 * There are a few ways that we can end up creating these spurious
3951 	 * resilver i/os:
3952 	 *
3953 	 * 1. A resilver i/o will be issued if any DVA in the BP has a
3954 	 * dirty DTL.  The mirror code will issue resilver writes to
3955 	 * each DVA, including the one(s) that are not on vdevs with dirty
3956 	 * DTLs.
3957 	 *
3958 	 * 2. With nested replication, which happens when we have a
3959 	 * "replacing" or "spare" vdev that's a child of a mirror or raidz.
3960 	 * For example, given mirror(replacing(A+B), C), it's likely that
3961 	 * only A is out of date (it's the new device). In this case, we'll
3962 	 * read from C, then use the data to resilver A+B -- but we don't
3963 	 * actually want to resilver B, just A. The top-level mirror has no
3964 	 * way to know this, so instead we just discard unnecessary repairs
3965 	 * as we work our way down the vdev tree.
3966 	 *
3967 	 * 3. ZTEST also creates mirrors of mirrors, mirrors of raidz, etc.
3968 	 * The same logic applies to any form of nested replication: ditto
3969 	 * + mirror, RAID-Z + replacing, etc.
3970 	 *
3971 	 * However, indirect vdevs point off to other vdevs which may have
3972 	 * DTL's, so we never bypass them.  The child i/os on concrete vdevs
3973 	 * will be properly bypassed instead.
3974 	 *
3975 	 * Leaf DTL_PARTIAL can be empty when a legitimate write comes from
3976 	 * a dRAID spare vdev. For example, when a dRAID spare is first
3977 	 * used, its spare blocks need to be written to but the leaf vdev's
3978 	 * of such blocks can have empty DTL_PARTIAL.
3979 	 *
3980 	 * There seemed no clean way to allow such writes while bypassing
3981 	 * spurious ones. At this point, just avoid all bypassing for dRAID
3982 	 * for correctness.
3983 	 */
3984 	if ((zio->io_flags & ZIO_FLAG_IO_REPAIR) &&
3985 	    !(zio->io_flags & ZIO_FLAG_SELF_HEAL) &&
3986 	    zio->io_txg != 0 &&	/* not a delegated i/o */
3987 	    vd->vdev_ops != &vdev_indirect_ops &&
3988 	    vd->vdev_top->vdev_ops != &vdev_draid_ops &&
3989 	    !vdev_dtl_contains(vd, DTL_PARTIAL, zio->io_txg, 1)) {
3990 		ASSERT(zio->io_type == ZIO_TYPE_WRITE);
3991 		zio_vdev_io_bypass(zio);
3992 		return (zio);
3993 	}
3994 
3995 	/*
3996 	 * Select the next best leaf I/O to process.  Distributed spares are
3997 	 * excluded since they dispatch the I/O directly to a leaf vdev after
3998 	 * applying the dRAID mapping.
3999 	 */
4000 	if (vd->vdev_ops->vdev_op_leaf &&
4001 	    vd->vdev_ops != &vdev_draid_spare_ops &&
4002 	    (zio->io_type == ZIO_TYPE_READ ||
4003 	    zio->io_type == ZIO_TYPE_WRITE ||
4004 	    zio->io_type == ZIO_TYPE_TRIM)) {
4005 
4006 		if ((zio = vdev_queue_io(zio)) == NULL)
4007 			return (NULL);
4008 
4009 		if (!vdev_accessible(vd, zio)) {
4010 			zio->io_error = SET_ERROR(ENXIO);
4011 			zio_interrupt(zio);
4012 			return (NULL);
4013 		}
4014 		zio->io_delay = gethrtime();
4015 	}
4016 
4017 	vd->vdev_ops->vdev_op_io_start(zio);
4018 	return (NULL);
4019 }
4020 
4021 static zio_t *
4022 zio_vdev_io_done(zio_t *zio)
4023 {
4024 	vdev_t *vd = zio->io_vd;
4025 	vdev_ops_t *ops = vd ? vd->vdev_ops : &vdev_mirror_ops;
4026 	boolean_t unexpected_error = B_FALSE;
4027 
4028 	if (zio_wait_for_children(zio, ZIO_CHILD_VDEV_BIT, ZIO_WAIT_DONE)) {
4029 		return (NULL);
4030 	}
4031 
4032 	ASSERT(zio->io_type == ZIO_TYPE_READ ||
4033 	    zio->io_type == ZIO_TYPE_WRITE || zio->io_type == ZIO_TYPE_TRIM);
4034 
4035 	if (zio->io_delay)
4036 		zio->io_delay = gethrtime() - zio->io_delay;
4037 
4038 	if (vd != NULL && vd->vdev_ops->vdev_op_leaf &&
4039 	    vd->vdev_ops != &vdev_draid_spare_ops) {
4040 		vdev_queue_io_done(zio);
4041 
4042 		if (zio_injection_enabled && zio->io_error == 0)
4043 			zio->io_error = zio_handle_device_injections(vd, zio,
4044 			    EIO, EILSEQ);
4045 
4046 		if (zio_injection_enabled && zio->io_error == 0)
4047 			zio->io_error = zio_handle_label_injection(zio, EIO);
4048 
4049 		if (zio->io_error && zio->io_type != ZIO_TYPE_TRIM) {
4050 			if (!vdev_accessible(vd, zio)) {
4051 				zio->io_error = SET_ERROR(ENXIO);
4052 			} else {
4053 				unexpected_error = B_TRUE;
4054 			}
4055 		}
4056 	}
4057 
4058 	ops->vdev_op_io_done(zio);
4059 
4060 	if (unexpected_error && vd->vdev_remove_wanted == B_FALSE)
4061 		VERIFY(vdev_probe(vd, zio) == NULL);
4062 
4063 	return (zio);
4064 }
4065 
4066 /*
4067  * This function is used to change the priority of an existing zio that is
4068  * currently in-flight. This is used by the arc to upgrade priority in the
4069  * event that a demand read is made for a block that is currently queued
4070  * as a scrub or async read IO. Otherwise, the high priority read request
4071  * would end up having to wait for the lower priority IO.
4072  */
4073 void
4074 zio_change_priority(zio_t *pio, zio_priority_t priority)
4075 {
4076 	zio_t *cio, *cio_next;
4077 	zio_link_t *zl = NULL;
4078 
4079 	ASSERT3U(priority, <, ZIO_PRIORITY_NUM_QUEUEABLE);
4080 
4081 	if (pio->io_vd != NULL && pio->io_vd->vdev_ops->vdev_op_leaf) {
4082 		vdev_queue_change_io_priority(pio, priority);
4083 	} else {
4084 		pio->io_priority = priority;
4085 	}
4086 
4087 	mutex_enter(&pio->io_lock);
4088 	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
4089 		cio_next = zio_walk_children(pio, &zl);
4090 		zio_change_priority(cio, priority);
4091 	}
4092 	mutex_exit(&pio->io_lock);
4093 }
4094 
4095 /*
4096  * For non-raidz ZIOs, we can just copy aside the bad data read from the
4097  * disk, and use that to finish the checksum ereport later.
