xref: /illumos-gate/usr/src/uts/common/fs/zfs/dbuf.c (revision 268bbb2a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
24  * Copyright (c) 2012, 2017 by Delphix. All rights reserved.
25  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
26  * Copyright (c) 2013, Joyent, Inc. All rights reserved.
27  * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
28  * Copyright (c) 2014 Integros [integros.com]
29  */
30 
31 #include <sys/zfs_context.h>
32 #include <sys/dmu.h>
33 #include <sys/dmu_send.h>
34 #include <sys/dmu_impl.h>
35 #include <sys/dbuf.h>
36 #include <sys/dmu_objset.h>
37 #include <sys/dsl_dataset.h>
38 #include <sys/dsl_dir.h>
39 #include <sys/dmu_tx.h>
40 #include <sys/spa.h>
41 #include <sys/zio.h>
42 #include <sys/dmu_zfetch.h>
43 #include <sys/sa.h>
44 #include <sys/sa_impl.h>
45 #include <sys/zfeature.h>
46 #include <sys/blkptr.h>
47 #include <sys/range_tree.h>
48 #include <sys/callb.h>
49 #include <sys/abd.h>
50 #include <sys/vdev.h>
51 #include <sys/cityhash.h>
52 
53 uint_t zfs_dbuf_evict_key;
54 
55 static boolean_t dbuf_undirty(dmu_buf_impl_t *db, dmu_tx_t *tx);
56 static void dbuf_write(dbuf_dirty_record_t *dr, arc_buf_t *data, dmu_tx_t *tx);
57 
58 #ifndef __lint
59 extern inline void dmu_buf_init_user(dmu_buf_user_t *dbu,
60     dmu_buf_evict_func_t *evict_func_sync,
61     dmu_buf_evict_func_t *evict_func_async,
62     dmu_buf_t **clear_on_evict_dbufp);
63 #endif /* ! __lint */
64 
65 /*
66  * Global data structures and functions for the dbuf cache.
67  */
68 static kmem_cache_t *dbuf_kmem_cache;
69 static taskq_t *dbu_evict_taskq;
70 
71 static kthread_t *dbuf_cache_evict_thread;
72 static kmutex_t dbuf_evict_lock;
73 static kcondvar_t dbuf_evict_cv;
74 static boolean_t dbuf_evict_thread_exit;
75 
76 /*
77  * LRU cache of dbufs. The dbuf cache maintains a list of dbufs that
78  * are not currently held but have been recently released. These dbufs
79  * are not eligible for arc eviction until they are aged out of the cache.
80  * Dbufs are added to the dbuf cache once the last hold is released. If a
81  * dbuf is later accessed and still exists in the dbuf cache, then it will
82  * be removed from the cache and later re-added to the head of the cache.
83  * Dbufs that are aged out of the cache will be immediately destroyed and
84  * become eligible for arc eviction.
85  */
86 static multilist_t *dbuf_cache;
87 static refcount_t dbuf_cache_size;
88 uint64_t dbuf_cache_max_bytes = 0;
89 
90 /* Set the default size of the dbuf cache to log2 fraction of arc size. */
91 int dbuf_cache_shift = 5;
92 
93 /*
94  * The dbuf cache uses a three-stage eviction policy:
95  *	- A low water marker designates when the dbuf eviction thread
96  *	should stop evicting from the dbuf cache.
97  *	- When we reach the maximum size (aka mid water mark), we
98  *	signal the eviction thread to run.
99  *	- The high water mark indicates when the eviction thread
100  *	is unable to keep up with the incoming load and eviction must
101  *	happen in the context of the calling thread.
102  *
103  * The dbuf cache:
104  *                                                 (max size)
105  *                                      low water   mid water   hi water
106  * +----------------------------------------+----------+----------+
107  * |                                        |          |          |
108  * |                                        |          |          |
109  * |                                        |          |          |
110  * |                                        |          |          |
111  * +----------------------------------------+----------+----------+
112  *                                        stop        signal     evict
113  *                                      evicting     eviction   directly
114  *                                                    thread
115  *
116  * The high and low water marks indicate the operating range for the eviction
117  * thread. The low water mark is, by default, 90% of the total size of the
118  * cache and the high water mark is at 110% (both of these percentages can be
119  * changed by setting dbuf_cache_lowater_pct and dbuf_cache_hiwater_pct,
120  * respectively). The eviction thread will try to ensure that the cache remains
121  * within this range by waking up every second and checking if the cache is
122  * above the low water mark. The thread can also be woken up by callers adding
123  * elements into the cache if the cache is larger than the mid water (i.e max
124  * cache size). Once the eviction thread is woken up and eviction is required,
125  * it will continue evicting buffers until it's able to reduce the cache size
126  * to the low water mark. If the cache size continues to grow and hits the high
127  * water mark, then callers adding elments to the cache will begin to evict
128  * directly from the cache until the cache is no longer above the high water
129  * mark.
130  */
131 
132 /*
133  * The percentage above and below the maximum cache size.
134  */
135 uint_t dbuf_cache_hiwater_pct = 10;
136 uint_t dbuf_cache_lowater_pct = 10;
137 
138 /* ARGSUSED */
139 static int
140 dbuf_cons(void *vdb, void *unused, int kmflag)
141 {
142 	dmu_buf_impl_t *db = vdb;
143 	bzero(db, sizeof (dmu_buf_impl_t));
144 
145 	mutex_init(&db->db_mtx, NULL, MUTEX_DEFAULT, NULL);
146 	cv_init(&db->db_changed, NULL, CV_DEFAULT, NULL);
147 	multilist_link_init(&db->db_cache_link);
148 	refcount_create(&db->db_holds);
149 
150 	return (0);
151 }
152 
153 /* ARGSUSED */
154 static void
155 dbuf_dest(void *vdb, void *unused)
156 {
157 	dmu_buf_impl_t *db = vdb;
158 	mutex_destroy(&db->db_mtx);
159 	cv_destroy(&db->db_changed);
160 	ASSERT(!multilist_link_active(&db->db_cache_link));
161 	refcount_destroy(&db->db_holds);
162 }
163 
164 /*
165  * dbuf hash table routines
166  */
167 static dbuf_hash_table_t dbuf_hash_table;
168 
169 static uint64_t dbuf_hash_count;
170 
171 /*
172  * We use Cityhash for this. It's fast, and has good hash properties without
173  * requiring any large static buffers.
174  */
175 static uint64_t
176 dbuf_hash(void *os, uint64_t obj, uint8_t lvl, uint64_t blkid)
177 {
178 	return (cityhash4((uintptr_t)os, obj, (uint64_t)lvl, blkid));
179 }
180 
181 #define	DBUF_EQUAL(dbuf, os, obj, level, blkid)		\
182 	((dbuf)->db.db_object == (obj) &&		\
183 	(dbuf)->db_objset == (os) &&			\
184 	(dbuf)->db_level == (level) &&			\
185 	(dbuf)->db_blkid == (blkid))
186 
187 dmu_buf_impl_t *
188 dbuf_find(objset_t *os, uint64_t obj, uint8_t level, uint64_t blkid)
189 {
190 	dbuf_hash_table_t *h = &dbuf_hash_table;
191 	uint64_t hv = dbuf_hash(os, obj, level, blkid);
192 	uint64_t idx = hv & h->hash_table_mask;
193 	dmu_buf_impl_t *db;
194 
195 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
196 	for (db = h->hash_table[idx]; db != NULL; db = db->db_hash_next) {
197 		if (DBUF_EQUAL(db, os, obj, level, blkid)) {
198 			mutex_enter(&db->db_mtx);
199 			if (db->db_state != DB_EVICTING) {
200 				mutex_exit(DBUF_HASH_MUTEX(h, idx));
201 				return (db);
202 			}
203 			mutex_exit(&db->db_mtx);
204 		}
205 	}
206 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
207 	return (NULL);
208 }
209 
210 static dmu_buf_impl_t *
211 dbuf_find_bonus(objset_t *os, uint64_t object)
212 {
213 	dnode_t *dn;
214 	dmu_buf_impl_t *db = NULL;
215 
216 	if (dnode_hold(os, object, FTAG, &dn) == 0) {
217 		rw_enter(&dn->dn_struct_rwlock, RW_READER);
218 		if (dn->dn_bonus != NULL) {
219 			db = dn->dn_bonus;
220 			mutex_enter(&db->db_mtx);
221 		}
222 		rw_exit(&dn->dn_struct_rwlock);
223 		dnode_rele(dn, FTAG);
224 	}
225 	return (db);
226 }
227 
228 /*
229  * Insert an entry into the hash table.  If there is already an element
230  * equal to elem in the hash table, then the already existing element
231  * will be returned and the new element will not be inserted.
232  * Otherwise returns NULL.
233  */
234 static dmu_buf_impl_t *
235 dbuf_hash_insert(dmu_buf_impl_t *db)
236 {
237 	dbuf_hash_table_t *h = &dbuf_hash_table;
238 	objset_t *os = db->db_objset;
239 	uint64_t obj = db->db.db_object;
240 	int level = db->db_level;
241 	uint64_t blkid = db->db_blkid;
242 	uint64_t hv = dbuf_hash(os, obj, level, blkid);
243 	uint64_t idx = hv & h->hash_table_mask;
244 	dmu_buf_impl_t *dbf;
245 
246 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
247 	for (dbf = h->hash_table[idx]; dbf != NULL; dbf = dbf->db_hash_next) {
248 		if (DBUF_EQUAL(dbf, os, obj, level, blkid)) {
249 			mutex_enter(&dbf->db_mtx);
250 			if (dbf->db_state != DB_EVICTING) {
251 				mutex_exit(DBUF_HASH_MUTEX(h, idx));
252 				return (dbf);
253 			}
254 			mutex_exit(&dbf->db_mtx);
255 		}
256 	}
257 
258 	mutex_enter(&db->db_mtx);
259 	db->db_hash_next = h->hash_table[idx];
260 	h->hash_table[idx] = db;
261 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
262 	atomic_inc_64(&dbuf_hash_count);
263 
264 	return (NULL);
265 }
266 
267 /*
268  * Remove an entry from the hash table.  It must be in the EVICTING state.
269  */
270 static void
271 dbuf_hash_remove(dmu_buf_impl_t *db)
272 {
273 	dbuf_hash_table_t *h = &dbuf_hash_table;
274 	uint64_t hv = dbuf_hash(db->db_objset, db->db.db_object,
275 	    db->db_level, db->db_blkid);
276 	uint64_t idx = hv & h->hash_table_mask;
277 	dmu_buf_impl_t *dbf, **dbp;
278 
279 	/*
280 	 * We musn't hold db_mtx to maintain lock ordering:
281 	 * DBUF_HASH_MUTEX > db_mtx.
282 	 */
283 	ASSERT(refcount_is_zero(&db->db_holds));
284 	ASSERT(db->db_state == DB_EVICTING);
285 	ASSERT(!MUTEX_HELD(&db->db_mtx));
286 
287 	mutex_enter(DBUF_HASH_MUTEX(h, idx));
288 	dbp = &h->hash_table[idx];
289 	while ((dbf = *dbp) != db) {
290 		dbp = &dbf->db_hash_next;
291 		ASSERT(dbf != NULL);
292 	}
293 	*dbp = db->db_hash_next;
294 	db->db_hash_next = NULL;
295 	mutex_exit(DBUF_HASH_MUTEX(h, idx));
296 	atomic_dec_64(&dbuf_hash_count);
297 }
298 
299 typedef enum {
300 	DBVU_EVICTING,
301 	DBVU_NOT_EVICTING
302 } dbvu_verify_type_t;
303 
304 static void
305 dbuf_verify_user(dmu_buf_impl_t *db, dbvu_verify_type_t verify_type)
306 {
307 #ifdef ZFS_DEBUG
308 	int64_t holds;
309 
310 	if (db->db_user == NULL)
311 		return;
312 
313 	/* Only data blocks support the attachment of user data. */
314 	ASSERT(db->db_level == 0);
315 
316 	/* Clients must resolve a dbuf before attaching user data. */
317 	ASSERT(db->db.db_data != NULL);
318 	ASSERT3U(db->db_state, ==, DB_CACHED);
319 
320 	holds = refcount_count(&db->db_holds);
321 	if (verify_type == DBVU_EVICTING) {
322 		/*
323 		 * Immediate eviction occurs when holds == dirtycnt.
324 		 * For normal eviction buffers, holds is zero on
325 		 * eviction, except when dbuf_fix_old_data() calls
326 		 * dbuf_clear_data().  However, the hold count can grow
327 		 * during eviction even though db_mtx is held (see
328 		 * dmu_bonus_hold() for an example), so we can only
329 		 * test the generic invariant that holds >= dirtycnt.
330 		 */
331 		ASSERT3U(holds, >=, db->db_dirtycnt);
332 	} else {
333 		if (db->db_user_immediate_evict == TRUE)
334 			ASSERT3U(holds, >=, db->db_dirtycnt);
335 		else
336 			ASSERT3U(holds, >, 0);
337 	}
338 #endif
339 }
340 
341 static void
342 dbuf_evict_user(dmu_buf_impl_t *db)
343 {
344 	dmu_buf_user_t *dbu = db->db_user;
345 
346 	ASSERT(MUTEX_HELD(&db->db_mtx));
347 
348 	if (dbu == NULL)
349 		return;
350 
351 	dbuf_verify_user(db, DBVU_EVICTING);
352 	db->db_user = NULL;
353 
354 #ifdef ZFS_DEBUG
355 	if (dbu->dbu_clear_on_evict_dbufp != NULL)
356 		*dbu->dbu_clear_on_evict_dbufp = NULL;
357 #endif
358 
359 	/*
360 	 * There are two eviction callbacks - one that we call synchronously
361 	 * and one that we invoke via a taskq.  The async one is useful for
362 	 * avoiding lock order reversals and limiting stack depth.
363 	 *
364 	 * Note that if we have a sync callback but no async callback,
365 	 * it's likely that the sync callback will free the structure
366 	 * containing the dbu.  In that case we need to take care to not
367 	 * dereference dbu after calling the sync evict func.
368 	 */
369 	boolean_t has_async = (dbu->dbu_evict_func_async != NULL);
370 
371 	if (dbu->dbu_evict_func_sync != NULL)
372 		dbu->dbu_evict_func_sync(dbu);
373 
374 	if (has_async) {
375 		taskq_dispatch_ent(dbu_evict_taskq, dbu->dbu_evict_func_async,
376 		    dbu, 0, &dbu->dbu_tqent);
377 	}
378 }
379 
380 boolean_t
381 dbuf_is_metadata(dmu_buf_impl_t *db)
382 {
383 	if (db->db_level > 0) {
384 		return (B_TRUE);
385 	} else {
386 		boolean_t is_metadata;
387 
388 		DB_DNODE_ENTER(db);
389 		is_metadata = DMU_OT_IS_METADATA(DB_DNODE(db)->dn_type);
390 		DB_DNODE_EXIT(db);
391 
392 		return (is_metadata);
393 	}
394 }
395 
396 /*
397  * This function *must* return indices evenly distributed between all
398  * sublists of the multilist. This is needed due to how the dbuf eviction
399  * code is laid out; dbuf_evict_thread() assumes dbufs are evenly
400  * distributed between all sublists and uses this assumption when
401  * deciding which sublist to evict from and how much to evict from it.
402  */
403 unsigned int
404 dbuf_cache_multilist_index_func(multilist_t *ml, void *obj)
405 {
406 	dmu_buf_impl_t *db = obj;
407 
408 	/*
409 	 * The assumption here, is the hash value for a given
410 	 * dmu_buf_impl_t will remain constant throughout it's lifetime
411 	 * (i.e. it's objset, object, level and blkid fields don't change).
412 	 * Thus, we don't need to store the dbuf's sublist index
413 	 * on insertion, as this index can be recalculated on removal.
414 	 *
415 	 * Also, the low order bits of the hash value are thought to be
416 	 * distributed evenly. Otherwise, in the case that the multilist
417 	 * has a power of two number of sublists, each sublists' usage
418 	 * would not be evenly distributed.
