xref: /titanic_52/usr/src/uts/common/fs/zfs/dbuf.c (revision 9d2159663a6316391e58ae8fc8a1e1a63dc9789c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 #include <sys/zfs_context.h>
26 #include <sys/dmu.h>
27 #include <sys/dmu_impl.h>
28 #include <sys/dbuf.h>
29 #include <sys/dmu_objset.h>
30 #include <sys/dsl_dataset.h>
31 #include <sys/dsl_dir.h>
32 #include <sys/dmu_tx.h>
33 #include <sys/spa.h>
34 #include <sys/zio.h>
35 #include <sys/dmu_zfetch.h>
36 #include <sys/sa.h>
37 #include <sys/sa_impl.h>
38 
39 static void dbuf_destroy(dmu_buf_impl_t *db);
40 static int dbuf_undirty(dmu_buf_impl_t *db, dmu_tx_t *tx);
41 static void dbuf_write(dbuf_dirty_record_t *dr, arc_buf_t *data, dmu_tx_t *tx);
42 
43 /*
44  * Global data structures and functions for the dbuf cache.
45  */
46 static kmem_cache_t *dbuf_cache;
47 
48 /* ARGSUSED */
49 static int
50 dbuf_cons(void *vdb, void *unused, int kmflag)
51 {
52 	dmu_buf_impl_t *db = vdb;
53 	bzero(db, sizeof (dmu_buf_impl_t));
54 
55 	mutex_init(&db->db_mtx, NULL, MUTEX_DEFAULT, NULL);
56 	cv_init(&db->db_changed, NULL, CV_DEFAULT, NULL);
57 	refcount_create(&db->db_holds);
58 	return (0);
59 }
60 
61 /* ARGSUSED */
62 static void
63 dbuf_dest(void *vdb, void *unused)
64 {
65 	dmu_buf_impl_t *db = vdb;
66 	mutex_destroy(&db->db_mtx);
67 	cv_destroy(&db->db_changed);
68 	refcount_destroy(&db->db_holds);
69 }
70 
71 /*
72  * dbuf hash table routines
73  */
74 static dbuf_hash_table_t dbuf_hash_table;
75 
76 static uint64_t dbuf_hash_count;
77 
78 static uint64_t
79 dbuf_hash(void *os, uint64_t obj, uint8_t lvl, uint64_t blkid)
80 {
81 	uintptr_t osv = (uintptr_t)os;
82 	uint64_t crc = -1ULL;
83 
84 	ASSERT(zfs_crc64_table[128] == ZFS_CRC64_POLY);
85 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (lvl)) & 0xFF];
86 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (osv >> 6)) & 0xFF];
87 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (obj >> 0)) & 0xFF];
88 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (obj >> 8)) & 0xFF];
89 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (blkid >> 0)) & 0xFF];
90 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (blkid >> 8)) & 0xFF];
91 
92 	crc ^= (osv>>14) ^ (obj>>16) ^ (blkid>>16);
93 
94 	return (crc);
95 }
96 
97 #define	DBUF_HASH(os, obj, level, blkid) dbuf_hash(os, obj, level, blkid);
98 
99 #define	DBUF_EQUAL(dbuf, os, obj, level, blkid)		\
100 	((dbuf)->db.db_object == (obj) &&		\
101 	(dbuf)->db_objset == (os) &&			\
102 	(dbuf)->db_level == (level) &&			\
103 	(dbuf)->db_blkid == (blkid))
104 
105 dmu_buf_impl_t *
106 dbuf_find(dnode_t *dn, uint8_t level, uint64_t blkid)
107 {
108 	dbuf_hash_table_t *h = &dbuf_hash_table;
109 	objset_t *os = dn->dn_objset;
110 	uint64_t obj = dn->dn_object;
111 	uint64_t hv = DBUF_HASH(os, obj, level, blkid);
112 	uint64_t idx = hv & h->hash_table_mask;
113 	dmu_buf_impl_t *db;
114 
115 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
116 	for (db = h->hash_table[idx]; db != NULL; db = db->db_hash_next) {
117 		if (DBUF_EQUAL(db, os, obj, level, blkid)) {
118 			mutex_enter(&db->db_mtx);
119 			if (db->db_state != DB_EVICTING) {
120 				mutex_exit(DBUF_HASH_MUTEX(h, idx));
121 				return (db);
122 			}
123 			mutex_exit(&db->db_mtx);
124 		}
125 	}
126 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
127 	return (NULL);
128 }
129 
130 /*
131  * Insert an entry into the hash table.  If there is already an element
132  * equal to elem in the hash table, then the already existing element
133  * will be returned and the new element will not be inserted.
134  * Otherwise returns NULL.
135  */
136 static dmu_buf_impl_t *
137 dbuf_hash_insert(dmu_buf_impl_t *db)
138 {
139 	dbuf_hash_table_t *h = &dbuf_hash_table;
140 	objset_t *os = db->db_objset;
141 	uint64_t obj = db->db.db_object;
142 	int level = db->db_level;
143 	uint64_t blkid = db->db_blkid;
144 	uint64_t hv = DBUF_HASH(os, obj, level, blkid);
145 	uint64_t idx = hv & h->hash_table_mask;
146 	dmu_buf_impl_t *dbf;
147 
148 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
149 	for (dbf = h->hash_table[idx]; dbf != NULL; dbf = dbf->db_hash_next) {
150 		if (DBUF_EQUAL(dbf, os, obj, level, blkid)) {
151 			mutex_enter(&dbf->db_mtx);
152 			if (dbf->db_state != DB_EVICTING) {
153 				mutex_exit(DBUF_HASH_MUTEX(h, idx));
154 				return (dbf);
155 			}
156 			mutex_exit(&dbf->db_mtx);
157 		}
158 	}
159 
160 	mutex_enter(&db->db_mtx);
161 	db->db_hash_next = h->hash_table[idx];
162 	h->hash_table[idx] = db;
163 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
164 	atomic_add_64(&dbuf_hash_count, 1);
165 
166 	return (NULL);
167 }
168 
169 /*
170  * Remove an entry from the hash table.  This operation will
171  * fail if there are any existing holds on the db.
172  */
173 static void
174 dbuf_hash_remove(dmu_buf_impl_t *db)
175 {
176 	dbuf_hash_table_t *h = &dbuf_hash_table;
177 	uint64_t hv = DBUF_HASH(db->db_objset, db->db.db_object,
178 	    db->db_level, db->db_blkid);
179 	uint64_t idx = hv & h->hash_table_mask;
180 	dmu_buf_impl_t *dbf, **dbp;
181 
182 	/*
183 	 * We musn't hold db_mtx to maintin lock ordering:
184 	 * DBUF_HASH_MUTEX > db_mtx.
185 	 */
186 	ASSERT(refcount_is_zero(&db->db_holds));
187 	ASSERT(db->db_state == DB_EVICTING);
188 	ASSERT(!MUTEX_HELD(&db->db_mtx));
189 
190 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
191 	dbp = &h->hash_table[idx];
192 	while ((dbf = *dbp) != db) {
193 		dbp = &dbf->db_hash_next;
194 		ASSERT(dbf != NULL);
195 	}
196 	*dbp = db->db_hash_next;
197 	db->db_hash_next = NULL;
198 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
199 	atomic_add_64(&dbuf_hash_count, -1);
200 }
201 
202 static arc_evict_func_t dbuf_do_evict;
203 
204 static void
205 dbuf_evict_user(dmu_buf_impl_t *db)
206 {
207 	ASSERT(MUTEX_HELD(&db->db_mtx));
208 
209 	if (db->db_level != 0 || db->db_evict_func == NULL)
210 		return;
211 
212 	if (db->db_user_data_ptr_ptr)
213 		*db->db_user_data_ptr_ptr = db->db.db_data;
214 	db->db_evict_func(&db->db, db->db_user_ptr);
215 	db->db_user_ptr = NULL;
216 	db->db_user_data_ptr_ptr = NULL;
217 	db->db_evict_func = NULL;
218 }
219 
220 void
221 dbuf_evict(dmu_buf_impl_t *db)
222 {
223 	ASSERT(MUTEX_HELD(&db->db_mtx));
224 	ASSERT(db->db_buf == NULL);
225 	ASSERT(db->db_data_pending == NULL);
226 
227 	dbuf_clear(db);
228 	dbuf_destroy(db);
229 }
230 
231 void
232 dbuf_init(void)
233 {
234 	uint64_t hsize = 1ULL << 16;
235 	dbuf_hash_table_t *h = &dbuf_hash_table;
236 	int i;
237 
238 	/*
239 	 * The hash table is big enough to fill all of physical memory
240 	 * with an average 4K block size.  The table will take up
241 	 * totalmem*sizeof(void*)/4K (i.e. 2MB/GB with 8-byte pointers).
242 	 */
243 	while (hsize * 4096 < physmem * PAGESIZE)
244 		hsize <<= 1;
245 
246 retry:
247 	h->hash_table_mask = hsize - 1;
248 	h->hash_table = kmem_zalloc(hsize * sizeof (void *), KM_NOSLEEP);
249 	if (h->hash_table == NULL) {
250 		/* XXX - we should really return an error instead of assert */
251 		ASSERT(hsize > (1ULL << 10));
252 		hsize >>= 1;
253 		goto retry;
254 	}
255 
256 	dbuf_cache = kmem_cache_create("dmu_buf_impl_t",
257 	    sizeof (dmu_buf_impl_t),
258 	    0, dbuf_cons, dbuf_dest, NULL, NULL, NULL, 0);
259 
260 	for (i = 0; i < DBUF_MUTEXES; i++)
261 		mutex_init(&h->hash_mutexes[i], NULL, MUTEX_DEFAULT, NULL);
262 }
263 
264 void
265 dbuf_fini(void)
266 {
267 	dbuf_hash_table_t *h = &dbuf_hash_table;
268 	int i;
269 
270 	for (i = 0; i < DBUF_MUTEXES; i++)
271 		mutex_destroy(&h->hash_mutexes[i]);
272 	kmem_free(h->hash_table, (h->hash_table_mask + 1) * sizeof (void *));
273 	kmem_cache_destroy(dbuf_cache);
274 }
275 
276 /*
277  * Other stuff.
278  */
279 
280 #ifdef ZFS_DEBUG
281 static void
282 dbuf_verify(dmu_buf_impl_t *db)
283 {
284 	dnode_t *dn = db->db_dnode;
285 	dbuf_dirty_record_t *dr;
286 
287 	ASSERT(MUTEX_HELD(&db->db_mtx));
288 
289 	if (!(zfs_flags & ZFS_DEBUG_DBUF_VERIFY))
290 		return;
291 
292 	ASSERT(db->db_objset != NULL);
293 	if (dn == NULL) {
294 		ASSERT(db->db_parent == NULL);
295 		ASSERT(db->db_blkptr == NULL);
296 	} else {
297 		ASSERT3U(db->db.db_object, ==, dn->dn_object);
298 		ASSERT3P(db->db_objset, ==, dn->dn_objset);
299 		ASSERT3U(db->db_level, <, dn->dn_nlevels);
300 		ASSERT(db->db_blkid == DMU_BONUS_BLKID || db->db_blkid ==
301 		    DMU_SPILL_BLKID || list_head(&dn->dn_dbufs));
302 	}
303 	if (db->db_blkid == DMU_BONUS_BLKID) {
304 		ASSERT(dn != NULL);
305 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
306 		ASSERT3U(db->db.db_offset, ==, DMU_BONUS_BLKID);
307 	} else if (db->db_blkid == DMU_SPILL_BLKID) {
308 		ASSERT(dn != NULL);
309 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
310 		ASSERT3U(db->db.db_offset, ==, 0);
311 	} else {
312 		ASSERT3U(db->db.db_offset, ==, db->db_blkid * db->db.db_size);
313 	}
314 
315 	for (dr = db->db_data_pending; dr != NULL; dr = dr->dr_next)
316 		ASSERT(dr->dr_dbuf == db);
317 
318 	for (dr = db->db_last_dirty; dr != NULL; dr = dr->dr_next)
319 		ASSERT(dr->dr_dbuf == db);
320 
321 	/*
322 	 * We can't assert that db_size matches dn_datablksz because it
323 	 * can be momentarily different when another thread is doing
324 	 * dnode_set_blksz().
325 	 */
326 	if (db->db_level == 0 && db->db.db_object == DMU_META_DNODE_OBJECT) {
327 		dr = db->db_data_pending;
328 		/*
329 		 * It should only be modified in syncing context, so
330 		 * make sure we only have one copy of the data.
331 		 */
332 		ASSERT(dr == NULL || dr->dt.dl.dr_data == db->db_buf);
333 	}
334 
335 	/* verify db->db_blkptr */
336 	if (db->db_blkptr) {
337 		if (db->db_parent == dn->dn_dbuf) {
338 			/* db is pointed to by the dnode */
339 			/* ASSERT3U(db->db_blkid, <, dn->dn_nblkptr); */
340 			if (DMU_OBJECT_IS_SPECIAL(db->db.db_object))
341 				ASSERT(db->db_parent == NULL);
342 			else
343 				ASSERT(db->db_parent != NULL);
344 			if (db->db_blkid != DMU_SPILL_BLKID)
345 				ASSERT3P(db->db_blkptr, ==,
346 				    &dn->dn_phys->dn_blkptr[db->db_blkid]);
347 		} else {
348 			/* db is pointed to by an indirect block */
349 			int epb = db->db_parent->db.db_size >> SPA_BLKPTRSHIFT;
350 			ASSERT3U(db->db_parent->db_level, ==, db->db_level+1);
351 			ASSERT3U(db->db_parent->db.db_object, ==,
352 			    db->db.db_object);
353 			/*
354 			 * dnode_grow_indblksz() can make this fail if we don't
355 			 * have the struct_rwlock.  XXX indblksz no longer
356 			 * grows.  safe to do this now?