4098  */
4099 static void
4100 zio_vsd_default_cksum_finish(zio_cksum_report_t *zcr,
4101     const abd_t *good_buf)
4102 {
4103 	/* no processing needed */
4104 	zfs_ereport_finish_checksum(zcr, good_buf, zcr->zcr_cbdata, B_FALSE);
4105 }
4106 
4107 void
4108 zio_vsd_default_cksum_report(zio_t *zio, zio_cksum_report_t *zcr)
4109 {
4110 	void *abd = abd_alloc_sametype(zio->io_abd, zio->io_size);
4111 
4112 	abd_copy(abd, zio->io_abd, zio->io_size);
4113 
4114 	zcr->zcr_cbinfo = zio->io_size;
4115 	zcr->zcr_cbdata = abd;
4116 	zcr->zcr_finish = zio_vsd_default_cksum_finish;
4117 	zcr->zcr_free = zio_abd_free;
4118 }
4119 
4120 static zio_t *
4121 zio_vdev_io_assess(zio_t *zio)
4122 {
4123 	vdev_t *vd = zio->io_vd;
4124 
4125 	if (zio_wait_for_children(zio, ZIO_CHILD_VDEV_BIT, ZIO_WAIT_DONE)) {
4126 		return (NULL);
4127 	}
4128 
4129 	if (vd == NULL && !(zio->io_flags & ZIO_FLAG_CONFIG_WRITER))
4130 		spa_config_exit(zio->io_spa, SCL_ZIO, zio);
4131 
4132 	if (zio->io_vsd != NULL) {
4133 		zio->io_vsd_ops->vsd_free(zio);
4134 		zio->io_vsd = NULL;
4135 	}
4136 
4137 	if (zio_injection_enabled && zio->io_error == 0)
4138 		zio->io_error = zio_handle_fault_injection(zio, EIO);
4139 
4140 	/*
4141 	 * If the I/O failed, determine whether we should attempt to retry it.
4142 	 *
4143 	 * On retry, we cut in line in the issue queue, since we don't want
4144 	 * compression/checksumming/etc. work to prevent our (cheap) IO reissue.
4145 	 */
4146 	if (zio->io_error && vd == NULL &&
4147 	    !(zio->io_flags & (ZIO_FLAG_DONT_RETRY | ZIO_FLAG_IO_RETRY))) {
4148 		ASSERT(!(zio->io_flags & ZIO_FLAG_DONT_QUEUE));	/* not a leaf */
4149 		ASSERT(!(zio->io_flags & ZIO_FLAG_IO_BYPASS));	/* not a leaf */
4150 		zio->io_error = 0;
4151 		zio->io_flags |= ZIO_FLAG_IO_RETRY | ZIO_FLAG_DONT_AGGREGATE;
4152 		zio->io_stage = ZIO_STAGE_VDEV_IO_START >> 1;
4153 		zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE,
4154 		    zio_requeue_io_start_cut_in_line);
4155 		return (NULL);
4156 	}
4157 
4158 	/*
4159 	 * If we got an error on a leaf device, convert it to ENXIO
4160 	 * if the device is not accessible at all.
4161 	 */
4162 	if (zio->io_error && vd != NULL && vd->vdev_ops->vdev_op_leaf &&
4163 	    !vdev_accessible(vd, zio))
4164 		zio->io_error = SET_ERROR(ENXIO);
4165 
4166 	/*
4167 	 * If we can't write to an interior vdev (mirror or RAID-Z),
4168 	 * set vdev_cant_write so that we stop trying to allocate from it.
4169 	 */
4170 	if (zio->io_error == ENXIO && zio->io_type == ZIO_TYPE_WRITE &&
4171 	    vd != NULL && !vd->vdev_ops->vdev_op_leaf) {
4172 		vdev_dbgmsg(vd, "zio_vdev_io_assess(zio=%px) setting "
4173 		    "cant_write=TRUE due to write failure with ENXIO",
4174 		    zio);
4175 		vd->vdev_cant_write = B_TRUE;
4176 	}
4177 
4178 	/*
4179 	 * If a cache flush returns ENOTSUP or ENOTTY, we know that no future
4180 	 * attempts will ever succeed. In this case we set a persistent
4181 	 * boolean flag so that we don't bother with it in the future.
4182 	 */
4183 	if ((zio->io_error == ENOTSUP || zio->io_error == ENOTTY) &&
4184 	    zio->io_type == ZIO_TYPE_IOCTL &&
4185 	    zio->io_cmd == DKIOCFLUSHWRITECACHE && vd != NULL)
4186 		vd->vdev_nowritecache = B_TRUE;
4187 
4188 	if (zio->io_error)
4189 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
4190 
4191 	return (zio);
4192 }
4193 
4194 void
4195 zio_vdev_io_reissue(zio_t *zio)
4196 {
4197 	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_START);
4198 	ASSERT(zio->io_error == 0);
4199 
4200 	zio->io_stage >>= 1;
4201 }
4202 
4203 void
4204 zio_vdev_io_redone(zio_t *zio)
4205 {
4206 	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_DONE);
4207 
4208 	zio->io_stage >>= 1;
4209 }
4210 
4211 void
4212 zio_vdev_io_bypass(zio_t *zio)
4213 {
4214 	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_START);
4215 	ASSERT(zio->io_error == 0);
4216 
4217 	zio->io_flags |= ZIO_FLAG_IO_BYPASS;
4218 	zio->io_stage = ZIO_STAGE_VDEV_IO_ASSESS >> 1;
4219 }
4220 
4221 /*
4222  * ==========================================================================
4223  * Encrypt and store encryption parameters
4224  * ==========================================================================
4225  */
4226 
4227 
4228 /*
4229  * This function is used for ZIO_STAGE_ENCRYPT. It is responsible for
4230  * managing the storage of encryption parameters and passing them to the
4231  * lower-level encryption functions.
4232  */
4233 static zio_t *
4234 zio_encrypt(zio_t *zio)
4235 {
4236 	zio_prop_t *zp = &zio->io_prop;
4237 	spa_t *spa = zio->io_spa;
4238 	blkptr_t *bp = zio->io_bp;
4239 	uint64_t psize = BP_GET_PSIZE(bp);
4240 	uint64_t dsobj = zio->io_bookmark.zb_objset;
4241 	dmu_object_type_t ot = BP_GET_TYPE(bp);
4242 	void *enc_buf = NULL;
4243 	abd_t *eabd = NULL;
4244 	uint8_t salt[ZIO_DATA_SALT_LEN];
4245 	uint8_t iv[ZIO_DATA_IV_LEN];
4246 	uint8_t mac[ZIO_DATA_MAC_LEN];
4247 	boolean_t no_crypt = B_FALSE;
4248 
4249 	/* the root zio already encrypted the data */
4250 	if (zio->io_child_type == ZIO_CHILD_GANG)
4251 		return (zio);
4252 
4253 	/* only ZIL blocks are re-encrypted on rewrite */
4254 	if (!IO_IS_ALLOCATING(zio) && ot != DMU_OT_INTENT_LOG)
4255 		return (zio);
4256 
4257 	if (!(zp->zp_encrypt || BP_IS_ENCRYPTED(bp))) {
4258 		BP_SET_CRYPT(bp, B_FALSE);
4259 		return (zio);
4260 	}
4261 
4262 	/* if we are doing raw encryption set the provided encryption params */
4263 	if (zio->io_flags & ZIO_FLAG_RAW_ENCRYPT) {
4264 		ASSERT0(BP_GET_LEVEL(bp));
4265 		BP_SET_CRYPT(bp, B_TRUE);
4266 		BP_SET_BYTEORDER(bp, zp->zp_byteorder);
4267 		if (ot != DMU_OT_OBJSET)
4268 			zio_crypt_encode_mac_bp(bp, zp->zp_mac);
4269 
4270 		/* dnode blocks must be written out in the provided byteorder */
4271 		if (zp->zp_byteorder != ZFS_HOST_BYTEORDER &&
4272 		    ot == DMU_OT_DNODE) {
4273 			void *bswap_buf = zio_buf_alloc(psize);
4274 			abd_t *babd = abd_get_from_buf(bswap_buf, psize);
4275 
4276 			ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
4277 			abd_copy_to_buf(bswap_buf, zio->io_abd, psize);
4278 			dmu_ot_byteswap[DMU_OT_BYTESWAP(ot)].ob_func(bswap_buf,
4279 			    psize);
4280 
4281 			abd_take_ownership_of_buf(babd, B_TRUE);
4282 			zio_push_transform(zio, babd, psize, psize, NULL);
4283 		}
4284 
4285 		if (DMU_OT_IS_ENCRYPTED(ot))
4286 			zio_crypt_encode_params_bp(bp, zp->zp_salt, zp->zp_iv);
4287 		return (zio);
4288 	}
4289 
4290 	/* indirect blocks only maintain a cksum of the lower level MACs */
4291 	if (BP_GET_LEVEL(bp) > 0) {
4292 		BP_SET_CRYPT(bp, B_TRUE);
4293 		VERIFY0(zio_crypt_do_indirect_mac_checksum_abd(B_TRUE,
4294 		    zio->io_orig_abd, BP_GET_LSIZE(bp), BP_SHOULD_BYTESWAP(bp),
4295 		    mac));
4296 		zio_crypt_encode_mac_bp(bp, mac);
4297 		return (zio);
4298 	}
4299 
4300 	/*
4301 	 * Objset blocks are a special case since they have 2 256-bit MACs
4302 	 * embedded within them.