419 	 */
420 	return (dbuf_hash(db->db_objset, db->db.db_object,
421 	    db->db_level, db->db_blkid) %
422 	    multilist_get_num_sublists(ml));
423 }
424 
425 static inline boolean_t
426 dbuf_cache_above_hiwater(void)
427 {
428 	uint64_t dbuf_cache_hiwater_bytes =
429 	    (dbuf_cache_max_bytes * dbuf_cache_hiwater_pct) / 100;
430 
431 	return (refcount_count(&dbuf_cache_size) >
432 	    dbuf_cache_max_bytes + dbuf_cache_hiwater_bytes);
433 }
434 
435 static inline boolean_t
436 dbuf_cache_above_lowater(void)
437 {
438 	uint64_t dbuf_cache_lowater_bytes =
439 	    (dbuf_cache_max_bytes * dbuf_cache_lowater_pct) / 100;
440 
441 	return (refcount_count(&dbuf_cache_size) >
442 	    dbuf_cache_max_bytes - dbuf_cache_lowater_bytes);
443 }
444 
445 /*
446  * Evict the oldest eligible dbuf from the dbuf cache.
447  */
448 static void
449 dbuf_evict_one(void)
450 {
451 	int idx = multilist_get_random_index(dbuf_cache);
452 	multilist_sublist_t *mls = multilist_sublist_lock(dbuf_cache, idx);
453 
454 	ASSERT(!MUTEX_HELD(&dbuf_evict_lock));
455 
456 	/*
457 	 * Set the thread's tsd to indicate that it's processing evictions.
458 	 * Once a thread stops evicting from the dbuf cache it will
459 	 * reset its tsd to NULL.
460 	 */
461 	ASSERT3P(tsd_get(zfs_dbuf_evict_key), ==, NULL);
462 	(void) tsd_set(zfs_dbuf_evict_key, (void *)B_TRUE);
463 
464 	dmu_buf_impl_t *db = multilist_sublist_tail(mls);
465 	while (db != NULL && mutex_tryenter(&db->db_mtx) == 0) {
466 		db = multilist_sublist_prev(mls, db);
467 	}
468 
469 	DTRACE_PROBE2(dbuf__evict__one, dmu_buf_impl_t *, db,
470 	    multilist_sublist_t *, mls);
471 
472 	if (db != NULL) {
473 		multilist_sublist_remove(mls, db);
474 		multilist_sublist_unlock(mls);
475 		(void) refcount_remove_many(&dbuf_cache_size,
476 		    db->db.db_size, db);
477 		dbuf_destroy(db);
478 	} else {
479 		multilist_sublist_unlock(mls);
480 	}
481 	(void) tsd_set(zfs_dbuf_evict_key, NULL);
482 }
483 
484 /*
485  * The dbuf evict thread is responsible for aging out dbufs from the
486  * cache. Once the cache has reached it's maximum size, dbufs are removed
487  * and destroyed. The eviction thread will continue running until the size
488  * of the dbuf cache is at or below the maximum size. Once the dbuf is aged
489  * out of the cache it is destroyed and becomes eligible for arc eviction.
490  */
491 /* ARGSUSED */
492 static void
493 dbuf_evict_thread(void *unused)
494 {
495 	callb_cpr_t cpr;
496 
497 	CALLB_CPR_INIT(&cpr, &dbuf_evict_lock, callb_generic_cpr, FTAG);
498 
499 	mutex_enter(&dbuf_evict_lock);
500 	while (!dbuf_evict_thread_exit) {
501 		while (!dbuf_cache_above_lowater() && !dbuf_evict_thread_exit) {
502 			CALLB_CPR_SAFE_BEGIN(&cpr);
503 			(void) cv_timedwait_hires(&dbuf_evict_cv,
504 			    &dbuf_evict_lock, SEC2NSEC(1), MSEC2NSEC(1), 0);
505 			CALLB_CPR_SAFE_END(&cpr, &dbuf_evict_lock);
506 		}
507 		mutex_exit(&dbuf_evict_lock);
508 
509 		/*
510 		 * Keep evicting as long as we're above the low water mark
511 		 * for the cache. We do this without holding the locks to
512 		 * minimize lock contention.
513 		 */
514 		while (dbuf_cache_above_lowater() && !dbuf_evict_thread_exit) {
515 			dbuf_evict_one();
516 		}
517 
518 		mutex_enter(&dbuf_evict_lock);
519 	}
520 
521 	dbuf_evict_thread_exit = B_FALSE;
522 	cv_broadcast(&dbuf_evict_cv);
523 	CALLB_CPR_EXIT(&cpr);	/* drops dbuf_evict_lock */
524 	thread_exit();
525 }
526 
527 /*
528  * Wake up the dbuf eviction thread if the dbuf cache is at its max size.
529  * If the dbuf cache is at its high water mark, then evict a dbuf from the
530  * dbuf cache using the callers context.
531  */
532 static void
533 dbuf_evict_notify(void)
534 {
535 
536 	/*
537 	 * We use thread specific data to track when a thread has
538 	 * started processing evictions. This allows us to avoid deeply
539 	 * nested stacks that would have a call flow similar to this:
540 	 *
541 	 * dbuf_rele()-->dbuf_rele_and_unlock()-->dbuf_evict_notify()
542 	 *	^						|
543 	 *	|						|
544 	 *	+-----dbuf_destroy()<--dbuf_evict_one()<--------+
545 	 *
546 	 * The dbuf_eviction_thread will always have its tsd set until
547 	 * that thread exits. All other threads will only set their tsd
548 	 * if they are participating in the eviction process. This only
549 	 * happens if the eviction thread is unable to process evictions
550 	 * fast enough. To keep the dbuf cache size in check, other threads
551 	 * can evict from the dbuf cache directly. Those threads will set
552 	 * their tsd values so that we ensure that they only evict one dbuf
553 	 * from the dbuf cache.
554 	 */
555 	if (tsd_get(zfs_dbuf_evict_key) != NULL)
556 		return;
557 
558 	/*
559 	 * We check if we should evict without holding the dbuf_evict_lock,
560 	 * because it's OK to occasionally make the wrong decision here,
561 	 * and grabbing the lock results in massive lock contention.
562 	 */
563 	if (refcount_count(&dbuf_cache_size) > dbuf_cache_max_bytes) {
564 		if (dbuf_cache_above_hiwater())
565 			dbuf_evict_one();
566 		cv_signal(&dbuf_evict_cv);
567 	}
568 }
569 
570 void
571 dbuf_init(void)
572 {
573 	uint64_t hsize = 1ULL << 16;
574 	dbuf_hash_table_t *h = &dbuf_hash_table;
575 	int i;
576 
577 	/*
578 	 * The hash table is big enough to fill all of physical memory
579 	 * with an average 4K block size.  The table will take up
580 	 * totalmem*sizeof(void*)/4K (i.e. 2MB/GB with 8-byte pointers).
581 	 */
582 	while (hsize * 4096 < physmem * PAGESIZE)
583 		hsize <<= 1;
584 
585 retry:
586 	h->hash_table_mask = hsize - 1;
587 	h->hash_table = kmem_zalloc(hsize * sizeof (void *), KM_NOSLEEP);
588 	if (h->hash_table == NULL) {
589 		/* XXX - we should really return an error instead of assert */
590 		ASSERT(hsize > (1ULL << 10));
591 		hsize >>= 1;
592 		goto retry;
593 	}
594 
595 	dbuf_kmem_cache = kmem_cache_create("dmu_buf_impl_t",
596 	    sizeof (dmu_buf_impl_t),
597 	    0, dbuf_cons, dbuf_dest, NULL, NULL, NULL, 0);
598 
599 	for (i = 0; i < DBUF_MUTEXES; i++)
600 		mutex_init(&h->hash_mutexes[i], NULL, MUTEX_DEFAULT, NULL);
601 
602 	/*
603 	 * Setup the parameters for the dbuf cache. We set the size of the
604 	 * dbuf cache to 1/32nd (default) of the size of the ARC. If the value
605 	 * has been set in /etc/system and it's not greater than the size of
606 	 * the ARC, then we honor that value.
607 	 */
608 	if (dbuf_cache_max_bytes == 0 ||
609 	    dbuf_cache_max_bytes >= arc_max_bytes())  {
610 		dbuf_cache_max_bytes = arc_max_bytes() >> dbuf_cache_shift;
611 	}
612 
613 	/*
614 	 * All entries are queued via taskq_dispatch_ent(), so min/maxalloc
615 	 * configuration is not required.
616 	 */
617 	dbu_evict_taskq = taskq_create("dbu_evict", 1, minclsyspri, 0, 0, 0);
618 
619 	dbuf_cache = multilist_create(sizeof (dmu_buf_impl_t),
620 	    offsetof(dmu_buf_impl_t, db_cache_link),
621 	    dbuf_cache_multilist_index_func);
622 	refcount_create(&dbuf_cache_size);
623 
624 	tsd_create(&zfs_dbuf_evict_key, NULL);
625 	dbuf_evict_thread_exit = B_FALSE;
626 	mutex_init(&dbuf_evict_lock, NULL, MUTEX_DEFAULT, NULL);
627 	cv_init(&dbuf_evict_cv, NULL, CV_DEFAULT, NULL);
628 	dbuf_cache_evict_thread = thread_create(NULL, 0, dbuf_evict_thread,
629 	    NULL, 0, &p0, TS_RUN, minclsyspri);
630 }
631 
632 void
633 dbuf_fini(void)
634 {
635 	dbuf_hash_table_t *h = &dbuf_hash_table;
636 	int i;
637 
638 	for (i = 0; i < DBUF_MUTEXES; i++)
639 		mutex_destroy(&h->hash_mutexes[i]);
640 	kmem_free(h->hash_table, (h->hash_table_mask + 1) * sizeof (void *));
641 	kmem_cache_destroy(dbuf_kmem_cache);
642 	taskq_destroy(dbu_evict_taskq);
643 
644 	mutex_enter(&dbuf_evict_lock);
645 	dbuf_evict_thread_exit = B_TRUE;
646 	while (dbuf_evict_thread_exit) {
647 		cv_signal(&dbuf_evict_cv);
648 		cv_wait(&dbuf_evict_cv, &dbuf_evict_lock);
649 	}
650 	mutex_exit(&dbuf_evict_lock);
651 	tsd_destroy(&zfs_dbuf_evict_key);
652 
653 	mutex_destroy(&dbuf_evict_lock);
654 	cv_destroy(&dbuf_evict_cv);
655 
656 	refcount_destroy(&dbuf_cache_size);
657 	multilist_destroy(dbuf_cache);
658 }
659 
660 /*
661  * Other stuff.
662  */
663 
664 #ifdef ZFS_DEBUG
665 static void
666 dbuf_verify(dmu_buf_impl_t *db)
667 {
668 	dnode_t *dn;
669 	dbuf_dirty_record_t *dr;
670 
671 	ASSERT(MUTEX_HELD(&db->db_mtx));
672 
673 	if (!(zfs_flags & ZFS_DEBUG_DBUF_VERIFY))
674 		return;
675 
676 	ASSERT(db->db_objset != NULL);
677 	DB_DNODE_ENTER(db);
678 	dn = DB_DNODE(db);
679 	if (dn == NULL) {
680 		ASSERT(db->db_parent == NULL);
681 		ASSERT(db->db_blkptr == NULL);
682 	} else {
683 		ASSERT3U(db->db.db_object, ==, dn->dn_object);
684 		ASSERT3P(db->db_objset, ==, dn->dn_objset);
685 		ASSERT3U(db->db_level, <, dn->dn_nlevels);
686 		ASSERT(db->db_blkid == DMU_BONUS_BLKID ||
687 		    db->db_blkid == DMU_SPILL_BLKID ||
688 		    !avl_is_empty(&dn->dn_dbufs));
689 	}
690 	if (db->db_blkid == DMU_BONUS_BLKID) {
691 		ASSERT(dn != NULL);
692 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
693 		ASSERT3U(db->db.db_offset, ==, DMU_BONUS_BLKID);
694 	} else if (db->db_blkid == DMU_SPILL_BLKID) {
695 		ASSERT(dn != NULL);
696 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
697 		ASSERT0(db->db.db_offset);
698 	} else {
699 		ASSERT3U(db->db.db_offset, ==, db->db_blkid * db->db.db_size);
700 	}
701 
702 	for (dr = db->db_data_pending; dr != NULL; dr = dr->dr_next)
703 		ASSERT(dr->dr_dbuf == db);
704 
705 	for (dr = db->db_last_dirty; dr != NULL; dr = dr->dr_next)
706 		ASSERT(dr->dr_dbuf == db);
707 
708 	/*
709 	 * We can't assert that db_size matches dn_datablksz because it
710 	 * can be momentarily different when another thread is doing
711 	 * dnode_set_blksz().
712 	 */
713 	if (db->db_level == 0 && db->db.db_object == DMU_META_DNODE_OBJECT) {
714 		dr = db->db_data_pending;
715 		/*
716 		 * It should only be modified in syncing context, so
717 		 * make sure we only have one copy of the data.
718 		 */
719 		ASSERT(dr == NULL || dr->dt.dl.dr_data == db->db_buf);
720 	}
721 
722 	/* verify db->db_blkptr */
723 	if (db->db_blkptr) {
724 		if (db->db_parent == dn->dn_dbuf) {
725 			/* db is pointed to by the dnode */
726 			/* ASSERT3U(db->db_blkid, <, dn->dn_nblkptr); */
727 			if (DMU_OBJECT_IS_SPECIAL(db->db.db_object))
728 				ASSERT(db->db_parent == NULL);
729 			else
730 				ASSERT(db->db_parent != NULL);
731 			if (db->db_blkid != DMU_SPILL_BLKID)
732 				ASSERT3P(db->db_blkptr, ==,
733 				    &dn->dn_phys->dn_blkptr[db->db_blkid]);
734 		} else {
735 			/* db is pointed to by an indirect block */
736 			int epb = db->db_parent->db.db_size >> SPA_BLKPTRSHIFT;
737 			ASSERT3U(db->db_parent->db_level, ==, db->db_level+1);
738 			ASSERT3U(db->db_parent->db.db_object, ==,
739 			    db->db.db_object);
740 			/*
741 			 * dnode_grow_indblksz() can make this fail if we don't
742 			 * have the struct_rwlock.  XXX indblksz no longer
743 			 * grows.  safe to do this now?
744 			 */
745 			if (RW_WRITE_HELD(&dn->dn_struct_rwlock)) {
746 				ASSERT3P(db->db_blkptr, ==,
747 				    ((blkptr_t *)db->db_parent->db.db_data +
748 				    db->db_blkid % epb));
749 			}
750 		}
751 	}
752 	if ((db->db_blkptr == NULL || BP_IS_HOLE(db->db_blkptr)) &&
753 	    (db->db_buf == NULL || db->db_buf->b_data) &&
754 	    db->db.db_data && db->db_blkid != DMU_BONUS_BLKID &&
755 	    db->db_state != DB_FILL && !dn->dn_free_txg) {
756 		/*
757 		 * If the blkptr isn't set but they have nonzero data,
758 		 * it had better be dirty, otherwise we'll lose that
759 		 * data when we evict this buffer.
760 		 *
761 		 * There is an exception to this rule for indirect blocks; in
762 		 * this case, if the indirect block is a hole, we fill in a few
763 		 * fields on each of the child blocks (importantly, birth time)
764 		 * to prevent hole birth times from being lost when you
765 		 * partially fill in a hole.
766 		 */
767 		if (db->db_dirtycnt == 0) {
768 			if (db->db_level == 0) {
769 				uint64_t *buf = db->db.db_data;
770 				int i;
771 
772 				for (i = 0; i < db->db.db_size >> 3; i++) {
773 					ASSERT(buf[i] == 0);
774 				}
775 			} else {
776 				blkptr_t *bps = db->db.db_data;
777 				ASSERT3U(1 << DB_DNODE(db)->dn_indblkshift, ==,
778 				    db->db.db_size);
779 				/*
780 				 * We want to verify that all the blkptrs in the
781 				 * indirect block are holes, but we may have
782 				 * automatically set up a few fields for them.