357 			 */
358 			if (RW_WRITE_HELD(&db->db_dnode->dn_struct_rwlock)) {
359 				ASSERT3P(db->db_blkptr, ==,
360 				    ((blkptr_t *)db->db_parent->db.db_data +
361 				    db->db_blkid % epb));
362 			}
363 		}
364 	}
365 	if ((db->db_blkptr == NULL || BP_IS_HOLE(db->db_blkptr)) &&
366 	    (db->db_buf == NULL || db->db_buf->b_data) &&
367 	    db->db.db_data && db->db_blkid != DMU_BONUS_BLKID &&
368 	    db->db_state != DB_FILL && !dn->dn_free_txg) {
369 		/*
370 		 * If the blkptr isn't set but they have nonzero data,
371 		 * it had better be dirty, otherwise we'll lose that
372 		 * data when we evict this buffer.
373 		 */
374 		if (db->db_dirtycnt == 0) {
375 			uint64_t *buf = db->db.db_data;
376 			int i;
377 
378 			for (i = 0; i < db->db.db_size >> 3; i++) {
379 				ASSERT(buf[i] == 0);
380 			}
381 		}
382 	}
383 }
384 #endif
385 
386 static void
387 dbuf_update_data(dmu_buf_impl_t *db)
388 {
389 	ASSERT(MUTEX_HELD(&db->db_mtx));
390 	if (db->db_level == 0 && db->db_user_data_ptr_ptr) {
391 		ASSERT(!refcount_is_zero(&db->db_holds));
392 		*db->db_user_data_ptr_ptr = db->db.db_data;
393 	}
394 }
395 
396 static void
397 dbuf_set_data(dmu_buf_impl_t *db, arc_buf_t *buf)
398 {
399 	ASSERT(MUTEX_HELD(&db->db_mtx));
400 	ASSERT(db->db_buf == NULL || !arc_has_callback(db->db_buf));
401 	db->db_buf = buf;
402 	if (buf != NULL) {
403 		ASSERT(buf->b_data != NULL);
404 		db->db.db_data = buf->b_data;
405 		if (!arc_released(buf))
406 			arc_set_callback(buf, dbuf_do_evict, db);
407 		dbuf_update_data(db);
408 	} else {
409 		dbuf_evict_user(db);
410 		db->db.db_data = NULL;
411 		if (db->db_state != DB_NOFILL)
412 			db->db_state = DB_UNCACHED;
413 	}
414 }
415 
416 /*
417  * Loan out an arc_buf for read.  Return the loaned arc_buf.
418  */
419 arc_buf_t *
420 dbuf_loan_arcbuf(dmu_buf_impl_t *db)
421 {
422 	arc_buf_t *abuf;
423 
424 	mutex_enter(&db->db_mtx);
425 	if (arc_released(db->db_buf) || refcount_count(&db->db_holds) > 1) {
426 		int blksz = db->db.db_size;
427 		mutex_exit(&db->db_mtx);
428 		abuf = arc_loan_buf(db->db_dnode->dn_objset->os_spa, blksz);
429 		bcopy(db->db.db_data, abuf->b_data, blksz);
430 	} else {
431 		abuf = db->db_buf;
432 		arc_loan_inuse_buf(abuf, db);
433 		dbuf_set_data(db, NULL);
434 		mutex_exit(&db->db_mtx);
435 	}
436 	return (abuf);
437 }
438 
439 uint64_t
440 dbuf_whichblock(dnode_t *dn, uint64_t offset)
441 {
442 	if (dn->dn_datablkshift) {
443 		return (offset >> dn->dn_datablkshift);
444 	} else {
445 		ASSERT3U(offset, <, dn->dn_datablksz);
446 		return (0);
447 	}
448 }
449 
450 static void
451 dbuf_read_done(zio_t *zio, arc_buf_t *buf, void *vdb)
452 {
453 	dmu_buf_impl_t *db = vdb;
454 
455 	mutex_enter(&db->db_mtx);
456 	ASSERT3U(db->db_state, ==, DB_READ);
457 	/*
458 	 * All reads are synchronous, so we must have a hold on the dbuf
459 	 */
460 	ASSERT(refcount_count(&db->db_holds) > 0);
461 	ASSERT(db->db_buf == NULL);
462 	ASSERT(db->db.db_data == NULL);
463 	if (db->db_level == 0 && db->db_freed_in_flight) {
464 		/* we were freed in flight; disregard any error */
465 		arc_release(buf, db);
466 		bzero(buf->b_data, db->db.db_size);
467 		arc_buf_freeze(buf);
468 		db->db_freed_in_flight = FALSE;
469 		dbuf_set_data(db, buf);
470 		db->db_state = DB_CACHED;
471 	} else if (zio == NULL || zio->io_error == 0) {
472 		dbuf_set_data(db, buf);
473 		db->db_state = DB_CACHED;
474 	} else {
475 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
476 		ASSERT3P(db->db_buf, ==, NULL);
477 		VERIFY(arc_buf_remove_ref(buf, db) == 1);
478 		db->db_state = DB_UNCACHED;
479 	}
480 	cv_broadcast(&db->db_changed);
481 	dbuf_rele_and_unlock(db, NULL);
482 }
483 
484 static void
485 dbuf_read_impl(dmu_buf_impl_t *db, zio_t *zio, uint32_t *flags)
486 {
487 	dnode_t *dn = db->db_dnode;
488 	zbookmark_t zb;
489 	uint32_t aflags = ARC_NOWAIT;
490 	arc_buf_t *pbuf;
491 
492 	ASSERT(!refcount_is_zero(&db->db_holds));
493 	/* We need the struct_rwlock to prevent db_blkptr from changing. */
494 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
495 	ASSERT(MUTEX_HELD(&db->db_mtx));
496 	ASSERT(db->db_state == DB_UNCACHED);
497 	ASSERT(db->db_buf == NULL);
498 
499 	if (db->db_blkid == DMU_BONUS_BLKID) {
500 		int bonuslen = MIN(dn->dn_bonuslen, dn->dn_phys->dn_bonuslen);
501 
502 		ASSERT3U(bonuslen, <=, db->db.db_size);
503 		db->db.db_data = zio_buf_alloc(DN_MAX_BONUSLEN);
504 		arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
505 		if (bonuslen < DN_MAX_BONUSLEN)
506 			bzero(db->db.db_data, DN_MAX_BONUSLEN);
507 		if (bonuslen)
508 			bcopy(DN_BONUS(dn->dn_phys), db->db.db_data, bonuslen);
509 		dbuf_update_data(db);
510 		db->db_state = DB_CACHED;
511 		mutex_exit(&db->db_mtx);
512 		return;
513 	}
514 
515 	/*
516 	 * Recheck BP_IS_HOLE() after dnode_block_freed() in case dnode_sync()
517 	 * processes the delete record and clears the bp while we are waiting
518 	 * for the dn_mtx (resulting in a "no" from block_freed).
519 	 */
520 	if (db->db_blkptr == NULL || BP_IS_HOLE(db->db_blkptr) ||
521 	    (db->db_level == 0 && (dnode_block_freed(dn, db->db_blkid) ||
522 	    BP_IS_HOLE(db->db_blkptr)))) {
523 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
524 
525 		dbuf_set_data(db, arc_buf_alloc(dn->dn_objset->os_spa,
526 		    db->db.db_size, db, type));
527 		bzero(db->db.db_data, db->db.db_size);
528 		db->db_state = DB_CACHED;
529 		*flags |= DB_RF_CACHED;
530 		mutex_exit(&db->db_mtx);
531 		return;
532 	}
533 
534 	db->db_state = DB_READ;
535 	mutex_exit(&db->db_mtx);
536 
537 	if (DBUF_IS_L2CACHEABLE(db))
538 		aflags |= ARC_L2CACHE;
539 
540 	SET_BOOKMARK(&zb, db->db_objset->os_dsl_dataset ?
541 	    db->db_objset->os_dsl_dataset->ds_object : DMU_META_OBJSET,
542 	    db->db.db_object, db->db_level, db->db_blkid);
543 
544 	dbuf_add_ref(db, NULL);
545 	/* ZIO_FLAG_CANFAIL callers have to check the parent zio's error */
546 
547 	if (db->db_parent)
548 		pbuf = db->db_parent->db_buf;
549 	else
550 		pbuf = db->db_objset->os_phys_buf;
551 
552 	(void) dsl_read(zio, dn->dn_objset->os_spa, db->db_blkptr, pbuf,
553 	    dbuf_read_done, db, ZIO_PRIORITY_SYNC_READ,
554 	    (*flags & DB_RF_CANFAIL) ? ZIO_FLAG_CANFAIL : ZIO_FLAG_MUSTSUCCEED,
555 	    &aflags, &zb);
556 	if (aflags & ARC_CACHED)
557 		*flags |= DB_RF_CACHED;
558 }
559 
560 int
561 dbuf_read(dmu_buf_impl_t *db, zio_t *zio, uint32_t flags)
562 {
563 	int err = 0;
564 	int havepzio = (zio != NULL);
565 	int prefetch;
566 
567 	/*
568 	 * We don't have to hold the mutex to check db_state because it
569 	 * can't be freed while we have a hold on the buffer.
570 	 */
571 	ASSERT(!refcount_is_zero(&db->db_holds));
572 
573 	if (db->db_state == DB_NOFILL)
574 		return (EIO);
575 
576 	if ((flags & DB_RF_HAVESTRUCT) == 0)
577 		rw_enter(&db->db_dnode->dn_struct_rwlock, RW_READER);
578 
579 	prefetch = db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
580 	    (flags & DB_RF_NOPREFETCH) == 0 && db->db_dnode != NULL &&
581 	    DBUF_IS_CACHEABLE(db);
582 
583 	mutex_enter(&db->db_mtx);
584 	if (db->db_state == DB_CACHED) {
585 		mutex_exit(&db->db_mtx);
586 		if (prefetch)
587 			dmu_zfetch(&db->db_dnode->dn_zfetch, db->db.db_offset,
588 			    db->db.db_size, TRUE);
589 		if ((flags & DB_RF_HAVESTRUCT) == 0)
590 			rw_exit(&db->db_dnode->dn_struct_rwlock);
591 	} else if (db->db_state == DB_UNCACHED) {
592 		if (zio == NULL) {
593 			zio = zio_root(db->db_dnode->dn_objset->os_spa,
594 			    NULL, NULL, ZIO_FLAG_CANFAIL);
595 		}
596 		dbuf_read_impl(db, zio, &flags);
597 
598 		/* dbuf_read_impl has dropped db_mtx for us */
599 
600 		if (prefetch)
601 			dmu_zfetch(&db->db_dnode->dn_zfetch, db->db.db_offset,
602 			    db->db.db_size, flags & DB_RF_CACHED);
603 
604 		if ((flags & DB_RF_HAVESTRUCT) == 0)
605 			rw_exit(&db->db_dnode->dn_struct_rwlock);
606 
607 		if (!havepzio)
608 			err = zio_wait(zio);
609 	} else {
610 		mutex_exit(&db->db_mtx);
611 		if (prefetch)
612 			dmu_zfetch(&db->db_dnode->dn_zfetch, db->db.db_offset,
613 			    db->db.db_size, TRUE);
614 		if ((flags & DB_RF_HAVESTRUCT) == 0)
615 			rw_exit(&db->db_dnode->dn_struct_rwlock);
616 
617 		mutex_enter(&db->db_mtx);
618 		if ((flags & DB_RF_NEVERWAIT) == 0) {
619 			while (db->db_state == DB_READ ||
620 			    db->db_state == DB_FILL) {
621 				ASSERT(db->db_state == DB_READ ||
622 				    (flags & DB_RF_HAVESTRUCT) == 0);
623 				cv_wait(&db->db_changed, &db->db_mtx);
624 			}
625 			if (db->db_state == DB_UNCACHED)
626 				err = EIO;
627 		}
628 		mutex_exit(&db->db_mtx);
629 	}
630 
631 	ASSERT(err || havepzio || db->db_state == DB_CACHED);
632 	return (err);
633 }
634 
635 static void
636 dbuf_noread(dmu_buf_impl_t *db)
637 {
638 	ASSERT(!refcount_is_zero(&db->db_holds));
639 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
640 	mutex_enter(&db->db_mtx);
641 	while (db->db_state == DB_READ || db->db_state == DB_FILL)
642 		cv_wait(&db->db_changed, &db->db_mtx);
643 	if (db->db_state == DB_UNCACHED) {
644 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
645 
646 		ASSERT(db->db_buf == NULL);
647 		ASSERT(db->db.db_data == NULL);
648 		dbuf_set_data(db, arc_buf_alloc(db->db_dnode->dn_objset->os_spa,
649 		    db->db.db_size, db, type));
650 		db->db_state = DB_FILL;
651 	} else if (db->db_state == DB_NOFILL) {
652 		dbuf_set_data(db, NULL);
653 	} else {
654 		ASSERT3U(db->db_state, ==, DB_CACHED);
655 	}
656 	mutex_exit(&db->db_mtx);
657 }
658 
659 /*
660  * This is our just-in-time copy function.  It makes a copy of
661  * buffers, that have been modified in a previous transaction
662  * group, before we modify them in the current active group.
663  *
664  * This function is used in two places: when we are dirtying a
665  * buffer for the first time in a txg, and when we are freeing
666  * a range in a dnode that includes this buffer.
667  *
668  * Note that when we are called from dbuf_free_range() we do
669  * not put a hold on the buffer, we just traverse the active
670  * dbuf list for the dnode.
