xref: /illumos-gate/usr/src/uts/common/fs/zfs/dbuf.c (revision 9ce6e318fecae800270f382ed76162508c5d525b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
24  * Copyright (c) 2012, 2015 by Delphix. All rights reserved.
25  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
26  * Copyright (c) 2013, Joyent, Inc. All rights reserved.
27  * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
28  */
29 
30 #include <sys/zfs_context.h>
31 #include <sys/dmu.h>
32 #include <sys/dmu_send.h>
33 #include <sys/dmu_impl.h>
34 #include <sys/dbuf.h>
35 #include <sys/dmu_objset.h>
36 #include <sys/dsl_dataset.h>
37 #include <sys/dsl_dir.h>
38 #include <sys/dmu_tx.h>
39 #include <sys/spa.h>
40 #include <sys/zio.h>
41 #include <sys/dmu_zfetch.h>
42 #include <sys/sa.h>
43 #include <sys/sa_impl.h>
44 #include <sys/zfeature.h>
45 #include <sys/blkptr.h>
46 #include <sys/range_tree.h>
47 
48 /*
49  * Number of times that zfs_free_range() took the slow path while doing
50  * a zfs receive.  A nonzero value indicates a potential performance problem.
51  */
52 uint64_t zfs_free_range_recv_miss;
53 
54 static void dbuf_destroy(dmu_buf_impl_t *db);
55 static boolean_t dbuf_undirty(dmu_buf_impl_t *db, dmu_tx_t *tx);
56 static void dbuf_write(dbuf_dirty_record_t *dr, arc_buf_t *data, dmu_tx_t *tx);
57 
58 #ifndef __lint
59 extern inline void dmu_buf_init_user(dmu_buf_user_t *dbu,
60     dmu_buf_evict_func_t *evict_func, dmu_buf_t **clear_on_evict_dbufp);
61 #endif /* ! __lint */
62 
63 /*
64  * Global data structures and functions for the dbuf cache.
65  */
66 static kmem_cache_t *dbuf_cache;
67 static taskq_t *dbu_evict_taskq;
68 
69 /* ARGSUSED */
70 static int
71 dbuf_cons(void *vdb, void *unused, int kmflag)
72 {
73 	dmu_buf_impl_t *db = vdb;
74 	bzero(db, sizeof (dmu_buf_impl_t));
75 
76 	mutex_init(&db->db_mtx, NULL, MUTEX_DEFAULT, NULL);
77 	cv_init(&db->db_changed, NULL, CV_DEFAULT, NULL);
78 	refcount_create(&db->db_holds);
79 
80 	return (0);
81 }
82 
83 /* ARGSUSED */
84 static void
85 dbuf_dest(void *vdb, void *unused)
86 {
87 	dmu_buf_impl_t *db = vdb;
88 	mutex_destroy(&db->db_mtx);
89 	cv_destroy(&db->db_changed);
90 	refcount_destroy(&db->db_holds);
91 }
92 
93 /*
94  * dbuf hash table routines
95  */
96 static dbuf_hash_table_t dbuf_hash_table;
97 
98 static uint64_t dbuf_hash_count;
99 
100 static uint64_t
101 dbuf_hash(void *os, uint64_t obj, uint8_t lvl, uint64_t blkid)
102 {
103 	uintptr_t osv = (uintptr_t)os;
104 	uint64_t crc = -1ULL;
105 
106 	ASSERT(zfs_crc64_table[128] == ZFS_CRC64_POLY);
107 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (lvl)) & 0xFF];
108 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (osv >> 6)) & 0xFF];
109 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (obj >> 0)) & 0xFF];
110 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (obj >> 8)) & 0xFF];
111 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (blkid >> 0)) & 0xFF];
112 	crc = (crc >> 8) ^ zfs_crc64_table[(crc ^ (blkid >> 8)) & 0xFF];
113 
114 	crc ^= (osv>>14) ^ (obj>>16) ^ (blkid>>16);
115 
116 	return (crc);
117 }
118 
119 #define	DBUF_HASH(os, obj, level, blkid) dbuf_hash(os, obj, level, blkid);
120 
121 #define	DBUF_EQUAL(dbuf, os, obj, level, blkid)		\
122 	((dbuf)->db.db_object == (obj) &&		\
123 	(dbuf)->db_objset == (os) &&			\
124 	(dbuf)->db_level == (level) &&			\
125 	(dbuf)->db_blkid == (blkid))
126 
127 dmu_buf_impl_t *
128 dbuf_find(objset_t *os, uint64_t obj, uint8_t level, uint64_t blkid)
129 {
130 	dbuf_hash_table_t *h = &dbuf_hash_table;
131 	uint64_t hv = DBUF_HASH(os, obj, level, blkid);
132 	uint64_t idx = hv & h->hash_table_mask;
133 	dmu_buf_impl_t *db;
134 
135 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
136 	for (db = h->hash_table[idx]; db != NULL; db = db->db_hash_next) {
137 		if (DBUF_EQUAL(db, os, obj, level, blkid)) {
138 			mutex_enter(&db->db_mtx);
139 			if (db->db_state != DB_EVICTING) {
140 				mutex_exit(DBUF_HASH_MUTEX(h, idx));
141 				return (db);
142 			}
143 			mutex_exit(&db->db_mtx);
144 		}
145 	}
146 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
147 	return (NULL);
148 }
149 
150 static dmu_buf_impl_t *
151 dbuf_find_bonus(objset_t *os, uint64_t object)
152 {
153 	dnode_t *dn;
154 	dmu_buf_impl_t *db = NULL;
155 
156 	if (dnode_hold(os, object, FTAG, &dn) == 0) {
157 		rw_enter(&dn->dn_struct_rwlock, RW_READER);
158 		if (dn->dn_bonus != NULL) {
159 			db = dn->dn_bonus;
160 			mutex_enter(&db->db_mtx);
161 		}
162 		rw_exit(&dn->dn_struct_rwlock);
163 		dnode_rele(dn, FTAG);
164 	}
165 	return (db);
166 }
167 
168 /*
169  * Insert an entry into the hash table.  If there is already an element
170  * equal to elem in the hash table, then the already existing element
171  * will be returned and the new element will not be inserted.
172  * Otherwise returns NULL.
173  */
174 static dmu_buf_impl_t *
175 dbuf_hash_insert(dmu_buf_impl_t *db)
176 {
177 	dbuf_hash_table_t *h = &dbuf_hash_table;
178 	objset_t *os = db->db_objset;
179 	uint64_t obj = db->db.db_object;
180 	int level = db->db_level;
181 	uint64_t blkid = db->db_blkid;
182 	uint64_t hv = DBUF_HASH(os, obj, level, blkid);
183 	uint64_t idx = hv & h->hash_table_mask;
184 	dmu_buf_impl_t *dbf;
185 
186 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
187 	for (dbf = h->hash_table[idx]; dbf != NULL; dbf = dbf->db_hash_next) {
188 		if (DBUF_EQUAL(dbf, os, obj, level, blkid)) {
189 			mutex_enter(&dbf->db_mtx);
190 			if (dbf->db_state != DB_EVICTING) {
191 				mutex_exit(DBUF_HASH_MUTEX(h, idx));
192 				return (dbf);
193 			}
194 			mutex_exit(&dbf->db_mtx);
195 		}
196 	}
197 
198 	mutex_enter(&db->db_mtx);
199 	db->db_hash_next = h->hash_table[idx];
200 	h->hash_table[idx] = db;
201 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
202 	atomic_inc_64(&dbuf_hash_count);
203 
204 	return (NULL);
205 }
206 
207 /*
208  * Remove an entry from the hash table.  It must be in the EVICTING state.
209  */
210 static void
211 dbuf_hash_remove(dmu_buf_impl_t *db)
212 {
213 	dbuf_hash_table_t *h = &dbuf_hash_table;
214 	uint64_t hv = DBUF_HASH(db->db_objset, db->db.db_object,
215 	    db->db_level, db->db_blkid);
216 	uint64_t idx = hv & h->hash_table_mask;
217 	dmu_buf_impl_t *dbf, **dbp;
218 
219 	/*
220 	 * We musn't hold db_mtx to maintain lock ordering:
221 	 * DBUF_HASH_MUTEX > db_mtx.
222 	 */
223 	ASSERT(refcount_is_zero(&db->db_holds));
224 	ASSERT(db->db_state == DB_EVICTING);
225 	ASSERT(!MUTEX_HELD(&db->db_mtx));
226 
227 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
228 	dbp = &h->hash_table[idx];
229 	while ((dbf = *dbp) != db) {
230 		dbp = &dbf->db_hash_next;
231 		ASSERT(dbf != NULL);
232 	}
233 	*dbp = db->db_hash_next;
234 	db->db_hash_next = NULL;
235 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
236 	atomic_dec_64(&dbuf_hash_count);
237 }
238 
239 static arc_evict_func_t dbuf_do_evict;
240 
241 typedef enum {
242 	DBVU_EVICTING,
243 	DBVU_NOT_EVICTING
244 } dbvu_verify_type_t;
245 
246 static void
247 dbuf_verify_user(dmu_buf_impl_t *db, dbvu_verify_type_t verify_type)
248 {
249 #ifdef ZFS_DEBUG
250 	int64_t holds;
251 
252 	if (db->db_user == NULL)
253 		return;
254 
255 	/* Only data blocks support the attachment of user data. */
256 	ASSERT(db->db_level == 0);
257 
258 	/* Clients must resolve a dbuf before attaching user data. */
259 	ASSERT(db->db.db_data != NULL);
260 	ASSERT3U(db->db_state, ==, DB_CACHED);
261 
262 	holds = refcount_count(&db->db_holds);
263 	if (verify_type == DBVU_EVICTING) {
264 		/*
265 		 * Immediate eviction occurs when holds == dirtycnt.
266 		 * For normal eviction buffers, holds is zero on
267 		 * eviction, except when dbuf_fix_old_data() calls
268 		 * dbuf_clear_data().  However, the hold count can grow
269 		 * during eviction even though db_mtx is held (see
270 		 * dmu_bonus_hold() for an example), so we can only
271 		 * test the generic invariant that holds >= dirtycnt.
272 		 */
273 		ASSERT3U(holds, >=, db->db_dirtycnt);
274 	} else {
275 		if (db->db_immediate_evict == TRUE)
276 			ASSERT3U(holds, >=, db->db_dirtycnt);
277 		else
278 			ASSERT3U(holds, >, 0);
279 	}
280 #endif
281 }
282 
283 static void
284 dbuf_evict_user(dmu_buf_impl_t *db)
285 {
286 	dmu_buf_user_t *dbu = db->db_user;
287 
288 	ASSERT(MUTEX_HELD(&db->db_mtx));
289 
290 	if (dbu == NULL)
291 		return;
292 
293 	dbuf_verify_user(db, DBVU_EVICTING);
294 	db->db_user = NULL;
295 
296 #ifdef ZFS_DEBUG
297 	if (dbu->dbu_clear_on_evict_dbufp != NULL)
298 		*dbu->dbu_clear_on_evict_dbufp = NULL;
299 #endif
300 
301 	/*
302 	 * Invoke the callback from a taskq to avoid lock order reversals
303 	 * and limit stack depth.
304 	 */
305 	taskq_dispatch_ent(dbu_evict_taskq, dbu->dbu_evict_func, dbu, 0,
306 	    &dbu->dbu_tqent);
307 }
308 
309 boolean_t
310 dbuf_is_metadata(dmu_buf_impl_t *db)
311 {
312 	if (db->db_level > 0) {
313 		return (B_TRUE);
314 	} else {
315 		boolean_t is_metadata;
316 
317 		DB_DNODE_ENTER(db);
318 		is_metadata = DMU_OT_IS_METADATA(DB_DNODE(db)->dn_type);
319 		DB_DNODE_EXIT(db);
320 
321 		return (is_metadata);
322 	}
323 }
324 
325 void
326 dbuf_evict(dmu_buf_impl_t *db)
327 {
328 	ASSERT(MUTEX_HELD(&db->db_mtx));
329 	ASSERT(db->db_buf == NULL);
330 	ASSERT(db->db_data_pending == NULL);
331 
332 	dbuf_clear(db);
333 	dbuf_destroy(db);
334 }
335 
336 void
337 dbuf_init(void)
338 {
339 	uint64_t hsize = 1ULL << 16;
340 	dbuf_hash_table_t *h = &dbuf_hash_table;
341 	int i;
342 
343 	/*
344 	 * The hash table is big enough to fill all of physical memory
345 	 * with an average 4K block size.  The table will take up
346 	 * totalmem*sizeof(void*)/4K (i.e. 2MB/GB with 8-byte pointers).
347 	 */
348 	while (hsize * 4096 < physmem * PAGESIZE)
349 		hsize <<= 1;
350 
351 retry:
352 	h->hash_table_mask = hsize - 1;
353 	h->hash_table = kmem_zalloc(hsize * sizeof (void *), KM_NOSLEEP);
354 	if (h->hash_table == NULL) {
355 		/* XXX - we should really return an error instead of assert */
356 		ASSERT(hsize > (1ULL << 10));
357 		hsize >>= 1;
358 		goto retry;
359 	}
360 
361 	dbuf_cache = kmem_cache_create("dmu_buf_impl_t",
362 	    sizeof (dmu_buf_impl_t),
363 	    0, dbuf_cons, dbuf_dest, NULL, NULL, NULL, 0);
364 
365 	for (i = 0; i < DBUF_MUTEXES; i++)
366 		mutex_init(&h->hash_mutexes[i], NULL, MUTEX_DEFAULT, NULL);
367 
368 	/*
369 	 * All entries are queued via taskq_dispatch_ent(), so min/maxalloc
370 	 * configuration is not required.
371 	 */
372 	dbu_evict_taskq = taskq_create("dbu_evict", 1, minclsyspri, 0, 0, 0);
373 }
374 
375 void
376 dbuf_fini(void)
377 {
378 	dbuf_hash_table_t *h = &dbuf_hash_table;
379 	int i;
380 
381 	for (i = 0; i < DBUF_MUTEXES; i++)
382 		mutex_destroy(&h->hash_mutexes[i]);
383 	kmem_free(h->hash_table, (h->hash_table_mask + 1) * sizeof (void *));
384 	kmem_cache_destroy(dbuf_cache);
385 	taskq_destroy(dbu_evict_taskq);
386 }
387 
388 /*
389  * Other stuff.
390  */
391 
392 #ifdef ZFS_DEBUG
393 static void
394 dbuf_verify(dmu_buf_impl_t *db)
395 {
396 	dnode_t *dn;
397 	dbuf_dirty_record_t *dr;
398 
399 	ASSERT(MUTEX_HELD(&db->db_mtx));
400 
401 	if (!(zfs_flags & ZFS_DEBUG_DBUF_VERIFY))
402 		return;
403 
404 	ASSERT(db->db_objset != NULL);
405 	DB_DNODE_ENTER(db);
406 	dn = DB_DNODE(db);
407 	if (dn == NULL) {
408 		ASSERT(db->db_parent == NULL);
409 		ASSERT(db->db_blkptr == NULL);
410 	} else {
411 		ASSERT3U(db->db.db_object, ==, dn->dn_object);
412 		ASSERT3P(db->db_objset, ==, dn->dn_objset);
413 		ASSERT3U(db->db_level, <, dn->dn_nlevels);
414 		ASSERT(db->db_blkid == DMU_BONUS_BLKID ||
415 		    db->db_blkid == DMU_SPILL_BLKID ||
416 		    !avl_is_empty(&dn->dn_dbufs));
417 	}
418 	if (db->db_blkid == DMU_BONUS_BLKID) {
419 		ASSERT(dn != NULL);
420 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
421 		ASSERT3U(db->db.db_offset, ==, DMU_BONUS_BLKID);
422 	} else if (db->db_blkid == DMU_SPILL_BLKID) {
423 		ASSERT(dn != NULL);
424 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
425 		ASSERT0(db->db.db_offset);
426 	} else {
427 		ASSERT3U(db->db.db_offset, ==, db->db_blkid * db->db.db_size);
428 	}
429 
430 	for (dr = db->db_data_pending; dr != NULL; dr = dr->dr_next)
431 		ASSERT(dr->dr_dbuf == db);
432 
433 	for (dr = db->db_last_dirty; dr != NULL; dr = dr->dr_next)
434 		ASSERT(dr->dr_dbuf == db);
435 
436 	/*
437 	 * We can't assert that db_size matches dn_datablksz because it
438 	 * can be momentarily different when another thread is doing
439 	 * dnode_set_blksz().
440 	 */
441 	if (db->db_level == 0 && db->db.db_object == DMU_META_DNODE_OBJECT) {
442 		dr = db->db_data_pending;
443 		/*
444 		 * It should only be modified in syncing context, so
445 		 * make sure we only have one copy of the data.
446 		 */
447 		ASSERT(dr == NULL || dr->dt.dl.dr_data == db->db_buf);
448 	}
449 
450 	/* verify db->db_blkptr */
451 	if (db->db_blkptr) {
452 		if (db->db_parent == dn->dn_dbuf) {
453 			/* db is pointed to by the dnode */
454 			/* ASSERT3U(db->db_blkid, <, dn->dn_nblkptr); */
455 			if (DMU_OBJECT_IS_SPECIAL(db->db.db_object))
456 				ASSERT(db->db_parent == NULL);
457 			else
458 				ASSERT(db->db_parent != NULL);
459 			if (db->db_blkid != DMU_SPILL_BLKID)
460 				ASSERT3P(db->db_blkptr, ==,
461 				    &dn->dn_phys->dn_blkptr[db->db_blkid]);
462 		} else {
463 			/* db is pointed to by an indirect block */
464 			int epb = db->db_parent->db.db_size >> SPA_BLKPTRSHIFT;
465 			ASSERT3U(db->db_parent->db_level, ==, db->db_level+1);
466 			ASSERT3U(db->db_parent->db.db_object, ==,
467 			    db->db.db_object);
468 			/*
469 			 * dnode_grow_indblksz() can make this fail if we don't
470 			 * have the struct_rwlock.  XXX indblksz no longer
471 			 * grows.  safe to do this now?