783 				 * We iterate through each blkptr and verify
784 				 * they only have those fields set.
785 				 */
786 				for (int i = 0;
787 				    i < db->db.db_size / sizeof (blkptr_t);
788 				    i++) {
789 					blkptr_t *bp = &bps[i];
790 					ASSERT(ZIO_CHECKSUM_IS_ZERO(
791 					    &bp->blk_cksum));
792 					ASSERT(
793 					    DVA_IS_EMPTY(&bp->blk_dva[0]) &&
794 					    DVA_IS_EMPTY(&bp->blk_dva[1]) &&
795 					    DVA_IS_EMPTY(&bp->blk_dva[2]));
796 					ASSERT0(bp->blk_fill);
797 					ASSERT0(bp->blk_pad[0]);
798 					ASSERT0(bp->blk_pad[1]);
799 					ASSERT(!BP_IS_EMBEDDED(bp));
800 					ASSERT(BP_IS_HOLE(bp));
801 					ASSERT0(bp->blk_phys_birth);
802 				}
803 			}
804 		}
805 	}
806 	DB_DNODE_EXIT(db);
807 }
808 #endif
809 
810 static void
811 dbuf_clear_data(dmu_buf_impl_t *db)
812 {
813 	ASSERT(MUTEX_HELD(&db->db_mtx));
814 	dbuf_evict_user(db);
815 	ASSERT3P(db->db_buf, ==, NULL);
816 	db->db.db_data = NULL;
817 	if (db->db_state != DB_NOFILL)
818 		db->db_state = DB_UNCACHED;
819 }
820 
821 static void
822 dbuf_set_data(dmu_buf_impl_t *db, arc_buf_t *buf)
823 {
824 	ASSERT(MUTEX_HELD(&db->db_mtx));
825 	ASSERT(buf != NULL);
826 
827 	db->db_buf = buf;
828 	ASSERT(buf->b_data != NULL);
829 	db->db.db_data = buf->b_data;
830 }
831 
832 /*
833  * Loan out an arc_buf for read.  Return the loaned arc_buf.
834  */
835 arc_buf_t *
836 dbuf_loan_arcbuf(dmu_buf_impl_t *db)
837 {
838 	arc_buf_t *abuf;
839 
840 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
841 	mutex_enter(&db->db_mtx);
842 	if (arc_released(db->db_buf) || refcount_count(&db->db_holds) > 1) {
843 		int blksz = db->db.db_size;
844 		spa_t *spa = db->db_objset->os_spa;
845 
846 		mutex_exit(&db->db_mtx);
847 		abuf = arc_loan_buf(spa, B_FALSE, blksz);
848 		bcopy(db->db.db_data, abuf->b_data, blksz);
849 	} else {
850 		abuf = db->db_buf;
851 		arc_loan_inuse_buf(abuf, db);
852 		db->db_buf = NULL;
853 		dbuf_clear_data(db);
854 		mutex_exit(&db->db_mtx);
855 	}
856 	return (abuf);
857 }
858 
859 /*
860  * Calculate which level n block references the data at the level 0 offset
861  * provided.
862  */
863 uint64_t
864 dbuf_whichblock(dnode_t *dn, int64_t level, uint64_t offset)
865 {
866 	if (dn->dn_datablkshift != 0 && dn->dn_indblkshift != 0) {
867 		/*
868 		 * The level n blkid is equal to the level 0 blkid divided by
869 		 * the number of level 0s in a level n block.
870 		 *
871 		 * The level 0 blkid is offset >> datablkshift =
872 		 * offset / 2^datablkshift.
873 		 *
874 		 * The number of level 0s in a level n is the number of block
875 		 * pointers in an indirect block, raised to the power of level.
876 		 * This is 2^(indblkshift - SPA_BLKPTRSHIFT)^level =
877 		 * 2^(level*(indblkshift - SPA_BLKPTRSHIFT)).
878 		 *
879 		 * Thus, the level n blkid is: offset /
880 		 * ((2^datablkshift)*(2^(level*(indblkshift - SPA_BLKPTRSHIFT)))
881 		 * = offset / 2^(datablkshift + level *
882 		 *   (indblkshift - SPA_BLKPTRSHIFT))
883 		 * = offset >> (datablkshift + level *
884 		 *   (indblkshift - SPA_BLKPTRSHIFT))
885 		 */
886 		return (offset >> (dn->dn_datablkshift + level *
887 		    (dn->dn_indblkshift - SPA_BLKPTRSHIFT)));
888 	} else {
889 		ASSERT3U(offset, <, dn->dn_datablksz);
890 		return (0);
891 	}
892 }
893 
894 static void
895 dbuf_read_done(zio_t *zio, arc_buf_t *buf, void *vdb)
896 {
897 	dmu_buf_impl_t *db = vdb;
898 
899 	mutex_enter(&db->db_mtx);
900 	ASSERT3U(db->db_state, ==, DB_READ);
901 	/*
902 	 * All reads are synchronous, so we must have a hold on the dbuf
903 	 */
904 	ASSERT(refcount_count(&db->db_holds) > 0);
905 	ASSERT(db->db_buf == NULL);
906 	ASSERT(db->db.db_data == NULL);
907 	if (db->db_level == 0 && db->db_freed_in_flight) {
908 		/* we were freed in flight; disregard any error */
909 		arc_release(buf, db);
910 		bzero(buf->b_data, db->db.db_size);
911 		arc_buf_freeze(buf);
912 		db->db_freed_in_flight = FALSE;
913 		dbuf_set_data(db, buf);
914 		db->db_state = DB_CACHED;
915 	} else if (zio == NULL || zio->io_error == 0) {
916 		dbuf_set_data(db, buf);
917 		db->db_state = DB_CACHED;
918 	} else {
919 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
920 		ASSERT3P(db->db_buf, ==, NULL);
921 		arc_buf_destroy(buf, db);
922 		db->db_state = DB_UNCACHED;
923 	}
924 	cv_broadcast(&db->db_changed);
925 	dbuf_rele_and_unlock(db, NULL);
926 }
927 
928 static void
929 dbuf_read_impl(dmu_buf_impl_t *db, zio_t *zio, uint32_t flags)
930 {
931 	dnode_t *dn;
932 	zbookmark_phys_t zb;
933 	arc_flags_t aflags = ARC_FLAG_NOWAIT;
934 
935 	DB_DNODE_ENTER(db);
936 	dn = DB_DNODE(db);
937 	ASSERT(!refcount_is_zero(&db->db_holds));
938 	/* We need the struct_rwlock to prevent db_blkptr from changing. */
939 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
940 	ASSERT(MUTEX_HELD(&db->db_mtx));
941 	ASSERT(db->db_state == DB_UNCACHED);
942 	ASSERT(db->db_buf == NULL);
943 
944 	if (db->db_blkid == DMU_BONUS_BLKID) {
945 		int bonuslen = MIN(dn->dn_bonuslen, dn->dn_phys->dn_bonuslen);
946 
947 		ASSERT3U(bonuslen, <=, db->db.db_size);
948 		db->db.db_data = zio_buf_alloc(DN_MAX_BONUSLEN);
949 		arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
950 		if (bonuslen < DN_MAX_BONUSLEN)
951 			bzero(db->db.db_data, DN_MAX_BONUSLEN);
952 		if (bonuslen)
953 			bcopy(DN_BONUS(dn->dn_phys), db->db.db_data, bonuslen);
954 		DB_DNODE_EXIT(db);
955 		db->db_state = DB_CACHED;
956 		mutex_exit(&db->db_mtx);
957 		return;
958 	}
959 
960 	/*
961 	 * Recheck BP_IS_HOLE() after dnode_block_freed() in case dnode_sync()
962 	 * processes the delete record and clears the bp while we are waiting
963 	 * for the dn_mtx (resulting in a "no" from block_freed).
964 	 */
965 	if (db->db_blkptr == NULL || BP_IS_HOLE(db->db_blkptr) ||
966 	    (db->db_level == 0 && (dnode_block_freed(dn, db->db_blkid) ||
967 	    BP_IS_HOLE(db->db_blkptr)))) {
968 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
969 
970 		dbuf_set_data(db, arc_alloc_buf(db->db_objset->os_spa, db, type,
971 		    db->db.db_size));
972 		bzero(db->db.db_data, db->db.db_size);
973 
974 		if (db->db_blkptr != NULL && db->db_level > 0 &&
975 		    BP_IS_HOLE(db->db_blkptr) &&
976 		    db->db_blkptr->blk_birth != 0) {
977 			blkptr_t *bps = db->db.db_data;
978 			for (int i = 0; i < ((1 <<
979 			    DB_DNODE(db)->dn_indblkshift) / sizeof (blkptr_t));
980 			    i++) {
981 				blkptr_t *bp = &bps[i];
982 				ASSERT3U(BP_GET_LSIZE(db->db_blkptr), ==,
983 				    1 << dn->dn_indblkshift);
984 				BP_SET_LSIZE(bp,
985 				    BP_GET_LEVEL(db->db_blkptr) == 1 ?
986 				    dn->dn_datablksz :
987 				    BP_GET_LSIZE(db->db_blkptr));
988 				BP_SET_TYPE(bp, BP_GET_TYPE(db->db_blkptr));
989 				BP_SET_LEVEL(bp,
990 				    BP_GET_LEVEL(db->db_blkptr) - 1);
991 				BP_SET_BIRTH(bp, db->db_blkptr->blk_birth, 0);
992 			}
993 		}
994 		DB_DNODE_EXIT(db);
995 		db->db_state = DB_CACHED;
996 		mutex_exit(&db->db_mtx);
997 		return;
998 	}
999 
1000 	DB_DNODE_EXIT(db);
1001 
1002 	db->db_state = DB_READ;
1003 	mutex_exit(&db->db_mtx);
1004 
1005 	if (DBUF_IS_L2CACHEABLE(db))
1006 		aflags |= ARC_FLAG_L2CACHE;
1007 
1008 	SET_BOOKMARK(&zb, db->db_objset->os_dsl_dataset ?
1009 	    db->db_objset->os_dsl_dataset->ds_object : DMU_META_OBJSET,
1010 	    db->db.db_object, db->db_level, db->db_blkid);
1011 
1012 	dbuf_add_ref(db, NULL);
1013 
1014 	(void) arc_read(zio, db->db_objset->os_spa, db->db_blkptr,
1015 	    dbuf_read_done, db, ZIO_PRIORITY_SYNC_READ,
1016 	    (flags & DB_RF_CANFAIL) ? ZIO_FLAG_CANFAIL : ZIO_FLAG_MUSTSUCCEED,
1017 	    &aflags, &zb);
1018 }
1019 
1020 /*
1021  * This is our just-in-time copy function.  It makes a copy of buffers that
1022  * have been modified in a previous transaction group before we access them in
1023  * the current active group.
1024  *
1025  * This function is used in three places: when we are dirtying a buffer for the
1026  * first time in a txg, when we are freeing a range in a dnode that includes
1027  * this buffer, and when we are accessing a buffer which was received compressed
1028  * and later referenced in a WRITE_BYREF record.
1029  *
1030  * Note that when we are called from dbuf_free_range() we do not put a hold on
1031  * the buffer, we just traverse the active dbuf list for the dnode.
1032  */
1033 static void
1034 dbuf_fix_old_data(dmu_buf_impl_t *db, uint64_t txg)
1035 {
1036 	dbuf_dirty_record_t *dr = db->db_last_dirty;
1037 
1038 	ASSERT(MUTEX_HELD(&db->db_mtx));
1039 	ASSERT(db->db.db_data != NULL);
1040 	ASSERT(db->db_level == 0);
1041 	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT);
1042 
1043 	if (dr == NULL ||
1044 	    (dr->dt.dl.dr_data !=
1045 	    ((db->db_blkid  == DMU_BONUS_BLKID) ? db->db.db_data : db->db_buf)))
1046 		return;
1047 
1048 	/*
1049 	 * If the last dirty record for this dbuf has not yet synced
1050 	 * and its referencing the dbuf data, either:
1051 	 *	reset the reference to point to a new copy,
1052 	 * or (if there a no active holders)
1053 	 *	just null out the current db_data pointer.
1054 	 */
1055 	ASSERT(dr->dr_txg >= txg - 2);
1056 	if (db->db_blkid == DMU_BONUS_BLKID) {
1057 		/* Note that the data bufs here are zio_bufs */
1058 		dr->dt.dl.dr_data = zio_buf_alloc(DN_MAX_BONUSLEN);
1059 		arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
1060 		bcopy(db->db.db_data, dr->dt.dl.dr_data, DN_MAX_BONUSLEN);
1061 	} else if (refcount_count(&db->db_holds) > db->db_dirtycnt) {
1062 		int size = arc_buf_size(db->db_buf);
1063 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
1064 		spa_t *spa = db->db_objset->os_spa;
1065 		enum zio_compress compress_type =
1066 		    arc_get_compression(db->db_buf);
1067 
1068 		if (compress_type == ZIO_COMPRESS_OFF) {
1069 			dr->dt.dl.dr_data = arc_alloc_buf(spa, db, type, size);
1070 		} else {
1071 			ASSERT3U(type, ==, ARC_BUFC_DATA);
1072 			dr->dt.dl.dr_data = arc_alloc_compressed_buf(spa, db,
1073 			    size, arc_buf_lsize(db->db_buf), compress_type);
1074 		}
1075 		bcopy(db->db.db_data, dr->dt.dl.dr_data->b_data, size);
1076 	} else {
1077 		db->db_buf = NULL;
1078 		dbuf_clear_data(db);
1079 	}
1080 }
1081 
1082 int
1083 dbuf_read(dmu_buf_impl_t *db, zio_t *zio, uint32_t flags)
1084 {
1085 	int err = 0;
1086 	boolean_t prefetch;
1087 	dnode_t *dn;
1088 
1089 	/*
1090 	 * We don't have to hold the mutex to check db_state because it
1091 	 * can't be freed while we have a hold on the buffer.
1092 	 */
1093 	ASSERT(!refcount_is_zero(&db->db_holds));
1094 
1095 	if (db->db_state == DB_NOFILL)
1096 		return (SET_ERROR(EIO));
1097 
1098 	DB_DNODE_ENTER(db);
1099 	dn = DB_DNODE(db);
1100 	if ((flags & DB_RF_HAVESTRUCT) == 0)
1101 		rw_enter(&dn->dn_struct_rwlock, RW_READER);
1102 
1103 	prefetch = db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
1104 	    (flags & DB_RF_NOPREFETCH) == 0 && dn != NULL &&
1105 	    DBUF_IS_CACHEABLE(db);
1106 
1107 	mutex_enter(&db->db_mtx);
1108 	if (db->db_state == DB_CACHED) {
1109 		/*
1110 		 * If the arc buf is compressed, we need to decompress it to
1111 		 * read the data. This could happen during the "zfs receive" of
1112 		 * a stream which is compressed and deduplicated.