671  */
672 static void
673 dbuf_fix_old_data(dmu_buf_impl_t *db, uint64_t txg)
674 {
675 	dbuf_dirty_record_t *dr = db->db_last_dirty;
676 
677 	ASSERT(MUTEX_HELD(&db->db_mtx));
678 	ASSERT(db->db.db_data != NULL);
679 	ASSERT(db->db_level == 0);
680 	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT);
681 
682 	if (dr == NULL ||
683 	    (dr->dt.dl.dr_data !=
684 	    ((db->db_blkid  == DMU_BONUS_BLKID) ? db->db.db_data : db->db_buf)))
685 		return;
686 
687 	/*
688 	 * If the last dirty record for this dbuf has not yet synced
689 	 * and its referencing the dbuf data, either:
690 	 * 	reset the reference to point to a new copy,
691 	 * or (if there a no active holders)
692 	 *	just null out the current db_data pointer.
693 	 */
694 	ASSERT(dr->dr_txg >= txg - 2);
695 	if (db->db_blkid == DMU_BONUS_BLKID) {
696 		/* Note that the data bufs here are zio_bufs */
697 		dr->dt.dl.dr_data = zio_buf_alloc(DN_MAX_BONUSLEN);
698 		arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
699 		bcopy(db->db.db_data, dr->dt.dl.dr_data, DN_MAX_BONUSLEN);
700 	} else if (refcount_count(&db->db_holds) > db->db_dirtycnt) {
701 		int size = db->db.db_size;
702 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
703 		dr->dt.dl.dr_data = arc_buf_alloc(
704 		    db->db_dnode->dn_objset->os_spa, size, db, type);
705 		bcopy(db->db.db_data, dr->dt.dl.dr_data->b_data, size);
706 	} else {
707 		dbuf_set_data(db, NULL);
708 	}
709 }
710 
711 void
712 dbuf_unoverride(dbuf_dirty_record_t *dr)
713 {
714 	dmu_buf_impl_t *db = dr->dr_dbuf;
715 	blkptr_t *bp = &dr->dt.dl.dr_overridden_by;
716 	uint64_t txg = dr->dr_txg;
717 
718 	ASSERT(MUTEX_HELD(&db->db_mtx));
719 	ASSERT(dr->dt.dl.dr_override_state != DR_IN_DMU_SYNC);
720 	ASSERT(db->db_level == 0);
721 
722 	if (db->db_blkid == DMU_BONUS_BLKID ||
723 	    dr->dt.dl.dr_override_state == DR_NOT_OVERRIDDEN)
724 		return;
725 
726 	ASSERT(db->db_data_pending != dr);
727 
728 	/* free this block */
729 	if (!BP_IS_HOLE(bp))
730 		zio_free(db->db_dnode->dn_objset->os_spa, txg, bp);
731 
732 	dr->dt.dl.dr_override_state = DR_NOT_OVERRIDDEN;
733 	/*
734 	 * Release the already-written buffer, so we leave it in
735 	 * a consistent dirty state.  Note that all callers are
736 	 * modifying the buffer, so they will immediately do
737 	 * another (redundant) arc_release().  Therefore, leave
738 	 * the buf thawed to save the effort of freezing &
739 	 * immediately re-thawing it.
740 	 */
741 	arc_release(dr->dt.dl.dr_data, db);
742 }
743 
744 /*
745  * Evict (if its unreferenced) or clear (if its referenced) any level-0
746  * data blocks in the free range, so that any future readers will find
747  * empty blocks.  Also, if we happen accross any level-1 dbufs in the
748  * range that have not already been marked dirty, mark them dirty so
749  * they stay in memory.
750  */
751 void
752 dbuf_free_range(dnode_t *dn, uint64_t start, uint64_t end, dmu_tx_t *tx)
753 {
754 	dmu_buf_impl_t *db, *db_next;
755 	uint64_t txg = tx->tx_txg;
756 	int epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
757 	uint64_t first_l1 = start >> epbs;
758 	uint64_t last_l1 = end >> epbs;
759 
760 	if (end > dn->dn_maxblkid && (end != DMU_SPILL_BLKID)) {
761 		end = dn->dn_maxblkid;
762 		last_l1 = end >> epbs;
763 	}
764 	dprintf_dnode(dn, "start=%llu end=%llu\n", start, end);
765 	mutex_enter(&dn->dn_dbufs_mtx);
766 	for (db = list_head(&dn->dn_dbufs); db; db = db_next) {
767 		db_next = list_next(&dn->dn_dbufs, db);
768 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
769 
770 		if (db->db_level == 1 &&
771 		    db->db_blkid >= first_l1 && db->db_blkid <= last_l1) {
772 			mutex_enter(&db->db_mtx);
773 			if (db->db_last_dirty &&
774 			    db->db_last_dirty->dr_txg < txg) {
775 				dbuf_add_ref(db, FTAG);
776 				mutex_exit(&db->db_mtx);
777 				dbuf_will_dirty(db, tx);
778 				dbuf_rele(db, FTAG);
779 			} else {
780 				mutex_exit(&db->db_mtx);
781 			}
782 		}
783 
784 		if (db->db_level != 0)
785 			continue;
786 		dprintf_dbuf(db, "found buf %s\n", "");
787 		if (db->db_blkid < start || db->db_blkid > end)
788 			continue;
789 
790 		/* found a level 0 buffer in the range */
791 		if (dbuf_undirty(db, tx))
792 			continue;
793 
794 		mutex_enter(&db->db_mtx);
795 		if (db->db_state == DB_UNCACHED ||
796 		    db->db_state == DB_NOFILL ||
797 		    db->db_state == DB_EVICTING) {
798 			ASSERT(db->db.db_data == NULL);
799 			mutex_exit(&db->db_mtx);
800 			continue;
801 		}
802 		if (db->db_state == DB_READ || db->db_state == DB_FILL) {
803 			/* will be handled in dbuf_read_done or dbuf_rele */
804 			db->db_freed_in_flight = TRUE;
805 			mutex_exit(&db->db_mtx);
806 			continue;
807 		}
808 		if (refcount_count(&db->db_holds) == 0) {
809 			ASSERT(db->db_buf);
810 			dbuf_clear(db);
811 			continue;
812 		}
813 		/* The dbuf is referenced */
814 
815 		if (db->db_last_dirty != NULL) {
816 			dbuf_dirty_record_t *dr = db->db_last_dirty;
817 
818 			if (dr->dr_txg == txg) {
819 				/*
820 				 * This buffer is "in-use", re-adjust the file
821 				 * size to reflect that this buffer may
822 				 * contain new data when we sync.
823 				 */
824 				if (db->db_blkid != DMU_SPILL_BLKID &&
825 				    db->db_blkid > dn->dn_maxblkid)
826 					dn->dn_maxblkid = db->db_blkid;
827 				dbuf_unoverride(dr);
828 			} else {
829 				/*
830 				 * This dbuf is not dirty in the open context.
831 				 * Either uncache it (if its not referenced in
832 				 * the open context) or reset its contents to
833 				 * empty.
834 				 */
835 				dbuf_fix_old_data(db, txg);
836 			}
837 		}
838 		/* clear the contents if its cached */
839 		if (db->db_state == DB_CACHED) {
840 			ASSERT(db->db.db_data != NULL);
841 			arc_release(db->db_buf, db);
842 			bzero(db->db.db_data, db->db.db_size);
843 			arc_buf_freeze(db->db_buf);
844 		}
845 
846 		mutex_exit(&db->db_mtx);
847 	}
848 	mutex_exit(&dn->dn_dbufs_mtx);
849 }
850 
851 static int
852 dbuf_block_freeable(dmu_buf_impl_t *db)
853 {
854 	dsl_dataset_t *ds = db->db_objset->os_dsl_dataset;
855 	uint64_t birth_txg = 0;
856 
857 	/*
858 	 * We don't need any locking to protect db_blkptr:
859 	 * If it's syncing, then db_last_dirty will be set
860 	 * so we'll ignore db_blkptr.
861 	 */
862 	ASSERT(MUTEX_HELD(&db->db_mtx));
863 	if (db->db_last_dirty)
864 		birth_txg = db->db_last_dirty->dr_txg;
865 	else if (db->db_blkptr)
866 		birth_txg = db->db_blkptr->blk_birth;
867 
868 	/*
869 	 * If we don't exist or are in a snapshot, we can't be freed.
870 	 * Don't pass the bp to dsl_dataset_block_freeable() since we
871 	 * are holding the db_mtx lock and might deadlock if we are
872 	 * prefetching a dedup-ed block.
873 	 */
874 	if (birth_txg)
875 		return (ds == NULL ||
876 		    dsl_dataset_block_freeable(ds, NULL, birth_txg));
877 	else
878 		return (FALSE);
879 }
880 
881 void
882 dbuf_new_size(dmu_buf_impl_t *db, int size, dmu_tx_t *tx)
883 {
884 	arc_buf_t *buf, *obuf;
885 	int osize = db->db.db_size;
886 	arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
887 
888 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
889 
890 	/* XXX does *this* func really need the lock? */
891 	ASSERT(RW_WRITE_HELD(&db->db_dnode->dn_struct_rwlock));
892 
893 	/*
894 	 * This call to dbuf_will_dirty() with the dn_struct_rwlock held
895 	 * is OK, because there can be no other references to the db
896 	 * when we are changing its size, so no concurrent DB_FILL can
897 	 * be happening.
898 	 */
899 	/*
900 	 * XXX we should be doing a dbuf_read, checking the return
901 	 * value and returning that up to our callers
902 	 */
903 	dbuf_will_dirty(db, tx);
904 
905 	/* create the data buffer for the new block */
906 	buf = arc_buf_alloc(db->db_dnode->dn_objset->os_spa, size, db, type);
907 
908 	/* copy old block data to the new block */
909 	obuf = db->db_buf;
910 	bcopy(obuf->b_data, buf->b_data, MIN(osize, size));
911 	/* zero the remainder */
912 	if (size > osize)
913 		bzero((uint8_t *)buf->b_data + osize, size - osize);
914 
915 	mutex_enter(&db->db_mtx);
916 	dbuf_set_data(db, buf);
917 	VERIFY(arc_buf_remove_ref(obuf, db) == 1);
918 	db->db.db_size = size;
919 
920 	if (db->db_level == 0) {
921 		ASSERT3U(db->db_last_dirty->dr_txg, ==, tx->tx_txg);
922 		db->db_last_dirty->dt.dl.dr_data = buf;
923 	}
924 	mutex_exit(&db->db_mtx);
925 
926 	dnode_willuse_space(db->db_dnode, size-osize, tx);
927 }
928 
929 void
930 dbuf_release_bp(dmu_buf_impl_t *db)
931 {
932 	objset_t *os = db->db_dnode->dn_objset;
933 	zbookmark_t zb;
934 
935 	ASSERT(dsl_pool_sync_context(dmu_objset_pool(os)));
936 	ASSERT(arc_released(os->os_phys_buf) ||
937 	    list_link_active(&os->os_dsl_dataset->ds_synced_link));
938 	ASSERT(db->db_parent == NULL || arc_released(db->db_parent->db_buf));
939 
940 	zb.zb_objset = os->os_dsl_dataset ?
941 	    os->os_dsl_dataset->ds_object : 0;
942 	zb.zb_object = db->db.db_object;
943 	zb.zb_level = db->db_level;
944 	zb.zb_blkid = db->db_blkid;
945 	(void) arc_release_bp(db->db_buf, db,
946 	    db->db_blkptr, os->os_spa, &zb);
947 }
948 
949 dbuf_dirty_record_t *
950 dbuf_dirty(dmu_buf_impl_t *db, dmu_tx_t *tx)
951 {
952 	dnode_t *dn = db->db_dnode;
953 	objset_t *os = dn->dn_objset;
954 	dbuf_dirty_record_t **drp, *dr;
955 	int drop_struct_lock = FALSE;
956 	boolean_t do_free_accounting = B_FALSE;
957 	int txgoff = tx->tx_txg & TXG_MASK;
958 
959 	ASSERT(tx->tx_txg != 0);
960 	ASSERT(!refcount_is_zero(&db->db_holds));
961 	DMU_TX_DIRTY_BUF(tx, db);
962 
963 	/*
964 	 * Shouldn't dirty a regular buffer in syncing context.  Private
965 	 * objects may be dirtied in syncing context, but only if they
966 	 * were already pre-dirtied in open context.
967 	 */
968 	ASSERT(!dmu_tx_is_syncing(tx) ||
969 	    BP_IS_HOLE(dn->dn_objset->os_rootbp) ||
970 	    DMU_OBJECT_IS_SPECIAL(dn->dn_object) ||
971 	    dn->dn_objset->os_dsl_dataset == NULL);
972 	/*
973 	 * We make this assert for private objects as well, but after we
974 	 * check if we're already dirty.  They are allowed to re-dirty
975 	 * in syncing context.
976 	 */
977 	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT ||
978 	    dn->dn_dirtyctx == DN_UNDIRTIED || dn->dn_dirtyctx ==
979 	    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));
980 
981 	mutex_enter(&db->db_mtx);
982 	/*
983 	 * XXX make this true for indirects too?  The problem is that
984 	 * transactions created with dmu_tx_create_assigned() from
985 	 * syncing context don't bother holding ahead.
986 	 */
987 	ASSERT(db->db_level != 0 ||
988 	    db->db_state == DB_CACHED || db->db_state == DB_FILL ||
989 	    db->db_state == DB_NOFILL);
990 
991 	mutex_enter(&dn->dn_mtx);
992 	/*
993 	 * Don't set dirtyctx to SYNC if we're just modifying this as we
994 	 * initialize the objset.
995 	 */
996 	if (dn->dn_dirtyctx == DN_UNDIRTIED &&
997 	    !BP_IS_HOLE(dn->dn_objset->os_rootbp)) {
998 		dn->dn_dirtyctx =
999 		    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN);
1000 		ASSERT(dn->dn_dirtyctx_firstset == NULL);
1001 		dn->dn_dirtyctx_firstset = kmem_alloc(1, KM_SLEEP);
1002 	}
1003 	mutex_exit(&dn->dn_mtx);
1004 
1005 	if (db->db_blkid == DMU_SPILL_BLKID)
1006 		dn->dn_have_spill = B_TRUE;
1007 
1008 	/*
1009 	 * If this buffer is already dirty, we're done.