4303 	 */
4304 	if (ot == DMU_OT_OBJSET) {
4305 		ASSERT0(DMU_OT_IS_ENCRYPTED(ot));
4306 		ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
4307 		BP_SET_CRYPT(bp, B_TRUE);
4308 		VERIFY0(spa_do_crypt_objset_mac_abd(B_TRUE, spa, dsobj,
4309 		    zio->io_abd, psize, BP_SHOULD_BYTESWAP(bp)));
4310 		return (zio);
4311 	}
4312 
4313 	/* unencrypted object types are only authenticated with a MAC */
4314 	if (!DMU_OT_IS_ENCRYPTED(ot)) {
4315 		BP_SET_CRYPT(bp, B_TRUE);
4316 		VERIFY0(spa_do_crypt_mac_abd(B_TRUE, spa, dsobj,
4317 		    zio->io_abd, psize, mac));
4318 		zio_crypt_encode_mac_bp(bp, mac);
4319 		return (zio);
4320 	}
4321 
4322 	/*
4323 	 * Later passes of sync-to-convergence may decide to rewrite data
4324 	 * in place to avoid more disk reallocations. This presents a problem
4325 	 * for encryption because this constitutes rewriting the new data with
4326 	 * the same encryption key and IV. However, this only applies to blocks
4327 	 * in the MOS (particularly the spacemaps) and we do not encrypt the
4328 	 * MOS. We assert that the zio is allocating or an intent log write
4329 	 * to enforce this.
4330 	 */
4331 	ASSERT(IO_IS_ALLOCATING(zio) || ot == DMU_OT_INTENT_LOG);
4332 	ASSERT(BP_GET_LEVEL(bp) == 0 || ot == DMU_OT_INTENT_LOG);
4333 	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_ENCRYPTION));
4334 	ASSERT3U(psize, !=, 0);
4335 
4336 	enc_buf = zio_buf_alloc(psize);
4337 	eabd = abd_get_from_buf(enc_buf, psize);
4338 	abd_take_ownership_of_buf(eabd, B_TRUE);
4339 
4340 	/*
4341 	 * For an explanation of what encryption parameters are stored
4342 	 * where, see the block comment in zio_crypt.c.
4343 	 */
4344 	if (ot == DMU_OT_INTENT_LOG) {
4345 		zio_crypt_decode_params_bp(bp, salt, iv);
4346 	} else {
4347 		BP_SET_CRYPT(bp, B_TRUE);
4348 	}
4349 
4350 	/* Perform the encryption. This should not fail */
4351 	VERIFY0(spa_do_crypt_abd(B_TRUE, spa, &zio->io_bookmark,
4352 	    BP_GET_TYPE(bp), BP_GET_DEDUP(bp), BP_SHOULD_BYTESWAP(bp),
4353 	    salt, iv, mac, psize, zio->io_abd, eabd, &no_crypt));
4354 
4355 	/* encode encryption metadata into the bp */
4356 	if (ot == DMU_OT_INTENT_LOG) {
4357 		/*
4358 		 * ZIL blocks store the MAC in the embedded checksum, so the
4359 		 * transform must always be applied.
4360 		 */
4361 		zio_crypt_encode_mac_zil(enc_buf, mac);
4362 		zio_push_transform(zio, eabd, psize, psize, NULL);
4363 	} else {
4364 		BP_SET_CRYPT(bp, B_TRUE);
4365 		zio_crypt_encode_params_bp(bp, salt, iv);
4366 		zio_crypt_encode_mac_bp(bp, mac);
4367 
4368 		if (no_crypt) {
4369 			ASSERT3U(ot, ==, DMU_OT_DNODE);
4370 			abd_free(eabd);
4371 		} else {
4372 			zio_push_transform(zio, eabd, psize, psize, NULL);
4373 		}
4374 	}
4375 
4376 	return (zio);
4377 }
4378 
4379 /*
4380  * ==========================================================================
4381  * Generate and verify checksums
4382  * ==========================================================================
4383  */
4384 static zio_t *
4385 zio_checksum_generate(zio_t *zio)
4386 {
4387 	blkptr_t *bp = zio->io_bp;
4388 	enum zio_checksum checksum;
4389 
4390 	if (bp == NULL) {
4391 		/*
4392 		 * This is zio_write_phys().
4393 		 * We're either generating a label checksum, or none at all.
4394 		 */
4395 		checksum = zio->io_prop.zp_checksum;
4396 
4397 		if (checksum == ZIO_CHECKSUM_OFF)
4398 			return (zio);
4399 
4400 		ASSERT(checksum == ZIO_CHECKSUM_LABEL);
4401 	} else {
4402 		if (BP_IS_GANG(bp) && zio->io_child_type == ZIO_CHILD_GANG) {
4403 			ASSERT(!IO_IS_ALLOCATING(zio));
4404 			checksum = ZIO_CHECKSUM_GANG_HEADER;
4405 		} else {
4406 			checksum = BP_GET_CHECKSUM(bp);
4407 		}
4408 	}
4409 
4410 	zio_checksum_compute(zio, checksum, zio->io_abd, zio->io_size);
4411 
4412 	return (zio);
4413 }
4414 
4415 static zio_t *
4416 zio_checksum_verify(zio_t *zio)
4417 {
4418 	zio_bad_cksum_t info;
4419 	blkptr_t *bp = zio->io_bp;
4420 	int error;
4421 
4422 	ASSERT(zio->io_vd != NULL);
4423 
4424 	if (bp == NULL) {
4425 		/*
4426 		 * This is zio_read_phys().
4427 		 * We're either verifying a label checksum, or nothing at all.