1113 		 */
1114 		if (db->db_buf != NULL &&
1115 		    arc_get_compression(db->db_buf) != ZIO_COMPRESS_OFF) {
1116 			dbuf_fix_old_data(db,
1117 			    spa_syncing_txg(dmu_objset_spa(db->db_objset)));
1118 			err = arc_decompress(db->db_buf);
1119 			dbuf_set_data(db, db->db_buf);
1120 		}
1121 		mutex_exit(&db->db_mtx);
1122 		if (prefetch)
1123 			dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1, B_TRUE);
1124 		if ((flags & DB_RF_HAVESTRUCT) == 0)
1125 			rw_exit(&dn->dn_struct_rwlock);
1126 		DB_DNODE_EXIT(db);
1127 	} else if (db->db_state == DB_UNCACHED) {
1128 		spa_t *spa = dn->dn_objset->os_spa;
1129 		boolean_t need_wait = B_FALSE;
1130 
1131 		if (zio == NULL &&
1132 		    db->db_blkptr != NULL && !BP_IS_HOLE(db->db_blkptr)) {
1133 			zio = zio_root(spa, NULL, NULL, ZIO_FLAG_CANFAIL);
1134 			need_wait = B_TRUE;
1135 		}
1136 		dbuf_read_impl(db, zio, flags);
1137 
1138 		/* dbuf_read_impl has dropped db_mtx for us */
1139 
1140 		if (prefetch)
1141 			dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1, B_TRUE);
1142 
1143 		if ((flags & DB_RF_HAVESTRUCT) == 0)
1144 			rw_exit(&dn->dn_struct_rwlock);
1145 		DB_DNODE_EXIT(db);
1146 
1147 		if (need_wait)
1148 			err = zio_wait(zio);
1149 	} else {
1150 		/*
1151 		 * Another reader came in while the dbuf was in flight
1152 		 * between UNCACHED and CACHED.  Either a writer will finish
1153 		 * writing the buffer (sending the dbuf to CACHED) or the
1154 		 * first reader's request will reach the read_done callback
1155 		 * and send the dbuf to CACHED.  Otherwise, a failure
1156 		 * occurred and the dbuf went to UNCACHED.
1157 		 */
1158 		mutex_exit(&db->db_mtx);
1159 		if (prefetch)
1160 			dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1, B_TRUE);
1161 		if ((flags & DB_RF_HAVESTRUCT) == 0)
1162 			rw_exit(&dn->dn_struct_rwlock);
1163 		DB_DNODE_EXIT(db);
1164 
1165 		/* Skip the wait per the caller's request. */
1166 		mutex_enter(&db->db_mtx);
1167 		if ((flags & DB_RF_NEVERWAIT) == 0) {
1168 			while (db->db_state == DB_READ ||
1169 			    db->db_state == DB_FILL) {
1170 				ASSERT(db->db_state == DB_READ ||
1171 				    (flags & DB_RF_HAVESTRUCT) == 0);
1172 				DTRACE_PROBE2(blocked__read, dmu_buf_impl_t *,
1173 				    db, zio_t *, zio);
1174 				cv_wait(&db->db_changed, &db->db_mtx);
1175 			}
1176 			if (db->db_state == DB_UNCACHED)
1177 				err = SET_ERROR(EIO);
1178 		}
1179 		mutex_exit(&db->db_mtx);
1180 	}
1181 
1182 	return (err);
1183 }
1184 
1185 static void
1186 dbuf_noread(dmu_buf_impl_t *db)
1187 {
1188 	ASSERT(!refcount_is_zero(&db->db_holds));
1189 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1190 	mutex_enter(&db->db_mtx);
1191 	while (db->db_state == DB_READ || db->db_state == DB_FILL)
1192 		cv_wait(&db->db_changed, &db->db_mtx);
1193 	if (db->db_state == DB_UNCACHED) {
1194 		arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
1195 		spa_t *spa = db->db_objset->os_spa;
1196 
1197 		ASSERT(db->db_buf == NULL);
1198 		ASSERT(db->db.db_data == NULL);
1199 		dbuf_set_data(db, arc_alloc_buf(spa, db, type, db->db.db_size));
1200 		db->db_state = DB_FILL;
1201 	} else if (db->db_state == DB_NOFILL) {
1202 		dbuf_clear_data(db);
1203 	} else {
1204 		ASSERT3U(db->db_state, ==, DB_CACHED);
1205 	}
1206 	mutex_exit(&db->db_mtx);
1207 }
1208 
1209 void
1210 dbuf_unoverride(dbuf_dirty_record_t *dr)
1211 {
1212 	dmu_buf_impl_t *db = dr->dr_dbuf;
1213 	blkptr_t *bp = &dr->dt.dl.dr_overridden_by;
1214 	uint64_t txg = dr->dr_txg;
1215 
1216 	ASSERT(MUTEX_HELD(&db->db_mtx));
1217 	/*
1218 	 * This assert is valid because dmu_sync() expects to be called by
1219 	 * a zilog's get_data while holding a range lock.  This call only
1220 	 * comes from dbuf_dirty() callers who must also hold a range lock.
1221 	 */
1222 	ASSERT(dr->dt.dl.dr_override_state != DR_IN_DMU_SYNC);
1223 	ASSERT(db->db_level == 0);
1224 
1225 	if (db->db_blkid == DMU_BONUS_BLKID ||
1226 	    dr->dt.dl.dr_override_state == DR_NOT_OVERRIDDEN)
1227 		return;
1228 
1229 	ASSERT(db->db_data_pending != dr);
1230 
1231 	/* free this block */
1232 	if (!BP_IS_HOLE(bp) && !dr->dt.dl.dr_nopwrite)
1233 		zio_free(db->db_objset->os_spa, txg, bp);
1234 
1235 	dr->dt.dl.dr_override_state = DR_NOT_OVERRIDDEN;
1236 	dr->dt.dl.dr_nopwrite = B_FALSE;
1237 
1238 	/*
1239 	 * Release the already-written buffer, so we leave it in
1240 	 * a consistent dirty state.  Note that all callers are
1241 	 * modifying the buffer, so they will immediately do
1242 	 * another (redundant) arc_release().  Therefore, leave
1243 	 * the buf thawed to save the effort of freezing &
1244 	 * immediately re-thawing it.
1245 	 */
1246 	arc_release(dr->dt.dl.dr_data, db);
1247 }
1248 
1249 /*
1250  * Evict (if its unreferenced) or clear (if its referenced) any level-0
1251  * data blocks in the free range, so that any future readers will find
1252  * empty blocks.
1253  */
1254 void
1255 dbuf_free_range(dnode_t *dn, uint64_t start_blkid, uint64_t end_blkid,
1256     dmu_tx_t *tx)
1257 {
1258 	dmu_buf_impl_t db_search;
1259 	dmu_buf_impl_t *db, *db_next;
1260 	uint64_t txg = tx->tx_txg;
1261 	avl_index_t where;
1262 
1263 	if (end_blkid > dn->dn_maxblkid &&
1264 	    !(start_blkid == DMU_SPILL_BLKID || end_blkid == DMU_SPILL_BLKID))
1265 		end_blkid = dn->dn_maxblkid;
1266 	dprintf_dnode(dn, "start=%llu end=%llu\n", start_blkid, end_blkid);
1267 
1268 	db_search.db_level = 0;
1269 	db_search.db_blkid = start_blkid;
1270 	db_search.db_state = DB_SEARCH;
1271 
1272 	mutex_enter(&dn->dn_dbufs_mtx);
1273 	db = avl_find(&dn->dn_dbufs, &db_search, &where);
1274 	ASSERT3P(db, ==, NULL);
1275 
1276 	db = avl_nearest(&dn->dn_dbufs, where, AVL_AFTER);
1277 
1278 	for (; db != NULL; db = db_next) {
1279 		db_next = AVL_NEXT(&dn->dn_dbufs, db);
1280 		ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1281 
1282 		if (db->db_level != 0 || db->db_blkid > end_blkid) {
1283 			break;
1284 		}
1285 		ASSERT3U(db->db_blkid, >=, start_blkid);
1286 
1287 		/* found a level 0 buffer in the range */
1288 		mutex_enter(&db->db_mtx);
1289 		if (dbuf_undirty(db, tx)) {
1290 			/* mutex has been dropped and dbuf destroyed */
1291 			continue;
1292 		}
1293 
1294 		if (db->db_state == DB_UNCACHED ||
1295 		    db->db_state == DB_NOFILL ||
1296 		    db->db_state == DB_EVICTING) {
1297 			ASSERT(db->db.db_data == NULL);
1298 			mutex_exit(&db->db_mtx);
1299 			continue;
1300 		}
1301 		if (db->db_state == DB_READ || db->db_state == DB_FILL) {
1302 			/* will be handled in dbuf_read_done or dbuf_rele */
1303 			db->db_freed_in_flight = TRUE;
1304 			mutex_exit(&db->db_mtx);
1305 			continue;
1306 		}
1307 		if (refcount_count(&db->db_holds) == 0) {
1308 			ASSERT(db->db_buf);
1309 			dbuf_destroy(db);
1310 			continue;
1311 		}
1312 		/* The dbuf is referenced */
1313 
1314 		if (db->db_last_dirty != NULL) {
1315 			dbuf_dirty_record_t *dr = db->db_last_dirty;
1316 
1317 			if (dr->dr_txg == txg) {
1318 				/*
1319 				 * This buffer is "in-use", re-adjust the file
1320 				 * size to reflect that this buffer may
1321 				 * contain new data when we sync.
1322 				 */
1323 				if (db->db_blkid != DMU_SPILL_BLKID &&
1324 				    db->db_blkid > dn->dn_maxblkid)
1325 					dn->dn_maxblkid = db->db_blkid;
1326 				dbuf_unoverride(dr);
1327 			} else {
1328 				/*
1329 				 * This dbuf is not dirty in the open context.
1330 				 * Either uncache it (if its not referenced in
1331 				 * the open context) or reset its contents to
1332 				 * empty.
1333 				 */
1334 				dbuf_fix_old_data(db, txg);
1335 			}
1336 		}
1337 		/* clear the contents if its cached */
1338 		if (db->db_state == DB_CACHED) {
1339 			ASSERT(db->db.db_data != NULL);
1340 			arc_release(db->db_buf, db);
1341 			bzero(db->db.db_data, db->db.db_size);
1342 			arc_buf_freeze(db->db_buf);
1343 		}
1344 
1345 		mutex_exit(&db->db_mtx);
1346 	}
1347 	mutex_exit(&dn->dn_dbufs_mtx);
1348 }
1349 
1350 void
1351 dbuf_new_size(dmu_buf_impl_t *db, int size, dmu_tx_t *tx)
1352 {
1353 	arc_buf_t *buf, *obuf;
1354 	int osize = db->db.db_size;
1355 	arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
1356 	dnode_t *dn;
1357 
1358 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1359 
1360 	DB_DNODE_ENTER(db);
1361 	dn = DB_DNODE(db);
1362 
1363 	/* XXX does *this* func really need the lock? */
1364 	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));
1365 
1366 	/*
1367 	 * This call to dmu_buf_will_dirty() with the dn_struct_rwlock held
1368 	 * is OK, because there can be no other references to the db
1369 	 * when we are changing its size, so no concurrent DB_FILL can
1370 	 * be happening.
1371 	 */
1372 	/*
1373 	 * XXX we should be doing a dbuf_read, checking the return
1374 	 * value and returning that up to our callers
1375 	 */
1376 	dmu_buf_will_dirty(&db->db, tx);
1377 
1378 	/* create the data buffer for the new block */
1379 	buf = arc_alloc_buf(dn->dn_objset->os_spa, db, type, size);
1380 
1381 	/* copy old block data to the new block */
1382 	obuf = db->db_buf;
1383 	bcopy(obuf->b_data, buf->b_data, MIN(osize, size));
1384 	/* zero the remainder */
1385 	if (size > osize)
1386 		bzero((uint8_t *)buf->b_data + osize, size - osize);
1387 
1388 	mutex_enter(&db->db_mtx);
1389 	dbuf_set_data(db, buf);
1390 	arc_buf_destroy(obuf, db);
1391 	db->db.db_size = size;
1392 
1393 	if (db->db_level == 0) {
1394 		ASSERT3U(db->db_last_dirty->dr_txg, ==, tx->tx_txg);
1395 		db->db_last_dirty->dt.dl.dr_data = buf;
1396 	}
1397 	mutex_exit(&db->db_mtx);
1398 
1399 	dmu_objset_willuse_space(dn->dn_objset, size - osize, tx);
1400 	DB_DNODE_EXIT(db);
1401 }
1402 
1403 void
1404 dbuf_release_bp(dmu_buf_impl_t *db)
1405 {
1406 	objset_t *os = db->db_objset;
1407 
1408 	ASSERT(dsl_pool_sync_context(dmu_objset_pool(os)));
1409 	ASSERT(arc_released(os->os_phys_buf) ||
1410 	    list_link_active(&os->os_dsl_dataset->ds_synced_link));
1411 	ASSERT(db->db_parent == NULL || arc_released(db->db_parent->db_buf));
1412 
1413 	(void) arc_release(db->db_buf, db);
1414 }
1415 
1416 /*
1417  * We already have a dirty record for this TXG, and we are being
1418  * dirtied again.
1419  */
1420 static void
1421 dbuf_redirty(dbuf_dirty_record_t *dr)
1422 {
1423 	dmu_buf_impl_t *db = dr->dr_dbuf;
1424 
1425 	ASSERT(MUTEX_HELD(&db->db_mtx));
1426 
1427 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID) {
1428 		/*
1429 		 * If this buffer has already been written out,
1430 		 * we now need to reset its state.
1431 		 */
1432 		dbuf_unoverride(dr);
1433 		if (db->db.db_object != DMU_META_DNODE_OBJECT &&
1434 		    db->db_state != DB_NOFILL) {
1435 			/* Already released on initial dirty, so just thaw. */
1436 			ASSERT(arc_released(db->db_buf));
1437 			arc_buf_thaw(db->db_buf);
1438 		}
1439 	}
1440 }
1441 
1442 dbuf_dirty_record_t *
1443 dbuf_dirty(dmu_buf_impl_t *db, dmu_tx_t *tx)
1444 {
1445 	dnode_t *dn;
1446 	objset_t *os;
1447 	dbuf_dirty_record_t **drp, *dr;
1448 	int drop_struct_lock = FALSE;
1449 	int txgoff = tx->tx_txg & TXG_MASK;
1450 
1451 	ASSERT(tx->tx_txg != 0);
1452 	ASSERT(!refcount_is_zero(&db->db_holds));
1453 	DMU_TX_DIRTY_BUF(tx, db);
1454 
1455 	DB_DNODE_ENTER(db);
1456 	dn = DB_DNODE(db);
1457 	/*
1458 	 * Shouldn't dirty a regular buffer in syncing context.  Private
1459 	 * objects may be dirtied in syncing context, but only if they
1460 	 * were already pre-dirtied in open context.
1461 	 */
1462 #ifdef DEBUG
1463 	if (dn->dn_objset->os_dsl_dataset != NULL) {
1464 		rrw_enter(&dn->dn_objset->os_dsl_dataset->ds_bp_rwlock,
1465 		    RW_READER, FTAG);
1466 	}
1467 	ASSERT(!dmu_tx_is_syncing(tx) ||
1468 	    BP_IS_HOLE(dn->dn_objset->os_rootbp) ||
1469 	    DMU_OBJECT_IS_SPECIAL(dn->dn_object) ||
1470 	    dn->dn_objset->os_dsl_dataset == NULL);
1471 	if (dn->dn_objset->os_dsl_dataset != NULL)
1472 		rrw_exit(&dn->dn_objset->os_dsl_dataset->ds_bp_rwlock, FTAG);
1473 #endif
1474 	/*
1475 	 * We make this assert for private objects as well, but after we
1476 	 * check if we're already dirty.  They are allowed to re-dirty
1477 	 * in syncing context.
1478 	 */
1479 	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT ||
1480 	    dn->dn_dirtyctx == DN_UNDIRTIED || dn->dn_dirtyctx ==
1481 	    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));
1482 
1483 	mutex_enter(&db->db_mtx);
1484 	/*
1485 	 * XXX make this true for indirects too?  The problem is that
1486 	 * transactions created with dmu_tx_create_assigned() from
1487 	 * syncing context don't bother holding ahead.
1488 	 */
1489 	ASSERT(db->db_level != 0 ||
1490 	    db->db_state == DB_CACHED || db->db_state == DB_FILL ||
1491 	    db->db_state == DB_NOFILL);
1492 
1493 	mutex_enter(&dn->dn_mtx);
1494 	/*
1495 	 * Don't set dirtyctx to SYNC if we're just modifying this as we
1496 	 * initialize the objset.