1010 	 */
1011 	drp = &db->db_last_dirty;
1012 	ASSERT(*drp == NULL || (*drp)->dr_txg <= tx->tx_txg ||
1013 	    db->db.db_object == DMU_META_DNODE_OBJECT);
1014 	while ((dr = *drp) != NULL && dr->dr_txg > tx->tx_txg)
1015 		drp = &dr->dr_next;
1016 	if (dr && dr->dr_txg == tx->tx_txg) {
1017 		if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID) {
1018 			/*
1019 			 * If this buffer has already been written out,
1020 			 * we now need to reset its state.
1021 			 */
1022 			dbuf_unoverride(dr);
1023 			if (db->db.db_object != DMU_META_DNODE_OBJECT &&
1024 			    db->db_state != DB_NOFILL)
1025 				arc_buf_thaw(db->db_buf);
1026 		}
1027 		mutex_exit(&db->db_mtx);
1028 		return (dr);
1029 	}
1030 
1031 	/*
1032 	 * Only valid if not already dirty.
1033 	 */
1034 	ASSERT(dn->dn_object == 0 ||
1035 	    dn->dn_dirtyctx == DN_UNDIRTIED || dn->dn_dirtyctx ==
1036 	    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));
1037 
1038 	ASSERT3U(dn->dn_nlevels, >, db->db_level);
1039 	ASSERT((dn->dn_phys->dn_nlevels == 0 && db->db_level == 0) ||
1040 	    dn->dn_phys->dn_nlevels > db->db_level ||
1041 	    dn->dn_next_nlevels[txgoff] > db->db_level ||
1042 	    dn->dn_next_nlevels[(tx->tx_txg-1) & TXG_MASK] > db->db_level ||
1043 	    dn->dn_next_nlevels[(tx->tx_txg-2) & TXG_MASK] > db->db_level);
1044 
1045 	/*
1046 	 * We should only be dirtying in syncing context if it's the
1047 	 * mos or we're initializing the os or it's a special object.
1048 	 * However, we are allowed to dirty in syncing context provided
1049 	 * we already dirtied it in open context.  Hence we must make
1050 	 * this assertion only if we're not already dirty.
1051 	 */
1052 	ASSERT(!dmu_tx_is_syncing(tx) || DMU_OBJECT_IS_SPECIAL(dn->dn_object) ||
1053 	    os->os_dsl_dataset == NULL || BP_IS_HOLE(os->os_rootbp));
1054 	ASSERT(db->db.db_size != 0);
1055 
1056 	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);
1057 
1058 	if (db->db_blkid != DMU_BONUS_BLKID) {
1059 		/*
1060 		 * Update the accounting.
1061 		 * Note: we delay "free accounting" until after we drop
1062 		 * the db_mtx.  This keeps us from grabbing other locks
1063 		 * (and possibly deadlocking) in bp_get_dsize() while
1064 		 * also holding the db_mtx.
1065 		 */
1066 		dnode_willuse_space(dn, db->db.db_size, tx);
1067 		do_free_accounting = dbuf_block_freeable(db);
1068 	}
1069 
1070 	/*
1071 	 * If this buffer is dirty in an old transaction group we need
1072 	 * to make a copy of it so that the changes we make in this
1073 	 * transaction group won't leak out when we sync the older txg.
1074 	 */
1075 	dr = kmem_zalloc(sizeof (dbuf_dirty_record_t), KM_SLEEP);
1076 	if (db->db_level == 0) {
1077 		void *data_old = db->db_buf;
1078 
1079 		if (db->db_state != DB_NOFILL) {
1080 			if (db->db_blkid == DMU_BONUS_BLKID) {
1081 				dbuf_fix_old_data(db, tx->tx_txg);
1082 				data_old = db->db.db_data;
1083 			} else if (db->db.db_object != DMU_META_DNODE_OBJECT) {
1084 				/*
1085 				 * Release the data buffer from the cache so
1086 				 * that we can modify it without impacting
1087 				 * possible other users of this cached data
1088 				 * block.  Note that indirect blocks and
1089 				 * private objects are not released until the
1090 				 * syncing state (since they are only modified
1091 				 * then).
1092 				 */
1093 				arc_release(db->db_buf, db);
1094 				dbuf_fix_old_data(db, tx->tx_txg);
1095 				data_old = db->db_buf;
1096 			}
1097 			ASSERT(data_old != NULL);
1098 		}
1099 		dr->dt.dl.dr_data = data_old;
1100 	} else {
1101 		mutex_init(&dr->dt.di.dr_mtx, NULL, MUTEX_DEFAULT, NULL);
1102 		list_create(&dr->dt.di.dr_children,
1103 		    sizeof (dbuf_dirty_record_t),
1104 		    offsetof(dbuf_dirty_record_t, dr_dirty_node));
1105 	}
1106 	dr->dr_dbuf = db;
1107 	dr->dr_txg = tx->tx_txg;
1108 	dr->dr_next = *drp;
1109 	*drp = dr;
1110 
1111 	/*
1112 	 * We could have been freed_in_flight between the dbuf_noread
1113 	 * and dbuf_dirty.  We win, as though the dbuf_noread() had
1114 	 * happened after the free.
1115 	 */
1116 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
1117 	    db->db_blkid != DMU_SPILL_BLKID) {
1118 		mutex_enter(&dn->dn_mtx);
1119 		dnode_clear_range(dn, db->db_blkid, 1, tx);
1120 		mutex_exit(&dn->dn_mtx);
1121 		db->db_freed_in_flight = FALSE;
1122 	}
1123 
1124 	/*
1125 	 * This buffer is now part of this txg
1126 	 */
1127 	dbuf_add_ref(db, (void *)(uintptr_t)tx->tx_txg);
1128 	db->db_dirtycnt += 1;
1129 	ASSERT3U(db->db_dirtycnt, <=, 3);
1130 
1131 	mutex_exit(&db->db_mtx);
1132 
1133 	if (db->db_blkid == DMU_BONUS_BLKID ||
1134 	    db->db_blkid == DMU_SPILL_BLKID) {
1135 		mutex_enter(&dn->dn_mtx);
1136 		ASSERT(!list_link_active(&dr->dr_dirty_node));
1137 		list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
1138 		mutex_exit(&dn->dn_mtx);
1139 		dnode_setdirty(dn, tx);
1140 		return (dr);
1141 	} else if (do_free_accounting) {
1142 		blkptr_t *bp = db->db_blkptr;
1143 		int64_t willfree = (bp && !BP_IS_HOLE(bp)) ?
1144 		    bp_get_dsize(os->os_spa, bp) : db->db.db_size;
1145 		/*
1146 		 * This is only a guess -- if the dbuf is dirty
1147 		 * in a previous txg, we don't know how much
1148 		 * space it will use on disk yet.  We should
1149 		 * really have the struct_rwlock to access
1150 		 * db_blkptr, but since this is just a guess,
1151 		 * it's OK if we get an odd answer.
1152 		 */
1153 		ddt_prefetch(os->os_spa, bp);
1154 		dnode_willuse_space(dn, -willfree, tx);
1155 	}
1156 
1157 	if (!RW_WRITE_HELD(&dn->dn_struct_rwlock)) {
1158 		rw_enter(&dn->dn_struct_rwlock, RW_READER);
1159 		drop_struct_lock = TRUE;
1160 	}
1161 
1162 	if (db->db_level == 0) {
1163 		dnode_new_blkid(dn, db->db_blkid, tx, drop_struct_lock);
1164 		ASSERT(dn->dn_maxblkid >= db->db_blkid);
1165 	}
1166 
1167 	if (db->db_level+1 < dn->dn_nlevels) {
1168 		dmu_buf_impl_t *parent = db->db_parent;
1169 		dbuf_dirty_record_t *di;
1170 		int parent_held = FALSE;
1171 
1172 		if (db->db_parent == NULL || db->db_parent == dn->dn_dbuf) {
1173 			int epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
1174 
1175 			parent = dbuf_hold_level(dn, db->db_level+1,
1176 			    db->db_blkid >> epbs, FTAG);
1177 			ASSERT(parent != NULL);
1178 			parent_held = TRUE;
1179 		}
1180 		if (drop_struct_lock)
1181 			rw_exit(&dn->dn_struct_rwlock);
1182 		ASSERT3U(db->db_level+1, ==, parent->db_level);
1183 		di = dbuf_dirty(parent, tx);
1184 		if (parent_held)
1185 			dbuf_rele(parent, FTAG);
1186 
1187 		mutex_enter(&db->db_mtx);
1188 		/*  possible race with dbuf_undirty() */
1189 		if (db->db_last_dirty == dr ||
1190 		    dn->dn_object == DMU_META_DNODE_OBJECT) {
1191 			mutex_enter(&di->dt.di.dr_mtx);
1192 			ASSERT3U(di->dr_txg, ==, tx->tx_txg);
1193 			ASSERT(!list_link_active(&dr->dr_dirty_node));
1194 			list_insert_tail(&di->dt.di.dr_children, dr);
1195 			mutex_exit(&di->dt.di.dr_mtx);
1196 			dr->dr_parent = di;
1197 		}
1198 		mutex_exit(&db->db_mtx);
1199 	} else {
1200 		ASSERT(db->db_level+1 == dn->dn_nlevels);
1201 		ASSERT(db->db_blkid < dn->dn_nblkptr);
1202 		ASSERT(db->db_parent == NULL ||
1203 		    db->db_parent == db->db_dnode->dn_dbuf);
1204 		mutex_enter(&dn->dn_mtx);
1205 		ASSERT(!list_link_active(&dr->dr_dirty_node));
1206 		list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
1207 		mutex_exit(&dn->dn_mtx);
1208 		if (drop_struct_lock)
1209 			rw_exit(&dn->dn_struct_rwlock);
1210 	}
1211 
1212 	dnode_setdirty(dn, tx);
1213 	return (dr);
1214 }
1215 
1216 static int
1217 dbuf_undirty(dmu_buf_impl_t *db, dmu_tx_t *tx)
1218 {
1219 	dnode_t *dn = db->db_dnode;
1220 	uint64_t txg = tx->tx_txg;
1221 	dbuf_dirty_record_t *dr, **drp;
1222 
1223 	ASSERT(txg != 0);
1224 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1225 
1226 	mutex_enter(&db->db_mtx);
1227 	/*
1228 	 * If this buffer is not dirty, we're done.
1229 	 */
1230 	for (drp = &db->db_last_dirty; (dr = *drp) != NULL; drp = &dr->dr_next)
1231 		if (dr->dr_txg <= txg)
1232 			break;
1233 	if (dr == NULL || dr->dr_txg < txg) {
1234 		mutex_exit(&db->db_mtx);
1235 		return (0);
1236 	}
1237 	ASSERT(dr->dr_txg == txg);
1238 	ASSERT(dr->dr_dbuf == db);
1239 
1240 	/*
1241 	 * If this buffer is currently held, we cannot undirty
1242 	 * it, since one of the current holders may be in the
1243 	 * middle of an update.  Note that users of dbuf_undirty()
1244 	 * should not place a hold on the dbuf before the call.