472 			 */
473 			if (RW_WRITE_HELD(&dn->dn_struct_rwlock)) {
474 				ASSERT3P(db->db_blkptr, ==,
475 				    ((blkptr_t *)db->db_parent->db.db_data +
476 				    db->db_blkid % epb));
477 			}
478 		}
479 	}
480 	if ((db->db_blkptr == NULL || BP_IS_HOLE(db->db_blkptr)) &&
481 	    (db->db_buf == NULL || db->db_buf->b_data) &&
482 	    db->db.db_data && db->db_blkid != DMU_BONUS_BLKID &&
483 	    db->db_state != DB_FILL && !dn->dn_free_txg) {
484 		/*
485 		 * If the blkptr isn't set but they have nonzero data,
486 		 * it had better be dirty, otherwise we'll lose that
487 		 * data when we evict this buffer.
488 		 */
489 		if (db->db_dirtycnt == 0) {
490 			uint64_t *buf = db->db.db_data;
491 			int i;
492 
493 			for (i = 0; i < db->db.db_size >> 3; i++) {
494 				ASSERT(buf[i] == 0);
495 			}
496 		}
497 	}
498 	DB_DNODE_EXIT(db);
499 }
500 #endif
501 
502 static void
503 dbuf_clear_data(dmu_buf_impl_t *db)
504 {
505 	ASSERT(MUTEX_HELD(&db->db_mtx));
506 	dbuf_evict_user(db);
507 	db->db_buf = NULL;
508 	db->db.db_data = NULL;
509 	if (db->db_state != DB_NOFILL)
510 		db->db_state = DB_UNCACHED;
511 }
512 
513 static void
514 dbuf_set_data(dmu_buf_impl_t *db, arc_buf_t *buf)
515 {
516 	ASSERT(MUTEX_HELD(&db->db_mtx));
517 	ASSERT(buf != NULL);
518 
519 	db->db_buf = buf;
520 	ASSERT(buf->b_data != NULL);
521 	db->db.db_data = buf->b_data;
522 	if (!arc_released(buf))
523 		arc_set_callback(buf, dbuf_do_evict, db);
524 }
525 
526 /*
527  * Loan out an arc_buf for read.  Return the loaned arc_buf.
528  */
529 arc_buf_t *
530 dbuf_loan_arcbuf(dmu_buf_impl_t *db)
531 {
532 	arc_buf_t *abuf;
533 
534 	mutex_enter(&db->db_mtx);
535 	if (arc_released(db->db_buf) || refcount_count(&db->db_holds) > 1) {
536 		int blksz = db->db.db_size;
537 		spa_t *spa = db->db_objset->os_spa;
538 
539 		mutex_exit(&db->db_mtx);
540 		abuf = arc_loan_buf(spa, blksz);
541 		bcopy(db->db.db_data, abuf->b_data, blksz);
542 	} else {
543 		abuf = db->db_buf;
544 		arc_loan_inuse_buf(abuf, db);
545 		dbuf_clear_data(db);
546 		mutex_exit(&db->db_mtx);
547 	}
548 	return (abuf);
549 }
550 
551 /*
552  * Calculate which level n block references the data at the level 0 offset
553  * provided.
554  */
555 uint64_t
556 dbuf_whichblock(dnode_t *dn, int64_t level, uint64_t offset)
557 {
558 	if (dn->dn_datablkshift != 0 && dn->dn_indblkshift != 0) {
559 		/*
560 		 * The level n blkid is equal to the level 0 blkid divided by
561 		 * the number of level 0s in a level n block.
562 		 *
563 		 * The level 0 blkid is offset >> datablkshift =
564 		 * offset / 2^datablkshift.
565 		 *
566 		 * The number of level 0s in a level n is the number of block
567 		 * pointers in an indirect block, raised to the power of level.
568 		 * This is 2^(indblkshift - SPA_BLKPTRSHIFT)^level =
569 		 * 2^(level*(indblkshift - SPA_BLKPTRSHIFT)).
570 		 *
571 		 * Thus, the level n blkid is: offset /
572 		 * ((2^datablkshift)*(2^(level*(indblkshift - SPA_BLKPTRSHIFT)))
573 		 * = offset / 2^(datablkshift + level *
574 		 *   (indblkshift - SPA_BLKPTRSHIFT))
575 		 * = offset >> (datablkshift + level *
576 		 *   (indblkshift - SPA_BLKPTRSHIFT))
577 		 */
578 		return (offset >> (dn->dn_datablkshift + level *
579 		    (dn->dn_indblkshift - SPA_BLKPTRSHIFT)));
580 	} else {
581 		ASSERT3U(offset, <, dn->dn_datablksz);
582 		return (0);
583 	}
584 }
585 
586 static void
587 dbuf_read_done(zio_t *zio, arc_buf_t *buf, void *vdb)
588 {
589 	dmu_buf_impl_t *db = vdb;
590 
591 	mutex_enter(&db->db_mtx);
592 	ASSERT3U(db->db_state, ==, DB_READ);
593 	/*
594 	 * All reads are synchronous, so we must have a hold on the dbuf
595 	 */
596 	ASSERT(refcount_count(&db->db_holds) > 0);
597 	ASSERT(db->db_buf == NULL);
598 	ASSERT(db->db.db_data == NULL);
599 	if (db->db_level == 0 && db->db_freed_in_flight) {
600 		/* we were freed in flight; disregard any error */
601 		arc_release(buf, db);
602 		bzero(buf->b_data, db->db.db_size);
603 		arc_buf_freeze(buf);
604 		db->db_freed_in_flight = FALSE;
605 		dbuf_set_data(db, buf);
606 		db->db_state = DB_CACHED;
607 	} else if (zio == NULL || zio->io_error == 0) {
608 		dbuf_set_data(db, buf);
609 		db->db_state = DB_CACHED;
610 	} else {
611 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
612 		ASSERT3P(db->db_buf, ==, NULL);
613 		VERIFY(arc_buf_remove_ref(buf, db));
614 		db->db_state = DB_UNCACHED;
615 	}
616 	cv_broadcast(&db->db_changed);
617 	dbuf_rele_and_unlock(db, NULL);
618 }
619 
620 static void
621 dbuf_read_impl(dmu_buf_impl_t *db, zio_t *zio, uint32_t flags)
622 {
623 	dnode_t *dn;
624 	zbookmark_phys_t zb;
625 	arc_flags_t aflags = ARC_FLAG_NOWAIT;
626 
627 	DB_DNODE_ENTER(db);
628 	dn = DB_DNODE(db);
629 	ASSERT(!refcount_is_zero(&db->db_holds));
630 	/* We need the struct_rwlock to prevent db_blkptr from changing. */
631 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
632 	ASSERT(MUTEX_HELD(&db->db_mtx));
633 	ASSERT(db->db_state == DB_UNCACHED);
634 	ASSERT(db->db_buf == NULL);
635 
636 	if (db->db_blkid == DMU_BONUS_BLKID) {
637 		int bonuslen = MIN(dn->dn_bonuslen, dn->dn_phys->dn_bonuslen);
638 
639 		ASSERT3U(bonuslen, <=, db->db.db_size);
640 		db->db.db_data = zio_buf_alloc(DN_MAX_BONUSLEN);
641 		arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
642 		if (bonuslen < DN_MAX_BONUSLEN)
643 			bzero(db->db.db_data, DN_MAX_BONUSLEN);
644 		if (bonuslen)
645 			bcopy(DN_BONUS(dn->dn_phys), db->db.db_data, bonuslen);
646 		DB_DNODE_EXIT(db);
647 		db->db_state = DB_CACHED;
648 		mutex_exit(&db->db_mtx);
649 		return;
650 	}
651 
652 	/*
653 	 * Recheck BP_IS_HOLE() after dnode_block_freed() in case dnode_sync()
654 	 * processes the delete record and clears the bp while we are waiting
655 	 * for the dn_mtx (resulting in a "no" from block_freed).
656 	 */
657 	if (db->db_blkptr == NULL || BP_IS_HOLE(db->db_blkptr) ||
658 	    (db->db_level == 0 && (dnode_block_freed(dn, db->db_blkid) ||
659 	    BP_IS_HOLE(db->db_blkptr)))) {
660 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
661 
662 		DB_DNODE_EXIT(db);
663 		dbuf_set_data(db, arc_buf_alloc(db->db_objset->os_spa,
664 		    db->db.db_size, db, type));
665 		bzero(db->db.db_data, db->db.db_size);
666 		db->db_state = DB_CACHED;
667 		mutex_exit(&db->db_mtx);
668 		return;
669 	}
670 
671 	DB_DNODE_EXIT(db);
672 
673 	db->db_state = DB_READ;
674 	mutex_exit(&db->db_mtx);
675 
676 	if (DBUF_IS_L2CACHEABLE(db))
677 		aflags |= ARC_FLAG_L2CACHE;
678 	if (DBUF_IS_L2COMPRESSIBLE(db))
679 		aflags |= ARC_FLAG_L2COMPRESS;
680 
681 	SET_BOOKMARK(&zb, db->db_objset->os_dsl_dataset ?
682 	    db->db_objset->os_dsl_dataset->ds_object : DMU_META_OBJSET,
683 	    db->db.db_object, db->db_level, db->db_blkid);
684 
685 	dbuf_add_ref(db, NULL);
686 
687 	(void) arc_read(zio, db->db_objset->os_spa, db->db_blkptr,
688 	    dbuf_read_done, db, ZIO_PRIORITY_SYNC_READ,
689 	    (flags & DB_RF_CANFAIL) ? ZIO_FLAG_CANFAIL : ZIO_FLAG_MUSTSUCCEED,
690 	    &aflags, &zb);
691 }
692 
693 int
694 dbuf_read(dmu_buf_impl_t *db, zio_t *zio, uint32_t flags)
695 {
696 	int err = 0;
697 	boolean_t havepzio = (zio != NULL);
698 	boolean_t prefetch;
699 	dnode_t *dn;
700 
701 	/*
702 	 * We don't have to hold the mutex to check db_state because it
703 	 * can't be freed while we have a hold on the buffer.
704 	 */
705 	ASSERT(!refcount_is_zero(&db->db_holds));
706 
707 	if (db->db_state == DB_NOFILL)
708 		return (SET_ERROR(EIO));
709 
710 	DB_DNODE_ENTER(db);
711 	dn = DB_DNODE(db);
712 	if ((flags & DB_RF_HAVESTRUCT) == 0)
713 		rw_enter(&dn->dn_struct_rwlock, RW_READER);
714 
715 	prefetch = db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
716 	    (flags & DB_RF_NOPREFETCH) == 0 && dn != NULL &&
717 	    DBUF_IS_CACHEABLE(db);
718 
719 	mutex_enter(&db->db_mtx);
720 	if (db->db_state == DB_CACHED) {
721 		mutex_exit(&db->db_mtx);
722 		if (prefetch)
723 			dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1);
724 		if ((flags & DB_RF_HAVESTRUCT) == 0)
725 			rw_exit(&dn->dn_struct_rwlock);
726 		DB_DNODE_EXIT(db);
727 	} else if (db->db_state == DB_UNCACHED) {
728 		spa_t *spa = dn->dn_objset->os_spa;
729 
730 		if (zio == NULL)
731 			zio = zio_root(spa, NULL, NULL, ZIO_FLAG_CANFAIL);
732 		dbuf_read_impl(db, zio, flags);
733 
734 		/* dbuf_read_impl has dropped db_mtx for us */
735 
736 		if (prefetch)
737 			dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1);
738 
739 		if ((flags & DB_RF_HAVESTRUCT) == 0)
740 			rw_exit(&dn->dn_struct_rwlock);
741 		DB_DNODE_EXIT(db);
742 
743 		if (!havepzio)
744 			err = zio_wait(zio);
745 	} else {
746 		/*
747 		 * Another reader came in while the dbuf was in flight
748 		 * between UNCACHED and CACHED.  Either a writer will finish
749 		 * writing the buffer (sending the dbuf to CACHED) or the
750 		 * first reader's request will reach the read_done callback
751 		 * and send the dbuf to CACHED.  Otherwise, a failure
752 		 * occurred and the dbuf went to UNCACHED.
753 		 */
754 		mutex_exit(&db->db_mtx);
755 		if (prefetch)
756 			dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1);
757 		if ((flags & DB_RF_HAVESTRUCT) == 0)
758 			rw_exit(&dn->dn_struct_rwlock);
759 		DB_DNODE_EXIT(db);
760 
761 		/* Skip the wait per the caller's request. */
762 		mutex_enter(&db->db_mtx);
763 		if ((flags & DB_RF_NEVERWAIT) == 0) {
764 			while (db->db_state == DB_READ ||
765 			    db->db_state == DB_FILL) {
766 				ASSERT(db->db_state == DB_READ ||
767 				    (flags & DB_RF_HAVESTRUCT) == 0);
768 				DTRACE_PROBE2(blocked__read, dmu_buf_impl_t *,
769 				    db, zio_t *, zio);
770 				cv_wait(&db->db_changed, &db->db_mtx);
771 			}
772 			if (db->db_state == DB_UNCACHED)
773 				err = SET_ERROR(EIO);
774 		}
775 		mutex_exit(&db->db_mtx);
776 	}
777 
778 	ASSERT(err || havepzio || db->db_state == DB_CACHED);
779 	return (err);
780 }
781 
782 static void
783 dbuf_noread(dmu_buf_impl_t *db)
784 {
785 	ASSERT(!refcount_is_zero(&db->db_holds));
786 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
787 	mutex_enter(&db->db_mtx);
788 	while (db->db_state == DB_READ || db->db_state == DB_FILL)
789 		cv_wait(&db->db_changed, &db->db_mtx);
790 	if (db->db_state == DB_UNCACHED) {
791 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
792 		spa_t *spa = db->db_objset->os_spa;
793 
794 		ASSERT(db->db_buf == NULL);
795 		ASSERT(db->db.db_data == NULL);
796 		dbuf_set_data(db, arc_buf_alloc(spa, db->db.db_size, db, type));
797 		db->db_state = DB_FILL;
798 	} else if (db->db_state == DB_NOFILL) {
799 		dbuf_clear_data(db);
800 	} else {
801 		ASSERT3U(db->db_state, ==, DB_CACHED);
802 	}
803 	mutex_exit(&db->db_mtx);
804 }
805 
806 /*
807  * This is our just-in-time copy function.  It makes a copy of
808  * buffers, that have been modified in a previous transaction
809  * group, before we modify them in the current active group.
810  *
811  * This function is used in two places: when we are dirtying a
812  * buffer for the first time in a txg, and when we are freeing
813  * a range in a dnode that includes this buffer.
814  *
815  * Note that when we are called from dbuf_free_range() we do
816  * not put a hold on the buffer, we just traverse the active
817  * dbuf list for the dnode.
818  */
819 static void
820 dbuf_fix_old_data(dmu_buf_impl_t *db, uint64_t txg)
821 {
822 	dbuf_dirty_record_t *dr = db->db_last_dirty;
823 
824 	ASSERT(MUTEX_HELD(&db->db_mtx));
825 	ASSERT(db->db.db_data != NULL);
826 	ASSERT(db->db_level == 0);
827 	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT);
828 
829 	if (dr == NULL ||
830 	    (dr->dt.dl.dr_data !=
831 	    ((db->db_blkid  == DMU_BONUS_BLKID) ? db->db.db_data : db->db_buf)))
832 		return;
833 
834 	/*
835 	 * If the last dirty record for this dbuf has not yet synced
836 	 * and its referencing the dbuf data, either:
837 	 *	reset the reference to point to a new copy,
838 	 * or (if there a no active holders)
839 	 *	just null out the current db_data pointer.
840 	 */
841 	ASSERT(dr->dr_txg >= txg - 2);
842 	if (db->db_blkid == DMU_BONUS_BLKID) {
843 		/* Note that the data bufs here are zio_bufs */
844 		dr->dt.dl.dr_data = zio_buf_alloc(DN_MAX_BONUSLEN);
845 		arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
846 		bcopy(db->db.db_data, dr->dt.dl.dr_data, DN_MAX_BONUSLEN);
847 	} else if (refcount_count(&db->db_holds) > db->db_dirtycnt) {
848 		int size = db->db.db_size;
849 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
850 		spa_t *spa = db->db_objset->os_spa;
851 
852 		dr->dt.dl.dr_data = arc_buf_alloc(spa, size, db, type);
853 		bcopy(db->db.db_data, dr->dt.dl.dr_data->b_data, size);
854 	} else {
855 		dbuf_clear_data(db);
856 	}
857 }
858 
859 void
860 dbuf_unoverride(dbuf_dirty_record_t *dr)
861 {
862 	dmu_buf_impl_t *db = dr->dr_dbuf;
863 	blkptr_t *bp = &dr->dt.dl.dr_overridden_by;
864 	uint64_t txg = dr->dr_txg;
865 
866 	ASSERT(MUTEX_HELD(&db->db_mtx));
867 	ASSERT(dr->dt.dl.dr_override_state != DR_IN_DMU_SYNC);
868 	ASSERT(db->db_level == 0);
869 
870 	if (db->db_blkid == DMU_BONUS_BLKID ||
871 	    dr->dt.dl.dr_override_state == DR_NOT_OVERRIDDEN)
872 		return;
873 
874 	ASSERT(db->db_data_pending != dr);
875 
876 	/* free this block */
877 	if (!BP_IS_HOLE(bp) && !dr->dt.dl.dr_nopwrite)
878 		zio_free(db->db_objset->os_spa, txg, bp);
879 
880 	dr->dt.dl.dr_override_state = DR_NOT_OVERRIDDEN;
881 	dr->dt.dl.dr_nopwrite = B_FALSE;
882 
883 	/*
884 	 * Release the already-written buffer, so we leave it in
885 	 * a consistent dirty state.  Note that all callers are
886 	 * modifying the buffer, so they will immediately do
887 	 * another (redundant) arc_release().  Therefore, leave
888 	 * the buf thawed to save the effort of freezing &
889 	 * immediately re-thawing it.