1497 	 */
1498 	if (dn->dn_dirtyctx == DN_UNDIRTIED) {
1499 		if (dn->dn_objset->os_dsl_dataset != NULL) {
1500 			rrw_enter(&dn->dn_objset->os_dsl_dataset->ds_bp_rwlock,
1501 			    RW_READER, FTAG);
1502 		}
1503 		if (!BP_IS_HOLE(dn->dn_objset->os_rootbp)) {
1504 			dn->dn_dirtyctx = (dmu_tx_is_syncing(tx) ?
1505 			    DN_DIRTY_SYNC : DN_DIRTY_OPEN);
1506 			ASSERT(dn->dn_dirtyctx_firstset == NULL);
1507 			dn->dn_dirtyctx_firstset = kmem_alloc(1, KM_SLEEP);
1508 		}
1509 		if (dn->dn_objset->os_dsl_dataset != NULL) {
1510 			rrw_exit(&dn->dn_objset->os_dsl_dataset->ds_bp_rwlock,
1511 			    FTAG);
1512 		}
1513 	}
1514 	mutex_exit(&dn->dn_mtx);
1515 
1516 	if (db->db_blkid == DMU_SPILL_BLKID)
1517 		dn->dn_have_spill = B_TRUE;
1518 
1519 	/*
1520 	 * If this buffer is already dirty, we're done.
1521 	 */
1522 	drp = &db->db_last_dirty;
1523 	ASSERT(*drp == NULL || (*drp)->dr_txg <= tx->tx_txg ||
1524 	    db->db.db_object == DMU_META_DNODE_OBJECT);
1525 	while ((dr = *drp) != NULL && dr->dr_txg > tx->tx_txg)
1526 		drp = &dr->dr_next;
1527 	if (dr && dr->dr_txg == tx->tx_txg) {
1528 		DB_DNODE_EXIT(db);
1529 
1530 		dbuf_redirty(dr);
1531 		mutex_exit(&db->db_mtx);
1532 		return (dr);
1533 	}
1534 
1535 	/*
1536 	 * Only valid if not already dirty.
1537 	 */
1538 	ASSERT(dn->dn_object == 0 ||
1539 	    dn->dn_dirtyctx == DN_UNDIRTIED || dn->dn_dirtyctx ==
1540 	    (dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));
1541 
1542 	ASSERT3U(dn->dn_nlevels, >, db->db_level);
1543 
1544 	/*
1545 	 * We should only be dirtying in syncing context if it's the
1546 	 * mos or we're initializing the os or it's a special object.
1547 	 * However, we are allowed to dirty in syncing context provided
1548 	 * we already dirtied it in open context.  Hence we must make
1549 	 * this assertion only if we're not already dirty.
1550 	 */
1551 	os = dn->dn_objset;
1552 	VERIFY3U(tx->tx_txg, <=, spa_final_dirty_txg(os->os_spa));
1553 #ifdef DEBUG
1554 	if (dn->dn_objset->os_dsl_dataset != NULL)
1555 		rrw_enter(&os->os_dsl_dataset->ds_bp_rwlock, RW_READER, FTAG);
1556 	ASSERT(!dmu_tx_is_syncing(tx) || DMU_OBJECT_IS_SPECIAL(dn->dn_object) ||
1557 	    os->os_dsl_dataset == NULL || BP_IS_HOLE(os->os_rootbp));
1558 	if (dn->dn_objset->os_dsl_dataset != NULL)
1559 		rrw_exit(&os->os_dsl_dataset->ds_bp_rwlock, FTAG);
1560 #endif
1561 	ASSERT(db->db.db_size != 0);
1562 
1563 	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);
1564 
1565 	if (db->db_blkid != DMU_BONUS_BLKID) {
1566 		dmu_objset_willuse_space(os, db->db.db_size, tx);
1567 	}
1568 
1569 	/*
1570 	 * If this buffer is dirty in an old transaction group we need
1571 	 * to make a copy of it so that the changes we make in this
1572 	 * transaction group won't leak out when we sync the older txg.
1573 	 */
1574 	dr = kmem_zalloc(sizeof (dbuf_dirty_record_t), KM_SLEEP);
1575 	if (db->db_level == 0) {
1576 		void *data_old = db->db_buf;
1577 
1578 		if (db->db_state != DB_NOFILL) {
1579 			if (db->db_blkid == DMU_BONUS_BLKID) {
1580 				dbuf_fix_old_data(db, tx->tx_txg);
1581 				data_old = db->db.db_data;
1582 			} else if (db->db.db_object != DMU_META_DNODE_OBJECT) {
1583 				/*
1584 				 * Release the data buffer from the cache so
1585 				 * that we can modify it without impacting
1586 				 * possible other users of this cached data
1587 				 * block.  Note that indirect blocks and
1588 				 * private objects are not released until the
1589 				 * syncing state (since they are only modified
1590 				 * then).
1591 				 */
1592 				arc_release(db->db_buf, db);
1593 				dbuf_fix_old_data(db, tx->tx_txg);
1594 				data_old = db->db_buf;
1595 			}
1596 			ASSERT(data_old != NULL);
1597 		}
1598 		dr->dt.dl.dr_data = data_old;
1599 	} else {
1600 		mutex_init(&dr->dt.di.dr_mtx, NULL, MUTEX_DEFAULT, NULL);
1601 		list_create(&dr->dt.di.dr_children,
1602 		    sizeof (dbuf_dirty_record_t),
1603 		    offsetof(dbuf_dirty_record_t, dr_dirty_node));
1604 	}
1605 	if (db->db_blkid != DMU_BONUS_BLKID && os->os_dsl_dataset != NULL)
1606 		dr->dr_accounted = db->db.db_size;
1607 	dr->dr_dbuf = db;
1608 	dr->dr_txg = tx->tx_txg;
1609 	dr->dr_next = *drp;
1610 	*drp = dr;
1611 
1612 	/*
1613 	 * We could have been freed_in_flight between the dbuf_noread
1614 	 * and dbuf_dirty.  We win, as though the dbuf_noread() had
1615 	 * happened after the free.
1616 	 */
1617 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
1618 	    db->db_blkid != DMU_SPILL_BLKID) {
1619 		mutex_enter(&dn->dn_mtx);
1620 		if (dn->dn_free_ranges[txgoff] != NULL) {
1621 			range_tree_clear(dn->dn_free_ranges[txgoff],
1622 			    db->db_blkid, 1);
1623 		}
1624 		mutex_exit(&dn->dn_mtx);
1625 		db->db_freed_in_flight = FALSE;
1626 	}
1627 
1628 	/*
1629 	 * This buffer is now part of this txg
1630 	 */
1631 	dbuf_add_ref(db, (void *)(uintptr_t)tx->tx_txg);
1632 	db->db_dirtycnt += 1;
1633 	ASSERT3U(db->db_dirtycnt, <=, 3);
1634 
1635 	mutex_exit(&db->db_mtx);
1636 
1637 	if (db->db_blkid == DMU_BONUS_BLKID ||
1638 	    db->db_blkid == DMU_SPILL_BLKID) {
1639 		mutex_enter(&dn->dn_mtx);
1640 		ASSERT(!list_link_active(&dr->dr_dirty_node));
1641 		list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
1642 		mutex_exit(&dn->dn_mtx);
1643 		dnode_setdirty(dn, tx);
1644 		DB_DNODE_EXIT(db);
1645 		return (dr);
1646 	}
1647 
1648 	/*
1649 	 * The dn_struct_rwlock prevents db_blkptr from changing
1650 	 * due to a write from syncing context completing
1651 	 * while we are running, so we want to acquire it before
1652 	 * looking at db_blkptr.
1653 	 */
1654 	if (!RW_WRITE_HELD(&dn->dn_struct_rwlock)) {
1655 		rw_enter(&dn->dn_struct_rwlock, RW_READER);
1656 		drop_struct_lock = TRUE;
1657 	}
1658 
1659 	/*
1660 	 * We need to hold the dn_struct_rwlock to make this assertion,
1661 	 * because it protects dn_phys / dn_next_nlevels from changing.
1662 	 */
1663 	ASSERT((dn->dn_phys->dn_nlevels == 0 && db->db_level == 0) ||
1664 	    dn->dn_phys->dn_nlevels > db->db_level ||
1665 	    dn->dn_next_nlevels[txgoff] > db->db_level ||
1666 	    dn->dn_next_nlevels[(tx->tx_txg-1) & TXG_MASK] > db->db_level ||
1667 	    dn->dn_next_nlevels[(tx->tx_txg-2) & TXG_MASK] > db->db_level);
1668 
1669 	/*
1670 	 * If we are overwriting a dedup BP, then unless it is snapshotted,
1671 	 * when we get to syncing context we will need to decrement its
1672 	 * refcount in the DDT.  Prefetch the relevant DDT block so that
1673 	 * syncing context won't have to wait for the i/o.
1674 	 */
1675 	ddt_prefetch(os->os_spa, db->db_blkptr);
1676 
1677 	if (db->db_level == 0) {
1678 		dnode_new_blkid(dn, db->db_blkid, tx, drop_struct_lock);
1679 		ASSERT(dn->dn_maxblkid >= db->db_blkid);
1680 	}
1681 
1682 	if (db->db_level+1 < dn->dn_nlevels) {
1683 		dmu_buf_impl_t *parent = db->db_parent;
1684 		dbuf_dirty_record_t *di;
1685 		int parent_held = FALSE;
1686 
1687 		if (db->db_parent == NULL || db->db_parent == dn->dn_dbuf) {
1688 			int epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
1689 
1690 			parent = dbuf_hold_level(dn, db->db_level+1,
1691 			    db->db_blkid >> epbs, FTAG);
1692 			ASSERT(parent != NULL);
1693 			parent_held = TRUE;
1694 		}
1695 		if (drop_struct_lock)
1696 			rw_exit(&dn->dn_struct_rwlock);
1697 		ASSERT3U(db->db_level+1, ==, parent->db_level);
1698 		di = dbuf_dirty(parent, tx);
1699 		if (parent_held)
1700 			dbuf_rele(parent, FTAG);
1701 
1702 		mutex_enter(&db->db_mtx);
1703 		/*
1704 		 * Since we've dropped the mutex, it's possible that
1705 		 * dbuf_undirty() might have changed this out from under us.
1706 		 */
1707 		if (db->db_last_dirty == dr ||
1708 		    dn->dn_object == DMU_META_DNODE_OBJECT) {
1709 			mutex_enter(&di->dt.di.dr_mtx);
1710 			ASSERT3U(di->dr_txg, ==, tx->tx_txg);
1711 			ASSERT(!list_link_active(&dr->dr_dirty_node));
1712 			list_insert_tail(&di->dt.di.dr_children, dr);
1713 			mutex_exit(&di->dt.di.dr_mtx);
1714 			dr->dr_parent = di;
1715 		}
1716 		mutex_exit(&db->db_mtx);
1717 	} else {
1718 		ASSERT(db->db_level+1 == dn->dn_nlevels);
1719 		ASSERT(db->db_blkid < dn->dn_nblkptr);
1720 		ASSERT(db->db_parent == NULL || db->db_parent == dn->dn_dbuf);
1721 		mutex_enter(&dn->dn_mtx);
1722 		ASSERT(!list_link_active(&dr->dr_dirty_node));
1723 		list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
1724 		mutex_exit(&dn->dn_mtx);
1725 		if (drop_struct_lock)
1726 			rw_exit(&dn->dn_struct_rwlock);
1727 	}
1728 
1729 	dnode_setdirty(dn, tx);
1730 	DB_DNODE_EXIT(db);
1731 	return (dr);
1732 }
1733 
1734 /*
1735  * Undirty a buffer in the transaction group referenced by the given
1736  * transaction.  Return whether this evicted the dbuf.
1737  */
1738 static boolean_t
1739 dbuf_undirty(dmu_buf_impl_t *db, dmu_tx_t *tx)
1740 {
1741 	dnode_t *dn;
1742 	uint64_t txg = tx->tx_txg;
1743 	dbuf_dirty_record_t *dr, **drp;
1744 
1745 	ASSERT(txg != 0);
1746 
1747 	/*
1748 	 * Due to our use of dn_nlevels below, this can only be called
1749 	 * in open context, unless we are operating on the MOS.
1750 	 * From syncing context, dn_nlevels may be different from the
1751 	 * dn_nlevels used when dbuf was dirtied.
1752 	 */
1753 	ASSERT(db->db_objset ==
1754 	    dmu_objset_pool(db->db_objset)->dp_meta_objset ||
1755 	    txg != spa_syncing_txg(dmu_objset_spa(db->db_objset)));
1756 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1757 	ASSERT0(db->db_level);
1758 	ASSERT(MUTEX_HELD(&db->db_mtx));
1759 
1760 	/*
1761 	 * If this buffer is not dirty, we're done.
1762 	 */
1763 	for (drp = &db->db_last_dirty; (dr = *drp) != NULL; drp = &dr->dr_next)
1764 		if (dr->dr_txg <= txg)
1765 			break;
1766 	if (dr == NULL || dr->dr_txg < txg)
1767 		return (B_FALSE);
1768 	ASSERT(dr->dr_txg == txg);
1769 	ASSERT(dr->dr_dbuf == db);
1770 
1771 	DB_DNODE_ENTER(db);
1772 	dn = DB_DNODE(db);
1773 
1774 	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);
1775 
1776 	ASSERT(db->db.db_size != 0);
1777 
1778 	dsl_pool_undirty_space(dmu_objset_pool(dn->dn_objset),
1779 	    dr->dr_accounted, txg);
1780 
1781 	*drp = dr->dr_next;
1782 
1783 	/*
1784 	 * Note that there are three places in dbuf_dirty()
1785 	 * where this dirty record may be put on a list.
1786 	 * Make sure to do a list_remove corresponding to
1787 	 * every one of those list_insert calls.
1788 	 */
1789 	if (dr->dr_parent) {
1790 		mutex_enter(&dr->dr_parent->dt.di.dr_mtx);
1791 		list_remove(&dr->dr_parent->dt.di.dr_children, dr);
1792 		mutex_exit(&dr->dr_parent->dt.di.dr_mtx);
1793 	} else if (db->db_blkid == DMU_SPILL_BLKID ||
1794 	    db->db_level + 1 == dn->dn_nlevels) {
1795 		ASSERT(db->db_blkptr == NULL || db->db_parent == dn->dn_dbuf);
1796 		mutex_enter(&dn->dn_mtx);
1797 		list_remove(&dn->dn_dirty_records[txg & TXG_MASK], dr);
1798 		mutex_exit(&dn->dn_mtx);
1799 	}
1800 	DB_DNODE_EXIT(db);
1801 
1802 	if (db->db_state != DB_NOFILL) {
1803 		dbuf_unoverride(dr);
1804 
1805 		ASSERT(db->db_buf != NULL);
1806 		ASSERT(dr->dt.dl.dr_data != NULL);
1807 		if (dr->dt.dl.dr_data != db->db_buf)
1808 			arc_buf_destroy(dr->dt.dl.dr_data, db);
1809 	}
1810 
1811 	kmem_free(dr, sizeof (dbuf_dirty_record_t));
1812 
1813 	ASSERT(db->db_dirtycnt > 0);
1814 	db->db_dirtycnt -= 1;
1815 
1816 	if (refcount_remove(&db->db_holds, (void *)(uintptr_t)txg) == 0) {
1817 		ASSERT(db->db_state == DB_NOFILL || arc_released(db->db_buf));
1818 		dbuf_destroy(db);
1819 		return (B_TRUE);
1820 	}
1821 
1822 	return (B_FALSE);
1823 }
1824 
1825 void
1826 dmu_buf_will_dirty(dmu_buf_t *db_fake, dmu_tx_t *tx)
1827 {
1828 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1829 	int rf = DB_RF_MUST_SUCCEED | DB_RF_NOPREFETCH;
1830 
1831 	ASSERT(tx->tx_txg != 0);
1832 	ASSERT(!refcount_is_zero(&db->db_holds));
1833 
1834 	/*
1835 	 * Quick check for dirtyness.  For already dirty blocks, this
1836 	 * reduces runtime of this function by >90%, and overall performance
1837 	 * by 50% for some workloads (e.g. file deletion with indirect blocks
1838 	 * cached).