4428 		 */
4429 		if (zio->io_prop.zp_checksum == ZIO_CHECKSUM_OFF)
4430 			return (zio);
4431 
4432 		ASSERT3U(zio->io_prop.zp_checksum, ==, ZIO_CHECKSUM_LABEL);
4433 	}
4434 
4435 	if ((error = zio_checksum_error(zio, &info)) != 0) {
4436 		zio->io_error = error;
4437 		if (error == ECKSUM &&
4438 		    !(zio->io_flags & ZIO_FLAG_SPECULATIVE)) {
4439 			mutex_enter(&zio->io_vd->vdev_stat_lock);
4440 			zio->io_vd->vdev_stat.vs_checksum_errors++;
4441 			mutex_exit(&zio->io_vd->vdev_stat_lock);
4442 			(void) zfs_ereport_start_checksum(zio->io_spa,
4443 			    zio->io_vd, &zio->io_bookmark, zio,
4444 			    zio->io_offset, zio->io_size, &info);
4445 		}
4446 	}
4447 
4448 	return (zio);
4449 }
4450 
4451 /*
4452  * Called by RAID-Z to ensure we don't compute the checksum twice.
4453  */
4454 void
4455 zio_checksum_verified(zio_t *zio)
4456 {
4457 	zio->io_pipeline &= ~ZIO_STAGE_CHECKSUM_VERIFY;
4458 }
4459 
4460 /*
4461  * ==========================================================================
4462  * Error rank.  Error are ranked in the order 0, ENXIO, ECKSUM, EIO, other.
4463  * An error of 0 indicates success.  ENXIO indicates whole-device failure,
4464  * which may be transient (e.g. unplugged) or permanent.  ECKSUM and EIO
4465  * indicate errors that are specific to one I/O, and most likely permanent.
4466  * Any other error is presumed to be worse because we weren't expecting it.
4467  * ==========================================================================
4468  */
4469 int
4470 zio_worst_error(int e1, int e2)
4471 {
4472 	static int zio_error_rank[] = { 0, ENXIO, ECKSUM, EIO };
4473 	int r1, r2;
4474 
4475 	for (r1 = 0; r1 < sizeof (zio_error_rank) / sizeof (int); r1++)
4476 		if (e1 == zio_error_rank[r1])
4477 			break;
4478 
4479 	for (r2 = 0; r2 < sizeof (zio_error_rank) / sizeof (int); r2++)
4480 		if (e2 == zio_error_rank[r2])
4481 			break;
4482 
4483 	return (r1 > r2 ? e1 : e2);
4484 }
4485 
4486 /*
4487  * ==========================================================================
4488  * I/O completion
4489  * ==========================================================================
4490  */
4491 static zio_t *
4492 zio_ready(zio_t *zio)
4493 {
4494 	blkptr_t *bp = zio->io_bp;
4495 	zio_t *pio, *pio_next;
4496 	zio_link_t *zl = NULL;
4497 
4498 	if (zio_wait_for_children(zio, ZIO_CHILD_LOGICAL_BIT |
4499 	    ZIO_CHILD_GANG_BIT | ZIO_CHILD_DDT_BIT, ZIO_WAIT_READY)) {
4500 		return (NULL);
4501 	}
4502 
4503 	if (zio->io_ready) {
4504 		ASSERT(IO_IS_ALLOCATING(zio));
4505 		ASSERT(bp->blk_birth == zio->io_txg || BP_IS_HOLE(bp) ||
4506 		    (zio->io_flags & ZIO_FLAG_NOPWRITE));
4507 		ASSERT(zio->io_children[ZIO_CHILD_GANG][ZIO_WAIT_READY] == 0);
4508 
4509 		zio->io_ready(zio);
4510 	}
4511 
4512 #ifdef ZFS_DEBUG
4513 	if (bp != NULL && bp != &zio->io_bp_copy)
4514 		zio->io_bp_copy = *bp;
4515 #endif
4516 
4517 	if (zio->io_error != 0) {
4518 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
4519 
4520 		if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
4521 			ASSERT(IO_IS_ALLOCATING(zio));
4522 			ASSERT(zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
4523 			ASSERT(zio->io_metaslab_class != NULL);
4524 			ASSERT(ZIO_HAS_ALLOCATOR(zio));
4525 
4526 			/*
4527 			 * We were unable to allocate anything, unreserve and
4528 			 * issue the next I/O to allocate.
4529 			 */
4530 			metaslab_class_throttle_unreserve(
4531 			    zio->io_metaslab_class, zio->io_prop.zp_copies,
4532 			    zio->io_allocator, zio);
4533 			zio_allocate_dispatch(zio->io_spa, zio->io_allocator);
4534 		}
4535 	}
4536 
4537 	mutex_enter(&zio->io_lock);
4538 	zio->io_state[ZIO_WAIT_READY] = 1;
4539 	pio = zio_walk_parents(zio, &zl);
4540 	mutex_exit(&zio->io_lock);
4541 
4542 	/*
4543 	 * As we notify zio's parents, new parents could be added.
4544 	 * New parents go to the head of zio's io_parent_list, however,
4545 	 * so we will (correctly) not notify them.  The remainder of zio's
4546 	 * io_parent_list, from 'pio_next' onward, cannot change because
4547 	 * all parents must wait for us to be done before they can be done.
4548 	 */
4549 	for (; pio != NULL; pio = pio_next) {
4550 		pio_next = zio_walk_parents(zio, &zl);
4551 		zio_notify_parent(pio, zio, ZIO_WAIT_READY, NULL);
4552 	}
4553 
4554 	if (zio->io_flags & ZIO_FLAG_NODATA) {
4555 		if (bp != NULL && BP_IS_GANG(bp)) {
4556 			zio->io_flags &= ~ZIO_FLAG_NODATA;
4557 		} else {
4558 			ASSERT((uintptr_t)zio->io_abd < SPA_MAXBLOCKSIZE);
4559 			zio->io_pipeline &= ~ZIO_VDEV_IO_STAGES;
4560 		}
4561 	}
4562 
4563 	if (zio_injection_enabled &&
4564 	    zio->io_spa->spa_syncing_txg == zio->io_txg)
4565 		zio_handle_ignored_writes(zio);
4566 
4567 	return (zio);
4568 }
4569 
4570 /*
4571  * Update the allocation throttle accounting.
4572  */
4573 static void
4574 zio_dva_throttle_done(zio_t *zio)
4575 {
4576 	zio_t *lio __maybe_unused = zio->io_logical;
4577 	zio_t *pio = zio_unique_parent(zio);
4578 	vdev_t *vd = zio->io_vd;
4579 	int flags = METASLAB_ASYNC_ALLOC;
4580 
4581 	ASSERT3P(zio->io_bp, !=, NULL);
4582 	ASSERT3U(zio->io_type, ==, ZIO_TYPE_WRITE);
4583 	ASSERT3U(zio->io_priority, ==, ZIO_PRIORITY_ASYNC_WRITE);
4584 	ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_VDEV);
4585 	ASSERT(vd != NULL);
4586 	ASSERT3P(vd, ==, vd->vdev_top);
4587 	ASSERT(zio_injection_enabled || !(zio->io_flags & ZIO_FLAG_IO_RETRY));
4588 	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REPAIR));
4589 	ASSERT(zio->io_flags & ZIO_FLAG_IO_ALLOCATING);
4590 	ASSERT(!(lio->io_flags & ZIO_FLAG_IO_REWRITE));
4591 	ASSERT(!(lio->io_orig_flags & ZIO_FLAG_NODATA));
4592 
4593 	/*
4594 	 * Parents of gang children can have two flavors -- ones that
4595 	 * allocated the gang header (will have ZIO_FLAG_IO_REWRITE set)
4596 	 * and ones that allocated the constituent blocks. The allocation
4597 	 * throttle needs to know the allocating parent zio so we must find
4598 	 * it here.