890 	 */
891 	arc_release(dr->dt.dl.dr_data, db);
892 }
893 
894 /*
895  * Evict (if its unreferenced) or clear (if its referenced) any level-0
896  * data blocks in the free range, so that any future readers will find
897  * empty blocks.
898  *
899  * This is a no-op if the dataset is in the middle of an incremental
900  * receive; see comment below for details.
901  */
902 void
903 dbuf_free_range(dnode_t *dn, uint64_t start_blkid, uint64_t end_blkid,
904     dmu_tx_t *tx)
905 {
906 	dmu_buf_impl_t db_search;
907 	dmu_buf_impl_t *db, *db_next;
908 	uint64_t txg = tx->tx_txg;
909 	avl_index_t where;
910 
911 	if (end_blkid > dn->dn_maxblkid && (end_blkid != DMU_SPILL_BLKID))
912 		end_blkid = dn->dn_maxblkid;
913 	dprintf_dnode(dn, "start=%llu end=%llu\n", start_blkid, end_blkid);
914 
915 	db_search.db_level = 0;
916 	db_search.db_blkid = start_blkid;
917 	db_search.db_state = DB_SEARCH;
918 
919 	mutex_enter(&dn->dn_dbufs_mtx);
920 	if (start_blkid >= dn->dn_unlisted_l0_blkid) {
921 		/* There can't be any dbufs in this range; no need to search. */
922 #ifdef DEBUG
923 		db = avl_find(&dn->dn_dbufs, &db_search, &where);
924 		ASSERT3P(db, ==, NULL);
925 		db = avl_nearest(&dn->dn_dbufs, where, AVL_AFTER);
926 		ASSERT(db == NULL || db->db_level > 0);
927 #endif
928 		mutex_exit(&dn->dn_dbufs_mtx);
929 		return;
930 	} else if (dmu_objset_is_receiving(dn->dn_objset)) {
931 		/*
932 		 * If we are receiving, we expect there to be no dbufs in
933 		 * the range to be freed, because receive modifies each
934 		 * block at most once, and in offset order.  If this is
935 		 * not the case, it can lead to performance problems,
936 		 * so note that we unexpectedly took the slow path.
937 		 */
938 		atomic_inc_64(&zfs_free_range_recv_miss);
939 	}
940 
941 	db = avl_find(&dn->dn_dbufs, &db_search, &where);
942 	ASSERT3P(db, ==, NULL);
943 	db = avl_nearest(&dn->dn_dbufs, where, AVL_AFTER);
944 
945 	for (; db != NULL; db = db_next) {
946 		db_next = AVL_NEXT(&dn->dn_dbufs, db);
947 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
948 
949 		if (db->db_level != 0 || db->db_blkid > end_blkid) {
950 			break;
951 		}
952 		ASSERT3U(db->db_blkid, >=, start_blkid);
953 
954 		/* found a level 0 buffer in the range */
955 		mutex_enter(&db->db_mtx);
956 		if (dbuf_undirty(db, tx)) {
957 			/* mutex has been dropped and dbuf destroyed */
958 			continue;
959 		}
960 
961 		if (db->db_state == DB_UNCACHED ||
962 		    db->db_state == DB_NOFILL ||
963 		    db->db_state == DB_EVICTING) {
964 			ASSERT(db->db.db_data == NULL);
965 			mutex_exit(&db->db_mtx);
966 			continue;
967 		}
968 		if (db->db_state == DB_READ || db->db_state == DB_FILL) {
969 			/* will be handled in dbuf_read_done or dbuf_rele */
970 			db->db_freed_in_flight = TRUE;
971 			mutex_exit(&db->db_mtx);
972 			continue;
973 		}
974 		if (refcount_count(&db->db_holds) == 0) {
975 			ASSERT(db->db_buf);
976 			dbuf_clear(db);
977 			continue;
978 		}
979 		/* The dbuf is referenced */
980 
981 		if (db->db_last_dirty != NULL) {
982 			dbuf_dirty_record_t *dr = db->db_last_dirty;
983 
984 			if (dr->dr_txg == txg) {
985 				/*
986 				 * This buffer is "in-use", re-adjust the file
987 				 * size to reflect that this buffer may
988 				 * contain new data when we sync.
989 				 */
990 				if (db->db_blkid != DMU_SPILL_BLKID &&
991 				    db->db_blkid > dn->dn_maxblkid)
992 					dn->dn_maxblkid = db->db_blkid;
993 				dbuf_unoverride(dr);
994 			} else {
995 				/*
996 				 * This dbuf is not dirty in the open context.
997 				 * Either uncache it (if its not referenced in
998 				 * the open context) or reset its contents to
999 				 * empty.
1000 				 */
1001 				dbuf_fix_old_data(db, txg);
1002 			}
1003 		}
1004 		/* clear the contents if its cached */
1005 		if (db->db_state == DB_CACHED) {
1006 			ASSERT(db->db.db_data != NULL);
1007 			arc_release(db->db_buf, db);
1008 			bzero(db->db.db_data, db->db.db_size);
1009 			arc_buf_freeze(db->db_buf);
1010 		}
1011 
1012 		mutex_exit(&db->db_mtx);
1013 	}
1014 	mutex_exit(&dn->dn_dbufs_mtx);
1015 }
1016 
1017 static int
1018 dbuf_block_freeable(dmu_buf_impl_t *db)
1019 {
1020 	dsl_dataset_t *ds = db->db_objset->os_dsl_dataset;
1021 	uint64_t birth_txg = 0;
1022 
1023 	/*
1024 	 * We don't need any locking to protect db_blkptr:
1025 	 * If it's syncing, then db_last_dirty will be set
1026 	 * so we'll ignore db_blkptr.
1027 	 *
1028 	 * This logic ensures that only block births for
1029 	 * filled blocks are considered.
1030 	 */
1031 	ASSERT(MUTEX_HELD(&db->db_mtx));
1032 	if (db->db_last_dirty && (db->db_blkptr == NULL ||
1033 	    !BP_IS_HOLE(db->db_blkptr))) {
1034 		birth_txg = db->db_last_dirty->dr_txg;
1035 	} else if (db->db_blkptr != NULL && !BP_IS_HOLE(db->db_blkptr)) {
1036 		birth_txg = db->db_blkptr->blk_birth;
1037 	}
1038 
1039 	/*
1040 	 * If this block don't exist or is in a snapshot, it can't be freed.
1041 	 * Don't pass the bp to dsl_dataset_block_freeable() since we
1042 	 * are holding the db_mtx lock and might deadlock if we are
1043 	 * prefetching a dedup-ed block.
1044 	 */
1045 	if (birth_txg != 0)
1046 		return (ds == NULL ||
1047 		    dsl_dataset_block_freeable(ds, NULL, birth_txg));
1048 	else
1049 		return (B_FALSE);
1050 }
1051 
1052 void
1053 dbuf_new_size(dmu_buf_impl_t *db, int size, dmu_tx_t *tx)
1054 {
1055 	arc_buf_t *buf, *obuf;
1056 	int osize = db->db.db_size;
1057 	arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
1058 	dnode_t *dn;
1059 
1060 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1061 
1062 	DB_DNODE_ENTER(db);
1063 	dn = DB_DNODE(db);
1064 
1065 	/* XXX does *this* func really need the lock? */
1066 	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));
1067 
1068 	/*
1069 	 * This call to dmu_buf_will_dirty() with the dn_struct_rwlock held
1070 	 * is OK, because there can be no other references to the db
1071 	 * when we are changing its size, so no concurrent DB_FILL can
1072 	 * be happening.
1073 	 */
1074 	/*
1075 	 * XXX we should be doing a dbuf_read, checking the return
1076 	 * value and returning that up to our callers
1077 	 */
1078 	dmu_buf_will_dirty(&db->db, tx);
1079 
1080 	/* create the data buffer for the new block */
1081 	buf = arc_buf_alloc(dn->dn_objset->os_spa, size, db, type);
1082 
1083 	/* copy old block data to the new block */
1084 	obuf = db->db_buf;
1085 	bcopy(obuf->b_data, buf->b_data, MIN(osize, size));
1086 	/* zero the remainder */
1087 	if (size > osize)
1088 		bzero((uint8_t *)buf->b_data + osize, size - osize);
1089 
1090 	mutex_enter(&db->db_mtx);
1091 	dbuf_set_data(db, buf);
1092 	VERIFY(arc_buf_remove_ref(obuf, db));
1093 	db->db.db_size = size;
1094 
1095 	if (db->db_level == 0) {
1096 		ASSERT3U(db->db_last_dirty->dr_txg, ==, tx->tx_txg);
1097 		db->db_last_dirty->dt.dl.dr_data = buf;
1098 	}
1099 	mutex_exit(&db->db_mtx);
1100 
1101 	dnode_willuse_space(dn, size-osize, tx);
1102 	DB_DNODE_EXIT(db);
1103 }
1104 
1105 void
1106 dbuf_release_bp(dmu_buf_impl_t *db)
1107 {
1108 	objset_t *os = db->db_objset;
1109 
1110 	ASSERT(dsl_pool_sync_context(dmu_objset_pool(os)));
1111 	ASSERT(arc_released(os->os_phys_buf) ||
1112 	    list_link_active(&os->os_dsl_dataset->ds_synced_link));
1113 	ASSERT(db->db_parent == NULL || arc_released(db->db_parent->db_buf));
1114 
1115 	(void) arc_release(db->db_buf, db);
1116 }
1117 
1118 /*
1119  * We already have a dirty record for this TXG, and we are being
1120  * dirtied again.
1121  */
1122 static void
1123 dbuf_redirty(dbuf_dirty_record_t *dr)
1124 {
1125 	dmu_buf_impl_t *db = dr->dr_dbuf;
1126 
1127 	ASSERT(MUTEX_HELD(&db->db_mtx));
1128 
1129 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID) {
1130 		/*
1131 		 * If this buffer has already been written out,
1132 		 * we now need to reset its state.
1133 		 */
1134 		dbuf_unoverride(dr);
1135 		if (db->db.db_object != DMU_META_DNODE_OBJECT &&
1136 		    db->db_state != DB_NOFILL) {
1137 			/* Already released on initial dirty, so just thaw. */
1138 			ASSERT(arc_released(db->db_buf));
1139 			arc_buf_thaw(db->db_buf);
1140 		}
1141 	}
1142 }
1143 
1144 dbuf_dirty_record_t *
1145 dbuf_dirty(dmu_buf_impl_t *db, dmu_tx_t *tx)
1146 {
1147 	dnode_t *dn;
1148 	objset_t *os;
1149 	dbuf_dirty_record_t **drp, *dr;
1150 	int drop_struct_lock = FALSE;
1151 	boolean_t do_free_accounting = B_FALSE;
1152 	int txgoff = tx->tx_txg & TXG_MASK;
1153 
1154 	ASSERT(tx->tx_txg != 0);
1155 	ASSERT(!refcount_is_zero(&db->db_holds));
1156 	DMU_TX_DIRTY_BUF(tx, db);
1157 
1158 	DB_DNODE_ENTER(db);
1159 	dn = DB_DNODE(db);
1160 	/*
1161 	 * Shouldn't dirty a regular buffer in syncing context.  Private
1162 	 * objects may be dirtied in syncing context, but only if they
1163 	 * were already pre-dirtied in open context.
1164 	 */
1165 	ASSERT(!dmu_tx_is_syncing(tx) ||
1166 	    BP_IS_HOLE(dn->dn_objset->os_rootbp) ||
1167 	    DMU_OBJECT_IS_SPECIAL(dn->dn_object) ||
1168 	    dn->dn_objset->os_dsl_dataset == NULL);
1169 	/*
1170 	 * We make this assert for private objects as well, but after we
1171 	 * check if we're already dirty.  They are allowed to re-dirty
1172 	 * in syncing context.
1173 	 */
1174 	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT ||
1175 	    dn->dn_dirtyctx == DN_UNDIRTIED || dn->dn_dirtyctx ==
1176 	    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));
1177 
1178 	mutex_enter(&db->db_mtx);
1179 	/*
1180 	 * XXX make this true for indirects too?  The problem is that
1181 	 * transactions created with dmu_tx_create_assigned() from
1182 	 * syncing context don't bother holding ahead.
1183 	 */
1184 	ASSERT(db->db_level != 0 ||
1185 	    db->db_state == DB_CACHED || db->db_state == DB_FILL ||
1186 	    db->db_state == DB_NOFILL);
1187 
1188 	mutex_enter(&dn->dn_mtx);
1189 	/*
1190 	 * Don't set dirtyctx to SYNC if we're just modifying this as we
1191 	 * initialize the objset.
1192 	 */
1193 	if (dn->dn_dirtyctx == DN_UNDIRTIED &&
1194 	    !BP_IS_HOLE(dn->dn_objset->os_rootbp)) {
1195 		dn->dn_dirtyctx =
1196 		    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN);
1197 		ASSERT(dn->dn_dirtyctx_firstset == NULL);
1198 		dn->dn_dirtyctx_firstset = kmem_alloc(1, KM_SLEEP);
1199 	}
1200 	mutex_exit(&dn->dn_mtx);
1201 
1202 	if (db->db_blkid == DMU_SPILL_BLKID)
1203 		dn->dn_have_spill = B_TRUE;
1204 
1205 	/*
1206 	 * If this buffer is already dirty, we're done.
1207 	 */
1208 	drp = &db->db_last_dirty;
1209 	ASSERT(*drp == NULL || (*drp)->dr_txg <= tx->tx_txg ||
1210 	    db->db.db_object == DMU_META_DNODE_OBJECT);
1211 	while ((dr = *drp) != NULL && dr->dr_txg > tx->tx_txg)
1212 		drp = &dr->dr_next;
1213 	if (dr && dr->dr_txg == tx->tx_txg) {
1214 		DB_DNODE_EXIT(db);
1215 
1216 		dbuf_redirty(dr);
1217 		mutex_exit(&db->db_mtx);
1218 		return (dr);
1219 	}
1220 
1221 	/*
1222 	 * Only valid if not already dirty.
1223 	 */
1224 	ASSERT(dn->dn_object == 0 ||
1225 	    dn->dn_dirtyctx == DN_UNDIRTIED || dn->dn_dirtyctx ==
1226 	    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));
1227 
1228 	ASSERT3U(dn->dn_nlevels, >, db->db_level);
1229 	ASSERT((dn->dn_phys->dn_nlevels == 0 && db->db_level == 0) ||
1230 	    dn->dn_phys->dn_nlevels > db->db_level ||
1231 	    dn->dn_next_nlevels[txgoff] > db->db_level ||
1232 	    dn->dn_next_nlevels[(tx->tx_txg-1) & TXG_MASK] > db->db_level ||
1233 	    dn->dn_next_nlevels[(tx->tx_txg-2) & TXG_MASK] > db->db_level);
1234 
1235 	/*
1236 	 * We should only be dirtying in syncing context if it's the
1237 	 * mos or we're initializing the os or it's a special object.
1238 	 * However, we are allowed to dirty in syncing context provided
1239 	 * we already dirtied it in open context.  Hence we must make
1240 	 * this assertion only if we're not already dirty.
1241 	 */
1242 	os = dn->dn_objset;
1243 	ASSERT(!dmu_tx_is_syncing(tx) || DMU_OBJECT_IS_SPECIAL(dn->dn_object) ||
1244 	    os->os_dsl_dataset == NULL || BP_IS_HOLE(os->os_rootbp));
1245 	ASSERT(db->db.db_size != 0);
1246 
1247 	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);
1248 
1249 	if (db->db_blkid != DMU_BONUS_BLKID) {
1250 		/*
1251 		 * Update the accounting.
1252 		 * Note: we delay "free accounting" until after we drop
1253 		 * the db_mtx.  This keeps us from grabbing other locks
1254 		 * (and possibly deadlocking) in bp_get_dsize() while
1255 		 * also holding the db_mtx.
1256 		 */
1257 		dnode_willuse_space(dn, db->db.db_size, tx);
1258 		do_free_accounting = dbuf_block_freeable(db);
1259 	}
1260 
1261 	/*
1262 	 * If this buffer is dirty in an old transaction group we need
1263 	 * to make a copy of it so that the changes we make in this
1264 	 * transaction group won't leak out when we sync the older txg.