1245 	 */
1246 	if (refcount_count(&db->db_holds) > db->db_dirtycnt) {
1247 		mutex_exit(&db->db_mtx);
1248 		/* Make sure we don't toss this buffer at sync phase */
1249 		mutex_enter(&dn->dn_mtx);
1250 		dnode_clear_range(dn, db->db_blkid, 1, tx);
1251 		mutex_exit(&dn->dn_mtx);
1252 		return (0);
1253 	}
1254 
1255 	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);
1256 
1257 	ASSERT(db->db.db_size != 0);
1258 
1259 	/* XXX would be nice to fix up dn_towrite_space[] */
1260 
1261 	*drp = dr->dr_next;
1262 
1263 	if (dr->dr_parent) {
1264 		mutex_enter(&dr->dr_parent->dt.di.dr_mtx);
1265 		list_remove(&dr->dr_parent->dt.di.dr_children, dr);
1266 		mutex_exit(&dr->dr_parent->dt.di.dr_mtx);
1267 	} else if (db->db_level+1 == dn->dn_nlevels) {
1268 		ASSERT(db->db_blkptr == NULL || db->db_parent == dn->dn_dbuf);
1269 		mutex_enter(&dn->dn_mtx);
1270 		list_remove(&dn->dn_dirty_records[txg & TXG_MASK], dr);
1271 		mutex_exit(&dn->dn_mtx);
1272 	}
1273 
1274 	if (db->db_level == 0) {
1275 		if (db->db_state != DB_NOFILL) {
1276 			dbuf_unoverride(dr);
1277 
1278 			ASSERT(db->db_buf != NULL);
1279 			ASSERT(dr->dt.dl.dr_data != NULL);
1280 			if (dr->dt.dl.dr_data != db->db_buf)
1281 				VERIFY(arc_buf_remove_ref(dr->dt.dl.dr_data,
1282 				    db) == 1);
1283 		}
1284 	} else {
1285 		ASSERT(db->db_buf != NULL);
1286 		ASSERT(list_head(&dr->dt.di.dr_children) == NULL);
1287 		mutex_destroy(&dr->dt.di.dr_mtx);
1288 		list_destroy(&dr->dt.di.dr_children);
1289 	}
1290 	kmem_free(dr, sizeof (dbuf_dirty_record_t));
1291 
1292 	ASSERT(db->db_dirtycnt > 0);
1293 	db->db_dirtycnt -= 1;
1294 
1295 	if (refcount_remove(&db->db_holds, (void *)(uintptr_t)txg) == 0) {
1296 		arc_buf_t *buf = db->db_buf;
1297 
1298 		ASSERT(db->db_state == DB_NOFILL || arc_released(buf));
1299 		dbuf_set_data(db, NULL);
1300 		VERIFY(arc_buf_remove_ref(buf, db) == 1);
1301 		dbuf_evict(db);
1302 		return (1);
1303 	}
1304 
1305 	mutex_exit(&db->db_mtx);
1306 	return (0);
1307 }
1308 
1309 #pragma weak dmu_buf_will_dirty = dbuf_will_dirty
1310 void
1311 dbuf_will_dirty(dmu_buf_impl_t *db, dmu_tx_t *tx)
1312 {
1313 	int rf = DB_RF_MUST_SUCCEED | DB_RF_NOPREFETCH;
1314 
1315 	ASSERT(tx->tx_txg != 0);
1316 	ASSERT(!refcount_is_zero(&db->db_holds));
1317 
1318 	if (RW_WRITE_HELD(&db->db_dnode->dn_struct_rwlock))
1319 		rf |= DB_RF_HAVESTRUCT;
1320 	(void) dbuf_read(db, NULL, rf);
1321 	(void) dbuf_dirty(db, tx);
1322 }
1323 
1324 void
1325 dmu_buf_will_not_fill(dmu_buf_t *db_fake, dmu_tx_t *tx)
1326 {
1327 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1328 
1329 	db->db_state = DB_NOFILL;
1330 
1331 	dmu_buf_will_fill(db_fake, tx);
1332 }
1333 
1334 void
1335 dmu_buf_will_fill(dmu_buf_t *db_fake, dmu_tx_t *tx)
1336 {
1337 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1338 
1339 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1340 	ASSERT(tx->tx_txg != 0);
1341 	ASSERT(db->db_level == 0);
1342 	ASSERT(!refcount_is_zero(&db->db_holds));
1343 
1344 	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT ||
1345 	    dmu_tx_private_ok(tx));
1346 
1347 	dbuf_noread(db);
1348 	(void) dbuf_dirty(db, tx);
1349 }
1350 
1351 #pragma weak dmu_buf_fill_done = dbuf_fill_done
1352 /* ARGSUSED */
1353 void
1354 dbuf_fill_done(dmu_buf_impl_t *db, dmu_tx_t *tx)
1355 {
1356 	mutex_enter(&db->db_mtx);
1357 	DBUF_VERIFY(db);
1358 
1359 	if (db->db_state == DB_FILL) {
1360 		if (db->db_level == 0 && db->db_freed_in_flight) {
1361 			ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1362 			/* we were freed while filling */
1363 			/* XXX dbuf_undirty? */
1364 			bzero(db->db.db_data, db->db.db_size);
1365 			db->db_freed_in_flight = FALSE;
1366 		}
1367 		db->db_state = DB_CACHED;
1368 		cv_broadcast(&db->db_changed);
1369 	}
1370 	mutex_exit(&db->db_mtx);
1371 }
1372 
1373 /*
1374  * Directly assign a provided arc buf to a given dbuf if it's not referenced
1375  * by anybody except our caller. Otherwise copy arcbuf's contents to dbuf.
1376  */
1377 void
1378 dbuf_assign_arcbuf(dmu_buf_impl_t *db, arc_buf_t *buf, dmu_tx_t *tx)
1379 {
1380 	ASSERT(!refcount_is_zero(&db->db_holds));
1381 	ASSERT(db->db_dnode->dn_object != DMU_META_DNODE_OBJECT);
1382 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1383 	ASSERT(db->db_level == 0);
1384 	ASSERT(DBUF_GET_BUFC_TYPE(db) == ARC_BUFC_DATA);
1385 	ASSERT(buf != NULL);
1386 	ASSERT(arc_buf_size(buf) == db->db.db_size);
1387 	ASSERT(tx->tx_txg != 0);
1388 
1389 	arc_return_buf(buf, db);
1390 	ASSERT(arc_released(buf));
1391 
1392 	mutex_enter(&db->db_mtx);
1393 
1394 	while (db->db_state == DB_READ || db->db_state == DB_FILL)
1395 		cv_wait(&db->db_changed, &db->db_mtx);
1396 
1397 	ASSERT(db->db_state == DB_CACHED || db->db_state == DB_UNCACHED);
1398 
1399 	if (db->db_state == DB_CACHED &&
1400 	    refcount_count(&db->db_holds) - 1 > db->db_dirtycnt) {
1401 		mutex_exit(&db->db_mtx);
1402 		(void) dbuf_dirty(db, tx);
1403 		bcopy(buf->b_data, db->db.db_data, db->db.db_size);
1404 		VERIFY(arc_buf_remove_ref(buf, db) == 1);
1405 		xuio_stat_wbuf_copied();
1406 		return;
1407 	}
1408 
1409 	xuio_stat_wbuf_nocopy();
1410 	if (db->db_state == DB_CACHED) {
1411 		dbuf_dirty_record_t *dr = db->db_last_dirty;
1412 
1413 		ASSERT(db->db_buf != NULL);
1414 		if (dr != NULL && dr->dr_txg == tx->tx_txg) {
1415 			ASSERT(dr->dt.dl.dr_data == db->db_buf);
1416 			if (!arc_released(db->db_buf)) {
1417 				ASSERT(dr->dt.dl.dr_override_state ==
1418 				    DR_OVERRIDDEN);
1419 				arc_release(db->db_buf, db);
1420 			}
1421 			dr->dt.dl.dr_data = buf;
1422 			VERIFY(arc_buf_remove_ref(db->db_buf, db) == 1);
1423 		} else if (dr == NULL || dr->dt.dl.dr_data != db->db_buf) {
1424 			arc_release(db->db_buf, db);
1425 			VERIFY(arc_buf_remove_ref(db->db_buf, db) == 1);
1426 		}
1427 		db->db_buf = NULL;
1428 	}
1429 	ASSERT(db->db_buf == NULL);
1430 	dbuf_set_data(db, buf);
1431 	db->db_state = DB_FILL;
1432 	mutex_exit(&db->db_mtx);
1433 	(void) dbuf_dirty(db, tx);
1434 	dbuf_fill_done(db, tx);
1435 }
1436 
1437 /*
1438  * "Clear" the contents of this dbuf.  This will mark the dbuf
1439  * EVICTING and clear *most* of its references.  Unfortunetely,
1440  * when we are not holding the dn_dbufs_mtx, we can't clear the
1441  * entry in the dn_dbufs list.  We have to wait until dbuf_destroy()
1442  * in this case.  For callers from the DMU we will usually see:
1443  *	dbuf_clear()->arc_buf_evict()->dbuf_do_evict()->dbuf_destroy()
1444  * For the arc callback, we will usually see:
1445  * 	dbuf_do_evict()->dbuf_clear();dbuf_destroy()
1446  * Sometimes, though, we will get a mix of these two:
1447  *	DMU: dbuf_clear()->arc_buf_evict()
1448  *	ARC: dbuf_do_evict()->dbuf_destroy()
1449  */
1450 void
1451 dbuf_clear(dmu_buf_impl_t *db)
1452 {
1453 	dnode_t *dn = db->db_dnode;
1454 	dmu_buf_impl_t *parent = db->db_parent;
1455 	dmu_buf_impl_t *dndb = dn->dn_dbuf;
1456 	int dbuf_gone = FALSE;
1457 
1458 	ASSERT(MUTEX_HELD(&db->db_mtx));
1459 	ASSERT(refcount_is_zero(&db->db_holds));
1460 
1461 	dbuf_evict_user(db);
1462 
1463 	if (db->db_state == DB_CACHED) {
1464 		ASSERT(db->db.db_data != NULL);
1465 		if (db->db_blkid == DMU_BONUS_BLKID) {
1466 			zio_buf_free(db->db.db_data, DN_MAX_BONUSLEN);
1467 			arc_space_return(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
1468 		}
1469 		db->db.db_data = NULL;
1470 		db->db_state = DB_UNCACHED;
1471 	}
1472 
1473 	ASSERT(db->db_state == DB_UNCACHED || db->db_state == DB_NOFILL);
1474 	ASSERT(db->db_data_pending == NULL);
1475 
1476 	db->db_state = DB_EVICTING;
1477 	db->db_blkptr = NULL;
1478 
1479 	if (db->db_blkid != DMU_BONUS_BLKID && MUTEX_HELD(&dn->dn_dbufs_mtx)) {
1480 		list_remove(&dn->dn_dbufs, db);
1481 		dnode_rele(dn, db);
1482 		db->db_dnode = NULL;
1483 	}
1484 
1485 	if (db->db_buf)
1486 		dbuf_gone = arc_buf_evict(db->db_buf);
1487 
1488 	if (!dbuf_gone)
1489 		mutex_exit(&db->db_mtx);
1490 
1491 	/*
1492 	 * If this dbuf is referened from an indirect dbuf,
1493 	 * decrement the ref count on the indirect dbuf.
1494 	 */
1495 	if (parent && parent != dndb)
1496 		dbuf_rele(parent, db);
1497 }
1498 
1499 static int
1500 dbuf_findbp(dnode_t *dn, int level, uint64_t blkid, int fail_sparse,
1501     dmu_buf_impl_t **parentp, blkptr_t **bpp)
1502 {
1503 	int nlevels, epbs;
1504 
1505 	*parentp = NULL;
1506 	*bpp = NULL;
1507 
1508 	ASSERT(blkid != DMU_BONUS_BLKID);
1509 
1510 	if (blkid == DMU_SPILL_BLKID) {
1511 		mutex_enter(&dn->dn_mtx);
1512 		if (dn->dn_have_spill &&
1513 		    (dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR))
1514 			*bpp = &dn->dn_phys->dn_spill;
1515 		else
1516 			*bpp = NULL;
1517 		dbuf_add_ref(dn->dn_dbuf, NULL);
1518 		*parentp = dn->dn_dbuf;
1519 		mutex_exit(&dn->dn_mtx);
1520 		return (0);
1521 	}
1522 
1523 	if (dn->dn_phys->dn_nlevels == 0)
1524 		nlevels = 1;
1525 	else
1526 		nlevels = dn->dn_phys->dn_nlevels;
1527 
1528 	epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
1529 
1530 	ASSERT3U(level * epbs, <, 64);
1531 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
1532 	if (level >= nlevels ||
1533 	    (blkid > (dn->dn_phys->dn_maxblkid >> (level * epbs)))) {
1534 		/* the buffer has no parent yet */
1535 		return (ENOENT);
1536 	} else if (level < nlevels-1) {
1537 		/* this block is referenced from an indirect block */
1538 		int err = dbuf_hold_impl(dn, level+1,
1539 		    blkid >> epbs, fail_sparse, NULL, parentp);
1540 		if (err)
1541 			return (err);
1542 		err = dbuf_read(*parentp, NULL,
1543 		    (DB_RF_HAVESTRUCT | DB_RF_NOPREFETCH | DB_RF_CANFAIL));
1544 		if (err) {
1545 			dbuf_rele(*parentp, NULL);
1546 			*parentp = NULL;
1547 			return (err);
1548 		}
1549 		*bpp = ((blkptr_t *)(*parentp)->db.db_data) +
1550 		    (blkid & ((1ULL << epbs) - 1));
1551 		return (0);
1552 	} else {
1553 		/* the block is referenced from the dnode */
1554 		ASSERT3U(level, ==, nlevels-1);
1555 		ASSERT(dn->dn_phys->dn_nblkptr == 0 ||
1556 		    blkid < dn->dn_phys->dn_nblkptr);
1557 		if (dn->dn_dbuf) {
1558 			dbuf_add_ref(dn->dn_dbuf, NULL);
1559 			*parentp = dn->dn_dbuf;
1560 		}
1561 		*bpp = &dn->dn_phys->dn_blkptr[blkid];
1562 		return (0);
1563 	}
1564 }
1565 
1566 static dmu_buf_impl_t *
1567 dbuf_create(dnode_t *dn, uint8_t level, uint64_t blkid,
1568     dmu_buf_impl_t *parent, blkptr_t *blkptr)
1569 {
1570 	objset_t *os = dn->dn_objset;
1571 	dmu_buf_impl_t *db, *odb;
1572 
1573 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
1574 	ASSERT(dn->dn_type != DMU_OT_NONE);
1575 
1576 	db = kmem_cache_alloc(dbuf_cache, KM_SLEEP);
1577 
1578 	db->db_objset = os;
1579 	db->db.db_object = dn->dn_object;
1580 	db->db_level = level;
1581 	db->db_blkid = blkid;
1582 	db->db_last_dirty = NULL;
1583 	db->db_dirtycnt = 0;
1584 	db->db_dnode = dn;
1585 	db->db_parent = parent;
1586 	db->db_blkptr = blkptr;
1587 
1588 	db->db_user_ptr = NULL;
1589 	db->db_user_data_ptr_ptr = NULL;
1590 	db->db_evict_func = NULL;
1591 	db->db_immediate_evict = 0;
1592 	db->db_freed_in_flight = 0;
1593 
1594 	if (blkid == DMU_BONUS_BLKID) {
1595 		ASSERT3P(parent, ==, dn->dn_dbuf);
1596 		db->db.db_size = DN_MAX_BONUSLEN -
1597 		    (dn->dn_nblkptr-1) * sizeof (blkptr_t);
1598 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
1599 		db->db.db_offset = DMU_BONUS_BLKID;
1600 		db->db_state = DB_UNCACHED;
1601 		/* the bonus dbuf is not placed in the hash table */
1602 		arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
1603 		return (db);
1604 	} else if (blkid == DMU_SPILL_BLKID) {
1605 		db->db.db_size = (blkptr != NULL) ?