1839 	 */
1840 	mutex_enter(&db->db_mtx);
1841 	dbuf_dirty_record_t *dr;
1842 	for (dr = db->db_last_dirty;
1843 	    dr != NULL && dr->dr_txg >= tx->tx_txg; dr = dr->dr_next) {
1844 		/*
1845 		 * It's possible that it is already dirty but not cached,
1846 		 * because there are some calls to dbuf_dirty() that don't
1847 		 * go through dmu_buf_will_dirty().
1848 		 */
1849 		if (dr->dr_txg == tx->tx_txg && db->db_state == DB_CACHED) {
1850 			/* This dbuf is already dirty and cached. */
1851 			dbuf_redirty(dr);
1852 			mutex_exit(&db->db_mtx);
1853 			return;
1854 		}
1855 	}
1856 	mutex_exit(&db->db_mtx);
1857 
1858 	DB_DNODE_ENTER(db);
1859 	if (RW_WRITE_HELD(&DB_DNODE(db)->dn_struct_rwlock))
1860 		rf |= DB_RF_HAVESTRUCT;
1861 	DB_DNODE_EXIT(db);
1862 	(void) dbuf_read(db, NULL, rf);
1863 	(void) dbuf_dirty(db, tx);
1864 }
1865 
1866 void
1867 dmu_buf_will_not_fill(dmu_buf_t *db_fake, dmu_tx_t *tx)
1868 {
1869 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1870 
1871 	db->db_state = DB_NOFILL;
1872 
1873 	dmu_buf_will_fill(db_fake, tx);
1874 }
1875 
1876 void
1877 dmu_buf_will_fill(dmu_buf_t *db_fake, dmu_tx_t *tx)
1878 {
1879 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
1880 
1881 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1882 	ASSERT(tx->tx_txg != 0);
1883 	ASSERT(db->db_level == 0);
1884 	ASSERT(!refcount_is_zero(&db->db_holds));
1885 
1886 	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT ||
1887 	    dmu_tx_private_ok(tx));
1888 
1889 	dbuf_noread(db);
1890 	(void) dbuf_dirty(db, tx);
1891 }
1892 
1893 #pragma weak dmu_buf_fill_done = dbuf_fill_done
1894 /* ARGSUSED */
1895 void
1896 dbuf_fill_done(dmu_buf_impl_t *db, dmu_tx_t *tx)
1897 {
1898 	mutex_enter(&db->db_mtx);
1899 	DBUF_VERIFY(db);
1900 
1901 	if (db->db_state == DB_FILL) {
1902 		if (db->db_level == 0 && db->db_freed_in_flight) {
1903 			ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1904 			/* we were freed while filling */
1905 			/* XXX dbuf_undirty? */
1906 			bzero(db->db.db_data, db->db.db_size);
1907 			db->db_freed_in_flight = FALSE;
1908 		}
1909 		db->db_state = DB_CACHED;
1910 		cv_broadcast(&db->db_changed);
1911 	}
1912 	mutex_exit(&db->db_mtx);
1913 }
1914 
1915 void
1916 dmu_buf_write_embedded(dmu_buf_t *dbuf, void *data,
1917     bp_embedded_type_t etype, enum zio_compress comp,
1918     int uncompressed_size, int compressed_size, int byteorder,
1919     dmu_tx_t *tx)
1920 {
1921 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)dbuf;
1922 	struct dirty_leaf *dl;
1923 	dmu_object_type_t type;
1924 
1925 	if (etype == BP_EMBEDDED_TYPE_DATA) {
1926 		ASSERT(spa_feature_is_active(dmu_objset_spa(db->db_objset),
1927 		    SPA_FEATURE_EMBEDDED_DATA));
1928 	}
1929 
1930 	DB_DNODE_ENTER(db);
1931 	type = DB_DNODE(db)->dn_type;
1932 	DB_DNODE_EXIT(db);
1933 
1934 	ASSERT0(db->db_level);
1935 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1936 
1937 	dmu_buf_will_not_fill(dbuf, tx);
1938 
1939 	ASSERT3U(db->db_last_dirty->dr_txg, ==, tx->tx_txg);
1940 	dl = &db->db_last_dirty->dt.dl;
1941 	encode_embedded_bp_compressed(&dl->dr_overridden_by,
1942 	    data, comp, uncompressed_size, compressed_size);
1943 	BPE_SET_ETYPE(&dl->dr_overridden_by, etype);
1944 	BP_SET_TYPE(&dl->dr_overridden_by, type);
1945 	BP_SET_LEVEL(&dl->dr_overridden_by, 0);
1946 	BP_SET_BYTEORDER(&dl->dr_overridden_by, byteorder);
1947 
1948 	dl->dr_override_state = DR_OVERRIDDEN;
1949 	dl->dr_overridden_by.blk_birth = db->db_last_dirty->dr_txg;
1950 }
1951 
1952 /*
1953  * Directly assign a provided arc buf to a given dbuf if it's not referenced
1954  * by anybody except our caller. Otherwise copy arcbuf's contents to dbuf.
1955  */
1956 void
1957 dbuf_assign_arcbuf(dmu_buf_impl_t *db, arc_buf_t *buf, dmu_tx_t *tx)
1958 {
1959 	ASSERT(!refcount_is_zero(&db->db_holds));
1960 	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
1961 	ASSERT(db->db_level == 0);
1962 	ASSERT3U(dbuf_is_metadata(db), ==, arc_is_metadata(buf));
1963 	ASSERT(buf != NULL);
1964 	ASSERT(arc_buf_lsize(buf) == db->db.db_size);
1965 	ASSERT(tx->tx_txg != 0);
1966 
1967 	arc_return_buf(buf, db);
1968 	ASSERT(arc_released(buf));
1969 
1970 	mutex_enter(&db->db_mtx);
1971 
1972 	while (db->db_state == DB_READ || db->db_state == DB_FILL)
1973 		cv_wait(&db->db_changed, &db->db_mtx);
1974 
1975 	ASSERT(db->db_state == DB_CACHED || db->db_state == DB_UNCACHED);
1976 
1977 	if (db->db_state == DB_CACHED &&
1978 	    refcount_count(&db->db_holds) - 1 > db->db_dirtycnt) {
1979 		mutex_exit(&db->db_mtx);
1980 		(void) dbuf_dirty(db, tx);
1981 		bcopy(buf->b_data, db->db.db_data, db->db.db_size);
1982 		arc_buf_destroy(buf, db);
1983 		xuio_stat_wbuf_copied();
1984 		return;
1985 	}
1986 
1987 	xuio_stat_wbuf_nocopy();
1988 	if (db->db_state == DB_CACHED) {
1989 		dbuf_dirty_record_t *dr = db->db_last_dirty;
1990 
1991 		ASSERT(db->db_buf != NULL);
1992 		if (dr != NULL && dr->dr_txg == tx->tx_txg) {
1993 			ASSERT(dr->dt.dl.dr_data == db->db_buf);
1994 			if (!arc_released(db->db_buf)) {
1995 				ASSERT(dr->dt.dl.dr_override_state ==
1996 				    DR_OVERRIDDEN);
1997 				arc_release(db->db_buf, db);
1998 			}
1999 			dr->dt.dl.dr_data = buf;
2000 			arc_buf_destroy(db->db_buf, db);
2001 		} else if (dr == NULL || dr->dt.dl.dr_data != db->db_buf) {
2002 			arc_release(db->db_buf, db);
2003 			arc_buf_destroy(db->db_buf, db);
2004 		}
2005 		db->db_buf = NULL;
2006 	}
2007 	ASSERT(db->db_buf == NULL);
2008 	dbuf_set_data(db, buf);
2009 	db->db_state = DB_FILL;
2010 	mutex_exit(&db->db_mtx);
2011 	(void) dbuf_dirty(db, tx);
2012 	dmu_buf_fill_done(&db->db, tx);
2013 }
2014 
2015 void
2016 dbuf_destroy(dmu_buf_impl_t *db)
2017 {
2018 	dnode_t *dn;
2019 	dmu_buf_impl_t *parent = db->db_parent;
2020 	dmu_buf_impl_t *dndb;
2021 
2022 	ASSERT(MUTEX_HELD(&db->db_mtx));
2023 	ASSERT(refcount_is_zero(&db->db_holds));
2024 
2025 	if (db->db_buf != NULL) {
2026 		arc_buf_destroy(db->db_buf, db);
2027 		db->db_buf = NULL;
2028 	}
2029 
2030 	if (db->db_blkid == DMU_BONUS_BLKID) {
2031 		ASSERT(db->db.db_data != NULL);
2032 		zio_buf_free(db->db.db_data, DN_MAX_BONUSLEN);
2033 		arc_space_return(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
2034 		db->db_state = DB_UNCACHED;
2035 	}
2036 
2037 	dbuf_clear_data(db);
2038 
2039 	if (multilist_link_active(&db->db_cache_link)) {
2040 		multilist_remove(dbuf_cache, db);
2041 		(void) refcount_remove_many(&dbuf_cache_size,
2042 		    db->db.db_size, db);
2043 	}
2044 
2045 	ASSERT(db->db_state == DB_UNCACHED || db->db_state == DB_NOFILL);
2046 	ASSERT(db->db_data_pending == NULL);
2047 
2048 	db->db_state = DB_EVICTING;
2049 	db->db_blkptr = NULL;
2050 
2051 	/*
2052 	 * Now that db_state is DB_EVICTING, nobody else can find this via
2053 	 * the hash table.  We can now drop db_mtx, which allows us to
2054 	 * acquire the dn_dbufs_mtx.
2055 	 */
2056 	mutex_exit(&db->db_mtx);
2057 
2058 	DB_DNODE_ENTER(db);
2059 	dn = DB_DNODE(db);
2060 	dndb = dn->dn_dbuf;
2061 	if (db->db_blkid != DMU_BONUS_BLKID) {
2062 		boolean_t needlock = !MUTEX_HELD(&dn->dn_dbufs_mtx);
2063 		if (needlock)
2064 			mutex_enter(&dn->dn_dbufs_mtx);
2065 		avl_remove(&dn->dn_dbufs, db);
2066 		atomic_dec_32(&dn->dn_dbufs_count);
2067 		membar_producer();
2068 		DB_DNODE_EXIT(db);
2069 		if (needlock)
2070 			mutex_exit(&dn->dn_dbufs_mtx);
2071 		/*
2072 		 * Decrementing the dbuf count means that the hold corresponding
2073 		 * to the removed dbuf is no longer discounted in dnode_move(),
2074 		 * so the dnode cannot be moved until after we release the hold.
2075 		 * The membar_producer() ensures visibility of the decremented
2076 		 * value in dnode_move(), since DB_DNODE_EXIT doesn't actually
2077 		 * release any lock.
2078 		 */
2079 		dnode_rele(dn, db);
2080 		db->db_dnode_handle = NULL;
2081 
2082 		dbuf_hash_remove(db);
2083 	} else {
2084 		DB_DNODE_EXIT(db);
2085 	}
2086 
2087 	ASSERT(refcount_is_zero(&db->db_holds));
2088 
2089 	db->db_parent = NULL;
2090 
2091 	ASSERT(db->db_buf == NULL);
2092 	ASSERT(db->db.db_data == NULL);
2093 	ASSERT(db->db_hash_next == NULL);
2094 	ASSERT(db->db_blkptr == NULL);
2095 	ASSERT(db->db_data_pending == NULL);
2096 	ASSERT(!multilist_link_active(&db->db_cache_link));
2097 
2098 	kmem_cache_free(dbuf_kmem_cache, db);
2099 	arc_space_return(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
2100 
2101 	/*
2102 	 * If this dbuf is referenced from an indirect dbuf,
2103 	 * decrement the ref count on the indirect dbuf.
2104 	 */
2105 	if (parent && parent != dndb)
2106 		dbuf_rele(parent, db);
2107 }
2108 
2109 /*
2110  * Note: While bpp will always be updated if the function returns success,
2111  * parentp will not be updated if the dnode does not have dn_dbuf filled in;
2112  * this happens when the dnode is the meta-dnode, or a userused or groupused
2113  * object.
2114  */
2115 static int
2116 dbuf_findbp(dnode_t *dn, int level, uint64_t blkid, int fail_sparse,
2117     dmu_buf_impl_t **parentp, blkptr_t **bpp)
2118 {
2119 	*parentp = NULL;
2120 	*bpp = NULL;
2121 
2122 	ASSERT(blkid != DMU_BONUS_BLKID);
2123 
2124 	if (blkid == DMU_SPILL_BLKID) {
2125 		mutex_enter(&dn->dn_mtx);
2126 		if (dn->dn_have_spill &&
2127 		    (dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR))
2128 			*bpp = &dn->dn_phys->dn_spill;
2129 		else
2130 			*bpp = NULL;
2131 		dbuf_add_ref(dn->dn_dbuf, NULL);
2132 		*parentp = dn->dn_dbuf;
2133 		mutex_exit(&dn->dn_mtx);
2134 		return (0);
2135 	}
2136 
2137 	int nlevels =
2138 	    (dn->dn_phys->dn_nlevels == 0) ? 1 : dn->dn_phys->dn_nlevels;
2139 	int epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
2140 
2141 	ASSERT3U(level * epbs, <, 64);
2142 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
2143 	/*
2144 	 * This assertion shouldn't trip as long as the max indirect block size
2145 	 * is less than 1M.  The reason for this is that up to that point,
2146 	 * the number of levels required to address an entire object with blocks
2147 	 * of size SPA_MINBLOCKSIZE satisfies nlevels * epbs + 1 <= 64.  In
2148 	 * other words, if N * epbs + 1 > 64, then if (N-1) * epbs + 1 > 55
2149 	 * (i.e. we can address the entire object), objects will all use at most
2150 	 * N-1 levels and the assertion won't overflow.  However, once epbs is
2151 	 * 13, 4 * 13 + 1 = 53, but 5 * 13 + 1 = 66.  Then, 4 levels will not be
2152 	 * enough to address an entire object, so objects will have 5 levels,
2153 	 * but then this assertion will overflow.
2154 	 *
2155 	 * All this is to say that if we ever increase DN_MAX_INDBLKSHIFT, we
2156 	 * need to redo this logic to handle overflows.