1265 	 */
1266 	dr = kmem_zalloc(sizeof (dbuf_dirty_record_t), KM_SLEEP);
1267 	if (db->db_level == 0) {
1268 		void *data_old = db->db_buf;
1269 
1270 		if (db->db_state != DB_NOFILL) {
1271 			if (db->db_blkid == DMU_BONUS_BLKID) {
1272 				dbuf_fix_old_data(db, tx->tx_txg);
1273 				data_old = db->db.db_data;
1274 			} else if (db->db.db_object != DMU_META_DNODE_OBJECT) {
1275 				/*
1276 				 * Release the data buffer from the cache so
1277 				 * that we can modify it without impacting
1278 				 * possible other users of this cached data
1279 				 * block.  Note that indirect blocks and
1280 				 * private objects are not released until the
1281 				 * syncing state (since they are only modified
1282 				 * then).
1283 				 */
1284 				arc_release(db->db_buf, db);
1285 				dbuf_fix_old_data(db, tx->tx_txg);
1286 				data_old = db->db_buf;
1287 			}
1288 			ASSERT(data_old != NULL);
1289 		}
1290 		dr->dt.dl.dr_data = data_old;
1291 	} else {
1292 		mutex_init(&dr->dt.di.dr_mtx, NULL, MUTEX_DEFAULT, NULL);
1293 		list_create(&dr->dt.di.dr_children,
1294 		    sizeof (dbuf_dirty_record_t),
1295 		    offsetof(dbuf_dirty_record_t, dr_dirty_node));
1296 	}
1297 	if (db->db_blkid != DMU_BONUS_BLKID && os->os_dsl_dataset != NULL)
1298 		dr->dr_accounted = db->db.db_size;
1299 	dr->dr_dbuf = db;
1300 	dr->dr_txg = tx->tx_txg;
1301 	dr->dr_next = *drp;
1302 	*drp = dr;
1303 
1304 	/*
1305 	 * We could have been freed_in_flight between the dbuf_noread
1306 	 * and dbuf_dirty.  We win, as though the dbuf_noread() had
1307 	 * happened after the free.
1308 	 */
1309 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
1310 	    db->db_blkid != DMU_SPILL_BLKID) {
1311 		mutex_enter(&dn->dn_mtx);
1312 		if (dn->dn_free_ranges[txgoff] != NULL) {
1313 			range_tree_clear(dn->dn_free_ranges[txgoff],
1314 			    db->db_blkid, 1);
1315 		}
1316 		mutex_exit(&dn->dn_mtx);
1317 		db->db_freed_in_flight = FALSE;
1318 	}
1319 
1320 	/*
1321 	 * This buffer is now part of this txg
1322 	 */
1323 	dbuf_add_ref(db, (void *)(uintptr_t)tx->tx_txg);
1324 	db->db_dirtycnt += 1;
1325 	ASSERT3U(db->db_dirtycnt, <=, 3);
1326 
1327 	mutex_exit(&db->db_mtx);
1328 
1329 	if (db->db_blkid == DMU_BONUS_BLKID ||
1330 	    db->db_blkid == DMU_SPILL_BLKID) {
1331 		mutex_enter(&dn->dn_mtx);
1332 		ASSERT(!list_link_active(&dr->dr_dirty_node));
1333 		list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
1334 		mutex_exit(&dn->dn_mtx);
1335 		dnode_setdirty(dn, tx);
1336 		DB_DNODE_EXIT(db);
1337 		return (dr);
1338 	} else if (do_free_accounting) {
1339 		blkptr_t *bp = db->db_blkptr;
1340 		int64_t willfree = (bp && !BP_IS_HOLE(bp)) ?
1341 		    bp_get_dsize(os->os_spa, bp) : db->db.db_size;
1342 		/*
1343 		 * This is only a guess -- if the dbuf is dirty
1344 		 * in a previous txg, we don't know how much
1345 		 * space it will use on disk yet.  We should
1346 		 * really have the struct_rwlock to access
1347 		 * db_blkptr, but since this is just a guess,
1348 		 * it's OK if we get an odd answer.
1349 		 */
1350 		ddt_prefetch(os->os_spa, bp);
1351 		dnode_willuse_space(dn, -willfree, tx);
1352 	}
1353 
1354 	if (!RW_WRITE_HELD(&dn->dn_struct_rwlock)) {
1355 		rw_enter(&dn->dn_struct_rwlock, RW_READER);
1356 		drop_struct_lock = TRUE;
1357 	}
1358 
1359 	if (db->db_level == 0) {
1360 		dnode_new_blkid(dn, db->db_blkid, tx, drop_struct_lock);
1361 		ASSERT(dn->dn_maxblkid >= db->db_blkid);
1362 	}
1363 
1364 	if (db->db_level+1 < dn->dn_nlevels) {
1365 		dmu_buf_impl_t *parent = db->db_parent;
1366 		dbuf_dirty_record_t *di;
1367 		int parent_held = FALSE;
1368 
1369 		if (db->db_parent == NULL || db->db_parent == dn->dn_dbuf) {
1370 			int epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
1371 
1372 			parent = dbuf_hold_level(dn, db->db_level+1,
1373 			    db->db_blkid >> epbs, FTAG);
1374 			ASSERT(parent != NULL);
1375 			parent_held = TRUE;
1376 		}
1377 		if (drop_struct_lock)
1378 			rw_exit(&dn->dn_struct_rwlock);
1379 		ASSERT3U(db->db_level+1, ==, parent->db_level);
1380 		di = dbuf_dirty(parent, tx);
1381 		if (parent_held)
1382 			dbuf_rele(parent, FTAG);
1383 
1384 		mutex_enter(&db->db_mtx);
1385 		/*
1386 		 * Since we've dropped the mutex, it's possible that
1387 		 * dbuf_undirty() might have changed this out from under us.
1388 		 */
1389 		if (db->db_last_dirty == dr ||
1390 		    dn->dn_object == DMU_META_DNODE_OBJECT) {
1391 			mutex_enter(&di->dt.di.dr_mtx);
1392 			ASSERT3U(di->dr_txg, ==, tx->tx_txg);
1393 			ASSERT(!list_link_active(&dr->dr_dirty_node));
1394 			list_insert_tail(&di->dt.di.dr_children, dr);
1395 			mutex_exit(&di->dt.di.dr_mtx);
1396 			dr->dr_parent = di;
1397 		}
1398 		mutex_exit(&db->db_mtx);
1399 	} else {
1400 		ASSERT(db->db_level+1 == dn->dn_nlevels);
1401 		ASSERT(db->db_blkid < dn->dn_nblkptr);
1402 		ASSERT(db->db_parent == NULL || db->db_parent == dn->dn_dbuf);
1403 		mutex_enter(&dn->dn_mtx);
1404 		ASSERT(!list_link_active(&dr->dr_dirty_node));
1405 		list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
1406 		mutex_exit(&dn->dn_mtx);
1407 		if (drop_struct_lock)
1408 			rw_exit(&dn->dn_struct_rwlock);
1409 	}
1410 
1411 	dnode_setdirty(dn, tx);
1412 	DB_DNODE_EXIT(db);
1413 	return (dr);
1414 }
1415 
1416 /*
1417  * Undirty a buffer in the transaction group referenced by the given
1418  * transaction.  Return whether this evicted the dbuf.
1419  */
1420 static boolean_t
1421 dbuf_undirty(dmu_buf_impl_t *db, dmu_tx_t *tx)
1422 {
1423 	dnode_t *dn;
1424 	uint64_t txg = tx->tx_txg;
1425 	dbuf_dirty_record_t *dr, **drp;
1426 
1427 	ASSERT(txg != 0);
1428 
1429 	/*
1430 	 * Due to our use of dn_nlevels below, this can only be called
1431 	 * in open context, unless we are operating on the MOS.
1432 	 * From syncing context, dn_nlevels may be different from the
1433 	 * dn_nlevels used when dbuf was dirtied.
1434 	 */
1435 	ASSERT(db->db_objset ==
1436 	    dmu_objset_pool(db->db_objset)->dp_meta_objset ||
1437 	    txg != spa_syncing_txg(dmu_objset_spa(db->db_objset)));
1438 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1439 	ASSERT0(db->db_level);
1440 	ASSERT(MUTEX_HELD(&db->db_mtx));
1441 
1442 	/*
1443 	 * If this buffer is not dirty, we're done.
1444 	 */
1445 	for (drp = &db->db_last_dirty; (dr = *drp) != NULL; drp = &dr->dr_next)
1446 		if (dr->dr_txg <= txg)
1447 			break;
1448 	if (dr == NULL || dr->dr_txg < txg)
1449 		return (B_FALSE);
1450 	ASSERT(dr->dr_txg == txg);
1451 	ASSERT(dr->dr_dbuf == db);
1452 
1453 	DB_DNODE_ENTER(db);
1454 	dn = DB_DNODE(db);
1455 
1456 	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);
1457 
1458 	ASSERT(db->db.db_size != 0);
1459 
1460 	dsl_pool_undirty_space(dmu_objset_pool(dn->dn_objset),
1461 	    dr->dr_accounted, txg);
1462 
1463 	*drp = dr->dr_next;
1464 
1465 	/*
1466 	 * Note that there are three places in dbuf_dirty()
1467 	 * where this dirty record may be put on a list.
1468 	 * Make sure to do a list_remove corresponding to
1469 	 * every one of those list_insert calls.
1470 	 */
1471 	if (dr->dr_parent) {
1472 		mutex_enter(&dr->dr_parent->dt.di.dr_mtx);
1473 		list_remove(&dr->dr_parent->dt.di.dr_children, dr);
1474 		mutex_exit(&dr->dr_parent->dt.di.dr_mtx);
1475 	} else if (db->db_blkid == DMU_SPILL_BLKID ||
1476 	    db->db_level + 1 == dn->dn_nlevels) {
1477 		ASSERT(db->db_blkptr == NULL || db->db_parent == dn->dn_dbuf);
1478 		mutex_enter(&dn->dn_mtx);
1479 		list_remove(&dn->dn_dirty_records[txg & TXG_MASK], dr);
1480 		mutex_exit(&dn->dn_mtx);
1481 	}
1482 	DB_DNODE_EXIT(db);
1483 
1484 	if (db->db_state != DB_NOFILL) {
1485 		dbuf_unoverride(dr);
1486 
1487 		ASSERT(db->db_buf != NULL);
1488 		ASSERT(dr->dt.dl.dr_data != NULL);
1489 		if (dr->dt.dl.dr_data != db->db_buf)
1490 			VERIFY(arc_buf_remove_ref(dr->dt.dl.dr_data, db));
1491 	}
1492 
1493 	kmem_free(dr, sizeof (dbuf_dirty_record_t));
1494 
1495 	ASSERT(db->db_dirtycnt > 0);
1496 	db->db_dirtycnt -= 1;
1497 
1498 	if (refcount_remove(&db->db_holds, (void *)(uintptr_t)txg) == 0) {
1499 		arc_buf_t *buf = db->db_buf;
1500 
1501 		ASSERT(db->db_state == DB_NOFILL || arc_released(buf));
1502 		dbuf_clear_data(db);
1503 		VERIFY(arc_buf_remove_ref(buf, db));
1504 		dbuf_evict(db);
1505 		return (B_TRUE);
1506 	}
1507 
1508 	return (B_FALSE);
1509 }
1510 
1511 void
1512 dmu_buf_will_dirty(dmu_buf_t *db_fake, dmu_tx_t *tx)
1513 {
1514 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1515 	int rf = DB_RF_MUST_SUCCEED | DB_RF_NOPREFETCH;
1516 
1517 	ASSERT(tx->tx_txg != 0);
1518 	ASSERT(!refcount_is_zero(&db->db_holds));
1519 
1520 	/*
1521 	 * Quick check for dirtyness.  For already dirty blocks, this
1522 	 * reduces runtime of this function by >90%, and overall performance
1523 	 * by 50% for some workloads (e.g. file deletion with indirect blocks
1524 	 * cached).
1525 	 */
1526 	mutex_enter(&db->db_mtx);
1527 	dbuf_dirty_record_t *dr;
1528 	for (dr = db->db_last_dirty;
1529 	    dr != NULL && dr->dr_txg >= tx->tx_txg; dr = dr->dr_next) {
1530 		/*
1531 		 * It's possible that it is already dirty but not cached,
1532 		 * because there are some calls to dbuf_dirty() that don't
1533 		 * go through dmu_buf_will_dirty().
1534 		 */
1535 		if (dr->dr_txg == tx->tx_txg && db->db_state == DB_CACHED) {
1536 			/* This dbuf is already dirty and cached. */
1537 			dbuf_redirty(dr);
1538 			mutex_exit(&db->db_mtx);
1539 			return;
1540 		}
1541 	}
1542 	mutex_exit(&db->db_mtx);
1543 
1544 	DB_DNODE_ENTER(db);
1545 	if (RW_WRITE_HELD(&DB_DNODE(db)->dn_struct_rwlock))
1546 		rf |= DB_RF_HAVESTRUCT;
1547 	DB_DNODE_EXIT(db);
1548 	(void) dbuf_read(db, NULL, rf);
1549 	(void) dbuf_dirty(db, tx);
1550 }
1551 
1552 void
1553 dmu_buf_will_not_fill(dmu_buf_t *db_fake, dmu_tx_t *tx)
1554 {
1555 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1556 
1557 	db->db_state = DB_NOFILL;
1558 
1559 	dmu_buf_will_fill(db_fake, tx);
1560 }
1561 
1562 void
1563 dmu_buf_will_fill(dmu_buf_t *db_fake, dmu_tx_t *tx)
1564 {
1565 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1566 
1567 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1568 	ASSERT(tx->tx_txg != 0);
1569 	ASSERT(db->db_level == 0);
1570 	ASSERT(!refcount_is_zero(&db->db_holds));
1571 
1572 	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT ||
1573 	    dmu_tx_private_ok(tx));
1574 
1575 	dbuf_noread(db);
1576 	(void) dbuf_dirty(db, tx);
1577 }
1578 
1579 #pragma weak dmu_buf_fill_done = dbuf_fill_done
1580 /* ARGSUSED */
1581 void
1582 dbuf_fill_done(dmu_buf_impl_t *db, dmu_tx_t *tx)
1583 {
1584 	mutex_enter(&db->db_mtx);
1585 	DBUF_VERIFY(db);
1586 
1587 	if (db->db_state == DB_FILL) {
1588 		if (db->db_level == 0 && db->db_freed_in_flight) {
1589 			ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1590 			/* we were freed while filling */
1591 			/* XXX dbuf_undirty? */
1592 			bzero(db->db.db_data, db->db.db_size);
1593 			db->db_freed_in_flight = FALSE;
1594 		}
1595 		db->db_state = DB_CACHED;
1596 		cv_broadcast(&db->db_changed);
1597 	}
1598 	mutex_exit(&db->db_mtx);
1599 }
1600 
1601 void
1602 dmu_buf_write_embedded(dmu_buf_t *dbuf, void *data,
1603     bp_embedded_type_t etype, enum zio_compress comp,
1604     int uncompressed_size, int compressed_size, int byteorder,
1605     dmu_tx_t *tx)
1606 {
1607 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)dbuf;
1608 	struct dirty_leaf *dl;
1609 	dmu_object_type_t type;
1610 
1611 	if (etype == BP_EMBEDDED_TYPE_DATA) {
1612 		ASSERT(spa_feature_is_active(dmu_objset_spa(db->db_objset),
1613 		    SPA_FEATURE_EMBEDDED_DATA));
1614 	}
1615 
1616 	DB_DNODE_ENTER(db);
1617 	type = DB_DNODE(db)->dn_type;
1618 	DB_DNODE_EXIT(db);
1619 
1620 	ASSERT0(db->db_level);
1621 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1622 
1623 	dmu_buf_will_not_fill(dbuf, tx);
1624 
1625 	ASSERT3U(db->db_last_dirty->dr_txg, ==, tx->tx_txg);
1626 	dl = &db->db_last_dirty->dt.dl;
1627 	encode_embedded_bp_compressed(&dl->dr_overridden_by,
1628 	    data, comp, uncompressed_size, compressed_size);
1629 	BPE_SET_ETYPE(&dl->dr_overridden_by, etype);
1630 	BP_SET_TYPE(&dl->dr_overridden_by, type);
1631 	BP_SET_LEVEL(&dl->dr_overridden_by, 0);
1632 	BP_SET_BYTEORDER(&dl->dr_overridden_by, byteorder);
1633 
1634 	dl->dr_override_state = DR_OVERRIDDEN;
1635 	dl->dr_overridden_by.blk_birth = db->db_last_dirty->dr_txg;
1636 }
1637 
1638 /*
1639  * Directly assign a provided arc buf to a given dbuf if it's not referenced
1640  * by anybody except our caller. Otherwise copy arcbuf's contents to dbuf.