4599 	 */
4600 	if (pio->io_child_type == ZIO_CHILD_GANG) {
4601 		/*
4602 		 * If our parent is a rewrite gang child then our grandparent
4603 		 * would have been the one that performed the allocation.
4604 		 */
4605 		if (pio->io_flags & ZIO_FLAG_IO_REWRITE)
4606 			pio = zio_unique_parent(pio);
4607 		flags |= METASLAB_GANG_CHILD;
4608 	}
4609 
4610 	ASSERT(IO_IS_ALLOCATING(pio));
4611 	ASSERT(ZIO_HAS_ALLOCATOR(pio));
4612 	ASSERT3P(zio, !=, zio->io_logical);
4613 	ASSERT(zio->io_logical != NULL);
4614 	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REPAIR));
4615 	ASSERT0(zio->io_flags & ZIO_FLAG_NOPWRITE);
4616 	ASSERT(zio->io_metaslab_class != NULL);
4617 
4618 	mutex_enter(&pio->io_lock);
4619 	metaslab_group_alloc_decrement(zio->io_spa, vd->vdev_id, pio, flags,
4620 	    pio->io_allocator, B_TRUE);
4621 	mutex_exit(&pio->io_lock);
4622 
4623 	metaslab_class_throttle_unreserve(zio->io_metaslab_class, 1,
4624 	    pio->io_allocator, pio);
4625 
4626 	/*
4627 	 * Call into the pipeline to see if there is more work that
4628 	 * needs to be done. If there is work to be done it will be
4629 	 * dispatched to another taskq thread.
4630 	 */
4631 	zio_allocate_dispatch(zio->io_spa, pio->io_allocator);
4632 }
4633 
4634 static zio_t *
4635 zio_done(zio_t *zio)
4636 {
4637 	/*
4638 	 * Always attempt to keep stack usage minimal here since
4639 	 * we can be called recursively up to 19 levels deep.
4640 	 */
4641 	const uint64_t psize = zio->io_size;
4642 	zio_t *pio, *pio_next;
4643 	zio_link_t *zl = NULL;
4644 
4645 	/*
4646 	 * If our children haven't all completed,
4647 	 * wait for them and then repeat this pipeline stage.
4648 	 */
4649 	if (zio_wait_for_children(zio, ZIO_CHILD_ALL_BITS, ZIO_WAIT_DONE)) {
4650 		return (NULL);
4651 	}
4652 
4653 	/*
4654 	 * If the allocation throttle is enabled, then update the accounting.
4655 	 * We only track child I/Os that are part of an allocating async
4656 	 * write. We must do this since the allocation is performed
4657 	 * by the logical I/O but the actual write is done by child I/Os.
4658 	 */
4659 	if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING &&
4660 	    zio->io_child_type == ZIO_CHILD_VDEV) {
4661 		ASSERT(zio->io_metaslab_class != NULL);
4662 		ASSERT(zio->io_metaslab_class->mc_alloc_throttle_enabled);
4663 		zio_dva_throttle_done(zio);
4664 	}
4665 
4666 	/*
4667 	 * If the allocation throttle is enabled, verify that
4668 	 * we have decremented the refcounts for every I/O that was throttled.
4669 	 */
4670 	if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
4671 		ASSERT(zio->io_type == ZIO_TYPE_WRITE);
4672 		ASSERT(zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
4673 		ASSERT(zio->io_bp != NULL);
4674 		ASSERT(ZIO_HAS_ALLOCATOR(zio));
4675 
4676 		metaslab_group_alloc_verify(zio->io_spa, zio->io_bp, zio,
4677 		    zio->io_allocator);
4678 		VERIFY(zfs_refcount_not_held(&zio->io_metaslab_class->
4679 		    mc_allocator[zio->io_allocator].mca_alloc_slots, zio));
4680 	}
4681 
4682 
4683 	for (int c = 0; c < ZIO_CHILD_TYPES; c++)
4684 		for (int w = 0; w < ZIO_WAIT_TYPES; w++)
4685 			ASSERT(zio->io_children[c][w] == 0);
4686 
4687 	if (zio->io_bp != NULL && !BP_IS_EMBEDDED(zio->io_bp)) {
4688 		ASSERT(zio->io_bp->blk_pad[0] == 0);
4689 		ASSERT(zio->io_bp->blk_pad[1] == 0);
4690 		ASSERT(memcmp(zio->io_bp, &zio->io_bp_copy,
4691 		    sizeof (blkptr_t)) == 0 ||
4692 		    (zio->io_bp == zio_unique_parent(zio)->io_bp));
4693 		if (zio->io_type == ZIO_TYPE_WRITE && !BP_IS_HOLE(zio->io_bp) &&
4694 		    zio->io_bp_override == NULL &&
4695 		    !(zio->io_flags & ZIO_FLAG_IO_REPAIR)) {
4696 			ASSERT3U(zio->io_prop.zp_copies, <=,
4697 			    BP_GET_NDVAS(zio->io_bp));
4698 			ASSERT(BP_COUNT_GANG(zio->io_bp) == 0 ||
4699 			    (BP_COUNT_GANG(zio->io_bp) ==
4700 			    BP_GET_NDVAS(zio->io_bp)));
4701 		}
4702 		if (zio->io_flags & ZIO_FLAG_NOPWRITE)
4703 			VERIFY(BP_EQUAL(zio->io_bp, &zio->io_bp_orig));
4704 	}
4705 
4706 	/*
4707 	 * If there were child vdev/gang/ddt errors, they apply to us now.
4708 	 */
4709 	zio_inherit_child_errors(zio, ZIO_CHILD_VDEV);
4710 	zio_inherit_child_errors(zio, ZIO_CHILD_GANG);
4711 	zio_inherit_child_errors(zio, ZIO_CHILD_DDT);
4712 
4713 	/*
4714 	 * If the I/O on the transformed data was successful, generate any
4715 	 * checksum reports now while we still have the transformed data.
4716 	 */
4717 	if (zio->io_error == 0) {
4718 		while (zio->io_cksum_report != NULL) {
4719 			zio_cksum_report_t *zcr = zio->io_cksum_report;
4720 			uint64_t align = zcr->zcr_align;
4721 			uint64_t asize = P2ROUNDUP(psize, align);
4722 			abd_t *adata = zio->io_abd;
4723 
4724 			if (adata != NULL && asize != psize) {
4725 				adata = abd_alloc(asize, B_TRUE);
4726 				abd_copy(adata, zio->io_abd, psize);
4727 				abd_zero_off(adata, psize, asize - psize);
4728 			}
4729 
4730 			zio->io_cksum_report = zcr->zcr_next;
4731 			zcr->zcr_next = NULL;
4732 			zcr->zcr_finish(zcr, adata);
4733 			zfs_ereport_free_checksum(zcr);
4734 
4735 			if (adata != NULL && asize != psize)
4736 				abd_free(adata);
4737 		}
4738 	}
4739 
4740 	zio_pop_transforms(zio);	/* note: may set zio->io_error */
4741 
4742 	vdev_stat_update(zio, psize);
4743 
4744 	/*
4745 	 * If this I/O is attached to a particular vdev is slow, exceeding
4746 	 * 30 seconds to complete, post an error described the I/O delay.