2157 	 */
2158 	ASSERT(level >= nlevels ||
2159 	    ((nlevels - level - 1) * epbs) +
2160 	    highbit64(dn->dn_phys->dn_nblkptr) <= 64);
2161 	if (level >= nlevels ||
2162 	    blkid >= ((uint64_t)dn->dn_phys->dn_nblkptr <<
2163 	    ((nlevels - level - 1) * epbs)) ||
2164 	    (fail_sparse &&
2165 	    blkid > (dn->dn_phys->dn_maxblkid >> (level * epbs)))) {
2166 		/* the buffer has no parent yet */
2167 		return (SET_ERROR(ENOENT));
2168 	} else if (level < nlevels-1) {
2169 		/* this block is referenced from an indirect block */
2170 		int err = dbuf_hold_impl(dn, level+1,
2171 		    blkid >> epbs, fail_sparse, FALSE, NULL, parentp);
2172 		if (err)
2173 			return (err);
2174 		err = dbuf_read(*parentp, NULL,
2175 		    (DB_RF_HAVESTRUCT | DB_RF_NOPREFETCH | DB_RF_CANFAIL));
2176 		if (err) {
2177 			dbuf_rele(*parentp, NULL);
2178 			*parentp = NULL;
2179 			return (err);
2180 		}
2181 		*bpp = ((blkptr_t *)(*parentp)->db.db_data) +
2182 		    (blkid & ((1ULL << epbs) - 1));
2183 		if (blkid > (dn->dn_phys->dn_maxblkid >> (level * epbs)))
2184 			ASSERT(BP_IS_HOLE(*bpp));
2185 		return (0);
2186 	} else {
2187 		/* the block is referenced from the dnode */
2188 		ASSERT3U(level, ==, nlevels-1);
2189 		ASSERT(dn->dn_phys->dn_nblkptr == 0 ||
2190 		    blkid < dn->dn_phys->dn_nblkptr);
2191 		if (dn->dn_dbuf) {
2192 			dbuf_add_ref(dn->dn_dbuf, NULL);
2193 			*parentp = dn->dn_dbuf;
2194 		}
2195 		*bpp = &dn->dn_phys->dn_blkptr[blkid];
2196 		return (0);
2197 	}
2198 }
2199 
2200 static dmu_buf_impl_t *
2201 dbuf_create(dnode_t *dn, uint8_t level, uint64_t blkid,
2202     dmu_buf_impl_t *parent, blkptr_t *blkptr)
2203 {
2204 	objset_t *os = dn->dn_objset;
2205 	dmu_buf_impl_t *db, *odb;
2206 
2207 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
2208 	ASSERT(dn->dn_type != DMU_OT_NONE);
2209 
2210 	db = kmem_cache_alloc(dbuf_kmem_cache, KM_SLEEP);
2211 
2212 	db->db_objset = os;
2213 	db->db.db_object = dn->dn_object;
2214 	db->db_level = level;
2215 	db->db_blkid = blkid;
2216 	db->db_last_dirty = NULL;
2217 	db->db_dirtycnt = 0;
2218 	db->db_dnode_handle = dn->dn_handle;
2219 	db->db_parent = parent;
2220 	db->db_blkptr = blkptr;
2221 
2222 	db->db_user = NULL;
2223 	db->db_user_immediate_evict = FALSE;
2224 	db->db_freed_in_flight = FALSE;
2225 	db->db_pending_evict = FALSE;
2226 
2227 	if (blkid == DMU_BONUS_BLKID) {
2228 		ASSERT3P(parent, ==, dn->dn_dbuf);
2229 		db->db.db_size = DN_MAX_BONUSLEN -
2230 		    (dn->dn_nblkptr-1) * sizeof (blkptr_t);
2231 		ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
2232 		db->db.db_offset = DMU_BONUS_BLKID;
2233 		db->db_state = DB_UNCACHED;
2234 		/* the bonus dbuf is not placed in the hash table */
2235 		arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
2236 		return (db);
2237 	} else if (blkid == DMU_SPILL_BLKID) {
2238 		db->db.db_size = (blkptr != NULL) ?
2239 		    BP_GET_LSIZE(blkptr) : SPA_MINBLOCKSIZE;
2240 		db->db.db_offset = 0;
2241 	} else {
2242 		int blocksize =
2243 		    db->db_level ? 1 << dn->dn_indblkshift : dn->dn_datablksz;
2244 		db->db.db_size = blocksize;
2245 		db->db.db_offset = db->db_blkid * blocksize;
2246 	}
2247 
2248 	/*
2249 	 * Hold the dn_dbufs_mtx while we get the new dbuf
2250 	 * in the hash table *and* added to the dbufs list.
2251 	 * This prevents a possible deadlock with someone
2252 	 * trying to look up this dbuf before its added to the
2253 	 * dn_dbufs list.
2254 	 */
2255 	mutex_enter(&dn->dn_dbufs_mtx);
2256 	db->db_state = DB_EVICTING;
2257 	if ((odb = dbuf_hash_insert(db)) != NULL) {
2258 		/* someone else inserted it first */
2259 		kmem_cache_free(dbuf_kmem_cache, db);
2260 		mutex_exit(&dn->dn_dbufs_mtx);
2261 		return (odb);
2262 	}
2263 	avl_add(&dn->dn_dbufs, db);
2264 
2265 	db->db_state = DB_UNCACHED;
2266 	mutex_exit(&dn->dn_dbufs_mtx);
2267 	arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_OTHER);
2268 
2269 	if (parent && parent != dn->dn_dbuf)
2270 		dbuf_add_ref(parent, db);
2271 
2272 	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT ||
2273 	    refcount_count(&dn->dn_holds) > 0);
2274 	(void) refcount_add(&dn->dn_holds, db);
2275 	atomic_inc_32(&dn->dn_dbufs_count);
2276 
2277 	dprintf_dbuf(db, "db=%p\n", db);
2278 
2279 	return (db);
2280 }
2281 
2282 typedef struct dbuf_prefetch_arg {
2283 	spa_t *dpa_spa;	/* The spa to issue the prefetch in. */
2284 	zbookmark_phys_t dpa_zb; /* The target block to prefetch. */
2285 	int dpa_epbs; /* Entries (blkptr_t's) Per Block Shift. */
2286 	int dpa_curlevel; /* The current level that we're reading */
2287 	dnode_t *dpa_dnode; /* The dnode associated with the prefetch */
2288 	zio_priority_t dpa_prio; /* The priority I/Os should be issued at. */
2289 	zio_t *dpa_zio; /* The parent zio_t for all prefetches. */
2290 	arc_flags_t dpa_aflags; /* Flags to pass to the final prefetch. */
2291 } dbuf_prefetch_arg_t;
2292 
2293 /*
2294  * Actually issue the prefetch read for the block given.
2295  */
2296 static void
2297 dbuf_issue_final_prefetch(dbuf_prefetch_arg_t *dpa, blkptr_t *bp)
2298 {
2299 	if (BP_IS_HOLE(bp) || BP_IS_EMBEDDED(bp))
2300 		return;
2301 
2302 	arc_flags_t aflags =
2303 	    dpa->dpa_aflags | ARC_FLAG_NOWAIT | ARC_FLAG_PREFETCH;
2304 
2305 	ASSERT3U(dpa->dpa_curlevel, ==, BP_GET_LEVEL(bp));
2306 	ASSERT3U(dpa->dpa_curlevel, ==, dpa->dpa_zb.zb_level);
2307 	ASSERT(dpa->dpa_zio != NULL);
2308 	(void) arc_read(dpa->dpa_zio, dpa->dpa_spa, bp, NULL, NULL,
2309 	    dpa->dpa_prio, ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
2310 	    &aflags, &dpa->dpa_zb);
2311 }
2312 
2313 /*
2314  * Called when an indirect block above our prefetch target is read in.  This
2315  * will either read in the next indirect block down the tree or issue the actual
2316  * prefetch if the next block down is our target.
2317  */
2318 static void
2319 dbuf_prefetch_indirect_done(zio_t *zio, arc_buf_t *abuf, void *private)
2320 {
2321 	dbuf_prefetch_arg_t *dpa = private;
2322 
2323 	ASSERT3S(dpa->dpa_zb.zb_level, <, dpa->dpa_curlevel);
2324 	ASSERT3S(dpa->dpa_curlevel, >, 0);
2325 
2326 	/*
2327 	 * The dpa_dnode is only valid if we are called with a NULL
2328 	 * zio. This indicates that the arc_read() returned without
2329 	 * first calling zio_read() to issue a physical read. Once
2330 	 * a physical read is made the dpa_dnode must be invalidated
2331 	 * as the locks guarding it may have been dropped. If the
2332 	 * dpa_dnode is still valid, then we want to add it to the dbuf
2333 	 * cache. To do so, we must hold the dbuf associated with the block
2334 	 * we just prefetched, read its contents so that we associate it
2335 	 * with an arc_buf_t, and then release it.
2336 	 */
2337 	if (zio != NULL) {
2338 		ASSERT3S(BP_GET_LEVEL(zio->io_bp), ==, dpa->dpa_curlevel);
2339 		if (zio->io_flags & ZIO_FLAG_RAW) {
2340 			ASSERT3U(BP_GET_PSIZE(zio->io_bp), ==, zio->io_size);
2341 		} else {
2342 			ASSERT3U(BP_GET_LSIZE(zio->io_bp), ==, zio->io_size);
2343 		}
2344 		ASSERT3P(zio->io_spa, ==, dpa->dpa_spa);
2345 
2346 		dpa->dpa_dnode = NULL;
2347 	} else if (dpa->dpa_dnode != NULL) {
2348 		uint64_t curblkid = dpa->dpa_zb.zb_blkid >>
2349 		    (dpa->dpa_epbs * (dpa->dpa_curlevel -
2350 		    dpa->dpa_zb.zb_level));
2351 		dmu_buf_impl_t *db = dbuf_hold_level(dpa->dpa_dnode,
2352 		    dpa->dpa_curlevel, curblkid, FTAG);
2353 		(void) dbuf_read(db, NULL,
2354 		    DB_RF_MUST_SUCCEED | DB_RF_NOPREFETCH | DB_RF_HAVESTRUCT);
2355 		dbuf_rele(db, FTAG);
2356 	}
2357 
2358 	dpa->dpa_curlevel--;
2359 
2360 	uint64_t nextblkid = dpa->dpa_zb.zb_blkid >>
2361 	    (dpa->dpa_epbs * (dpa->dpa_curlevel - dpa->dpa_zb.zb_level));
2362 	blkptr_t *bp = ((blkptr_t *)abuf->b_data) +
2363 	    P2PHASE(nextblkid, 1ULL << dpa->dpa_epbs);
2364 	if (BP_IS_HOLE(bp) || (zio != NULL && zio->io_error != 0)) {
2365 		kmem_free(dpa, sizeof (*dpa));
2366 	} else if (dpa->dpa_curlevel == dpa->dpa_zb.zb_level) {
2367 		ASSERT3U(nextblkid, ==, dpa->dpa_zb.zb_blkid);
2368 		dbuf_issue_final_prefetch(dpa, bp);
2369 		kmem_free(dpa, sizeof (*dpa));
2370 	} else {
2371 		arc_flags_t iter_aflags = ARC_FLAG_NOWAIT;
2372 		zbookmark_phys_t zb;
2373 
2374 		/* flag if L2ARC eligible, l2arc_noprefetch then decides */
2375 		if (dpa->dpa_aflags & ARC_FLAG_L2CACHE)
2376 			iter_aflags |= ARC_FLAG_L2CACHE;
2377 
2378 		ASSERT3U(dpa->dpa_curlevel, ==, BP_GET_LEVEL(bp));
2379 
2380 		SET_BOOKMARK(&zb, dpa->dpa_zb.zb_objset,
2381 		    dpa->dpa_zb.zb_object, dpa->dpa_curlevel, nextblkid);
2382 
2383 		(void) arc_read(dpa->dpa_zio, dpa->dpa_spa,
2384 		    bp, dbuf_prefetch_indirect_done, dpa, dpa->dpa_prio,
2385 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
2386 		    &iter_aflags, &zb);
2387 	}
2388 
2389 	arc_buf_destroy(abuf, private);
2390 }
2391 
2392 /*
2393  * Issue prefetch reads for the given block on the given level.  If the indirect
2394  * blocks above that block are not in memory, we will read them in
2395  * asynchronously.  As a result, this call never blocks waiting for a read to
2396  * complete.
2397  */
2398 void
2399 dbuf_prefetch(dnode_t *dn, int64_t level, uint64_t blkid, zio_priority_t prio,
2400     arc_flags_t aflags)
2401 {
2402 	blkptr_t bp;
2403 	int epbs, nlevels, curlevel;
2404 	uint64_t curblkid;
2405 
2406 	ASSERT(blkid != DMU_BONUS_BLKID);
2407 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
2408 
2409 	if (blkid > dn->dn_maxblkid)
2410 		return;
2411 
2412 	if (dnode_block_freed(dn, blkid))
2413 		return;
2414 
2415 	/*
2416 	 * This dnode hasn't been written to disk yet, so there's nothing to
2417 	 * prefetch.
2418 	 */
2419 	nlevels = dn->dn_phys->dn_nlevels;
2420 	if (level >= nlevels || dn->dn_phys->dn_nblkptr == 0)
2421 		return;
2422 
2423 	epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
2424 	if (dn->dn_phys->dn_maxblkid < blkid << (epbs * level))
2425 		return;
2426 
2427 	dmu_buf_impl_t *db = dbuf_find(dn->dn_objset, dn->dn_object,
2428 	    level, blkid);
2429 	if (db != NULL) {
2430 		mutex_exit(&db->db_mtx);
2431 		/*
2432 		 * This dbuf already exists.  It is either CACHED, or
2433 		 * (we assume) about to be read or filled.
2434 		 */
2435 		return;
2436 	}
2437 
2438 	/*
2439 	 * Find the closest ancestor (indirect block) of the target block
2440 	 * that is present in the cache.  In this indirect block, we will
2441 	 * find the bp that is at curlevel, curblkid.
2442 	 */
2443 	curlevel = level;
2444 	curblkid = blkid;
2445 	while (curlevel < nlevels - 1) {
2446 		int parent_level = curlevel + 1;
2447 		uint64_t parent_blkid = curblkid >> epbs;
2448 		dmu_buf_impl_t *db;
2449 
2450 		if (dbuf_hold_impl(dn, parent_level, parent_blkid,
2451 		    FALSE, TRUE, FTAG, &db) == 0) {
2452 			blkptr_t *bpp = db->db_buf->b_data;
2453 			bp = bpp[P2PHASE(curblkid, 1 << epbs)];
2454 			dbuf_rele(db, FTAG);
2455 			break;
2456 		}
2457 
2458 		curlevel = parent_level;
2459 		curblkid = parent_blkid;
2460 	}
2461 
2462 	if (curlevel == nlevels - 1) {
2463 		/* No cached indirect blocks found. */
2464 		ASSERT3U(curblkid, <, dn->dn_phys->dn_nblkptr);
2465 		bp = dn->dn_phys->dn_blkptr[curblkid];
2466 	}
2467 	if (BP_IS_HOLE(&bp))
2468 		return;
2469 
2470 	ASSERT3U(curlevel, ==, BP_GET_LEVEL(&bp));
2471 
2472 	zio_t *pio = zio_root(dmu_objset_spa(dn->dn_objset), NULL, NULL,
2473 	    ZIO_FLAG_CANFAIL);
2474 
2475 	dbuf_prefetch_arg_t *dpa = kmem_zalloc(sizeof (*dpa), KM_SLEEP);
2476 	dsl_dataset_t *ds = dn->dn_objset->os_dsl_dataset;
2477 	SET_BOOKMARK(&dpa->dpa_zb, ds != NULL ? ds->ds_object : DMU_META_OBJSET,
2478 	    dn->dn_object, level, blkid);
2479 	dpa->dpa_curlevel = curlevel;
2480 	dpa->dpa_prio = prio;
2481 	dpa->dpa_aflags = aflags;
2482 	dpa->dpa_spa = dn->dn_objset->os_spa;
2483 	dpa->dpa_dnode = dn;
2484 	dpa->dpa_epbs = epbs;
2485 	dpa->dpa_zio = pio;
2486 
2487 	/* flag if L2ARC eligible, l2arc_noprefetch then decides */
2488 	if (DNODE_LEVEL_IS_L2CACHEABLE(dn, level))
2489 		dpa->dpa_aflags |= ARC_FLAG_L2CACHE;
2490 
2491 	/*
2492 	 * If we have the indirect just above us, no need to do the asynchronous
2493 	 * prefetch chain; we'll just run the last step ourselves.  If we're at
2494 	 * a higher level, though, we want to issue the prefetches for all the
2495 	 * indirect blocks asynchronously, so we can go on with whatever we were
2496 	 * doing.
2497 	 */
2498 	if (curlevel == level) {
2499 		ASSERT3U(curblkid, ==, blkid);
2500 		dbuf_issue_final_prefetch(dpa, &bp);
2501 		kmem_free(dpa, sizeof (*dpa));
2502 	} else {
2503 		arc_flags_t iter_aflags = ARC_FLAG_NOWAIT;
2504 		zbookmark_phys_t zb;
2505 
2506 		/* flag if L2ARC eligible, l2arc_noprefetch then decides */
2507 		if (DNODE_LEVEL_IS_L2CACHEABLE(dn, level))
2508 			iter_aflags |= ARC_FLAG_L2CACHE;
2509 
2510 		SET_BOOKMARK(&zb, ds != NULL ? ds->ds_object : DMU_META_OBJSET,
2511 		    dn->dn_object, curlevel, curblkid);
2512 		(void) arc_read(dpa->dpa_zio, dpa->dpa_spa,
2513 		    &bp, dbuf_prefetch_indirect_done, dpa, prio,
2514 		    ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE,
2515 		    &iter_aflags, &zb);
2516 	}
2517 	/*
2518 	 * We use pio here instead of dpa_zio since it's possible that
2519 	 * dpa may have already been freed.