1641  */
1642 void
1643 dbuf_assign_arcbuf(dmu_buf_impl_t *db, arc_buf_t *buf, dmu_tx_t *tx)
1644 {
1645 	ASSERT(!refcount_is_zero(&db->db_holds));
1646 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1647 	ASSERT(db->db_level == 0);
1648 	ASSERT(DBUF_GET_BUFC_TYPE(db) == ARC_BUFC_DATA);
1649 	ASSERT(buf != NULL);
1650 	ASSERT(arc_buf_size(buf) == db->db.db_size);
1651 	ASSERT(tx->tx_txg != 0);
1652 
1653 	arc_return_buf(buf, db);
1654 	ASSERT(arc_released(buf));
1655 
1656 	mutex_enter(&db->db_mtx);
1657 
1658 	while (db->db_state == DB_READ || db->db_state == DB_FILL)
1659 		cv_wait(&db->db_changed, &db->db_mtx);
1660 
1661 	ASSERT(db->db_state == DB_CACHED || db->db_state == DB_UNCACHED);
1662 
1663 	if (db->db_state == DB_CACHED &&
1664 	    refcount_count(&db->db_holds) - 1 > db->db_dirtycnt) {
1665 		mutex_exit(&db->db_mtx);
1666 		(void) dbuf_dirty(db, tx);
1667 		bcopy(buf->b_data, db->db.db_data, db->db.db_size);
1668 		VERIFY(arc_buf_remove_ref(buf, db));
1669 		xuio_stat_wbuf_copied();
1670 		return;
1671 	}
1672 
1673 	xuio_stat_wbuf_nocopy();
1674 	if (db->db_state == DB_CACHED) {
1675 		dbuf_dirty_record_t *dr = db->db_last_dirty;
1676 
1677 		ASSERT(db->db_buf != NULL);
1678 		if (dr != NULL && dr->dr_txg == tx->tx_txg) {
1679 			ASSERT(dr->dt.dl.dr_data == db->db_buf);
1680 			if (!arc_released(db->db_buf)) {
1681 				ASSERT(dr->dt.dl.dr_override_state ==
1682 				    DR_OVERRIDDEN);
1683 				arc_release(db->db_buf, db);
1684 			}
1685 			dr->dt.dl.dr_data = buf;
1686 			VERIFY(arc_buf_remove_ref(db->db_buf, db));
1687 		} else if (dr == NULL || dr->dt.dl.dr_data != db->db_buf) {
1688 			arc_release(db->db_buf, db);
1689 			VERIFY(arc_buf_remove_ref(db->db_buf, db));
1690 		}
1691 		db->db_buf = NULL;
1692 	}
1693 	ASSERT(db->db_buf == NULL);
1694 	dbuf_set_data(db, buf);
1695 	db->db_state = DB_FILL;
1696 	mutex_exit(&db->db_mtx);
1697 	(void) dbuf_dirty(db, tx);
1698 	dmu_buf_fill_done(&db->db, tx);
1699 }
1700 
1701 /*
1702  * "Clear" the contents of this dbuf.  This will mark the dbuf
1703  * EVICTING and clear *most* of its references.  Unfortunately,
1704  * when we are not holding the dn_dbufs_mtx, we can't clear the
1705  * entry in the dn_dbufs list.  We have to wait until dbuf_destroy()
1706  * in this case.  For callers from the DMU we will usually see:
1707  *	dbuf_clear()->arc_clear_callback()->dbuf_do_evict()->dbuf_destroy()
1708  * For the arc callback, we will usually see:
1709  *	dbuf_do_evict()->dbuf_clear();dbuf_destroy()
1710  * Sometimes, though, we will get a mix of these two:
1711  *	DMU: dbuf_clear()->arc_clear_callback()
1712  *	ARC: dbuf_do_evict()->dbuf_destroy()
1713  *
1714  * This routine will dissociate the dbuf from the arc, by calling
1715  * arc_clear_callback(), but will not evict the data from the ARC.
1716  */
1717 void
1718 dbuf_clear(dmu_buf_impl_t *db)
1719 {
1720 	dnode_t *dn;
1721 	dmu_buf_impl_t *parent = db->db_parent;
1722 	dmu_buf_impl_t *dndb;
1723 	boolean_t dbuf_gone = B_FALSE;
1724 
1725 	ASSERT(MUTEX_HELD(&db->db_mtx));
1726 	ASSERT(refcount_is_zero(&db->db_holds));
1727 
1728 	dbuf_evict_user(db);
1729 
1730 	if (db->db_state == DB_CACHED) {
1731 		ASSERT(db->db.db_data != NULL);
1732 		if (db->db_blkid == DMU_BONUS_BLKID) {
1733 			zio_buf_free(db->db.db_data, DN_MAX_BONUSLEN);
1734 			arc_space_return(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
1735 		}
1736 		db->db.db_data = NULL;
1737 		db->db_state = DB_UNCACHED;
1738 	}
1739 
1740 	ASSERT(db->db_state == DB_UNCACHED || db->db_state == DB_NOFILL);
1741 	ASSERT(db->db_data_pending == NULL);
1742 
1743 	db->db_state = DB_EVICTING;
1744 	db->db_blkptr = NULL;
1745 
1746 	DB_DNODE_ENTER(db);
1747 	dn = DB_DNODE(db);
1748 	dndb = dn->dn_dbuf;
1749 	if (db->db_blkid != DMU_BONUS_BLKID && MUTEX_HELD(&dn->dn_dbufs_mtx)) {
1750 		avl_remove(&dn->dn_dbufs, db);
1751 		atomic_dec_32(&dn->dn_dbufs_count);
1752 		membar_producer();
1753 		DB_DNODE_EXIT(db);
1754 		/*
1755 		 * Decrementing the dbuf count means that the hold corresponding
1756 		 * to the removed dbuf is no longer discounted in dnode_move(),
1757 		 * so the dnode cannot be moved until after we release the hold.
1758 		 * The membar_producer() ensures visibility of the decremented
1759 		 * value in dnode_move(), since DB_DNODE_EXIT doesn't actually
1760 		 * release any lock.
1761 		 */
1762 		dnode_rele(dn, db);
1763 		db->db_dnode_handle = NULL;
1764 	} else {
1765 		DB_DNODE_EXIT(db);
1766 	}
1767 
1768 	if (db->db_buf)
1769 		dbuf_gone = arc_clear_callback(db->db_buf);
1770 
1771 	if (!dbuf_gone)
1772 		mutex_exit(&db->db_mtx);
1773 
1774 	/*
1775 	 * If this dbuf is referenced from an indirect dbuf,
1776 	 * decrement the ref count on the indirect dbuf.
1777 	 */
1778 	if (parent && parent != dndb)
1779 		dbuf_rele(parent, db);
1780 }
1781 
1782 /*
1783  * Note: While bpp will always be updated if the function returns success,
1784  * parentp will not be updated if the dnode does not have dn_dbuf filled in;
1785  * this happens when the dnode is the meta-dnode, or a userused or groupused
1786  * object.
1787  */
1788 static int
1789 dbuf_findbp(dnode_t *dn, int level, uint64_t blkid, int fail_sparse,
1790     dmu_buf_impl_t **parentp, blkptr_t **bpp)
1791 {
1792 	int nlevels, epbs;
1793 
1794 	*parentp = NULL;
1795 	*bpp = NULL;
1796 
1797 	ASSERT(blkid != DMU_BONUS_BLKID);
1798 
1799 	if (blkid == DMU_SPILL_BLKID) {
1800 		mutex_enter(&dn->dn_mtx);
1801 		if (dn->dn_have_spill &&
1802 		    (dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR))
1803 			*bpp = &dn->dn_phys->dn_spill;
1804 		else
1805 			*bpp = NULL;
1806 		dbuf_add_ref(dn->dn_dbuf, NULL);
1807 		*parentp = dn->dn_dbuf;
1808 		mutex_exit(&dn->dn_mtx);
1809 		return (0);
1810 	}
1811 
1812 	if (dn->dn_phys->dn_nlevels == 0)
1813 		nlevels = 1;
1814 	else
1815 		nlevels = dn->dn_phys->dn_nlevels;
1816 
1817 	epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
1818 
1819 	ASSERT3U(level * epbs, <, 64);
1820 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
1821 	if (level >= nlevels ||
1822 	    (blkid > (dn->dn_phys->dn_maxblkid >> (level * epbs)))) {
1823 		/* the buffer has no parent yet */
1824 		return (SET_ERROR(ENOENT));
1825 	} else if (level < nlevels-1) {
1826 		/* this block is referenced from an indirect block */
1827 		int err = dbuf_hold_impl(dn, level+1,
1828 		    blkid >> epbs, fail_sparse, FALSE, NULL, parentp);
1829 		if (err)
1830 			return (err);
1831 		err = dbuf_read(*parentp, NULL,
1832 		    (DB_RF_HAVESTRUCT | DB_RF_NOPREFETCH | DB_RF_CANFAIL));
1833 		if (err) {
1834 			dbuf_rele(*parentp, NULL);
1835 			*parentp = NULL;
1836 			return (err);
1837 		}
1838 		*bpp = ((blkptr_t *)(*parentp)->db.db_data) +
1839 		    (blkid & ((1ULL << epbs) - 1));
1840 		return (0);
1841 	} else {
1842 		/* the block is referenced from the dnode */
1843 		ASSERT3U(level, ==, nlevels-1);
1844 		ASSERT(dn->dn_phys->dn_nblkptr == 0 ||
1845 		    blkid < dn->dn_phys->dn_nblkptr);
1846 		if (dn->dn_dbuf) {
1847 			dbuf_add_ref(dn->dn_dbuf, NULL);
1848 			*parentp = dn->dn_dbuf;
1849 		}
1850 		*bpp = &dn->dn_phys->dn_blkptr[blkid];
1851 		return (0);
1852 	}
1853 }
1854 
1855 static dmu_buf_impl_t *
1856 dbuf_create(dnode_t *dn, uint8_t level, uint64_t blkid,
1857     dmu_buf_impl_t *parent, blkptr_t *blkptr)
1858 {
1859 	objset_t *os = dn->dn_objset;
1860 	dmu_buf_impl_t *db, *odb;
1861 
1862 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
1863 	ASSERT(dn->dn_type != DMU_OT_NONE);
1864 
1865 	db = kmem_cache_alloc(dbuf_cache, KM_SLEEP);
1866 
1867 	db->db_objset = os;
1868 	db->db.db_object = dn->dn_object;
1869 	db->db_level = level;
1870 	db->db_blkid = blkid;
1871 	db->db_last_dirty = NULL;
1872 	db->db_dirtycnt = 0;
1873 	db->db_dnode_handle = dn->dn_handle;
1874 	db->db_parent = parent;
1875 	db->db_blkptr = blkptr;
1876 
1877 	db->db_user = NULL;
1878 	db->db_immediate_evict = 0;
1879 	db->db_freed_in_flight = 0;
1880 
1881 	if (blkid == DMU_BONUS_BLKID) {
1882 		ASSERT3P(parent, ==, dn->dn_dbuf);
1883 		db->db.db_size = DN_MAX_BONUSLEN -
1884 		    (dn->dn_nblkptr-1) * sizeof (blkptr_t);
1885 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
1886 		db->db.db_offset = DMU_BONUS_BLKID;
1887 		db->db_state = DB_UNCACHED;
1888 		/* the bonus dbuf is not placed in the hash table */
1889 		arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
1890 		return (db);
1891 	} else if (blkid == DMU_SPILL_BLKID) {
1892 		db->db.db_size = (blkptr != NULL) ?
1893 		    BP_GET_LSIZE(blkptr) : SPA_MINBLOCKSIZE;
1894 		db->db.db_offset = 0;
1895 	} else {
1896 		int blocksize =
1897 		    db->db_level ? 1 << dn->dn_indblkshift : dn->dn_datablksz;
1898 		db->db.db_size = blocksize;
1899 		db->db.db_offset = db->db_blkid * blocksize;
1900 	}
1901 
1902 	/*
1903 	 * Hold the dn_dbufs_mtx while we get the new dbuf
1904 	 * in the hash table *and* added to the dbufs list.
1905 	 * This prevents a possible deadlock with someone
1906 	 * trying to look up this dbuf before its added to the
1907 	 * dn_dbufs list.
1908 	 */
1909 	mutex_enter(&dn->dn_dbufs_mtx);
1910 	db->db_state = DB_EVICTING;
1911 	if ((odb = dbuf_hash_insert(db)) != NULL) {
1912 		/* someone else inserted it first */
1913 		kmem_cache_free(dbuf_cache, db);
1914 		mutex_exit(&dn->dn_dbufs_mtx);
1915 		return (odb);
1916 	}
1917 	avl_add(&dn->dn_dbufs, db);
1918 	if (db->db_level == 0 && db->db_blkid >=
1919 	    dn->dn_unlisted_l0_blkid)
1920 		dn->dn_unlisted_l0_blkid = db->db_blkid + 1;
1921 	db->db_state = DB_UNCACHED;
1922 	mutex_exit(&dn->dn_dbufs_mtx);
1923 	arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
1924 
1925 	if (parent && parent != dn->dn_dbuf)
1926 		dbuf_add_ref(parent, db);
1927 
1928 	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT ||
1929 	    refcount_count(&dn->dn_holds) > 0);
1930 	(void) refcount_add(&dn->dn_holds, db);
1931 	atomic_inc_32(&dn->dn_dbufs_count);
1932 
1933 	dprintf_dbuf(db, "db=%p\n", db);
1934 
1935 	return (db);
1936 }
1937 
1938 static int
1939 dbuf_do_evict(void *private)
1940 {
1941 	dmu_buf_impl_t *db = private;
1942 
1943 	if (!MUTEX_HELD(&db->db_mtx))
1944 		mutex_enter(&db->db_mtx);
1945 
1946 	ASSERT(refcount_is_zero(&db->db_holds));
1947 
1948 	if (db->db_state != DB_EVICTING) {
1949 		ASSERT(db->db_state == DB_CACHED);
1950 		DBUF_VERIFY(db);
1951 		db->db_buf = NULL;
1952 		dbuf_evict(db);
1953 	} else {
1954 		mutex_exit(&db->db_mtx);
1955 		dbuf_destroy(db);
1956 	}
1957 	return (0);
1958 }
1959 
1960 static void
1961 dbuf_destroy(dmu_buf_impl_t *db)
1962 {
1963 	ASSERT(refcount_is_zero(&db->db_holds));
1964 
1965 	if (db->db_blkid != DMU_BONUS_BLKID) {
1966 		/*
1967 		 * If this dbuf is still on the dn_dbufs list,
1968 		 * remove it from that list.
1969 		 */
1970 		if (db->db_dnode_handle != NULL) {
1971 			dnode_t *dn;
1972 
1973 			DB_DNODE_ENTER(db);
1974 			dn = DB_DNODE(db);
1975 			mutex_enter(&dn->dn_dbufs_mtx);
1976 			avl_remove(&dn->dn_dbufs, db);
1977 			atomic_dec_32(&dn->dn_dbufs_count);
1978 			mutex_exit(&dn->dn_dbufs_mtx);
1979 			DB_DNODE_EXIT(db);
1980 			/*
1981 			 * Decrementing the dbuf count means that the hold
1982 			 * corresponding to the removed dbuf is no longer
1983 			 * discounted in dnode_move(), so the dnode cannot be
1984 			 * moved until after we release the hold.
1985 			 */
1986 			dnode_rele(dn, db);
1987 			db->db_dnode_handle = NULL;
1988 		}
1989 		dbuf_hash_remove(db);
1990 	}
1991 	db->db_parent = NULL;
1992 	db->db_buf = NULL;
1993 
1994 	ASSERT(db->db.db_data == NULL);
1995 	ASSERT(db->db_hash_next == NULL);
1996 	ASSERT(db->db_blkptr == NULL);
1997 	ASSERT(db->db_data_pending == NULL);
1998 
1999 	kmem_cache_free(dbuf_cache, db);
2000 	arc_space_return(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
2001 }
2002 
2003 typedef struct dbuf_prefetch_arg {
2004 	spa_t *dpa_spa;	/* The spa to issue the prefetch in. */
2005 	zbookmark_phys_t dpa_zb; /* The target block to prefetch. */
2006 	int dpa_epbs; /* Entries (blkptr_t's) Per Block Shift. */
2007 	int dpa_curlevel; /* The current level that we're reading */
2008 	zio_priority_t dpa_prio; /* The priority I/Os should be issued at. */
2009 	zio_t *dpa_zio; /* The parent zio_t for all prefetches. */
2010 	arc_flags_t dpa_aflags; /* Flags to pass to the final prefetch. */
2011 } dbuf_prefetch_arg_t;
2012 
2013 /*
2014  * Actually issue the prefetch read for the block given.
2015  */
2016 static void
2017 dbuf_issue_final_prefetch(dbuf_prefetch_arg_t *dpa, blkptr_t *bp)
2018 {
2019 	if (BP_IS_HOLE(bp) || BP_IS_EMBEDDED(bp))
2020 		return;
2021 
2022 	arc_flags_t aflags =
2023 	    dpa->dpa_aflags | ARC_FLAG_NOWAIT | ARC_FLAG_PREFETCH;
2024 
2025 	ASSERT3U(dpa->dpa_curlevel, ==, BP_GET_LEVEL(bp));
2026 	ASSERT3U(dpa->dpa_curlevel, ==, dpa->dpa_zb.zb_level);
2027 	ASSERT(dpa->dpa_zio != NULL);
2028 	(void) arc_read(dpa->dpa_zio, dpa->dpa_spa, bp, NULL, NULL,
2029 	    dpa->dpa_prio, ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
2030 	    &aflags, &dpa->dpa_zb);
2031 }
2032 
2033 /*
2034  * Called when an indirect block above our prefetch target is read in.  This
2035  * will either read in the next indirect block down the tree or issue the actual
2036  * prefetch if the next block down is our target.