4747 	 * We ignore these errors if the device is currently unavailable.
4748 	 */
4749 	if (zio->io_delay >= MSEC2NSEC(zio_slow_io_ms)) {
4750 		if (zio->io_vd != NULL && !vdev_is_dead(zio->io_vd)) {
4751 			/*
4752 			 * We want to only increment our slow IO counters if
4753 			 * the IO is valid (i.e. not if the drive is removed).
4754 			 *
4755 			 * zfs_ereport_post() will also do these checks, but
4756 			 * it can also ratelimit and have other failures, so we
4757 			 * need to increment the slow_io counters independent
4758 			 * of it.
4759 			 */
4760 			if (zfs_ereport_is_valid(FM_EREPORT_ZFS_DELAY,
4761 			    zio->io_spa, zio->io_vd, zio)) {
4762 				mutex_enter(&zio->io_vd->vdev_stat_lock);
4763 				zio->io_vd->vdev_stat.vs_slow_ios++;
4764 				mutex_exit(&zio->io_vd->vdev_stat_lock);
4765 
4766 				(void) zfs_ereport_post(FM_EREPORT_ZFS_DELAY,
4767 				    zio->io_spa, zio->io_vd, &zio->io_bookmark,
4768 				    zio, 0);
4769 			}
4770 		}
4771 	}
4772 
4773 	if (zio->io_error) {
4774 		/*
4775 		 * If this I/O is attached to a particular vdev,
4776 		 * generate an error message describing the I/O failure
4777 		 * at the block level.  We ignore these errors if the
4778 		 * device is currently unavailable.
4779 		 */
4780 		if (zio->io_error != ECKSUM && zio->io_vd != NULL &&
4781 		    !vdev_is_dead(zio->io_vd)) {
4782 			int ret = zfs_ereport_post(FM_EREPORT_ZFS_IO,
4783 			    zio->io_spa, zio->io_vd, &zio->io_bookmark, zio, 0);
4784 			if (ret != EALREADY) {
4785 				mutex_enter(&zio->io_vd->vdev_stat_lock);
4786 				if (zio->io_type == ZIO_TYPE_READ)
4787 					zio->io_vd->vdev_stat.vs_read_errors++;
4788 				else if (zio->io_type == ZIO_TYPE_WRITE)
4789 					zio->io_vd->vdev_stat.vs_write_errors++;
4790 				mutex_exit(&zio->io_vd->vdev_stat_lock);
4791 			}
4792 		}
4793 
4794 		if ((zio->io_error == EIO || !(zio->io_flags &
4795 		    (ZIO_FLAG_SPECULATIVE | ZIO_FLAG_DONT_PROPAGATE))) &&
4796 		    zio == zio->io_logical) {
4797 			/*
4798 			 * For logical I/O requests, tell the SPA to log the
4799 			 * error and generate a logical data ereport.
4800 			 */
4801 			spa_log_error(zio->io_spa, &zio->io_bookmark,
4802 			    &zio->io_bp->blk_birth);
4803 			(void) zfs_ereport_post(FM_EREPORT_ZFS_DATA,
4804 			    zio->io_spa, NULL, &zio->io_bookmark, zio, 0);
4805 		}
4806 	}
4807 
4808 	if (zio->io_error && zio == zio->io_logical) {
4809 		/*
4810 		 * Determine whether zio should be reexecuted.  This will
4811 		 * propagate all the way to the root via zio_notify_parent().
4812 		 */
4813 		ASSERT(zio->io_vd == NULL && zio->io_bp != NULL);
4814 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
4815 
4816 		if (IO_IS_ALLOCATING(zio) &&
4817 		    !(zio->io_flags & ZIO_FLAG_CANFAIL)) {
4818 			if (zio->io_error != ENOSPC)
4819 				zio->io_reexecute |= ZIO_REEXECUTE_NOW;
4820 			else
4821 				zio->io_reexecute |= ZIO_REEXECUTE_SUSPEND;
4822 		}
4823 
4824 		if ((zio->io_type == ZIO_TYPE_READ ||
4825 		    zio->io_type == ZIO_TYPE_FREE) &&
4826 		    !(zio->io_flags & ZIO_FLAG_SCAN_THREAD) &&
4827 		    zio->io_error == ENXIO &&
4828 		    spa_load_state(zio->io_spa) == SPA_LOAD_NONE &&
4829 		    spa_get_failmode(zio->io_spa) != ZIO_FAILURE_MODE_CONTINUE)
4830 			zio->io_reexecute |= ZIO_REEXECUTE_SUSPEND;
4831 
4832 		if (!(zio->io_flags & ZIO_FLAG_CANFAIL) && !zio->io_reexecute)
4833 			zio->io_reexecute |= ZIO_REEXECUTE_SUSPEND;
4834 
4835 		/*
4836 		 * Here is a possibly good place to attempt to do
4837 		 * either combinatorial reconstruction or error correction
4838 		 * based on checksums.  It also might be a good place
4839 		 * to send out preliminary ereports before we suspend
4840 		 * processing.
4841 		 */
4842 	}
4843 
4844 	/*
4845 	 * If there were logical child errors, they apply to us now.
4846 	 * We defer this until now to avoid conflating logical child
4847 	 * errors with errors that happened to the zio itself when
4848 	 * updating vdev stats and reporting FMA events above.
4849 	 */
4850 	zio_inherit_child_errors(zio, ZIO_CHILD_LOGICAL);
4851 
4852 	if ((zio->io_error || zio->io_reexecute) &&
4853 	    IO_IS_ALLOCATING(zio) && zio->io_gang_leader == zio &&
4854 	    !(zio->io_flags & (ZIO_FLAG_IO_REWRITE | ZIO_FLAG_NOPWRITE)))
4855 		zio_dva_unallocate(zio, zio->io_gang_tree, zio->io_bp);
4856 
4857 	zio_gang_tree_free(&zio->io_gang_tree);
4858 
4859 	/*
4860 	 * Godfather I/Os should never suspend.
4861 	 */
4862 	if ((zio->io_flags & ZIO_FLAG_GODFATHER) &&
4863 	    (zio->io_reexecute & ZIO_REEXECUTE_SUSPEND))
4864 		zio->io_reexecute &= ~ZIO_REEXECUTE_SUSPEND;
4865 
4866 	if (zio->io_reexecute) {
4867 		/*
4868 		 * This is a logical I/O that wants to reexecute.
4869 		 *
4870 		 * Reexecute is top-down.  When an i/o fails, if it's not
4871 		 * the root, it simply notifies its parent and sticks around.
4872 		 * The parent, seeing that it still has children in zio_done(),
4873 		 * does the same.  This percolates all the way up to the root.
4874 		 * The root i/o will reexecute or suspend the entire tree.
4875 		 *
4876 		 * This approach ensures that zio_reexecute() honors
4877 		 * all the original i/o dependency relationships, e.g.
4878 		 * parents not executing until children are ready.