1606 		    BP_GET_LSIZE(blkptr) : SPA_MINBLOCKSIZE;
1607 		db->db.db_offset = 0;
1608 	} else {
1609 		int blocksize =
1610 		    db->db_level ? 1<<dn->dn_indblkshift :  dn->dn_datablksz;
1611 		db->db.db_size = blocksize;
1612 		db->db.db_offset = db->db_blkid * blocksize;
1613 	}
1614 
1615 	/*
1616 	 * Hold the dn_dbufs_mtx while we get the new dbuf
1617 	 * in the hash table *and* added to the dbufs list.
1618 	 * This prevents a possible deadlock with someone
1619 	 * trying to look up this dbuf before its added to the
1620 	 * dn_dbufs list.
1621 	 */
1622 	mutex_enter(&dn->dn_dbufs_mtx);
1623 	db->db_state = DB_EVICTING;
1624 	if ((odb = dbuf_hash_insert(db)) != NULL) {
1625 		/* someone else inserted it first */
1626 		kmem_cache_free(dbuf_cache, db);
1627 		mutex_exit(&dn->dn_dbufs_mtx);
1628 		return (odb);
1629 	}
1630 	list_insert_head(&dn->dn_dbufs, db);
1631 	db->db_state = DB_UNCACHED;
1632 	mutex_exit(&dn->dn_dbufs_mtx);
1633 	arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
1634 
1635 	if (parent && parent != dn->dn_dbuf)
1636 		dbuf_add_ref(parent, db);
1637 
1638 	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT ||
1639 	    refcount_count(&dn->dn_holds) > 0);
1640 	(void) refcount_add(&dn->dn_holds, db);
1641 
1642 	dprintf_dbuf(db, "db=%p\n", db);
1643 
1644 	return (db);
1645 }
1646 
1647 static int
1648 dbuf_do_evict(void *private)
1649 {
1650 	arc_buf_t *buf = private;
1651 	dmu_buf_impl_t *db = buf->b_private;
1652 
1653 	if (!MUTEX_HELD(&db->db_mtx))
1654 		mutex_enter(&db->db_mtx);
1655 
1656 	ASSERT(refcount_is_zero(&db->db_holds));
1657 
1658 	if (db->db_state != DB_EVICTING) {
1659 		ASSERT(db->db_state == DB_CACHED);
1660 		DBUF_VERIFY(db);
1661 		db->db_buf = NULL;
1662 		dbuf_evict(db);
1663 	} else {
1664 		mutex_exit(&db->db_mtx);
1665 		dbuf_destroy(db);
1666 	}
1667 	return (0);
1668 }
1669 
1670 static void
1671 dbuf_destroy(dmu_buf_impl_t *db)
1672 {
1673 	ASSERT(refcount_is_zero(&db->db_holds));
1674 
1675 	if (db->db_blkid != DMU_BONUS_BLKID) {
1676 		/*
1677 		 * If this dbuf is still on the dn_dbufs list,
1678 		 * remove it from that list.
1679 		 */
1680 		if (db->db_dnode) {
1681 			dnode_t *dn = db->db_dnode;
1682 
1683 			mutex_enter(&dn->dn_dbufs_mtx);
1684 			list_remove(&dn->dn_dbufs, db);
1685 			mutex_exit(&dn->dn_dbufs_mtx);
1686 
1687 			dnode_rele(dn, db);
1688 			db->db_dnode = NULL;
1689 		}
1690 		dbuf_hash_remove(db);
1691 	}
1692 	db->db_parent = NULL;
1693 	db->db_buf = NULL;
1694 
1695 	ASSERT(!list_link_active(&db->db_link));
1696 	ASSERT(db->db.db_data == NULL);
1697 	ASSERT(db->db_hash_next == NULL);
1698 	ASSERT(db->db_blkptr == NULL);
1699 	ASSERT(db->db_data_pending == NULL);
1700 
1701 	kmem_cache_free(dbuf_cache, db);
1702 	arc_space_return(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
1703 }
1704 
1705 void
1706 dbuf_prefetch(dnode_t *dn, uint64_t blkid)
1707 {
1708 	dmu_buf_impl_t *db = NULL;
1709 	blkptr_t *bp = NULL;
1710 
1711 	ASSERT(blkid != DMU_BONUS_BLKID);
1712 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
1713 
1714 	if (dnode_block_freed(dn, blkid))
1715 		return;
1716 
1717 	/* dbuf_find() returns with db_mtx held */
1718 	if (db = dbuf_find(dn, 0, blkid)) {
1719 		if (refcount_count(&db->db_holds) > 0) {
1720 			/*
1721 			 * This dbuf is active.  We assume that it is
1722 			 * already CACHED, or else about to be either
1723 			 * read or filled.
1724 			 */
1725 			mutex_exit(&db->db_mtx);
1726 			return;
1727 		}
1728 		mutex_exit(&db->db_mtx);
1729 		db = NULL;
1730 	}
1731 
1732 	if (dbuf_findbp(dn, 0, blkid, TRUE, &db, &bp) == 0) {
1733 		if (bp && !BP_IS_HOLE(bp)) {
1734 			int priority = dn->dn_type == DMU_OT_DDT_ZAP ?
1735 			    ZIO_PRIORITY_DDT_PREFETCH : ZIO_PRIORITY_ASYNC_READ;
1736 			arc_buf_t *pbuf;
1737 			dsl_dataset_t *ds = dn->dn_objset->os_dsl_dataset;
1738 			uint32_t aflags = ARC_NOWAIT | ARC_PREFETCH;
1739 			zbookmark_t zb;
1740 
1741 			SET_BOOKMARK(&zb, ds ? ds->ds_object : DMU_META_OBJSET,
1742 			    dn->dn_object, 0, blkid);
1743 
1744 			if (db)
1745 				pbuf = db->db_buf;
1746 			else
1747 				pbuf = dn->dn_objset->os_phys_buf;
1748 
1749 			(void) dsl_read(NULL, dn->dn_objset->os_spa,
1750 			    bp, pbuf, NULL, NULL, priority,
1751 			    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
1752 			    &aflags, &zb);
1753 		}
1754 		if (db)
1755 			dbuf_rele(db, NULL);
1756 	}
1757 }
1758 
1759 /*
1760  * Returns with db_holds incremented, and db_mtx not held.
1761  * Note: dn_struct_rwlock must be held.
1762  */
1763 int
1764 dbuf_hold_impl(dnode_t *dn, uint8_t level, uint64_t blkid, int fail_sparse,
1765     void *tag, dmu_buf_impl_t **dbp)
1766 {
1767 	dmu_buf_impl_t *db, *parent = NULL;
1768 
1769 	ASSERT(blkid != DMU_BONUS_BLKID);
1770 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
1771 	ASSERT3U(dn->dn_nlevels, >, level);
1772 
1773 	*dbp = NULL;
1774 top:
1775 	/* dbuf_find() returns with db_mtx held */
1776 	db = dbuf_find(dn, level, blkid);
1777 
1778 	if (db == NULL) {
1779 		blkptr_t *bp = NULL;
1780 		int err;
1781 
1782 		ASSERT3P(parent, ==, NULL);
1783 		err = dbuf_findbp(dn, level, blkid, fail_sparse, &parent, &bp);
1784 		if (fail_sparse) {
1785 			if (err == 0 && bp && BP_IS_HOLE(bp))
1786 				err = ENOENT;
1787 			if (err) {
1788 				if (parent)
1789 					dbuf_rele(parent, NULL);
1790 				return (err);
1791 			}
1792 		}
1793 		if (err && err != ENOENT)
1794 			return (err);
1795 		db = dbuf_create(dn, level, blkid, parent, bp);
1796 	}
1797 
1798 	if (db->db_buf && refcount_is_zero(&db->db_holds)) {
1799 		arc_buf_add_ref(db->db_buf, db);
1800 		if (db->db_buf->b_data == NULL) {
1801 			dbuf_clear(db);
1802 			if (parent) {
1803 				dbuf_rele(parent, NULL);
1804 				parent = NULL;
1805 			}
1806 			goto top;
1807 		}
1808 		ASSERT3P(db->db.db_data, ==, db->db_buf->b_data);
1809 	}
1810 
1811 	ASSERT(db->db_buf == NULL || arc_referenced(db->db_buf));
1812 
1813 	/*
1814 	 * If this buffer is currently syncing out, and we are are
1815 	 * still referencing it from db_data, we need to make a copy
1816 	 * of it in case we decide we want to dirty it again in this txg.
1817 	 */
1818 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
1819 	    dn->dn_object != DMU_META_DNODE_OBJECT &&
1820 	    db->db_state == DB_CACHED && db->db_data_pending) {
1821 		dbuf_dirty_record_t *dr = db->db_data_pending;
1822 
1823 		if (dr->dt.dl.dr_data == db->db_buf) {
1824 			arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
1825 
1826 			dbuf_set_data(db,
1827 			    arc_buf_alloc(db->db_dnode->dn_objset->os_spa,
1828 			    db->db.db_size, db, type));
1829 			bcopy(dr->dt.dl.dr_data->b_data, db->db.db_data,
1830 			    db->db.db_size);
1831 		}
1832 	}
1833 
1834 	(void) refcount_add(&db->db_holds, tag);
1835 	dbuf_update_data(db);
1836 	DBUF_VERIFY(db);
1837 	mutex_exit(&db->db_mtx);
1838 
1839 	/* NOTE: we can't rele the parent until after we drop the db_mtx */
1840 	if (parent)
1841 		dbuf_rele(parent, NULL);
1842 
1843 	ASSERT3P(db->db_dnode, ==, dn);
1844 	ASSERT3U(db->db_blkid, ==, blkid);
1845 	ASSERT3U(db->db_level, ==, level);
1846 	*dbp = db;
1847 
1848 	return (0);
1849 }
1850 
1851 dmu_buf_impl_t *
1852 dbuf_hold(dnode_t *dn, uint64_t blkid, void *tag)
1853 {
1854 	dmu_buf_impl_t *db;
1855 	int err = dbuf_hold_impl(dn, 0, blkid, FALSE, tag, &db);
1856 	return (err ? NULL : db);
1857 }
1858 
1859 dmu_buf_impl_t *
1860 dbuf_hold_level(dnode_t *dn, int level, uint64_t blkid, void *tag)
1861 {
1862 	dmu_buf_impl_t *db;
1863 	int err = dbuf_hold_impl(dn, level, blkid, FALSE, tag, &db);
1864 	return (err ? NULL : db);
1865 }
1866 
1867 void
1868 dbuf_create_bonus(dnode_t *dn)
1869 {
1870 	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));
1871 
1872 	ASSERT(dn->dn_bonus == NULL);
1873 	dn->dn_bonus = dbuf_create(dn, 0, DMU_BONUS_BLKID, dn->dn_dbuf, NULL);
1874 }
1875 
1876 int
1877 dbuf_spill_set_blksz(dmu_buf_t *db_fake, uint64_t blksz, dmu_tx_t *tx)
1878 {
1879 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1880 	if (db->db_blkid != DMU_SPILL_BLKID)
1881 		return (ENOTSUP);
1882 	if (blksz == 0)
1883 		blksz = SPA_MINBLOCKSIZE;
1884 	if (blksz > SPA_MAXBLOCKSIZE)
1885 		blksz = SPA_MAXBLOCKSIZE;
1886 	else
1887 		blksz = P2ROUNDUP(blksz, SPA_MINBLOCKSIZE);
1888 
1889 	rw_enter(&db->db_dnode->dn_struct_rwlock, RW_WRITER);
1890 	dbuf_new_size(db, blksz, tx);
1891 	rw_exit(&db->db_dnode->dn_struct_rwlock);
1892 
1893 	return (0);
1894 }
1895 
1896 void
1897 dbuf_rm_spill(dnode_t *dn, dmu_tx_t *tx)
1898 {
1899 	dbuf_free_range(dn, DMU_SPILL_BLKID, DMU_SPILL_BLKID, tx);
1900 }
1901 
1902 #pragma weak dmu_buf_add_ref = dbuf_add_ref
1903 void
1904 dbuf_add_ref(dmu_buf_impl_t *db, void *tag)
1905 {
1906 	int64_t holds = refcount_add(&db->db_holds, tag);
1907 	ASSERT(holds > 1);
1908 }
1909 
1910 #pragma weak dmu_buf_rele = dbuf_rele
1911 void
1912 dbuf_rele(dmu_buf_impl_t *db, void *tag)
1913 {
1914 	mutex_enter(&db->db_mtx);
1915 	dbuf_rele_and_unlock(db, tag);
1916 }
1917 
1918 /*
1919  * dbuf_rele() for an already-locked dbuf.  This is necessary to allow
1920  * db_dirtycnt and db_holds to be updated atomically.
1921  */
1922 void
1923 dbuf_rele_and_unlock(dmu_buf_impl_t *db, void *tag)
1924 {
1925 	int64_t holds;
1926 
1927 	ASSERT(MUTEX_HELD(&db->db_mtx));
1928 	DBUF_VERIFY(db);
1929 
1930 	holds = refcount_remove(&db->db_holds, tag);
1931 	ASSERT(holds >= 0);
1932 
1933 	/*
1934 	 * We can't freeze indirects if there is a possibility that they
1935 	 * may be modified in the current syncing context.
1936 	 */
1937 	if (db->db_buf && holds == (db->db_level == 0 ? db->db_dirtycnt : 0))
1938 		arc_buf_freeze(db->db_buf);
1939 
1940 	if (holds == db->db_dirtycnt &&
1941 	    db->db_level == 0 && db->db_immediate_evict)
1942 		dbuf_evict_user(db);
1943 
1944 	if (holds == 0) {
1945 		if (db->db_blkid == DMU_BONUS_BLKID) {
1946 			mutex_exit(&db->db_mtx);
1947 			dnode_rele(db->db_dnode, db);
1948 		} else if (db->db_buf == NULL) {
1949 			/*
1950 			 * This is a special case: we never associated this
1951 			 * dbuf with any data allocated from the ARC.