2037  */
2038 static void
2039 dbuf_prefetch_indirect_done(zio_t *zio, arc_buf_t *abuf, void *private)
2040 {
2041 	dbuf_prefetch_arg_t *dpa = private;
2042 
2043 	ASSERT3S(dpa->dpa_zb.zb_level, <, dpa->dpa_curlevel);
2044 	ASSERT3S(dpa->dpa_curlevel, >, 0);
2045 	if (zio != NULL) {
2046 		ASSERT3S(BP_GET_LEVEL(zio->io_bp), ==, dpa->dpa_curlevel);
2047 		ASSERT3U(BP_GET_LSIZE(zio->io_bp), ==, zio->io_size);
2048 		ASSERT3P(zio->io_spa, ==, dpa->dpa_spa);
2049 	}
2050 
2051 	dpa->dpa_curlevel--;
2052 
2053 	uint64_t nextblkid = dpa->dpa_zb.zb_blkid >>
2054 	    (dpa->dpa_epbs * (dpa->dpa_curlevel - dpa->dpa_zb.zb_level));
2055 	blkptr_t *bp = ((blkptr_t *)abuf->b_data) +
2056 	    P2PHASE(nextblkid, 1ULL << dpa->dpa_epbs);
2057 	if (BP_IS_HOLE(bp) || (zio != NULL && zio->io_error != 0)) {
2058 		kmem_free(dpa, sizeof (*dpa));
2059 	} else if (dpa->dpa_curlevel == dpa->dpa_zb.zb_level) {
2060 		ASSERT3U(nextblkid, ==, dpa->dpa_zb.zb_blkid);
2061 		dbuf_issue_final_prefetch(dpa, bp);
2062 		kmem_free(dpa, sizeof (*dpa));
2063 	} else {
2064 		arc_flags_t iter_aflags = ARC_FLAG_NOWAIT;
2065 		zbookmark_phys_t zb;
2066 
2067 		ASSERT3U(dpa->dpa_curlevel, ==, BP_GET_LEVEL(bp));
2068 
2069 		SET_BOOKMARK(&zb, dpa->dpa_zb.zb_objset,
2070 		    dpa->dpa_zb.zb_object, dpa->dpa_curlevel, nextblkid);
2071 
2072 		(void) arc_read(dpa->dpa_zio, dpa->dpa_spa,
2073 		    bp, dbuf_prefetch_indirect_done, dpa, dpa->dpa_prio,
2074 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
2075 		    &iter_aflags, &zb);
2076 	}
2077 	(void) arc_buf_remove_ref(abuf, private);
2078 }
2079 
2080 /*
2081  * Issue prefetch reads for the given block on the given level.  If the indirect
2082  * blocks above that block are not in memory, we will read them in
2083  * asynchronously.  As a result, this call never blocks waiting for a read to
2084  * complete.
2085  */
2086 void
2087 dbuf_prefetch(dnode_t *dn, int64_t level, uint64_t blkid, zio_priority_t prio,
2088     arc_flags_t aflags)
2089 {
2090 	blkptr_t bp;
2091 	int epbs, nlevels, curlevel;
2092 	uint64_t curblkid;
2093 
2094 	ASSERT(blkid != DMU_BONUS_BLKID);
2095 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
2096 
2097 	if (blkid > dn->dn_maxblkid)
2098 		return;
2099 
2100 	if (dnode_block_freed(dn, blkid))
2101 		return;
2102 
2103 	/*
2104 	 * This dnode hasn't been written to disk yet, so there's nothing to
2105 	 * prefetch.
2106 	 */
2107 	nlevels = dn->dn_phys->dn_nlevels;
2108 	if (level >= nlevels || dn->dn_phys->dn_nblkptr == 0)
2109 		return;
2110 
2111 	epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
2112 	if (dn->dn_phys->dn_maxblkid < blkid << (epbs * level))
2113 		return;
2114 
2115 	dmu_buf_impl_t *db = dbuf_find(dn->dn_objset, dn->dn_object,
2116 	    level, blkid);
2117 	if (db != NULL) {
2118 		mutex_exit(&db->db_mtx);
2119 		/*
2120 		 * This dbuf already exists.  It is either CACHED, or
2121 		 * (we assume) about to be read or filled.
2122 		 */
2123 		return;
2124 	}
2125 
2126 	/*
2127 	 * Find the closest ancestor (indirect block) of the target block
2128 	 * that is present in the cache.  In this indirect block, we will
2129 	 * find the bp that is at curlevel, curblkid.
2130 	 */
2131 	curlevel = level;
2132 	curblkid = blkid;
2133 	while (curlevel < nlevels - 1) {
2134 		int parent_level = curlevel + 1;
2135 		uint64_t parent_blkid = curblkid >> epbs;
2136 		dmu_buf_impl_t *db;
2137 
2138 		if (dbuf_hold_impl(dn, parent_level, parent_blkid,
2139 		    FALSE, TRUE, FTAG, &db) == 0) {
2140 			blkptr_t *bpp = db->db_buf->b_data;
2141 			bp = bpp[P2PHASE(curblkid, 1 << epbs)];
2142 			dbuf_rele(db, FTAG);
2143 			break;
2144 		}
2145 
2146 		curlevel = parent_level;
2147 		curblkid = parent_blkid;
2148 	}
2149 
2150 	if (curlevel == nlevels - 1) {
2151 		/* No cached indirect blocks found. */
2152 		ASSERT3U(curblkid, <, dn->dn_phys->dn_nblkptr);
2153 		bp = dn->dn_phys->dn_blkptr[curblkid];
2154 	}
2155 	if (BP_IS_HOLE(&bp))
2156 		return;
2157 
2158 	ASSERT3U(curlevel, ==, BP_GET_LEVEL(&bp));
2159 
2160 	zio_t *pio = zio_root(dmu_objset_spa(dn->dn_objset), NULL, NULL,
2161 	    ZIO_FLAG_CANFAIL);
2162 
2163 	dbuf_prefetch_arg_t *dpa = kmem_zalloc(sizeof (*dpa), KM_SLEEP);
2164 	dsl_dataset_t *ds = dn->dn_objset->os_dsl_dataset;
2165 	SET_BOOKMARK(&dpa->dpa_zb, ds != NULL ? ds->ds_object : DMU_META_OBJSET,
2166 	    dn->dn_object, level, blkid);
2167 	dpa->dpa_curlevel = curlevel;
2168 	dpa->dpa_prio = prio;
2169 	dpa->dpa_aflags = aflags;
2170 	dpa->dpa_spa = dn->dn_objset->os_spa;
2171 	dpa->dpa_epbs = epbs;
2172 	dpa->dpa_zio = pio;
2173 
2174 	/*
2175 	 * If we have the indirect just above us, no need to do the asynchronous
2176 	 * prefetch chain; we'll just run the last step ourselves.  If we're at
2177 	 * a higher level, though, we want to issue the prefetches for all the
2178 	 * indirect blocks asynchronously, so we can go on with whatever we were
2179 	 * doing.
2180 	 */
2181 	if (curlevel == level) {
2182 		ASSERT3U(curblkid, ==, blkid);
2183 		dbuf_issue_final_prefetch(dpa, &bp);
2184 		kmem_free(dpa, sizeof (*dpa));
2185 	} else {
2186 		arc_flags_t iter_aflags = ARC_FLAG_NOWAIT;
2187 		zbookmark_phys_t zb;
2188 
2189 		SET_BOOKMARK(&zb, ds != NULL ? ds->ds_object : DMU_META_OBJSET,
2190 		    dn->dn_object, curlevel, curblkid);
2191 		(void) arc_read(dpa->dpa_zio, dpa->dpa_spa,
2192 		    &bp, dbuf_prefetch_indirect_done, dpa, prio,
2193 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
2194 		    &iter_aflags, &zb);
2195 	}
2196 	/*
2197 	 * We use pio here instead of dpa_zio since it's possible that
2198 	 * dpa may have already been freed.
2199 	 */
2200 	zio_nowait(pio);
2201 }
2202 
2203 /*
2204  * Returns with db_holds incremented, and db_mtx not held.
2205  * Note: dn_struct_rwlock must be held.
2206  */
2207 int
2208 dbuf_hold_impl(dnode_t *dn, uint8_t level, uint64_t blkid,
2209     boolean_t fail_sparse, boolean_t fail_uncached,
2210     void *tag, dmu_buf_impl_t **dbp)
2211 {
2212 	dmu_buf_impl_t *db, *parent = NULL;
2213 
2214 	ASSERT(blkid != DMU_BONUS_BLKID);
2215 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
2216 	ASSERT3U(dn->dn_nlevels, >, level);
2217 
2218 	*dbp = NULL;
2219 top:
2220 	/* dbuf_find() returns with db_mtx held */
2221 	db = dbuf_find(dn->dn_objset, dn->dn_object, level, blkid);
2222 
2223 	if (db == NULL) {
2224 		blkptr_t *bp = NULL;
2225 		int err;
2226 
2227 		if (fail_uncached)
2228 			return (SET_ERROR(ENOENT));
2229 
2230 		ASSERT3P(parent, ==, NULL);
2231 		err = dbuf_findbp(dn, level, blkid, fail_sparse, &parent, &bp);
2232 		if (fail_sparse) {
2233 			if (err == 0 && bp && BP_IS_HOLE(bp))
2234 				err = SET_ERROR(ENOENT);
2235 			if (err) {
2236 				if (parent)
2237 					dbuf_rele(parent, NULL);
2238 				return (err);
2239 			}
2240 		}
2241 		if (err && err != ENOENT)
2242 			return (err);
2243 		db = dbuf_create(dn, level, blkid, parent, bp);
2244 	}
2245 
2246 	if (fail_uncached && db->db_state != DB_CACHED) {
2247 		mutex_exit(&db->db_mtx);
2248 		return (SET_ERROR(ENOENT));
2249 	}
2250 
2251 	if (db->db_buf && refcount_is_zero(&db->db_holds)) {
2252 		arc_buf_add_ref(db->db_buf, db);
2253 		if (db->db_buf->b_data == NULL) {
2254 			dbuf_clear(db);
2255 			if (parent) {
2256 				dbuf_rele(parent, NULL);
2257 				parent = NULL;
2258 			}
2259 			goto top;
2260 		}
2261 		ASSERT3P(db->db.db_data, ==, db->db_buf->b_data);
2262 	}
2263 
2264 	ASSERT(db->db_buf == NULL || arc_referenced(db->db_buf));
2265 
2266 	/*
2267 	 * If this buffer is currently syncing out, and we are are
2268 	 * still referencing it from db_data, we need to make a copy
2269 	 * of it in case we decide we want to dirty it again in this txg.
2270 	 */
2271 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
2272 	    dn->dn_object != DMU_META_DNODE_OBJECT &&
2273 	    db->db_state == DB_CACHED && db->db_data_pending) {
2274 		dbuf_dirty_record_t *dr = db->db_data_pending;
2275 
2276 		if (dr->dt.dl.dr_data == db->db_buf) {
2277 			arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
2278 
2279 			dbuf_set_data(db,
2280 			    arc_buf_alloc(dn->dn_objset->os_spa,
2281 			    db->db.db_size, db, type));
2282 			bcopy(dr->dt.dl.dr_data->b_data, db->db.db_data,
2283 			    db->db.db_size);
2284 		}
2285 	}
2286 
2287 	(void) refcount_add(&db->db_holds, tag);
2288 	DBUF_VERIFY(db);
2289 	mutex_exit(&db->db_mtx);
2290 
2291 	/* NOTE: we can't rele the parent until after we drop the db_mtx */
2292 	if (parent)
2293 		dbuf_rele(parent, NULL);
2294 
2295 	ASSERT3P(DB_DNODE(db), ==, dn);
2296 	ASSERT3U(db->db_blkid, ==, blkid);
2297 	ASSERT3U(db->db_level, ==, level);
2298 	*dbp = db;
2299 
2300 	return (0);
2301 }
2302 
2303 dmu_buf_impl_t *
2304 dbuf_hold(dnode_t *dn, uint64_t blkid, void *tag)
2305 {
2306 	return (dbuf_hold_level(dn, 0, blkid, tag));
2307 }
2308 
2309 dmu_buf_impl_t *
2310 dbuf_hold_level(dnode_t *dn, int level, uint64_t blkid, void *tag)
2311 {
2312 	dmu_buf_impl_t *db;
2313 	int err = dbuf_hold_impl(dn, level, blkid, FALSE, FALSE, tag, &db);
2314 	return (err ? NULL : db);
2315 }
2316 
2317 void
2318 dbuf_create_bonus(dnode_t *dn)
2319 {
2320 	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));
2321 
2322 	ASSERT(dn->dn_bonus == NULL);
2323 	dn->dn_bonus = dbuf_create(dn, 0, DMU_BONUS_BLKID, dn->dn_dbuf, NULL);
2324 }
2325 
2326 int
2327 dbuf_spill_set_blksz(dmu_buf_t *db_fake, uint64_t blksz, dmu_tx_t *tx)
2328 {
2329 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2330 	dnode_t *dn;
2331 
2332 	if (db->db_blkid != DMU_SPILL_BLKID)
2333 		return (SET_ERROR(ENOTSUP));
2334 	if (blksz == 0)
2335 		blksz = SPA_MINBLOCKSIZE;
2336 	ASSERT3U(blksz, <=, spa_maxblocksize(dmu_objset_spa(db->db_objset)));
2337 	blksz = P2ROUNDUP(blksz, SPA_MINBLOCKSIZE);
2338 
2339 	DB_DNODE_ENTER(db);
2340 	dn = DB_DNODE(db);
2341 	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
2342 	dbuf_new_size(db, blksz, tx);
2343 	rw_exit(&dn->dn_struct_rwlock);
2344 	DB_DNODE_EXIT(db);
2345 
2346 	return (0);
2347 }
2348 
2349 void
2350 dbuf_rm_spill(dnode_t *dn, dmu_tx_t *tx)
2351 {
2352 	dbuf_free_range(dn, DMU_SPILL_BLKID, DMU_SPILL_BLKID, tx);
2353 }
2354 
2355 #pragma weak dmu_buf_add_ref = dbuf_add_ref
2356 void
2357 dbuf_add_ref(dmu_buf_impl_t *db, void *tag)
2358 {
2359 	int64_t holds = refcount_add(&db->db_holds, tag);
2360 	ASSERT(holds > 1);
2361 }
2362 
2363 #pragma weak dmu_buf_try_add_ref = dbuf_try_add_ref
2364 boolean_t
2365 dbuf_try_add_ref(dmu_buf_t *db_fake, objset_t *os, uint64_t obj, uint64_t blkid,
2366     void *tag)
2367 {
2368 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2369 	dmu_buf_impl_t *found_db;
2370 	boolean_t result = B_FALSE;
2371 
2372 	if (db->db_blkid == DMU_BONUS_BLKID)
2373 		found_db = dbuf_find_bonus(os, obj);
2374 	else
2375 		found_db = dbuf_find(os, obj, 0, blkid);
2376 
2377 	if (found_db != NULL) {
2378 		if (db == found_db && dbuf_refcount(db) > db->db_dirtycnt) {
2379 			(void) refcount_add(&db->db_holds, tag);
2380 			result = B_TRUE;
2381 		}
2382 		mutex_exit(&db->db_mtx);
2383 	}
2384 	return (result);
2385 }
2386 
2387 /*
2388  * If you call dbuf_rele() you had better not be referencing the dnode handle
2389  * unless you have some other direct or indirect hold on the dnode. (An indirect
2390  * hold is a hold on one of the dnode's dbufs, including the bonus buffer.)
2391  * Without that, the dbuf_rele() could lead to a dnode_rele() followed by the
2392  * dnode's parent dbuf evicting its dnode handles.
2393  */
2394 void
2395 dbuf_rele(dmu_buf_impl_t *db, void *tag)
2396 {
2397 	mutex_enter(&db->db_mtx);
2398 	dbuf_rele_and_unlock(db, tag);
2399 }
2400 
2401 void
2402 dmu_buf_rele(dmu_buf_t *db, void *tag)
2403 {
2404 	dbuf_rele((dmu_buf_impl_t *)db, tag);
2405 }
2406 
2407 /*
2408  * dbuf_rele() for an already-locked dbuf.  This is necessary to allow
2409  * db_dirtycnt and db_holds to be updated atomically.
2410  */
2411 void
2412 dbuf_rele_and_unlock(dmu_buf_impl_t *db, void *tag)
2413 {
2414 	int64_t holds;
2415 
2416 	ASSERT(MUTEX_HELD(&db->db_mtx));
2417 	DBUF_VERIFY(db);
2418 
2419 	/*
2420 	 * Remove the reference to the dbuf before removing its hold on the
2421 	 * dnode so we can guarantee in dnode_move() that a referenced bonus
2422 	 * buffer has a corresponding dnode hold.
2423 	 */
2424 	holds = refcount_remove(&db->db_holds, tag);
2425 	ASSERT(holds >= 0);
2426 
2427 	/*
2428 	 * We can't freeze indirects if there is a possibility that they
2429 	 * may be modified in the current syncing context.
2430 	 */
2431 	if (db->db_buf && holds == (db->db_level == 0 ? db->db_dirtycnt : 0))
2432 		arc_buf_freeze(db->db_buf);
2433 
2434 	if (holds == db->db_dirtycnt &&
2435 	    db->db_level == 0 && db->db_immediate_evict)
2436 		dbuf_evict_user(db);
2437 
2438 	if (holds == 0) {
2439 		if (db->db_blkid == DMU_BONUS_BLKID) {
2440 			dnode_t *dn;
2441 
2442 			/*
2443 			 * If the dnode moves here, we cannot cross this
2444 			 * barrier until the move completes.
2445 			 */
2446 			DB_DNODE_ENTER(db);
2447 
2448 			dn = DB_DNODE(db);
2449 			atomic_dec_32(&dn->dn_dbufs_count);
2450 
2451 			/*
2452 			 * Decrementing the dbuf count means that the bonus
2453 			 * buffer's dnode hold is no longer discounted in
2454 			 * dnode_move(). The dnode cannot move until after
2455 			 * the dnode_rele_and_unlock() below.