4879 		 */
4880 		ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
4881 
4882 		zio->io_gang_leader = NULL;
4883 
4884 		mutex_enter(&zio->io_lock);
4885 		zio->io_state[ZIO_WAIT_DONE] = 1;
4886 		mutex_exit(&zio->io_lock);
4887 
4888 		/*
4889 		 * "The Godfather" I/O monitors its children but is
4890 		 * not a true parent to them. It will track them through
4891 		 * the pipeline but severs its ties whenever they get into
4892 		 * trouble (e.g. suspended). This allows "The Godfather"
4893 		 * I/O to return status without blocking.
4894 		 */
4895 		zl = NULL;
4896 		for (pio = zio_walk_parents(zio, &zl); pio != NULL;
4897 		    pio = pio_next) {
4898 			zio_link_t *remove_zl = zl;
4899 			pio_next = zio_walk_parents(zio, &zl);
4900 
4901 			if ((pio->io_flags & ZIO_FLAG_GODFATHER) &&
4902 			    (zio->io_reexecute & ZIO_REEXECUTE_SUSPEND)) {
4903 				zio_remove_child(pio, zio, remove_zl);
4904 				/*
4905 				 * This is a rare code path, so we don't
4906 				 * bother with "next_to_execute".
4907 				 */
4908 				zio_notify_parent(pio, zio, ZIO_WAIT_DONE,
4909 				    NULL);
4910 			}
4911 		}
4912 
4913 		if ((pio = zio_unique_parent(zio)) != NULL) {
4914 			/*
4915 			 * We're not a root i/o, so there's nothing to do
4916 			 * but notify our parent.  Don't propagate errors
4917 			 * upward since we haven't permanently failed yet.
4918 			 */
4919 			ASSERT(!(zio->io_flags & ZIO_FLAG_GODFATHER));
4920 			zio->io_flags |= ZIO_FLAG_DONT_PROPAGATE;
4921 			/*
4922 			 * This is a rare code path, so we don't bother with
4923 			 * "next_to_execute".
4924 			 */
4925 			zio_notify_parent(pio, zio, ZIO_WAIT_DONE, NULL);
4926 		} else if (zio->io_reexecute & ZIO_REEXECUTE_SUSPEND) {
4927 			/*
4928 			 * We'd fail again if we reexecuted now, so suspend
4929 			 * until conditions improve (e.g. device comes online).
4930 			 */
4931 			zio_suspend(zio->io_spa, zio, ZIO_SUSPEND_IOERR);
4932 		} else {
4933 			/*
4934 			 * Reexecution is potentially a huge amount of work.
4935 			 * Hand it off to the otherwise-unused claim taskq.
4936 			 */
4937 			ASSERT(taskq_empty_ent(&zio->io_tqent));
4938 			spa_taskq_dispatch_ent(zio->io_spa,
4939 			    ZIO_TYPE_CLAIM, ZIO_TASKQ_ISSUE,
4940 			    zio_reexecute, zio, 0, &zio->io_tqent, NULL);
4941 		}
4942 		return (NULL);
4943 	}
4944 
4945 	ASSERT(list_is_empty(&zio->io_child_list));
4946 	ASSERT(zio->io_reexecute == 0);
4947 	ASSERT(zio->io_error == 0 || (zio->io_flags & ZIO_FLAG_CANFAIL));
4948 
4949 	/*
4950 	 * Report any checksum errors, since the I/O is complete.
4951 	 */
4952 	while (zio->io_cksum_report != NULL) {
4953 		zio_cksum_report_t *zcr = zio->io_cksum_report;
4954 		zio->io_cksum_report = zcr->zcr_next;
4955 		zcr->zcr_next = NULL;
4956 		zcr->zcr_finish(zcr, NULL);
4957 		zfs_ereport_free_checksum(zcr);
4958 	}
4959 
4960 	/*
4961 	 * It is the responsibility of the done callback to ensure that this
4962 	 * particular zio is no longer discoverable for adoption, and as
4963 	 * such, cannot acquire any new parents.
4964 	 */
4965 	if (zio->io_done)
4966 		zio->io_done(zio);
4967 
4968 	mutex_enter(&zio->io_lock);
4969 	zio->io_state[ZIO_WAIT_DONE] = 1;
4970 	mutex_exit(&zio->io_lock);
4971 
4972 	/*
4973 	 * We are done executing this zio.  We may want to execute a parent
4974 	 * next.  See the comment in zio_notify_parent().
4975 	 */
4976 	zio_t *next_to_execute = NULL;
4977 	zl = NULL;
4978 	for (pio = zio_walk_parents(zio, &zl); pio != NULL; pio = pio_next) {
4979 		zio_link_t *remove_zl = zl;
4980 		pio_next = zio_walk_parents(zio, &zl);
4981 		zio_remove_child(pio, zio, remove_zl);
4982 		zio_notify_parent(pio, zio, ZIO_WAIT_DONE, &next_to_execute);
4983 	}
4984 
4985 	if (zio->io_waiter != NULL) {
4986 		mutex_enter(&zio->io_lock);
4987 		zio->io_executor = NULL;
4988 		cv_broadcast(&zio->io_cv);
4989 		mutex_exit(&zio->io_lock);
4990 	} else {
4991 		zio_destroy(zio);
4992 	}
4993 
4994 	return (next_to_execute);
4995 }
4996 
4997 /*
4998  * ==========================================================================
4999  * I/O pipeline definition
5000  * ==========================================================================
5001  */
5002 static zio_pipe_stage_t *zio_pipeline[] = {
5003 	NULL,
5004 	zio_read_bp_init,
5005 	zio_write_bp_init,
5006 	zio_free_bp_init,
5007 	zio_issue_async,
5008 	zio_write_compress,
5009 	zio_encrypt,
5010 	zio_checksum_generate,
5011 	zio_nop_write,
5012 	zio_brt_free,
5013 	zio_ddt_read_start,
5014 	zio_ddt_read_done,
5015 	zio_ddt_write,
5016 	zio_ddt_free,
5017 	zio_gang_assemble,
5018 	zio_gang_issue,
5019 	zio_dva_throttle,
5020 	zio_dva_allocate,
5021 	zio_dva_free,
5022 	zio_dva_claim,
5023 	zio_ready,
5024 	zio_vdev_io_start,
5025 	zio_vdev_io_done,
5026 	zio_vdev_io_assess,
5027 	zio_checksum_verify,
5028 	zio_done
5029 };
5030 
5031 
5032 
5033 
5034 /*
5035  * Compare two zbookmark_phys_t's to see which we would reach first in a
5036  * pre-order traversal of the object tree.
5037  *
5038  * This is simple in every case aside from the meta-dnode object. For all other
5039  * objects, we traverse them in order (object 1 before object 2, and so on).
5040  * However, all of these objects are traversed while traversing object 0, since
5041  * the data it points to is the list of objects.  Thus, we need to convert to a
5042  * canonical representation so we can compare meta-dnode bookmarks to
5043  * non-meta-dnode bookmarks.
5044  *
5045  * We do this by calculating "equivalents" for each field of the zbookmark.
5046  * zbookmarks outside of the meta-dnode use their own object and level, and
5047  * calculate the level 0 equivalent (the first L0 blkid that is contained in the
5048  * blocks this bookmark refers to) by multiplying their blkid by their span
5049  * (the number of L0 blocks contained within one block at their level).
5050  * zbookmarks inside the meta-dnode calculate their object equivalent
5051  * (which is L0equiv * dnodes per data block), use 0 for their L0equiv, and use
5052  * level + 1<<31 (any value larger than a level could ever be) for their level.
5053  * This causes them to always compare before a bookmark in their object
5054  * equivalent, compare appropriately to bookmarks in other objects, and to
5055  * compare appropriately to other bookmarks in the meta-dnode.