1952 			 */
1953 			ASSERT(db->db_state == DB_UNCACHED ||
1954 			    db->db_state == DB_NOFILL);
1955 			dbuf_evict(db);
1956 		} else if (arc_released(db->db_buf)) {
1957 			arc_buf_t *buf = db->db_buf;
1958 			/*
1959 			 * This dbuf has anonymous data associated with it.
1960 			 */
1961 			dbuf_set_data(db, NULL);
1962 			VERIFY(arc_buf_remove_ref(buf, db) == 1);
1963 			dbuf_evict(db);
1964 		} else {
1965 			VERIFY(arc_buf_remove_ref(db->db_buf, db) == 0);
1966 			if (!DBUF_IS_CACHEABLE(db))
1967 				dbuf_clear(db);
1968 			else
1969 				mutex_exit(&db->db_mtx);
1970 		}
1971 	} else {
1972 		mutex_exit(&db->db_mtx);
1973 	}
1974 }
1975 
1976 #pragma weak dmu_buf_refcount = dbuf_refcount
1977 uint64_t
1978 dbuf_refcount(dmu_buf_impl_t *db)
1979 {
1980 	return (refcount_count(&db->db_holds));
1981 }
1982 
1983 void *
1984 dmu_buf_set_user(dmu_buf_t *db_fake, void *user_ptr, void *user_data_ptr_ptr,
1985     dmu_buf_evict_func_t *evict_func)
1986 {
1987 	return (dmu_buf_update_user(db_fake, NULL, user_ptr,
1988 	    user_data_ptr_ptr, evict_func));
1989 }
1990 
1991 void *
1992 dmu_buf_set_user_ie(dmu_buf_t *db_fake, void *user_ptr, void *user_data_ptr_ptr,
1993     dmu_buf_evict_func_t *evict_func)
1994 {
1995 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1996 
1997 	db->db_immediate_evict = TRUE;
1998 	return (dmu_buf_update_user(db_fake, NULL, user_ptr,
1999 	    user_data_ptr_ptr, evict_func));
2000 }
2001 
2002 void *
2003 dmu_buf_update_user(dmu_buf_t *db_fake, void *old_user_ptr, void *user_ptr,
2004     void *user_data_ptr_ptr, dmu_buf_evict_func_t *evict_func)
2005 {
2006 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2007 	ASSERT(db->db_level == 0);
2008 
2009 	ASSERT((user_ptr == NULL) == (evict_func == NULL));
2010 
2011 	mutex_enter(&db->db_mtx);
2012 
2013 	if (db->db_user_ptr == old_user_ptr) {
2014 		db->db_user_ptr = user_ptr;
2015 		db->db_user_data_ptr_ptr = user_data_ptr_ptr;
2016 		db->db_evict_func = evict_func;
2017 
2018 		dbuf_update_data(db);
2019 	} else {
2020 		old_user_ptr = db->db_user_ptr;
2021 	}
2022 
2023 	mutex_exit(&db->db_mtx);
2024 	return (old_user_ptr);
2025 }
2026 
2027 void *
2028 dmu_buf_get_user(dmu_buf_t *db_fake)
2029 {
2030 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2031 	ASSERT(!refcount_is_zero(&db->db_holds));
2032 
2033 	return (db->db_user_ptr);
2034 }
2035 
2036 boolean_t
2037 dmu_buf_freeable(dmu_buf_t *dbuf)
2038 {
2039 	boolean_t res = B_FALSE;
2040 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)dbuf;
2041 
2042 	if (db->db_blkptr)
2043 		res = dsl_dataset_block_freeable(db->db_objset->os_dsl_dataset,
2044 		    db->db_blkptr, db->db_blkptr->blk_birth);
2045 
2046 	return (res);
2047 }
2048 
2049 static void
2050 dbuf_check_blkptr(dnode_t *dn, dmu_buf_impl_t *db)
2051 {
2052 	/* ASSERT(dmu_tx_is_syncing(tx) */
2053 	ASSERT(MUTEX_HELD(&db->db_mtx));
2054 
2055 	if (db->db_blkptr != NULL)
2056 		return;
2057 
2058 	if (db->db_blkid == DMU_SPILL_BLKID) {
2059 		db->db_blkptr = &dn->dn_phys->dn_spill;
2060 		BP_ZERO(db->db_blkptr);
2061 		return;
2062 	}
2063 	if (db->db_level == dn->dn_phys->dn_nlevels-1) {
2064 		/*
2065 		 * This buffer was allocated at a time when there was
2066 		 * no available blkptrs from the dnode, or it was
2067 		 * inappropriate to hook it in (i.e., nlevels mis-match).
2068 		 */
2069 		ASSERT(db->db_blkid < dn->dn_phys->dn_nblkptr);
2070 		ASSERT(db->db_parent == NULL);
2071 		db->db_parent = dn->dn_dbuf;
2072 		db->db_blkptr = &dn->dn_phys->dn_blkptr[db->db_blkid];
2073 		DBUF_VERIFY(db);
2074 	} else {
2075 		dmu_buf_impl_t *parent = db->db_parent;
2076 		int epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
2077 
2078 		ASSERT(dn->dn_phys->dn_nlevels > 1);
2079 		if (parent == NULL) {
2080 			mutex_exit(&db->db_mtx);
2081 			rw_enter(&dn->dn_struct_rwlock, RW_READER);
2082 			(void) dbuf_hold_impl(dn, db->db_level+1,
2083 			    db->db_blkid >> epbs, FALSE, db, &parent);
2084 			rw_exit(&dn->dn_struct_rwlock);
2085 			mutex_enter(&db->db_mtx);
2086 			db->db_parent = parent;
2087 		}
2088 		db->db_blkptr = (blkptr_t *)parent->db.db_data +
2089 		    (db->db_blkid & ((1ULL << epbs) - 1));
2090 		DBUF_VERIFY(db);
2091 	}
2092 }
2093 
2094 static void
2095 dbuf_sync_indirect(dbuf_dirty_record_t *dr, dmu_tx_t *tx)
2096 {
2097 	dmu_buf_impl_t *db = dr->dr_dbuf;
2098 	dnode_t *dn = db->db_dnode;
2099 	zio_t *zio;
2100 
2101 	ASSERT(dmu_tx_is_syncing(tx));
2102 
2103 	dprintf_dbuf_bp(db, db->db_blkptr, "blkptr=%p", db->db_blkptr);
2104 
2105 	mutex_enter(&db->db_mtx);
2106 
2107 	ASSERT(db->db_level > 0);
2108 	DBUF_VERIFY(db);
2109 
2110 	if (db->db_buf == NULL) {
2111 		mutex_exit(&db->db_mtx);
2112 		(void) dbuf_read(db, NULL, DB_RF_MUST_SUCCEED);
2113 		mutex_enter(&db->db_mtx);
2114 	}
2115 	ASSERT3U(db->db_state, ==, DB_CACHED);
2116 	ASSERT3U(db->db.db_size, ==, 1<<dn->dn_phys->dn_indblkshift);
2117 	ASSERT(db->db_buf != NULL);
2118 
2119 	dbuf_check_blkptr(dn, db);
2120 
2121 	db->db_data_pending = dr;
2122 
2123 	mutex_exit(&db->db_mtx);
2124 	dbuf_write(dr, db->db_buf, tx);
2125 
2126 	zio = dr->dr_zio;
2127 	mutex_enter(&dr->dt.di.dr_mtx);
2128 	dbuf_sync_list(&dr->dt.di.dr_children, tx);
2129 	ASSERT(list_head(&dr->dt.di.dr_children) == NULL);
2130 	mutex_exit(&dr->dt.di.dr_mtx);
2131 	zio_nowait(zio);
2132 }
2133 
2134 static void
2135 dbuf_sync_leaf(dbuf_dirty_record_t *dr, dmu_tx_t *tx)
2136 {
2137 	arc_buf_t **datap = &dr->dt.dl.dr_data;
2138 	dmu_buf_impl_t *db = dr->dr_dbuf;
2139 	dnode_t *dn = db->db_dnode;
2140 	objset_t *os = dn->dn_objset;
2141 	uint64_t txg = tx->tx_txg;
2142 
2143 	ASSERT(dmu_tx_is_syncing(tx));
2144 
2145 	dprintf_dbuf_bp(db, db->db_blkptr, "blkptr=%p", db->db_blkptr);
2146 
2147 	mutex_enter(&db->db_mtx);
2148 	/*
2149 	 * To be synced, we must be dirtied.  But we
2150 	 * might have been freed after the dirty.
2151 	 */
2152 	if (db->db_state == DB_UNCACHED) {
2153 		/* This buffer has been freed since it was dirtied */
2154 		ASSERT(db->db.db_data == NULL);
2155 	} else if (db->db_state == DB_FILL) {
2156 		/* This buffer was freed and is now being re-filled */
2157 		ASSERT(db->db.db_data != dr->dt.dl.dr_data);
2158 	} else {
2159 		ASSERT(db->db_state == DB_CACHED || db->db_state == DB_NOFILL);
2160 	}
2161 	DBUF_VERIFY(db);
2162 
2163 	if (db->db_blkid == DMU_SPILL_BLKID) {
2164 		mutex_enter(&dn->dn_mtx);
2165 		dn->dn_phys->dn_flags |= DNODE_FLAG_SPILL_BLKPTR;
2166 		mutex_exit(&dn->dn_mtx);
2167 	}
2168 
2169 	/*
2170 	 * If this is a bonus buffer, simply copy the bonus data into the
2171 	 * dnode.  It will be written out when the dnode is synced (and it
2172 	 * will be synced, since it must have been dirty for dbuf_sync to
2173 	 * be called).
2174 	 */
2175 	if (db->db_blkid == DMU_BONUS_BLKID) {
2176 		dbuf_dirty_record_t **drp;
2177 
2178 		ASSERT(*datap != NULL);
2179 		ASSERT3U(db->db_level, ==, 0);
2180 		ASSERT3U(dn->dn_phys->dn_bonuslen, <=, DN_MAX_BONUSLEN);
2181 		bcopy(*datap, DN_BONUS(dn->dn_phys), dn->dn_phys->dn_bonuslen);
2182 		if (*datap != db->db.db_data) {
2183 			zio_buf_free(*datap, DN_MAX_BONUSLEN);
2184 			arc_space_return(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
2185 		}
2186 		db->db_data_pending = NULL;
2187 		drp = &db->db_last_dirty;
2188 		while (*drp != dr)
2189 			drp = &(*drp)->dr_next;
2190 		ASSERT(dr->dr_next == NULL);
2191 		ASSERT(dr->dr_dbuf == db);
2192 		*drp = dr->dr_next;
2193 		kmem_free(dr, sizeof (dbuf_dirty_record_t));
2194 		ASSERT(db->db_dirtycnt > 0);
2195 		db->db_dirtycnt -= 1;
2196 		dbuf_rele_and_unlock(db, (void *)(uintptr_t)txg);
2197 		return;
2198 	}
2199 
2200 	/*
2201 	 * This function may have dropped the db_mtx lock allowing a dmu_sync
2202 	 * operation to sneak in. As a result, we need to ensure that we
2203 	 * don't check the dr_override_state until we have returned from
2204 	 * dbuf_check_blkptr.
2205 	 */
2206 	dbuf_check_blkptr(dn, db);
2207 
2208 	/*
2209 	 * If this buffer is in the middle of an immdiate write,
2210 	 * wait for the synchronous IO to complete.
2211 	 */
2212 	while (dr->dt.dl.dr_override_state == DR_IN_DMU_SYNC) {
2213 		ASSERT(dn->dn_object != DMU_META_DNODE_OBJECT);
2214 		cv_wait(&db->db_changed, &db->db_mtx);
2215 		ASSERT(dr->dt.dl.dr_override_state != DR_NOT_OVERRIDDEN);
2216 	}
2217 
2218 	if (db->db_state != DB_NOFILL &&
2219 	    dn->dn_object != DMU_META_DNODE_OBJECT &&
2220 	    refcount_count(&db->db_holds) > 1 &&
2221 	    dr->dt.dl.dr_override_state != DR_OVERRIDDEN &&
2222 	    *datap == db->db_buf) {
2223 		/*
2224 		 * If this buffer is currently "in use" (i.e., there
2225 		 * are active holds and db_data still references it),
2226 		 * then make a copy before we start the write so that
2227 		 * any modifications from the open txg will not leak
2228 		 * into this write.
2229 		 *
2230 		 * NOTE: this copy does not need to be made for
2231 		 * objects only modified in the syncing context (e.g.
2232 		 * DNONE_DNODE blocks).
2233 		 */
2234 		int blksz = arc_buf_size(*datap);
2235 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
2236 		*datap = arc_buf_alloc(os->os_spa, blksz, db, type);
2237 		bcopy(db->db.db_data, (*datap)->b_data, blksz);
2238 	}
2239 	db->db_data_pending = dr;
2240 
2241 	mutex_exit(&db->db_mtx);
2242 
2243 	dbuf_write(dr, *datap, tx);
2244 
2245 	ASSERT(!list_link_active(&dr->dr_dirty_node));
2246 	if (dn->dn_object == DMU_META_DNODE_OBJECT)
2247 		list_insert_tail(&dn->dn_dirty_records[txg&TXG_MASK], dr);
2248 	else
2249 		zio_nowait(dr->dr_zio);
2250 }
2251 
2252 void
2253 dbuf_sync_list(list_t *list, dmu_tx_t *tx)
2254 {
2255 	dbuf_dirty_record_t *dr;
2256 
2257 	while (dr = list_head(list)) {
2258 		if (dr->dr_zio != NULL) {
2259 			/*
2260 			 * If we find an already initialized zio then we
2261 			 * are processing the meta-dnode, and we have finished.
2262 			 * The dbufs for all dnodes are put back on the list
2263 			 * during processing, so that we can zio_wait()
2264 			 * these IOs after initiating all child IOs.