2520 	 */
2521 	zio_nowait(pio);
2522 }
2523 
2524 /*
2525  * Returns with db_holds incremented, and db_mtx not held.
2526  * Note: dn_struct_rwlock must be held.
2527  */
2528 int
2529 dbuf_hold_impl(dnode_t *dn, uint8_t level, uint64_t blkid,
2530     boolean_t fail_sparse, boolean_t fail_uncached,
2531     void *tag, dmu_buf_impl_t **dbp)
2532 {
2533 	dmu_buf_impl_t *db, *parent = NULL;
2534 
2535 	ASSERT(blkid != DMU_BONUS_BLKID);
2536 	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
2537 	ASSERT3U(dn->dn_nlevels, >, level);
2538 
2539 	*dbp = NULL;
2540 top:
2541 	/* dbuf_find() returns with db_mtx held */
2542 	db = dbuf_find(dn->dn_objset, dn->dn_object, level, blkid);
2543 
2544 	if (db == NULL) {
2545 		blkptr_t *bp = NULL;
2546 		int err;
2547 
2548 		if (fail_uncached)
2549 			return (SET_ERROR(ENOENT));
2550 
2551 		ASSERT3P(parent, ==, NULL);
2552 		err = dbuf_findbp(dn, level, blkid, fail_sparse, &parent, &bp);
2553 		if (fail_sparse) {
2554 			if (err == 0 && bp && BP_IS_HOLE(bp))
2555 				err = SET_ERROR(ENOENT);
2556 			if (err) {
2557 				if (parent)
2558 					dbuf_rele(parent, NULL);
2559 				return (err);
2560 			}
2561 		}
2562 		if (err && err != ENOENT)
2563 			return (err);
2564 		db = dbuf_create(dn, level, blkid, parent, bp);
2565 	}
2566 
2567 	if (fail_uncached && db->db_state != DB_CACHED) {
2568 		mutex_exit(&db->db_mtx);
2569 		return (SET_ERROR(ENOENT));
2570 	}
2571 
2572 	if (db->db_buf != NULL)
2573 		ASSERT3P(db->db.db_data, ==, db->db_buf->b_data);
2574 
2575 	ASSERT(db->db_buf == NULL || arc_referenced(db->db_buf));
2576 
2577 	/*
2578 	 * If this buffer is currently syncing out, and we are are
2579 	 * still referencing it from db_data, we need to make a copy
2580 	 * of it in case we decide we want to dirty it again in this txg.
2581 	 */
2582 	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
2583 	    dn->dn_object != DMU_META_DNODE_OBJECT &&
2584 	    db->db_state == DB_CACHED && db->db_data_pending) {
2585 		dbuf_dirty_record_t *dr = db->db_data_pending;
2586 
2587 		if (dr->dt.dl.dr_data == db->db_buf) {
2588 			arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
2589 
2590 			dbuf_set_data(db,
2591 			    arc_alloc_buf(dn->dn_objset->os_spa, db, type,
2592 			    db->db.db_size));
2593 			bcopy(dr->dt.dl.dr_data->b_data, db->db.db_data,
2594 			    db->db.db_size);
2595 		}
2596 	}
2597 
2598 	if (multilist_link_active(&db->db_cache_link)) {
2599 		ASSERT(refcount_is_zero(&db->db_holds));
2600 		multilist_remove(dbuf_cache, db);
2601 		(void) refcount_remove_many(&dbuf_cache_size,
2602 		    db->db.db_size, db);
2603 	}
2604 	(void) refcount_add(&db->db_holds, tag);
2605 	DBUF_VERIFY(db);
2606 	mutex_exit(&db->db_mtx);
2607 
2608 	/* NOTE: we can't rele the parent until after we drop the db_mtx */
2609 	if (parent)
2610 		dbuf_rele(parent, NULL);
2611 
2612 	ASSERT3P(DB_DNODE(db), ==, dn);
2613 	ASSERT3U(db->db_blkid, ==, blkid);
2614 	ASSERT3U(db->db_level, ==, level);
2615 	*dbp = db;
2616 
2617 	return (0);
2618 }
2619 
2620 dmu_buf_impl_t *
2621 dbuf_hold(dnode_t *dn, uint64_t blkid, void *tag)
2622 {
2623 	return (dbuf_hold_level(dn, 0, blkid, tag));
2624 }
2625 
2626 dmu_buf_impl_t *
2627 dbuf_hold_level(dnode_t *dn, int level, uint64_t blkid, void *tag)
2628 {
2629 	dmu_buf_impl_t *db;
2630 	int err = dbuf_hold_impl(dn, level, blkid, FALSE, FALSE, tag, &db);
2631 	return (err ? NULL : db);
2632 }
2633 
2634 void
2635 dbuf_create_bonus(dnode_t *dn)
2636 {
2637 	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));
2638 
2639 	ASSERT(dn->dn_bonus == NULL);
2640 	dn->dn_bonus = dbuf_create(dn, 0, DMU_BONUS_BLKID, dn->dn_dbuf, NULL);
2641 }
2642 
2643 int
2644 dbuf_spill_set_blksz(dmu_buf_t *db_fake, uint64_t blksz, dmu_tx_t *tx)
2645 {
2646 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2647 	dnode_t *dn;
2648 
2649 	if (db->db_blkid != DMU_SPILL_BLKID)
2650 		return (SET_ERROR(ENOTSUP));
2651 	if (blksz == 0)
2652 		blksz = SPA_MINBLOCKSIZE;
2653 	ASSERT3U(blksz, <=, spa_maxblocksize(dmu_objset_spa(db->db_objset)));
2654 	blksz = P2ROUNDUP(blksz, SPA_MINBLOCKSIZE);
2655 
2656 	DB_DNODE_ENTER(db);
2657 	dn = DB_DNODE(db);
2658 	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
2659 	dbuf_new_size(db, blksz, tx);
2660 	rw_exit(&dn->dn_struct_rwlock);
2661 	DB_DNODE_EXIT(db);
2662 
2663 	return (0);
2664 }
2665 
2666 void
2667 dbuf_rm_spill(dnode_t *dn, dmu_tx_t *tx)
2668 {
2669 	dbuf_free_range(dn, DMU_SPILL_BLKID, DMU_SPILL_BLKID, tx);
2670 }
2671 
2672 #pragma weak dmu_buf_add_ref = dbuf_add_ref
2673 void
2674 dbuf_add_ref(dmu_buf_impl_t *db, void *tag)
2675 {
2676 	int64_t holds = refcount_add(&db->db_holds, tag);
2677 	ASSERT3S(holds, >, 1);
2678 }
2679 
2680 #pragma weak dmu_buf_try_add_ref = dbuf_try_add_ref
2681 boolean_t
2682 dbuf_try_add_ref(dmu_buf_t *db_fake, objset_t *os, uint64_t obj, uint64_t blkid,
2683     void *tag)
2684 {
2685 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2686 	dmu_buf_impl_t *found_db;
2687 	boolean_t result = B_FALSE;
2688 
2689 	if (db->db_blkid == DMU_BONUS_BLKID)
2690 		found_db = dbuf_find_bonus(os, obj);
2691 	else
2692 		found_db = dbuf_find(os, obj, 0, blkid);
2693 
2694 	if (found_db != NULL) {
2695 		if (db == found_db && dbuf_refcount(db) > db->db_dirtycnt) {
2696 			(void) refcount_add(&db->db_holds, tag);
2697 			result = B_TRUE;
2698 		}
2699 		mutex_exit(&db->db_mtx);
2700 	}
2701 	return (result);
2702 }
2703 
2704 /*
2705  * If you call dbuf_rele() you had better not be referencing the dnode handle
2706  * unless you have some other direct or indirect hold on the dnode. (An indirect
2707  * hold is a hold on one of the dnode's dbufs, including the bonus buffer.)
2708  * Without that, the dbuf_rele() could lead to a dnode_rele() followed by the
2709  * dnode's parent dbuf evicting its dnode handles.
2710  */
2711 void
2712 dbuf_rele(dmu_buf_impl_t *db, void *tag)
2713 {
2714 	mutex_enter(&db->db_mtx);
2715 	dbuf_rele_and_unlock(db, tag);
2716 }
2717 
2718 void
2719 dmu_buf_rele(dmu_buf_t *db, void *tag)
2720 {
2721 	dbuf_rele((dmu_buf_impl_t *)db, tag);
2722 }
2723 
2724 /*
2725  * dbuf_rele() for an already-locked dbuf.  This is necessary to allow
2726  * db_dirtycnt and db_holds to be updated atomically.
2727  */
2728 void
2729 dbuf_rele_and_unlock(dmu_buf_impl_t *db, void *tag)
2730 {
2731 	int64_t holds;
2732 
2733 	ASSERT(MUTEX_HELD(&db->db_mtx));
2734 	DBUF_VERIFY(db);
2735 
2736 	/*
2737 	 * Remove the reference to the dbuf before removing its hold on the
2738 	 * dnode so we can guarantee in dnode_move() that a referenced bonus
2739 	 * buffer has a corresponding dnode hold.
2740 	 */
2741 	holds = refcount_remove(&db->db_holds, tag);
2742 	ASSERT(holds >= 0);
2743 
2744 	/*
2745 	 * We can't freeze indirects if there is a possibility that they
2746 	 * may be modified in the current syncing context.
2747 	 */
2748 	if (db->db_buf != NULL &&
2749 	    holds == (db->db_level == 0 ? db->db_dirtycnt : 0)) {
2750 		arc_buf_freeze(db->db_buf);
2751 	}
2752 
2753 	if (holds == db->db_dirtycnt &&
2754 	    db->db_level == 0 && db->db_user_immediate_evict)
2755 		dbuf_evict_user(db);
2756 
2757 	if (holds == 0) {
2758 		if (db->db_blkid == DMU_BONUS_BLKID) {
2759 			dnode_t *dn;
2760 			boolean_t evict_dbuf = db->db_pending_evict;
2761 
2762 			/*
2763 			 * If the dnode moves here, we cannot cross this
2764 			 * barrier until the move completes.
2765 			 */
2766 			DB_DNODE_ENTER(db);
2767 
2768 			dn = DB_DNODE(db);
2769 			atomic_dec_32(&dn->dn_dbufs_count);
2770 
2771 			/*
2772 			 * Decrementing the dbuf count means that the bonus
2773 			 * buffer's dnode hold is no longer discounted in
2774 			 * dnode_move(). The dnode cannot move until after
2775 			 * the dnode_rele() below.
2776 			 */
2777 			DB_DNODE_EXIT(db);
2778 
2779 			/*
2780 			 * Do not reference db after its lock is dropped.
2781 			 * Another thread may evict it.
2782 			 */
2783 			mutex_exit(&db->db_mtx);
2784 
2785 			if (evict_dbuf)
2786 				dnode_evict_bonus(dn);
2787 
2788 			dnode_rele(dn, db);
2789 		} else if (db->db_buf == NULL) {
2790 			/*
2791 			 * This is a special case: we never associated this
2792 			 * dbuf with any data allocated from the ARC.
2793 			 */
2794 			ASSERT(db->db_state == DB_UNCACHED ||
2795 			    db->db_state == DB_NOFILL);
2796 			dbuf_destroy(db);
2797 		} else if (arc_released(db->db_buf)) {
2798 			/*
2799 			 * This dbuf has anonymous data associated with it.
2800 			 */
2801 			dbuf_destroy(db);
2802 		} else {
2803 			boolean_t do_arc_evict = B_FALSE;
2804 			blkptr_t bp;
2805 			spa_t *spa = dmu_objset_spa(db->db_objset);
2806 
2807 			if (!DBUF_IS_CACHEABLE(db) &&
2808 			    db->db_blkptr != NULL &&
2809 			    !BP_IS_HOLE(db->db_blkptr) &&
2810 			    !BP_IS_EMBEDDED(db->db_blkptr)) {
2811 				do_arc_evict = B_TRUE;
2812 				bp = *db->db_blkptr;
2813 			}
2814 
2815 			if (!DBUF_IS_CACHEABLE(db) ||
2816 			    db->db_pending_evict) {
2817 				dbuf_destroy(db);
2818 			} else if (!multilist_link_active(&db->db_cache_link)) {
2819 				multilist_insert(dbuf_cache, db);
2820 				(void) refcount_add_many(&dbuf_cache_size,
2821 				    db->db.db_size, db);
2822 				mutex_exit(&db->db_mtx);
2823 
2824 				dbuf_evict_notify();
2825 			}
2826 
2827 			if (do_arc_evict)
2828 				arc_freed(spa, &bp);
2829 		}
2830 	} else {
2831 		mutex_exit(&db->db_mtx);
2832 	}
2833 
2834 }
2835 
2836 #pragma weak dmu_buf_refcount = dbuf_refcount
2837 uint64_t
2838 dbuf_refcount(dmu_buf_impl_t *db)
2839 {
2840 	return (refcount_count(&db->db_holds));
2841 }
2842 
2843 void *
2844 dmu_buf_replace_user(dmu_buf_t *db_fake, dmu_buf_user_t *old_user,
2845     dmu_buf_user_t *new_user)
2846 {
2847 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2848 
2849 	mutex_enter(&db->db_mtx);
2850 	dbuf_verify_user(db, DBVU_NOT_EVICTING);
2851 	if (db->db_user == old_user)
2852 		db->db_user = new_user;
2853 	else
2854 		old_user = db->db_user;
2855 	dbuf_verify_user(db, DBVU_NOT_EVICTING);
2856 	mutex_exit(&db->db_mtx);
2857 
2858 	return (old_user);
2859 }
2860 
2861 void *
2862 dmu_buf_set_user(dmu_buf_t *db_fake, dmu_buf_user_t *user)
2863 {
2864 	return (dmu_buf_replace_user(db_fake, NULL, user));
2865 }
2866 
2867 void *
2868 dmu_buf_set_user_ie(dmu_buf_t *db_fake, dmu_buf_user_t *user)
2869 {
2870 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2871 
2872 	db->db_user_immediate_evict = TRUE;
2873 	return (dmu_buf_set_user(db_fake, user));
2874 }
2875 
2876 void *
2877 dmu_buf_remove_user(dmu_buf_t *db_fake, dmu_buf_user_t *user)
2878 {
2879 	return (dmu_buf_replace_user(db_fake, user, NULL));
2880 }
2881 
2882 void *
2883 dmu_buf_get_user(dmu_buf_t *db_fake)
2884 {
2885 	dmu_buf_impl_t *db = (dmu_buf_impl_t *)db_fake;
2886 
2887 	dbuf_verify_user(db, DBVU_NOT_EVICTING);
2888 	return (db->db_user);
2889 }
2890 
2891 void
2892 dmu_buf_user_evict_wait()
2893 {
2894 	taskq_wait(dbu_evict_taskq);
2895 }
2896 
2897 blkptr_t *
2898 dmu_buf_get_blkptr(dmu_buf_t *db)
2899 {
2900 	dmu_buf_impl_t *dbi = (dmu_buf_impl_t *)db;
2901 	return (dbi->db_blkptr);
2902 }
2903 
2904 objset_t *
2905 dmu_buf_get_objset(dmu_buf_t *db)
2906 {
2907 	dmu_buf_impl_t *dbi = (dmu_buf_impl_t *)db;
2908 	return (dbi->db_objset);
2909 }
2910 
2911 dnode_t *
2912 dmu_buf_dnode_enter(dmu_buf_t *db)
2913 {
2914 	dmu_buf_impl_t *dbi = (dmu_buf_impl_t *)