5056  */
5057 int
5058 zbookmark_compare(uint16_t dbss1, uint8_t ibs1, uint16_t dbss2, uint8_t ibs2,
5059     const zbookmark_phys_t *zb1, const zbookmark_phys_t *zb2)
5060 {
5061 	/*
5062 	 * These variables represent the "equivalent" values for the zbookmark,
5063 	 * after converting zbookmarks inside the meta dnode to their
5064 	 * normal-object equivalents.
5065 	 */
5066 	uint64_t zb1obj, zb2obj;
5067 	uint64_t zb1L0, zb2L0;
5068 	uint64_t zb1level, zb2level;
5069 
5070 	if (zb1->zb_object == zb2->zb_object &&
5071 	    zb1->zb_level == zb2->zb_level &&
5072 	    zb1->zb_blkid == zb2->zb_blkid)
5073 		return (0);
5074 
5075 	IMPLY(zb1->zb_level > 0, ibs1 >= SPA_MINBLOCKSHIFT);
5076 	IMPLY(zb2->zb_level > 0, ibs2 >= SPA_MINBLOCKSHIFT);
5077 
5078 	/*
5079 	 * BP_SPANB calculates the span in blocks.
5080 	 */
5081 	zb1L0 = (zb1->zb_blkid) * BP_SPANB(ibs1, zb1->zb_level);
5082 	zb2L0 = (zb2->zb_blkid) * BP_SPANB(ibs2, zb2->zb_level);
5083 
5084 	if (zb1->zb_object == DMU_META_DNODE_OBJECT) {
5085 		zb1obj = zb1L0 * (dbss1 << (SPA_MINBLOCKSHIFT - DNODE_SHIFT));
5086 		zb1L0 = 0;
5087 		zb1level = zb1->zb_level + COMPARE_META_LEVEL;
5088 	} else {
5089 		zb1obj = zb1->zb_object;
5090 		zb1level = zb1->zb_level;
5091 	}
5092 
5093 	if (zb2->zb_object == DMU_META_DNODE_OBJECT) {
5094 		zb2obj = zb2L0 * (dbss2 << (SPA_MINBLOCKSHIFT - DNODE_SHIFT));
5095 		zb2L0 = 0;
5096 		zb2level = zb2->zb_level + COMPARE_META_LEVEL;
5097 	} else {
5098 		zb2obj = zb2->zb_object;
5099 		zb2level = zb2->zb_level;
5100 	}
5101 
5102 	/* Now that we have a canonical representation, do the comparison. */
5103 	if (zb1obj != zb2obj)
5104 		return (zb1obj < zb2obj ? -1 : 1);
5105 	else if (zb1L0 != zb2L0)
5106 		return (zb1L0 < zb2L0 ? -1 : 1);
5107 	else if (zb1level != zb2level)
5108 		return (zb1level > zb2level ? -1 : 1);
5109 	/*
5110 	 * This can (theoretically) happen if the bookmarks have the same object
5111 	 * and level, but different blkids, if the block sizes are not the same.
5112 	 * There is presently no way to change the indirect block sizes
5113 	 */
5114 	return (0);
5115 }
5116 
5117 /*
5118  *  This function checks the following: given that last_block is the place that
5119  *  our traversal stopped last time, does that guarantee that we've visited
5120  *  every node under subtree_root?  Therefore, we can't just use the raw output
5121  *  of zbookmark_compare.  We have to pass in a modified version of
5122  *  subtree_root; by incrementing the block id, and then checking whether
5123  *  last_block is before or equal to that, we can tell whether or not having
5124  *  visited last_block implies that all of subtree_root's children have been
5125  *  visited.
5126  */
5127 boolean_t
5128 zbookmark_subtree_completed(const dnode_phys_t *dnp,
5129     const zbookmark_phys_t *subtree_root, const zbookmark_phys_t *last_block)
5130 {
5131 	zbookmark_phys_t mod_zb = *subtree_root;
5132 	mod_zb.zb_blkid++;
5133 	ASSERT0(last_block->zb_level);
5134 
5135 	/* The objset_phys_t isn't before anything. */
5136 	if (dnp == NULL)
5137 		return (B_FALSE);
5138 
5139 	/*
5140 	 * We pass in 1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT) for the
5141 	 * data block size in sectors, because that variable is only used if
5142 	 * the bookmark refers to a block in the meta-dnode.  Since we don't
5143 	 * know without examining it what object it refers to, and there's no
5144 	 * harm in passing in this value in other cases, we always pass it in.
5145 	 *
5146 	 * We pass in 0 for the indirect block size shift because zb2 must be
5147 	 * level 0.  The indirect block size is only used to calculate the span
5148 	 * of the bookmark, but since the bookmark must be level 0, the span is
5149 	 * always 1, so the math works out.
5150 	 *
5151 	 * If you make changes to how the zbookmark_compare code works, be sure
5152 	 * to make sure that this code still works afterwards.
5153 	 */
5154 	return (zbookmark_compare(dnp->dn_datablkszsec, dnp->dn_indblkshift,
5155 	    1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT), 0, &mod_zb,
5156 	    last_block) <= 0);
5157 }
5158 
5159 /*
5160  * This function is similar to zbookmark_subtree_completed(), but returns true
5161  * if subtree_root is equal or ahead of last_block, i.e. still to be done.
5162  */
5163 boolean_t
5164 zbookmark_subtree_tbd(const dnode_phys_t *dnp,
5165     const zbookmark_phys_t *subtree_root, const zbookmark_phys_t *last_block)
5166 {
5167 	ASSERT0(last_block->zb_level);
5168 	if (dnp == NULL)
5169 		return (B_FALSE);
5170 	return (zbookmark_compare(dnp->dn_datablkszsec, dnp->dn_indblkshift,
5171 	    1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT), 0, subtree_root,
5172 	    last_block) >= 0);
5173 }
5174 
5175 EXPORT_SYMBOL(zio_type_name);
5176 EXPORT_SYMBOL(zio_buf_alloc);
5177 EXPORT_SYMBOL(zio_data_buf_alloc);
5178 EXPORT_SYMBOL(zio_buf_free);
5179 EXPORT_SYMBOL(zio_data_buf_free);
5180 
5181 ZFS_MODULE_PARAM(zfs_zio, zio_, slow_io_ms, INT, ZMOD_RW,
5182 	"Max I/O completion time (milliseconds) before marking it as slow");
5183 
5184 ZFS_MODULE_PARAM(zfs_zio, zio_, requeue_io_start_cut_in_line, INT, ZMOD_RW,
5185 	"Prioritize requeued I/O");
5186 
5187 ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_deferred_free,  UINT, ZMOD_RW,
5188 	"Defer frees starting in this pass");
5189 
5190 ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_dont_compress, UINT, ZMOD_RW,
5191 	"Don't compress starting in this pass");
5192 
5193 ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_rewrite, UINT, ZMOD_RW,
5194 	"Rewrite new bps starting in this pass");
5195 
5196 ZFS_MODULE_PARAM(zfs_zio, zio_, dva_throttle_enabled, INT, ZMOD_RW,
5197 	"Throttle block allocations in the ZIO pipeline");
5198 
5199 ZFS_MODULE_PARAM(zfs_zio, zio_, deadman_log_all, INT, ZMOD_RW,
5200 	"Log all slow ZIOs, not just those with vdevs");
5201