2456 			 */
2457 			DB_DNODE_EXIT(db);
2458 
2459 			/*
2460 			 * Do not reference db after its lock is dropped.
2461 			 * Another thread may evict it.
2462 			 */
2463 			mutex_exit(&db->db_mtx);
2464 
2465 			/*
2466 			 * If the dnode has been freed, evict the bonus
2467 			 * buffer immediately.	The data in the bonus
2468 			 * buffer is no longer relevant and this prevents
2469 			 * a stale bonus buffer from being associated
2470 			 * with this dnode_t should the dnode_t be reused
2471 			 * prior to being destroyed.
2472 			 */
2473 			mutex_enter(&dn->dn_mtx);
2474 			if (dn->dn_type == DMU_OT_NONE ||
2475 			    dn->dn_free_txg != 0) {
2476 				/*
2477 				 * Drop dn_mtx.  It is a leaf lock and
2478 				 * cannot be held when dnode_evict_bonus()
2479 				 * acquires other locks in order to
2480 				 * perform the eviction.
2481 				 *
2482 				 * Freed dnodes cannot be reused until the
2483 				 * last hold is released.  Since this bonus
2484 				 * buffer has a hold, the dnode will remain
2485 				 * in the free state, even without dn_mtx
2486 				 * held, until the dnode_rele_and_unlock()
2487 				 * below.
2488 				 */
2489 				mutex_exit(&dn->dn_mtx);
2490 				dnode_evict_bonus(dn);
2491 				mutex_enter(&dn->dn_mtx);
2492 			}
2493 			dnode_rele_and_unlock(dn, db);
2494 		} else if (db->db_buf == NULL) {
2495 			/*
2496 			 * This is a special case: we never associated this
2497 			 * dbuf with any data allocated from the ARC.
2498 			 */
2499 			ASSERT(db->db_state == DB_UNCACHED ||
2500 			    db->db_state == DB_NOFILL);
2501 			dbuf_evict(db);
2502 		} else if (arc_released(db->db_buf)) {
2503 			arc_buf_t *buf = db->db_buf;
2504 			/*
2505 			 * This dbuf has anonymous data associated with it.
2506 			 */
2507 			dbuf_clear_data(db);
2508 			VERIFY(arc_buf_remove_ref(buf, db));
2509 			dbuf_evict(db);
2510 		} else {
2511 			VERIFY(!arc_buf_remove_ref(db->db_buf, db));
2512 
2513 			/*
2514 			 * A dbuf will be eligible for eviction if either the
2515 			 * 'primarycache' property is set or a duplicate
2516 			 * copy of this buffer is already cached in the arc.
2517 			 *
2518 			 * In the case of the 'primarycache' a buffer
2519 			 * is considered for eviction if it matches the
2520 			 * criteria set in the property.
2521 			 *
2522 			 * To decide if our buffer is considered a
2523 			 * duplicate, we must call into the arc to determine
2524 			 * if multiple buffers are referencing the same
2525 			 * block on-disk. If so, then we simply evict
2526 			 * ourselves.
2527 			 */
2528 			if (!DBUF_IS_CACHEABLE(db)) {
2529 				if (db->db_blkptr != NULL &&
2530 				    !BP_IS_HOLE(db->db_blkptr) &&
2531 				    !BP_IS_EMBEDDED(db->db_blkptr)) {
2532 					spa_t *spa =
2533 					    dmu_objset_spa(db->db_objset);
2534 					blkptr_t bp = *db->db_blkptr;
2535 					dbuf_clear(db);
2536 					arc_freed(spa, &bp);
2537 				} else {
2538 					dbuf_clear(db);
2539 				}
2540 			} else if (db->db_objset->os_evicting ||
2541 			    arc_buf_eviction_needed(db->db_buf)) {
2542 				dbuf_clear(db);
2543 			} else {
2544 				mutex_exit(&db->db_mtx);
2545 			}
2546 		}
2547 	} else {
2548 		mutex_exit(&db->db_mtx);
2549 	}
2550 }
2551 
2552 #pragma weak dmu_buf_refcount = dbuf_refcount
2553 uint64_t
2554 dbuf_refcount(dmu_buf_impl_t *db)
2555 {
2556 	return (refcount_count(&db->db_holds));
2557 }
2558 
2559 void *
2560 dmu_buf_replace_user(dmu_buf_t *db_fake, dmu_buf_user_t *old_user,
2561     dmu_buf_user_t *new_user)
2562 {
2563 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2564 
2565 	mutex_enter(&db->db_mtx);
2566 	dbuf_verify_user(db, DBVU_NOT_EVICTING);
2567 	if (db->db_user == old_user)
2568 		db->db_user = new_user;
2569 	else
2570 		old_user = db->db_user;
2571 	dbuf_verify_user(db, DBVU_NOT_EVICTING);
2572 	mutex_exit(&db->db_mtx);
2573 
2574 	return (old_user);
2575 }
2576 
2577 void *
2578 dmu_buf_set_user(dmu_buf_t *db_fake, dmu_buf_user_t *user)
2579 {
2580 	return (dmu_buf_replace_user(db_fake, NULL, user));
2581 }
2582 
2583 void *
2584 dmu_buf_set_user_ie(dmu_buf_t *db_fake, dmu_buf_user_t *user)
2585 {
2586 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2587 
2588 	db->db_immediate_evict = TRUE;
2589 	return (dmu_buf_set_user(db_fake, user));
2590 }
2591 
2592 void *
2593 dmu_buf_remove_user(dmu_buf_t *db_fake, dmu_buf_user_t *user)
2594 {
2595 	return (dmu_buf_replace_user(db_fake, user, NULL));
2596 }
2597 
2598 void *
2599 dmu_buf_get_user(dmu_buf_t *db_fake)
2600 {
2601 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2602 
2603 	dbuf_verify_user(db, DBVU_NOT_EVICTING);
2604 	return (db->db_user);
2605 }
2606 
2607 void
2608 dmu_buf_user_evict_wait()
2609 {
2610 	taskq_wait(dbu_evict_taskq);
2611 }
2612 
2613 boolean_t
2614 dmu_buf_freeable(dmu_buf_t *dbuf)
2615 {
2616 	boolean_t res = B_FALSE;
2617 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)dbuf;
2618 
2619 	if (db->db_blkptr)
2620 		res = dsl_dataset_block_freeable(db->db_objset->os_dsl_dataset,
2621 		    db->db_blkptr, db->db_blkptr->blk_birth);
2622 
2623 	return (res);
2624 }
2625 
2626 blkptr_t *
2627 dmu_buf_get_blkptr(dmu_buf_t *db)
2628 {
2629 	dmu_buf_impl_t *dbi = (dmu_buf_impl_t *)db;
2630 	return (dbi->db_blkptr);
2631 }
2632 
2633 static void
2634 dbuf_check_blkptr(dnode_t *dn, dmu_buf_impl_t *db)
2635 {
2636 	/* ASSERT(dmu_tx_is_syncing(tx) */
2637 	ASSERT(MUTEX_HELD(&db->db_mtx));
2638 
2639 	if (db->db_blkptr != NULL)
2640 		return;
2641 
2642 	if (db->db_blkid == DMU_SPILL_BLKID) {
2643 		db->db_blkptr = &dn->dn_phys->dn_spill;
2644 		BP_ZERO(db->db_blkptr);
2645 		return;
2646 	}
2647 	if (db->db_level == dn->dn_phys->dn_nlevels-1) {
2648 		/*
2649 		 * This buffer was allocated at a time when there was
2650 		 * no available blkptrs from the dnode, or it was
2651 		 * inappropriate to hook it in (i.e., nlevels mis-match).
2652 		 */
2653 		ASSERT(db->db_blkid < dn->dn_phys->dn_nblkptr);
2654 		ASSERT(db->db_parent == NULL);
2655 		db->db_parent = dn->dn_dbuf;
2656 		db->db_blkptr = &dn->dn_phys->dn_blkptr[db->db_blkid];
2657 		DBUF_VERIFY(db);
2658 	} else {
2659 		dmu_buf_impl_t *parent = db->db_parent;
2660 		int epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
2661 
2662 		ASSERT(dn->dn_phys->dn_nlevels > 1);
2663 		if (parent == NULL) {
2664 			mutex_exit(&db->db_mtx);
2665 			rw_enter(&dn->dn_struct_rwlock, RW_READER);
2666 			parent = dbuf_hold_level(dn, db->db_level + 1,
2667 			    db->db_blkid >> epbs, db);
2668 			rw_exit(&dn->dn_struct_rwlock);
2669 			mutex_enter(&db->db_mtx);
2670 			db->db_parent = parent;
2671 		}
2672 		db->db_blkptr = (blkptr_t *)parent->db.db_data +
2673 		    (db->db_blkid & ((1ULL << epbs) - 1));
2674 		DBUF_VERIFY(db);
2675 	}
2676 }
2677 
2678 static void
2679 dbuf_sync_indirect(dbuf_dirty_record_t *dr, dmu_tx_t *tx)
2680 {
2681 	dmu_buf_impl_t *db = dr->dr_dbuf;
2682 	dnode_t *dn;
2683 	zio_t *zio;
2684 
2685 	ASSERT(dmu_tx_is_syncing(tx));
2686 
2687 	dprintf_dbuf_bp(db, db->db_blkptr, "blkptr=%p", db->db_blkptr);
2688 
2689 	mutex_enter(&db->db_mtx);
2690 
2691 	ASSERT(db->db_level > 0);
2692 	DBUF_VERIFY(db);
2693 
2694 	/* Read the block if it hasn't been read yet. */
2695 	if (db->db_buf == NULL) {
2696 		mutex_exit(&db->db_mtx);
2697 		(void) dbuf_read(db, NULL, DB_RF_MUST_SUCCEED);
2698 		mutex_enter(&db->db_mtx);
2699 	}
2700 	ASSERT3U(db->db_state, ==, DB_CACHED);
2701 	ASSERT(db->db_buf != NULL);
2702 
2703 	DB_DNODE_ENTER(db);
2704 	dn = DB_DNODE(db);
2705 	/* Indirect block size must match what the dnode thinks it is. */
2706 	ASSERT3U(db->db.db_size, ==, 1<<dn->dn_phys->dn_indblkshift);
2707 	dbuf_check_blkptr(dn, db);
2708 	DB_DNODE_EXIT(db);
2709 
2710 	/* Provide the pending dirty record to child dbufs */
2711 	db->db_data_pending = dr;
2712 
2713 	mutex_exit(&db->db_mtx);
2714 	dbuf_write(dr, db->db_buf, tx);
2715 
2716 	zio = dr->dr_zio;
2717 	mutex_enter(&dr->dt.di.dr_mtx);
2718 	dbuf_sync_list(&dr->dt.di.dr_children, db->db_level - 1, tx);
2719 	ASSERT(list_head(&dr->dt.di.dr_children) == NULL);
2720 	mutex_exit(&dr->dt.di.dr_mtx);
2721 	zio_nowait(zio);
2722 }
2723 
2724 static void
2725 dbuf_sync_leaf(dbuf_dirty_record_t *dr, dmu_tx_t *tx)
2726 {
2727 	arc_buf_t **datap = &dr->dt.dl.dr_data;
2728 	dmu_buf_impl_t *db = dr->dr_dbuf;
2729 	dnode_t *dn;
2730 	objset_t *os;
2731 	uint64_t txg = tx->tx_txg;
2732 
2733 	ASSERT(dmu_tx_is_syncing(tx));
2734 
2735 	dprintf_dbuf_bp(db, db->db_blkptr, "blkptr=%p", db->db_blkptr);
2736 
2737 	mutex_enter(&db->db_mtx);
2738 	/*
2739 	 * To be synced, we must be dirtied.  But we
2740 	 * might have been freed after the dirty.
2741 	 */
2742 	if (db->db_state == DB_UNCACHED) {
2743 		/* This buffer has been freed since it was dirtied */
2744 		ASSERT(db->db.db_data == NULL);
2745 	} else if (db->db_state == DB_FILL) {
2746 		/* This buffer was freed and is now being re-filled */
2747 		ASSERT(db->db.db_data != dr->dt.dl.dr_data);
2748 	} else {
2749 		ASSERT(db->db_state == DB_CACHED || db->db_state == DB_NOFILL);
2750 	}
2751 	DBUF_VERIFY(db);
2752 
2753 	DB_DNODE_ENTER(db);
2754 	dn = DB_DNODE(db);
2755 
2756 	if (db->db_blkid == DMU_SPILL_BLKID) {
2757 		mutex_enter(&dn->dn_mtx);
2758 		dn->dn_phys->dn_flags |= DNODE_FLAG_SPILL_BLKPTR;
2759 		mutex_exit(&dn->dn_mtx);
2760 	}
2761 
2762 	/*
2763 	 * If this is a bonus buffer, simply copy the bonus data into the
2764 	 * dnode.  It will be written out when the dnode is synced (and it
2765 	 * will be synced, since it must have been dirty for dbuf_sync to
2766 	 * be called).
2767 	 */
2768 	if (db->db_blkid == DMU_BONUS_BLKID) {
2769 		dbuf_dirty_record_t **drp;
2770 
2771 		ASSERT(*datap != NULL);
2772 		ASSERT0(db->db_level);
2773 		ASSERT3U(dn->dn_phys->dn_bonuslen, <=, DN_MAX_BONUSLEN);
2774 		bcopy(*datap, DN_BONUS(dn->dn_phys), dn->dn_phys->dn_bonuslen);
2775 		DB_DNODE_EXIT(db);
2776 
2777 		if (*datap != db->db.db_data) {
2778 			zio_buf_free(*datap, DN_MAX_BONUSLEN);
2779 			arc_space_return(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
2780 		}
2781 		db->db_data_pending = NULL;
2782 		drp = &db->db_last_dirty;
2783 		while (*drp != dr)
2784 			drp = &(*drp)->dr_next;
2785 		ASSERT(dr->dr_next == NULL);
2786 		ASSERT(dr->dr_dbuf == db);
2787 		*drp = dr->dr_next;
2788 		kmem_free(dr, sizeof (dbuf_dirty_record_t));
2789 		ASSERT(db->db_dirtycnt > 0);
2790 		db->db_dirtycnt -= 1;
2791 		dbuf_rele_and_unlock(db, (void *)(uintptr_t)txg);
2792 		return;
2793 	}
2794 
2795 	os = dn->dn_objset;
2796 
2797 	/*
2798 	 * This function may have dropped the db_mtx lock allowing a dmu_sync
2799 	 * operation to sneak in. As a result, we need to ensure that we
2800 	 * don't check the dr_override_state until we have returned from
2801 	 * dbuf_check_blkptr.
2802 	 */
2803 	dbuf_check_blkptr(dn, db);
2804 
2805 	/*
2806 	 * If this buffer is in the middle of an immediate write,
2807 	 * wait for the synchronous IO to complete.
2808 	 */
2809 	while (dr->dt.dl.dr_override_state == DR_IN_DMU_SYNC) {
2810 		ASSERT(dn->dn_object != DMU_META_DNODE_OBJECT);
2811 		cv_wait(&db->db_changed, &db->db_mtx);
2812 		ASSERT(dr->dt.dl.dr_override_state != DR_NOT_OVERRIDDEN);
2813 	}
2814 
2815 	if (db->db_state != DB_NOFILL &&
2816 	    dn->dn_object != DMU_META_DNODE_OBJECT &&
2817 	    refcount_count(&db->db_holds) > 1 &&
2818 	    dr->dt.dl.dr_override_state != DR_OVERRIDDEN &&
2819 	    *datap == db->db_buf) {
2820 		/*
2821 		 * If this buffer is currently "in use" (i.e., there
2822 		 * are active holds and db_data still references it),
2823 		 * then make a copy before we start the write so that
2824 		 * any modifications from the open txg will not leak
2825 		 * into this write.
2826 		 *
2827 		 * NOTE: this copy does not need to be made for
2828 		 * objects only modified in the syncing context (e.g.
2829 		 * DNONE_DNODE blocks).
2830 		 */
2831 		int blksz = arc_buf_size(*datap);
2832 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
2833 		*datap = arc_buf_alloc(os->os_spa, blksz, db, type);
2834 		bcopy(db->db.db_data, (*datap)->b_data, blksz);
2835 	}
2836 	db->db_data_pending = dr;
2837 
2838 	mutex_exit(&db->db_mtx);
2839 
2840 	dbuf_write(dr, *datap, tx);
2841 
2842 	ASSERT(!list_link_active(&dr->dr_dirty_node));
2843 	if (dn->dn_object == DMU_META_DNODE_OBJECT) {
2844 		list_insert_tail(&dn->dn_dirty_records[txg&TXG_MASK], dr);
2845 		DB_DNODE_EXIT(db);
2846 	} else {
2847 		/*
2848 		 * Although zio_nowait() does not "wait for an IO", it does
2849 		 * initiate the IO. If this is an empty write it seems plausible
2850 		 * that the IO could actually be completed before the nowait
2851 		 * returns. We need to DB_DNODE_EXIT() first in case
2852 		 * zio_nowait() invalidates the dbuf.
2853 		 */
2854 		DB_DNODE_EXIT(db);
2855 		zio_nowait(dr->dr_zio);
2856 	}
2857 }
2858 
2859 void
2860 dbuf_sync_list(list_t *list, int level, dmu_tx_t *tx)
2861 {
2862 	dbuf_dirty_record_t *dr;
2863 
2864 	while (dr = list_head(list)) {
2865 		if (dr->dr_zio != NULL) {
2866 			/*
2867 			 * If we find an already initialized zio then we
2868 			 * are processing the meta-dnode, and we have finished.