2265 			 */
2266 			ASSERT3U(dr->dr_dbuf->db.db_object, ==,
2267 			    DMU_META_DNODE_OBJECT);
2268 			break;
2269 		}
2270 		list_remove(list, dr);
2271 		if (dr->dr_dbuf->db_level > 0)
2272 			dbuf_sync_indirect(dr, tx);
2273 		else
2274 			dbuf_sync_leaf(dr, tx);
2275 	}
2276 }
2277 
2278 /* ARGSUSED */
2279 static void
2280 dbuf_write_ready(zio_t *zio, arc_buf_t *buf, void *vdb)
2281 {
2282 	dmu_buf_impl_t *db = vdb;
2283 	blkptr_t *bp = zio->io_bp;
2284 	blkptr_t *bp_orig = &zio->io_bp_orig;
2285 	dnode_t *dn = db->db_dnode;
2286 	spa_t *spa = zio->io_spa;
2287 	int64_t delta;
2288 	uint64_t fill = 0;
2289 	int i;
2290 
2291 	ASSERT(db->db_blkptr == bp);
2292 
2293 	delta = bp_get_dsize_sync(spa, bp) - bp_get_dsize_sync(spa, bp_orig);
2294 	dnode_diduse_space(dn, delta - zio->io_prev_space_delta);
2295 	zio->io_prev_space_delta = delta;
2296 
2297 	if (BP_IS_HOLE(bp)) {
2298 		ASSERT(bp->blk_fill == 0);
2299 		return;
2300 	}
2301 
2302 	ASSERT((db->db_blkid != DMU_SPILL_BLKID &&
2303 	    BP_GET_TYPE(bp) == dn->dn_type) ||
2304 	    (db->db_blkid == DMU_SPILL_BLKID &&
2305 	    BP_GET_TYPE(bp) == dn->dn_bonustype));
2306 	ASSERT(BP_GET_LEVEL(bp) == db->db_level);
2307 
2308 	mutex_enter(&db->db_mtx);
2309 
2310 #ifdef ZFS_DEBUG
2311 	if (db->db_blkid == DMU_SPILL_BLKID) {
2312 		dnode_t *dn = db->db_dnode;
2313 		ASSERT(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR);
2314 		ASSERT(!(BP_IS_HOLE(db->db_blkptr)) &&
2315 		    db->db_blkptr == &dn->dn_phys->dn_spill);
2316 	}
2317 #endif
2318 
2319 	if (db->db_level == 0) {
2320 		mutex_enter(&dn->dn_mtx);
2321 		if (db->db_blkid > dn->dn_phys->dn_maxblkid &&
2322 		    db->db_blkid != DMU_SPILL_BLKID)
2323 			dn->dn_phys->dn_maxblkid = db->db_blkid;
2324 		mutex_exit(&dn->dn_mtx);
2325 
2326 		if (dn->dn_type == DMU_OT_DNODE) {
2327 			dnode_phys_t *dnp = db->db.db_data;
2328 			for (i = db->db.db_size >> DNODE_SHIFT; i > 0;
2329 			    i--, dnp++) {
2330 				if (dnp->dn_type != DMU_OT_NONE)
2331 					fill++;
2332 			}
2333 		} else {
2334 			fill = 1;
2335 		}
2336 	} else {
2337 		blkptr_t *ibp = db->db.db_data;
2338 		ASSERT3U(db->db.db_size, ==, 1<<dn->dn_phys->dn_indblkshift);
2339 		for (i = db->db.db_size >> SPA_BLKPTRSHIFT; i > 0; i--, ibp++) {
2340 			if (BP_IS_HOLE(ibp))
2341 				continue;
2342 			fill += ibp->blk_fill;
2343 		}
2344 	}
2345 
2346 	bp->blk_fill = fill;
2347 
2348 	mutex_exit(&db->db_mtx);
2349 }
2350 
2351 /* ARGSUSED */
2352 static void
2353 dbuf_write_done(zio_t *zio, arc_buf_t *buf, void *vdb)
2354 {
2355 	dmu_buf_impl_t *db = vdb;
2356 	blkptr_t *bp = zio->io_bp;
2357 	blkptr_t *bp_orig = &zio->io_bp_orig;
2358 	dnode_t *dn = db->db_dnode;
2359 	objset_t *os = dn->dn_objset;
2360 	uint64_t txg = zio->io_txg;
2361 	dbuf_dirty_record_t **drp, *dr;
2362 
2363 	ASSERT3U(zio->io_error, ==, 0);
2364 	ASSERT(db->db_blkptr == bp);
2365 
2366 	if (zio->io_flags & ZIO_FLAG_IO_REWRITE) {
2367 		ASSERT(BP_EQUAL(bp, bp_orig));
2368 	} else {
2369 		dsl_dataset_t *ds = os->os_dsl_dataset;
2370 		dmu_tx_t *tx = os->os_synctx;
2371 
2372 		(void) dsl_dataset_block_kill(ds, bp_orig, tx, B_TRUE);
2373 		dsl_dataset_block_born(ds, bp, tx);
2374 	}
2375 
2376 	mutex_enter(&db->db_mtx);
2377 
2378 	DBUF_VERIFY(db);
2379 
2380 	drp = &db->db_last_dirty;
2381 	while ((dr = *drp) != db->db_data_pending)
2382 		drp = &dr->dr_next;
2383 	ASSERT(!list_link_active(&dr->dr_dirty_node));
2384 	ASSERT(dr->dr_txg == txg);
2385 	ASSERT(dr->dr_dbuf == db);
2386 	ASSERT(dr->dr_next == NULL);
2387 	*drp = dr->dr_next;
2388 
2389 #ifdef ZFS_DEBUG
2390 	if (db->db_blkid == DMU_SPILL_BLKID) {
2391 		dnode_t *dn = db->db_dnode;
2392 		ASSERT(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR);
2393 		ASSERT(!(BP_IS_HOLE(db->db_blkptr)) &&
2394 		    db->db_blkptr == &dn->dn_phys->dn_spill);
2395 	}
2396 #endif
2397 
2398 	if (db->db_level == 0) {
2399 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
2400 		ASSERT(dr->dt.dl.dr_override_state == DR_NOT_OVERRIDDEN);
2401 		if (db->db_state != DB_NOFILL) {
2402 			if (dr->dt.dl.dr_data != db->db_buf)
2403 				VERIFY(arc_buf_remove_ref(dr->dt.dl.dr_data,
2404 				    db) == 1);
2405 			else if (!arc_released(db->db_buf))
2406 				arc_set_callback(db->db_buf, dbuf_do_evict, db);
2407 		}
2408 	} else {
2409 		ASSERT(list_head(&dr->dt.di.dr_children) == NULL);
2410 		ASSERT3U(db->db.db_size, ==, 1<<dn->dn_phys->dn_indblkshift);
2411 		if (!BP_IS_HOLE(db->db_blkptr)) {
2412 			int epbs =
2413 			    dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
2414 			ASSERT3U(BP_GET_LSIZE(db->db_blkptr), ==,
2415 			    db->db.db_size);
2416 			ASSERT3U(dn->dn_phys->dn_maxblkid
2417 			    >> (db->db_level * epbs), >=, db->db_blkid);
2418 			arc_set_callback(db->db_buf, dbuf_do_evict, db);
2419 		}
2420 		mutex_destroy(&dr->dt.di.dr_mtx);
2421 		list_destroy(&dr->dt.di.dr_children);
2422 	}
2423 	kmem_free(dr, sizeof (dbuf_dirty_record_t));
2424 
2425 	cv_broadcast(&db->db_changed);
2426 	ASSERT(db->db_dirtycnt > 0);
2427 	db->db_dirtycnt -= 1;
2428 	db->db_data_pending = NULL;
2429 	dbuf_rele_and_unlock(db, (void *)(uintptr_t)txg);
2430 }
2431 
2432 static void
2433 dbuf_write_nofill_ready(zio_t *zio)
2434 {
2435 	dbuf_write_ready(zio, NULL, zio->io_private);
2436 }
2437 
2438 static void
2439 dbuf_write_nofill_done(zio_t *zio)
2440 {
2441 	dbuf_write_done(zio, NULL, zio->io_private);
2442 }
2443 
2444 static void
2445 dbuf_write_override_ready(zio_t *zio)
2446 {
2447 	dbuf_dirty_record_t *dr = zio->io_private;
2448 	dmu_buf_impl_t *db = dr->dr_dbuf;
2449 
2450 	dbuf_write_ready(zio, NULL, db);
2451 }
2452 
2453 static void
2454 dbuf_write_override_done(zio_t *zio)
2455 {
2456 	dbuf_dirty_record_t *dr = zio->io_private;
2457 	dmu_buf_impl_t *db = dr->dr_dbuf;
2458 	blkptr_t *obp = &dr->dt.dl.dr_overridden_by;
2459 
2460 	mutex_enter(&db->db_mtx);
2461 	if (!BP_EQUAL(zio->io_bp, obp)) {
2462 		if (!BP_IS_HOLE(obp))
2463 			dsl_free(spa_get_dsl(zio->io_spa), zio->io_txg, obp);
2464 		arc_release(dr->dt.dl.dr_data, db);
2465 	}
2466 	mutex_exit(&db->db_mtx);
2467 
2468 	dbuf_write_done(zio, NULL, db);
2469 }
2470 
2471 static void
2472 dbuf_write(dbuf_dirty_record_t *dr, arc_buf_t *data, dmu_tx_t *tx)
2473 {
2474 	dmu_buf_impl_t *db = dr->dr_dbuf;
2475 	dnode_t *dn = db->db_dnode;
2476 	objset_t *os = dn->dn_objset;
2477 	dmu_buf_impl_t *parent = db->db_parent;
2478 	uint64_t txg = tx->tx_txg;
2479 	zbookmark_t zb;
2480 	zio_prop_t zp;
2481 	zio_t *zio;
2482 	int wp_flag = 0;
2483 
2484 	if (db->db_state != DB_NOFILL) {
2485 		if (db->db_level > 0 || dn->dn_type == DMU_OT_DNODE) {
2486 			/*
2487 			 * Private object buffers are released here rather
2488 			 * than in dbuf_dirty() since they are only modified
2489 			 * in the syncing context and we don't want the
2490 			 * overhead of making multiple copies of the data.
2491 			 */
2492 			if (BP_IS_HOLE(db->db_blkptr)) {
2493 				arc_buf_thaw(data);
2494 			} else {
2495 				dbuf_release_bp(db);
2496 			}
2497 		}
2498 	}
2499 
2500 	if (parent != dn->dn_dbuf) {
2501 		ASSERT(parent && parent->db_data_pending);
2502 		ASSERT(db->db_level == parent->db_level-1);
2503 		ASSERT(arc_released(parent->db_buf));
2504 		zio = parent->db_data_pending->dr_zio;
2505 	} else {
2506 		ASSERT((db->db_level == dn->dn_phys->dn_nlevels-1 &&
2507 		    db->db_blkid != DMU_SPILL_BLKID) ||
2508 		    (db->db_blkid == DMU_SPILL_BLKID && db->db_level == 0));
2509 		if (db->db_blkid != DMU_SPILL_BLKID)
2510 			ASSERT3P(db->db_blkptr, ==,
2511 			    &dn->dn_phys->dn_blkptr[db->db_blkid]);
2512 		zio = dn->dn_zio;
2513 	}
2514 
2515 	ASSERT(db->db_level == 0 || data == db->db_buf);
2516 	ASSERT3U(db->db_blkptr->blk_birth, <=, txg);
2517 	ASSERT(zio);
2518 
2519 	SET_BOOKMARK(&zb, os->os_dsl_dataset ?
2520 	    os->os_dsl_dataset->ds_object : DMU_META_OBJSET,
2521 	    db->db.db_object, db->db_level, db->db_blkid);
2522 
2523 	if (db->db_blkid == DMU_SPILL_BLKID)
2524 		wp_flag = WP_SPILL;
2525 	wp_flag |= (db->db_state == DB_NOFILL) ? WP_NOFILL : 0;
2526 
2527 	dmu_write_policy(os, dn, db->db_level, wp_flag, &zp);
2528 
2529 	if (db->db_level == 0 && dr->dt.dl.dr_override_state == DR_OVERRIDDEN) {
2530 		ASSERT(db->db_state != DB_NOFILL);
2531 		dr->dr_zio = zio_write(zio, os->os_spa, txg,
2532 		    db->db_blkptr, data->b_data, arc_buf_size(data), &zp,
2533 		    dbuf_write_override_ready, dbuf_write_override_done, dr,
2534 		    ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_MUSTSUCCEED, &zb);
2535 		mutex_enter(&db->db_mtx);
2536 		dr->dt.dl.dr_override_state = DR_NOT_OVERRIDDEN;
2537 		zio_write_override(dr->dr_zio, &dr->dt.dl.dr_overridden_by,
2538 		    dr->dt.dl.dr_copies);
2539 		mutex_exit(&db->db_mtx);
2540 	} else if (db->db_state == DB_NOFILL) {
2541 		ASSERT(zp.zp_checksum == ZIO_CHECKSUM_OFF);
2542 		dr->dr_zio = zio_write(zio, os->os_spa, txg,
2543 		    db->db_blkptr, NULL, db->db.db_size, &zp,
2544 		    dbuf_write_nofill_ready, dbuf_write_nofill_done, db,
2545 		    ZIO_PRIORITY_ASYNC_WRITE,
2546 		    ZIO_FLAG_MUSTSUCCEED | ZIO_FLAG_NODATA, &zb);
2547 	} else {
2548 		ASSERT(arc_released(data));
2549 		dr->dr_zio = arc_write(zio, os->os_spa, txg,
2550 		    db->db_blkptr, data, DBUF_IS_L2CACHEABLE(db), &zp,
2551 		    dbuf_write_ready, dbuf_write_done, db,
2552 		    ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_MUSTSUCCEED, &zb);
2553 	}
2554 }
2555