2869 			 * The dbufs for all dnodes are put back on the list
2870 			 * during processing, so that we can zio_wait()
2871 			 * these IOs after initiating all child IOs.
2872 			 */
2873 			ASSERT3U(dr->dr_dbuf->db.db_object, ==,
2874 			    DMU_META_DNODE_OBJECT);
2875 			break;
2876 		}
2877 		if (dr->dr_dbuf->db_blkid != DMU_BONUS_BLKID &&
2878 		    dr->dr_dbuf->db_blkid != DMU_SPILL_BLKID) {
2879 			VERIFY3U(dr->dr_dbuf->db_level, ==, level);
2880 		}
2881 		list_remove(list, dr);
2882 		if (dr->dr_dbuf->db_level > 0)
2883 			dbuf_sync_indirect(dr, tx);
2884 		else
2885 			dbuf_sync_leaf(dr, tx);
2886 	}
2887 }
2888 
2889 /* ARGSUSED */
2890 static void
2891 dbuf_write_ready(zio_t *zio, arc_buf_t *buf, void *vdb)
2892 {
2893 	dmu_buf_impl_t *db = vdb;
2894 	dnode_t *dn;
2895 	blkptr_t *bp = zio->io_bp;
2896 	blkptr_t *bp_orig = &zio->io_bp_orig;
2897 	spa_t *spa = zio->io_spa;
2898 	int64_t delta;
2899 	uint64_t fill = 0;
2900 	int i;
2901 
2902 	ASSERT3P(db->db_blkptr, ==, bp);
2903 
2904 	DB_DNODE_ENTER(db);
2905 	dn = DB_DNODE(db);
2906 	delta = bp_get_dsize_sync(spa, bp) - bp_get_dsize_sync(spa, bp_orig);
2907 	dnode_diduse_space(dn, delta - zio->io_prev_space_delta);
2908 	zio->io_prev_space_delta = delta;
2909 
2910 	if (bp->blk_birth != 0) {
2911 		ASSERT((db->db_blkid != DMU_SPILL_BLKID &&
2912 		    BP_GET_TYPE(bp) == dn->dn_type) ||
2913 		    (db->db_blkid == DMU_SPILL_BLKID &&
2914 		    BP_GET_TYPE(bp) == dn->dn_bonustype) ||
2915 		    BP_IS_EMBEDDED(bp));
2916 		ASSERT(BP_GET_LEVEL(bp) == db->db_level);
2917 	}
2918 
2919 	mutex_enter(&db->db_mtx);
2920 
2921 #ifdef ZFS_DEBUG
2922 	if (db->db_blkid == DMU_SPILL_BLKID) {
2923 		ASSERT(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR);
2924 		ASSERT(!(BP_IS_HOLE(db->db_blkptr)) &&
2925 		    db->db_blkptr == &dn->dn_phys->dn_spill);
2926 	}
2927 #endif
2928 
2929 	if (db->db_level == 0) {
2930 		mutex_enter(&dn->dn_mtx);
2931 		if (db->db_blkid > dn->dn_phys->dn_maxblkid &&
2932 		    db->db_blkid != DMU_SPILL_BLKID)
2933 			dn->dn_phys->dn_maxblkid = db->db_blkid;
2934 		mutex_exit(&dn->dn_mtx);
2935 
2936 		if (dn->dn_type == DMU_OT_DNODE) {
2937 			dnode_phys_t *dnp = db->db.db_data;
2938 			for (i = db->db.db_size >> DNODE_SHIFT; i > 0;
2939 			    i--, dnp++) {
2940 				if (dnp->dn_type != DMU_OT_NONE)
2941 					fill++;
2942 			}
2943 		} else {
2944 			if (BP_IS_HOLE(bp)) {
2945 				fill = 0;
2946 			} else {
2947 				fill = 1;
2948 			}
2949 		}
2950 	} else {
2951 		blkptr_t *ibp = db->db.db_data;
2952 		ASSERT3U(db->db.db_size, ==, 1<<dn->dn_phys->dn_indblkshift);
2953 		for (i = db->db.db_size >> SPA_BLKPTRSHIFT; i > 0; i--, ibp++) {
2954 			if (BP_IS_HOLE(ibp))
2955 				continue;
2956 			fill += BP_GET_FILL(ibp);
2957 		}
2958 	}
2959 	DB_DNODE_EXIT(db);
2960 
2961 	if (!BP_IS_EMBEDDED(bp))
2962 		bp->blk_fill = fill;
2963 
2964 	mutex_exit(&db->db_mtx);
2965 }
2966 
2967 /*
2968  * The SPA will call this callback several times for each zio - once
2969  * for every physical child i/o (zio->io_phys_children times).  This
2970  * allows the DMU to monitor the progress of each logical i/o.  For example,
2971  * there may be 2 copies of an indirect block, or many fragments of a RAID-Z
2972  * block.  There may be a long delay before all copies/fragments are completed,
2973  * so this callback allows us to retire dirty space gradually, as the physical
2974  * i/os complete.
2975  */
2976 /* ARGSUSED */
2977 static void
2978 dbuf_write_physdone(zio_t *zio, arc_buf_t *buf, void *arg)
2979 {
2980 	dmu_buf_impl_t *db = arg;
2981 	objset_t *os = db->db_objset;
2982 	dsl_pool_t *dp = dmu_objset_pool(os);
2983 	dbuf_dirty_record_t *dr;
2984 	int delta = 0;
2985 
2986 	dr = db->db_data_pending;
2987 	ASSERT3U(dr->dr_txg, ==, zio->io_txg);
2988 
2989 	/*
2990 	 * The callback will be called io_phys_children times.  Retire one
2991 	 * portion of our dirty space each time we are called.  Any rounding
2992 	 * error will be cleaned up by dsl_pool_sync()'s call to
2993 	 * dsl_pool_undirty_space().
2994 	 */
2995 	delta = dr->dr_accounted / zio->io_phys_children;
2996 	dsl_pool_undirty_space(dp, delta, zio->io_txg);
2997 }
2998 
2999 /* ARGSUSED */
3000 static void
3001 dbuf_write_done(zio_t *zio, arc_buf_t *buf, void *vdb)
3002 {
3003 	dmu_buf_impl_t *db = vdb;
3004 	blkptr_t *bp_orig = &zio->io_bp_orig;
3005 	blkptr_t *bp = db->db_blkptr;
3006 	objset_t *os = db->db_objset;
3007 	dmu_tx_t *tx = os->os_synctx;
3008 	dbuf_dirty_record_t **drp, *dr;
3009 
3010 	ASSERT0(zio->io_error);
3011 	ASSERT(db->db_blkptr == bp);
3012 
3013 	/*
3014 	 * For nopwrites and rewrites we ensure that the bp matches our
3015 	 * original and bypass all the accounting.
3016 	 */
3017 	if (zio->io_flags & (ZIO_FLAG_IO_REWRITE | ZIO_FLAG_NOPWRITE)) {
3018 		ASSERT(BP_EQUAL(bp, bp_orig));
3019 	} else {
3020 		dsl_dataset_t *ds = os->os_dsl_dataset;
3021 		(void) dsl_dataset_block_kill(ds, bp_orig, tx, B_TRUE);
3022 		dsl_dataset_block_born(ds, bp, tx);
3023 	}
3024 
3025 	mutex_enter(&db->db_mtx);
3026 
3027 	DBUF_VERIFY(db);
3028 
3029 	drp = &db->db_last_dirty;
3030 	while ((dr = *drp) != db->db_data_pending)
3031 		drp = &dr->dr_next;
3032 	ASSERT(!list_link_active(&dr->dr_dirty_node));
3033 	ASSERT(dr->dr_dbuf == db);
3034 	ASSERT(dr->dr_next == NULL);
3035 	*drp = dr->dr_next;
3036 
3037 #ifdef ZFS_DEBUG
3038 	if (db->db_blkid == DMU_SPILL_BLKID) {
3039 		dnode_t *dn;
3040 
3041 		DB_DNODE_ENTER(db);
3042 		dn = DB_DNODE(db);
3043 		ASSERT(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR);
3044 		ASSERT(!(BP_IS_HOLE(db->db_blkptr)) &&
3045 		    db->db_blkptr == &dn->dn_phys->dn_spill);
3046 		DB_DNODE_EXIT(db);
3047 	}
3048 #endif
3049 
3050 	if (db->db_level == 0) {
3051 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
3052 		ASSERT(dr->dt.dl.dr_override_state == DR_NOT_OVERRIDDEN);
3053 		if (db->db_state != DB_NOFILL) {
3054 			if (dr->dt.dl.dr_data != db->db_buf)
3055 				VERIFY(arc_buf_remove_ref(dr->dt.dl.dr_data,
3056 				    db));
3057 			else if (!arc_released(db->db_buf))
3058 				arc_set_callback(db->db_buf, dbuf_do_evict, db);
3059 		}
3060 	} else {
3061 		dnode_t *dn;
3062 
3063 		DB_DNODE_ENTER(db);
3064 		dn = DB_DNODE(db);
3065 		ASSERT(list_head(&dr->dt.di.dr_children) == NULL);
3066 		ASSERT3U(db->db.db_size, ==, 1 << dn->dn_phys->dn_indblkshift);
3067 		if (!BP_IS_HOLE(db->db_blkptr)) {
3068 			int epbs =
3069 			    dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
3070 			ASSERT3U(db->db_blkid, <=,
3071 			    dn->dn_phys->dn_maxblkid >> (db->db_level * epbs));
3072 			ASSERT3U(BP_GET_LSIZE(db->db_blkptr), ==,
3073 			    db->db.db_size);
3074 			if (!arc_released(db->db_buf))
3075 				arc_set_callback(db->db_buf, dbuf_do_evict, db);
3076 		}
3077 		DB_DNODE_EXIT(db);
3078 		mutex_destroy(&dr->dt.di.dr_mtx);
3079 		list_destroy(&dr->dt.di.dr_children);
3080 	}
3081 	kmem_free(dr, sizeof (dbuf_dirty_record_t));
3082 
3083 	cv_broadcast(&db->db_changed);
3084 	ASSERT(db->db_dirtycnt > 0);
3085 	db->db_dirtycnt -= 1;
3086 	db->db_data_pending = NULL;
3087 	dbuf_rele_and_unlock(db, (void *)(uintptr_t)tx->tx_txg);
3088 }
3089 
3090 static void
3091 dbuf_write_nofill_ready(zio_t *zio)
3092 {
3093 	dbuf_write_ready(zio, NULL, zio->io_private);
3094 }
3095 
3096 static void
3097 dbuf_write_nofill_done(zio_t *zio)
3098 {
3099 	dbuf_write_done(zio, NULL, zio->io_private);
3100 }
3101 
3102 static void
3103 dbuf_write_override_ready(zio_t *zio)
3104 {
3105 	dbuf_dirty_record_t *dr = zio->io_private;
3106 	dmu_buf_impl_t *db = dr->dr_dbuf;
3107 
3108 	dbuf_write_ready(zio, NULL, db);
3109 }
3110 
3111 static void
3112 dbuf_write_override_done(zio_t *zio)
3113 {
3114 	dbuf_dirty_record_t *dr = zio->io_private;
3115 	dmu_buf_impl_t *db = dr->dr_dbuf;
3116 	blkptr_t *obp = &dr->dt.dl.dr_overridden_by;
3117 
3118 	mutex_enter(&db->db_mtx);
3119 	if (!BP_EQUAL(zio->io_bp, obp)) {
3120 		if (!BP_IS_HOLE(obp))
3121 			dsl_free(spa_get_dsl(zio->io_spa), zio->io_txg, obp);
3122 		arc_release(dr->dt.dl.dr_data, db);
3123 	}
3124 	mutex_exit(&db->db_mtx);
3125 
3126 	dbuf_write_done(zio, NULL, db);
3127 }
3128 
3129 /* Issue I/O to commit a dirty buffer to disk. */
3130 static void
3131 dbuf_write(dbuf_dirty_record_t *dr, arc_buf_t *data, dmu_tx_t *tx)
3132 {
3133 	dmu_buf_impl_t *db = dr->dr_dbuf;
3134 	dnode_t *dn;
3135 	objset_t *os;
3136 	dmu_buf_impl_t *parent = db->db_parent;
3137 	uint64_t txg = tx->tx_txg;
3138 	zbookmark_phys_t zb;
3139 	zio_prop_t zp;
3140 	zio_t *zio;
3141 	int wp_flag = 0;
3142 
3143 	DB_DNODE_ENTER(db);
3144 	dn = DB_DNODE(db);
3145 	os = dn->dn_objset;
3146 
3147 	if (db->db_state != DB_NOFILL) {
3148 		if (db->db_level > 0 || dn->dn_type == DMU_OT_DNODE) {
3149 			/*
3150 			 * Private object buffers are released here rather
3151 			 * than in dbuf_dirty() since they are only modified
3152 			 * in the syncing context and we don't want the
3153 			 * overhead of making multiple copies of the data.
3154 			 */
3155 			if (BP_IS_HOLE(db->db_blkptr)) {
3156 				arc_buf_thaw(data);
3157 			} else {
3158 				dbuf_release_bp(db);
3159 			}
3160 		}
3161 	}
3162 
3163 	if (parent != dn->dn_dbuf) {
3164 		/* Our parent is an indirect block. */
3165 		/* We have a dirty parent that has been scheduled for write. */
3166 		ASSERT(parent && parent->db_data_pending);
3167 		/* Our parent's buffer is one level closer to the dnode. */
3168 		ASSERT(db->db_level == parent->db_level-1);
3169 		/*
3170 		 * We're about to modify our parent's db_data by modifying
3171 		 * our block pointer, so the parent must be released.
3172 		 */
3173 		ASSERT(arc_released(parent->db_buf));
3174 		zio = parent->db_data_pending->dr_zio;
3175 	} else {
3176 		/* Our parent is the dnode itself. */
3177 		ASSERT((db->db_level == dn->dn_phys->dn_nlevels-1 &&
3178 		    db->db_blkid != DMU_SPILL_BLKID) ||
3179 		    (db->db_blkid == DMU_SPILL_BLKID && db->db_level == 0));
3180 		if (db->db_blkid != DMU_SPILL_BLKID)
3181 			ASSERT3P(db->db_blkptr, ==,
3182 			    &dn->dn_phys->dn_blkptr[db->db_blkid]);
3183 		zio = dn->dn_zio;
3184 	}
3185 
3186 	ASSERT(db->db_level == 0 || data == db->db_buf);
3187 	ASSERT3U(db->db_blkptr->blk_birth, <=, txg);
3188 	ASSERT(zio);
3189 
3190 	SET_BOOKMARK(&zb, os->os_dsl_dataset ?
3191 	    os->os_dsl_dataset->ds_object : DMU_META_OBJSET,
3192 	    db->db.db_object, db->db_level, db->db_blkid);
3193 
3194 	if (db->db_blkid == DMU_SPILL_BLKID)
3195 		wp_flag = WP_SPILL;
3196 	wp_flag |= (db->db_state == DB_NOFILL) ? WP_NOFILL : 0;
3197 
3198 	dmu_write_policy(os, dn, db->db_level, wp_flag, &zp);
3199 	DB_DNODE_EXIT(db);
3200 
3201 	if (db->db_level == 0 &&
3202 	    dr->dt.dl.dr_override_state == DR_OVERRIDDEN) {
3203 		/*
3204 		 * The BP for this block has been provided by open context
3205 		 * (by dmu_sync() or dmu_buf_write_embedded()).
3206 		 */
3207 		void *contents = (data != NULL) ? data->b_data : NULL;
3208 
3209 		dr->dr_zio = zio_write(zio, os->os_spa, txg,
3210 		    db->db_blkptr, contents, db->db.db_size, &zp,
3211 		    dbuf_write_override_ready, NULL, dbuf_write_override_done,
3212 		    dr, ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_MUSTSUCCEED, &zb);
3213 		mutex_enter(&db->db_mtx);
3214 		dr->dt.dl.dr_override_state = DR_NOT_OVERRIDDEN;
3215 		zio_write_override(dr->dr_zio, &dr->dt.dl.dr_overridden_by,
3216 		    dr->dt.dl.dr_copies, dr->dt.dl.dr_nopwrite);
3217 		mutex_exit(&db->db_mtx);
3218 	} else if (db->db_state == DB_NOFILL) {
3219 		ASSERT(zp.zp_checksum == ZIO_CHECKSUM_OFF ||
3220 		    zp.zp_checksum == ZIO_CHECKSUM_NOPARITY);
3221 		dr->dr_zio = zio_write(zio, os->os_spa, txg,
3222 		    db->db_blkptr, NULL, db->db.db_size, &zp,
3223 		    dbuf_write_nofill_ready, NULL, dbuf_write_nofill_done, db,
3224 		    ZIO_PRIORITY_ASYNC_WRITE,
3225 		    ZIO_FLAG_MUSTSUCCEED | ZIO_FLAG_NODATA, &zb);
3226 	} else {
3227 		ASSERT(arc_released(data));
3228 		dr->dr_zio = arc_write(zio, os->os_spa, txg,
3229 		    db->db_blkptr, data, DBUF_IS_L2CACHEABLE(db),
3230 		    DBUF_IS_L2COMPRESSIBLE(db), &zp, dbuf_write_ready,
3231 		    dbuf_write_physdone, dbuf_write_done, db,
3232 		    ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_MUSTSUCCEED, &zb);
3233 	}
3234 }
3235